The values and philosophy of Mercy Services have implications on how personal information is collected, stored, used and disclosed. Mercy Services starts from a belief that each individual should control who has information about her/him and what is done with this information.
Personal information is any information that can be used to personally identify you. This may include your name, address, telephone number, email address and profession or occupation. If the information we collect personally identifies you, or you are reasonably identifiable from it, the information will be considered personal information.
Sensitive information has the highest level of protection and is defined as information or an opinion about an individual’s:
The Health Records Information Privacy Act (NSW) also applies a higher privacy standard to organisations, such as Mercy Services, that hold “health information”.
Health information includes information or an opinion about the physical or mental health or disability of an individual. Health information also includes personal information that is information or an opinion about:
This policy specifies how Mercy Services will meet its moral and legal obligations to ensure that each individual has as much control over their personal information as possible. The policy and its procedures apply to all staff and volunteers.
Mercy Services is committed to protecting the privacy of its clients, employees, volunteers, donors and supporters. Private/personal information includes the: name, address, relationship to Mercy Services, health information and photographic image of applicable persons (client/carer/donor/staff/volunteer/applicant for paid/voluntary work, donor/supporter).
We will seek your consent to enable us to collect information about you. In seeking your consent we will try to explain:
We may collect the following types of personal information on clients, staff, volunteers and donors/supporters:
We may also collect some information that is not personal information because it does not identify you or anyone else. For example, we may collect anonymous answers to surveys or aggregated information about how users use our website.
We collect your personal information directly from you unless it is unreasonable or impracticable to do so. When collecting personal information from you, we may collect it in ways including:
You should always feel the setting where we are collecting the information from you provides enough privacy.
If you are unable to give consent we will seek consent from your Enduring Power of Attorney, Guardian or any other person who is authorised by law to act for or represent you.
We may also collect personal information from third parties including reports and information provided to us by other services that are or have assisted you, law enforcement agencies and other government entities.
As our website is linked to the internet, and the internet is inherently insecure, we cannot provide any assurance regarding the security of transmission of information you communicate to us online. We also cannot guarantee that the information you supply will not be intercepted while being transmitted over the internet. Accordingly, any personal information or other information which you transmit to us online is transmitted at your own risk.
If you do not provide us with the personal information described above, some or all of the following may happen:
Where a person’s information is being used for research or statistical purposes we may be able to protect your privacy by using a unique number or code to represent you rather than use your name. The use of an identifier (number or code) instead of a person’s name may still not be enough to prevent others identifying you. This is particularly the case with members of minorities and those with atypical characteristics. In these cases the information will not be used or will be further disguised.
Mercy Services is prohibited by law and will not adopt, use or disclose an identifier assigned by a government agency, except in prescribed circumstances e.g. Tax file number.
Wherever it is lawful and practicable, we will give people the opportunity to remain anonymous when entering into transactions with, or receiving services from Mercy Services.
We collect, hold, use and disclose your personal information for the following purposes:
We may send you direct marketing communications and information about our products and services that we consider may be of interest to you. These communications may be sent in various forms, including mail, SMS, fax and email, in accordance with applicable marketing laws, such as the Spam Act 2003 (Cth). If you indicate a preference for a method of communication, we will endeavour to use that method whenever practical to do so. In addition, at any time you may opt-out of receiving marketing communications from us by contacting us (see the details below) or by using opt-out facilities provided in the marketing communications and we will then ensure that your name is removed from our mailing list.
We do not provide your personal information to other organisations for the purposes of direct marketing.
We will take reasonable security safeguards to protect the security of personal information we hold.
Some reasonable safeguards include:
Client records are only removed from Mercy Services premises:
We will retain information relating to the applicable person as follows:
We will dispose of information securely. When we delete or dispose of a person’s information we will keep a record of:
When we transfer a person’s information to another organisation (and we do not continue to hold a copy of that information) we will keep a record of the name and address of the organisation to which we transferred the information.
In general, we will only use (within Mercy Services) and disclose (to people/organisations outside Mercy Services) a person’s information for the primary purpose for which the information was collected.
We may disclose your personal information to:
There may be circumstances when Mercy Services has to disclose information without the person’s consent. These circumstances include:
In the event that any of the situations described above should occur, Mercy Services will make reasonable efforts to discuss the matter with the person at the earliest possible opportunity.
Mercy Services will only transfer health information out of NSW in the following circumstances:
You may request access to any personal information we hold about you at any time by contacting us (see the details below).
Where a person seeks to access her/his information held by Mercy Services the person’s request should be on the appropriate form (Attachment 4). This form requires the person to specify the way they want to access her/his information.
There is no fee charged for requesting to access your information. If you want a copy of your information exceeding ten pages or if it requires detailed searching of our records, we may charge you an administration fee of $1 per page.
Mercy Services may refuse a person access to their health information if:
If Mercy Services decides to refuse access, it will provide a written reason for the refusal. The reason must be one of the reasons listed above. Access may be refused to a part of the information, to which a request relates, but provided to the remainder of the information.
Where Mercy Services refuses to provide the person with access to their health information on the grounds that providing access would pose a serious threat to their life or health, the notice of refusal must:
Access must then be provided to the nominated medical practitioner within 21 days of receiving the person’s nomination.
Mercy Services may not be able to provide information in the way requested due to:
I. sections needing to be blocked out or omitted due to the reasons listed above;
II. the request placing unreasonable demands on Mercy Services resources;
III. the request being detrimental to the preservation of the information; and/or
IV. the release involving an infringement of copyright.
In these cases, Mercy Services will discuss with the person the other options.
Mercy Services will respond to a request for access within 21 days after receiving the request.
If you believe that personal information we hold about you is incorrect, incomplete or inaccurate, then you may request us to amend it.
Where a person seeks to amend her/his information held by Mercy Services the person’s request must be on the appropriate form.
Mercy Services will respond to a request to amend a record within 21 days after receiving the request. In response to a request for amendment, Mercy Services may amend (by way of corrections, deletions or additions) the person’s information to ensure:
For legal and medical reasons, Mercy Services will generally not permanently delete information from a person’s record.
Mercy Services may refuse to amend the person’s health information if it is satisfied that the health information is not incomplete, incorrect, irrelevant, out of date or misleading.
If Mercy Services is not prepared to make the amendment requested, it will give the person in writing:
1. the reason for the refusal;
2. the complaint mechanism; and
3. any other matter prescribed by the Australian Privacy Principles regulations .
If a request to amend information is refused the person can ask Mercy Services to add a notation to the health information specifying their claim that the information is inaccurate, out-of-date, incomplete, irrelevant or misleading. Mercy Services will then take reasonable steps to ensure the statement is apparent to those who access the information.
With the client’s consent Mercy Services will inform third parties about amended client information provided by, or relied upon by, that third party.
We encourage you, in the first instance, to raise your issue with your immediate Coordinator or Manager to try and resolve the issue. If you are still not satisfied with the response to your concern or complaint please contact our Complaints Officer, who is also our Chief Executive Officer.
Once received we will review your concern or complaint and commit to providing a response within 21 working days, the Complaints Officer will be independent of the original compliant and will have the authority to fully investigate and resolve the complaint. If your concern still remains unresolved to your satisfaction we will assist you in directing your issue to: NSW Information and Privacy Commission on 1300 363 992 http://www.ipc.nsw.gov.au/.
At any stage you can involve a support person or advocate. Agencies that may help in this area are:
The Disability Advocacy Service Phone (02) 4927 0111; or
The Aged Care Rights Service (TARS). Phone toll free: 1800 424 079.