Privacy Policy

Introduction & overview

Here at Resta Care Pty Ltd ABN 79 681 890 111 (we, us or our) protecting your privacy and treating your personal data in accordance with Australian privacy laws and with care is of paramount importance to us.

This Privacy Policy explains what personal data we collect, why we collect personal data and how we collect, use, disclose, store and protect your personal data when you visit our website, use our services or products, provide us with information about yourself (such as when you sign up to our service or use our services) or when you accept services from us. We collect and process your personal data for specific purposes including: to provide and improve our services, to communicate with you, to personalise your experience, for analytics and research, and to comply with our legal obligations.

This Privacy Policy also explains how to contact us to correct, update or delete any personal data provided to us, or make a complaint if you have concerns.

If you do not agree with the terms of this privacy policy, please do not access our website, use our services or provide any information about yourself to us.

We are compliant with the Privacy Act 1988 (Cth) (the Act) and the Australian Privacy Principles (APPs). In the event of a data breach, we have a clear and actionable response plan in place. This includes promptly notifying affected individuals and relevant authorities, containing the breach, assessing its impact, and implementing measures to prevent future occurrences. If you have any questions or concerns about our data handling practices, please contact our Privacy Officer at info@restacare.com.au.

We will only collect and process personal data about you where we have a lawful basis to do so. Lawful basis includes consent (where you have given consent), contract (where processing is necessary for the performance of a contract with you), legal obligation (where processing is necessary for compliance with a legal obligation we have), and legitimate interests (including security threats or fraud, risk of harm to self or others, compliance with applicable laws, and enabling us to administer our service).

If you choose to withdraw your consent, we will stop processing your personal data for the purposes you initially agreed to, unless we have another lawful basis for doing so. This may result in limited access to our services that require the processing of your personal data. We will retain your data only as necessary to comply with legal obligations or resolve disputes.

We maintain secure records of all user consents and withdrawals to ensure compliance with data protection regulations and to respect your privacy choices. These records are kept for the duration of our relationship with you and for a reasonable period thereafter as required by applicable laws.

Unless otherwise indicated by the context words importing the singular include the plural and vice versa.

Changes that we make to our privacy policy

We will notify you about any changes to our Privacy Policy by updating the “Last Updated” date of this Privacy Policy. You are encouraged to periodically review this Privacy Policy to stay informed of updates. We will seek your explicit consent for any changes in our Privacy Policy that affect how we process your personal data. If you do not agree with the changes, you may choose to stop using our services.

Collection of your personal data by third parties

This Privacy Policy does not apply to any third-party service or website which we connect to, and which may also collect and use information about you. We are not responsible for the privacy practices of any third party. However, we take reasonable steps to ensure that third parties who are required to access your personal data as part of the services we provide to you have at least the same level of security we employ to protect your personal data.

Which entities does this privacy policy cover?

This Privacy Policy applies to us with respect to content on our websites, our products and services and information you provide to us about yourself. This Privacy Policy also applies to our related bodies corporate.

What is personal data?

Personal data is defined as data, whether true or not, about an individual who can be identified: (a) from that data; or (b) from that data and other information to which the organisation has or is likely to have access. Personal data may include sensitive information such as health information about you.

When and how do we collect your personal data?

We collect most personal data directly from you when you consent to use our services or receive communications from us, or information we receive from third parties. This may occur in personal consultations with you, in telephone consultations or via electronic means such as SMS or email.

Your consent may be express (e.g. you agree to the use of your information by ticking a box) or implied by an action you take or do not take (e.g. because you have agreed to terms and conditions that contain information about the use or disclosure of your information).

You provide us your information when you use our services or website generally or when you otherwise deal with us.

What personal data do we collect?

Personal data

We may collect and process various types of personal data, including sensitive personal data. Sensitive personal data includes information such as racial or ethnic origin, political opinions, religious beliefs, health information, or biometric data.

We collect demographic and personally identifiable information either directly from you or as provided to us through third parties that you have consented to disclose such information. That personally identifiable information, collected in compliance with the Act, may include (but not be limited to):

• full name;
• mailing or street address;
• date of birth;
• email address;
• telephone number and other contact details;
• age or date of birth;
• occupation;
• place of birth;
• photographic representations of you;
• Medicare Number (where applicable);
• NDIS plan and details about your NDIS profile;
• hospital discharge summaries, medical history reports and medico-legal reports;
• DVA number and related details;
• Chronic Disease Management Plans and similar reports;
• Private Health Insurance details;
• credit card and other information for billing (where applicable);
• your device ID, browser type and version, device type, geo-location information, computer and connection information, statistics on page views, traffic to and from the sites, ad data, IP address and standard web log information, and the specific purpose for which each category of data is used;
• information about you that you provide to us or that we obtain when you apply for employment with us;
• details of the services we have provided to you or that you have enquired about, including any additional information necessary to deliver those services and respond to your enquiries;
• any additional information relating to you that you provide to us directly through our website or use of our services or indirectly through your use of our website or use of our services or online presence or through other websites or accounts from which you permit us to collect information;
• information you provide about yourself when you communicate to us or others when you use the services;
• information you provide to us through surveys; or
• any other personal data that is directly related to and necessary for facilitating your dealings with us, as explicitly stated at the time of collection.

We may collect these types of personal data either directly from you, or from third parties or from third party applications you control and give us access to. We may collect this information when you:

• register for our products or services;
• communicate with us through correspondence, chats, email, or when you share information with us from other social applications, services or websites;
• give permission to third party health care providers to release information to us about you such as MyAgedCare, General Practitioners, NDIA, DVA and other similar types of organisations;
• interact with our site, products, services, content and advertising.

Why do we collect your personal data?

We may collect your personal data when required by law but generally we collect personal data from you (or about you) to allow us to:

• supply you with information about our products and services;
• provide you with our products and services;
• manage your appointments with us;
• respond to your enquiries;
• render invoices and obtain payment for products and services;
• ensure your use of our services and products are safe and secure;
• send administrative information;
• marketing and advertising to you, with your explicit consent and in compliance with the Act and APPs;
• respond to inquiries and offer support;
• request user feedback;
• improve user experience;
• enforce terms and conditions and policies;
• protect from abuse and malicious users;
• consider applications for employment;
• respond to legal requests and prevent harm;
• communicate more effectively with you about our services and your care; and
• ensure your experience with us is a positive one.

Personal data collected or received by us will only be used for the stated purpose for which it was provided.

When do we disclose your personal data?

We may collect, hold, use and disclose your personal data for the following purposes:

• to enable you to access and use our services and products;
• to enable our chosen third party service providers to work with us in delivering our products and services to you;
• to operate, protect, improve and optimise our products or services, business and our users’ experience, such as to perform analytics, conduct research and for advertising and marketing;
• to send you service, support and administrative messages, reminders, technical notices, updates, security alerts, and information requested by you;
• to send you marketing and promotional messages and other information that may be of interest to you, including information sent by, or on behalf of, our business partners that we think you may find interesting, provided we have obtained your consent beforehand;
• to comply with our legal obligations, including but not limited to the Act and APPs, resolve any disputes that we may have with any of our users, and enforce our agreements with third parties.

To whom do we disclose your personal data?

We may disclose personal data for the purposes described in this Privacy Policy to:

• our employees, agents and contractors and related bodies corporate;
• third party suppliers and service providers (including providers for the operation of our website and/or our business or in connection with providing our services to you) including banks and payment processors and service providers;
• businesses whom you interact with via our services;
• your other health care providers;
• government agencies to whom we must report;
• your next of kin or family members when you consent to disclosure;
• relevant third parties such as emergency services or next of kin or nominated family members in the event we determine that there a serious risk of life, health or safety to you, where it is impractical to obtain your consent beforehand;
• professional advisers and agents;
• payment systems operators (e.g. merchants receiving card payments);
• our existing or potential third party service providers, agents, business partners or partners;
• our sponsors or promoters of any competition that we conduct via our services;
• anyone to whom our assets or businesses (or any part of them) are transferred;
• specific third parties authorised by you to receive information held by us; and/or
• other persons, including government agencies, regulatory bodies and law enforcement agencies, or as required, authorised or permitted by law.

Aggregated information & direct marketing

We do not sell your personal data. However, we may aggregate the information you and others provide to us and share this aggregated information with third parties.

We may use and share this aggregated information with third parties for research purposes or to enhance our services and provide our partners with a better understanding of the users of our services. We will not sell or license this aggregated information.

We and/or our carefully selected business partners may send you direct marketing communications and information about our service and products. This may take the form of emails, SMS, mail or other forms of communication, in accordance with the laws of your country. You may opt-out of receiving marketing materials from us by contacting us using the details set out below or by using the opt-out facilities provided (e.g., an unsubscribe link).

You can object to us using your information for these purposes.

What id you don’t want us to collect your personal data?

You are not obligated to provide us with your personal data. However, please note that if you do not provide your personal data, you may not be able to take full advantage of some of the features of our website or our services. You also have the right to withdraw your consent at any time, in which case you should contact us using the contact details provided in this Privacy Policy.

What if you don’t want to receive further communications from us?

You may choose whether to receive communications from us. Should you wish to remove yourself from our database you may do so at any time by contacting us by emailing us at info@restacare.com.au.

How can I access, correct and/or update personal data you have collected?

At any time, you may contact us to request access to or modification of your personal data. Unless permitted by the Act, we will not refuse to comply with your request.

Corrections / updates

To submit corrections to your personal data, please email our Privacy Officer at info@restacare.com.au with the subject line “Personal Data Correction Request”. In your email, please include your full name, contact information, the specific data you wish to correct, and the accurate information. We will verify your identity and process your correction request as quickly as possible, making all efforts to correct the data once we have confirmed your identity and the accuracy of the new information.

We will make all efforts to correct data after a request is made, once we have proved your identity. Once any corrections are made to your personal data, we will notify you via email or your preferred method of communication to confirm that the changes have been implemented.

Access

We will deal with all requests for access to personal data as quickly as possible, and no later than the prescribed time required by law (unless any complexities arise). Requests for a large amount of information, or information which is not currently in use, may require further time before a response can be given.

We will provide you your personal data in a structured, commonly used, machine-readable format.

In certain circumstances, we may refuse to provide you with access to the personal data we hold about you. Such circumstances include, but are not limited to situations where providing access would be:

• unlawful;
• unreasonably impact other people’s privacy;
• compromise an investigation of unlawful activity;
• disclose our intentions that could affect negotiations with you;
• hinder enforcement-related activities conducted by or on behalf of an enforcement body; or
• reveal evaluative information connected with a commercially sensitive decision-making process within our business.

We will also refuse access where the personal data relates to existing or anticipated legal proceedings, and the information would not be accessible by the process of discovery in those proceedings. Further, we reserve the right to refuse access if we find that your request is frivolous or vexatious, or if we have a reasonable belief that there is an ongoing or potential unlawful activity or serious misconduct that could be impacted detrimentally by granting access.

If we refuse to give you access, we will provide you with reasons for our refusal, unless doing so would be unreasonable in the circumstances. We will also take reasonable steps to give you access in a way that meets your needs without giving rise to the reasons of our refusal. Further, we will provide details of how you may make a complaint about our decision.

General

Please note that the access and correction requirements under this Privacy Policy operates alongside and do not replace other informal or legal procedures by which an individual can be provided access to, or correction of, their personal data. We maintain a record of all access and correction requests received, along with their outcomes, for internal audit and compliance purposes.

We may ask you to verify your identity before acting on any of your requests. We will not charge a fee for the exercise of your rights under the Act. We do not charge any fees for reviewing access or correction requests. However, we may charge a reasonable fee if your request involves a significant amount of work.

How do we store and protect your personal data?

For us to provide excellent service we are required to store some personal data and, and we take the greatest of care to ensure this information is treated as private and confidential. Transmitting personal data via the internet does have inherent risks associated with it and no information transmitted over the internet can be guaranteed to be completely secure. While we will endeavour to protect your personal data as best as possible, we cannot guarantee the security of any information that you transmit to us or receive from us. We will take all reasonable steps, including but not limited to, where appropriate, the use of encryption, secure servers, and two-factor authentication, to ensure the security of this data. However the transmission and exchange of information is carried out at your own risk.

We will take reasonable steps to maintain the integrity and security of any personal data we have stored, including taking reasonable steps to prevent interference and loss, misuse, unauthorised access, modification or disclosure of such personal data.

We also store and protect your personal data within physical files when necessary and we ensure that such physical files are secured.

Your personal data may be stored with third party platforms that we use to provide our products and services to you such as our practice management system, invoicing platform and cloud storage providers.

We have established agreements with these third parties that require them to maintain adequate security measures. However, we cannot be held liable for events outside our control.

It is important that you protect your privacy by ensuring that no one obtains your personal data, and you must contact us directly if your details change. Should your information be erroneously provided to us or no longer remain valid within the constraints of this Privacy Policy we will securely destroy or de-identify it as soon as practicable, as long as it is lawful to do so.

We have obligations to notify you if you are affected by a data breach. We will take all reasonable precautions to take remedial action to prevent such an event. However, as we cannot guarantee that remedial action will be sufficient to prevent all instances of a breach, we will take steps to notify you of an eligible data breach as soon as practicable, and provide recommendations as to what steps you should take to mitigate any serious issues.

How long do we keep your personal data

We are committed to regularly reviewing and updating our data retention periods to ensure compliance with legal requirements and best practices in data protection. Personal data shall be processed and stored for as long as required by the purpose they have been collected for. We ensure that personal data is minimised to what is necessary during the retention period and securely deleted or anonymised when no longer needed.

Therefore:

• Personal data collected for purposes related to the performance of a contract between us and you shall be retained until such contract has been fully performed.
• Personal data collected for the purposes of our legitimate interests shall be retained as long as needed to fulfil such purposes. You may find specific information regarding the legitimate interests pursued by us within the relevant sections of this document or by contacting us.

We will retain personal data for a longer period if we are required to do so by law or by an order from a legal authority. Exceptions to our standard retention periods may apply in cases of ongoing legal disputes, investigations, or other legitimate business needs that require extended retention. In such cases, we will retain the relevant data only for as long as necessary to fulfill these specific purposes. Once the retention period expires, personal data shall be automatically deleted through our data management system. The right of access, the right to erasure, the right to rectification and the right to data portability cannot be enforced after expiration of the retention period.

Your rights about your personal data

You may exercise certain rights regarding their personal data which we process. In particular, you have the right to do the following:

• You have the right to withdraw consent where you have previously given your consent to the processing of your personal data.
• You have the right to object to the processing of your personal data if the processing is carried out on a legal basis other than consent.
• You have the right to learn if your personal data is being processed by us, obtain disclosure regarding certain aspects of the processing and obtain a copy of the personal data undergoing processing.
• You have the right to verify the accuracy of your personal data and ask for it to be updated or corrected.
• You have the right, under certain circumstances, to restrict the processing of your personal data. In this case, we will not process your personal data for any purpose other than storing it.
• You have the right, under certain circumstances, to obtain the erasure of your personal data from us.
• You have the right to lodge a complaint with the Office of the Australian Information Commissioner (OAIC).

Log data

Whenever you use our website, or in a case of an error within the website, we collect data and information (through third party products) called Log Data. This Log Data may include information such as your device, Internet Protocol address, device name, operating system version, the configuration of the device when utilising our website, the time and date of your use of our website and other statistics.

Transfer out

Your personal data is transferred to our hosting service providers, such as an Amazon Web Services and their data centres .  Wherever possible we take reasonable steps to ensure that your personal data is hosted in Australia. However we may be required to agree for our hosting service providers to host your personal data at hosting nodes in countries outside of Australia.  Where this occurs the hosting of your personal data is always subject to compliance with the Australian Privacy Principles, specifically APP 8 – Cross-border Disclosure of Personal Information. You acknowledge that such transfers may occur, and that any personal data that we transfer may be subject to laws, regulations, and standards that are different from those in Australia.

Cookies

Cookies are text files placed on your computer to collect standard Internet log information and visitor behaviour information. When you visit our website, we may collect information from you automatically through cookies or similar technology. While we do not use browsing information to identify you personally, we may record certain information about your use of our website, such as which pages you visit, the time and date of your visit and the internet protocol address assigned to your computer.

Insofar as those cookies are not strictly necessary for the provision of our website and services, we will ask you to consent to our use of cookies when you first visit our website. We may also use ‘cookies’ or other similar tracking technologies on our website that help us track your website usage and remember your preferences. Cookies are small files that store information on your computer, TV, mobile phone or other device. They enable the entity that put the cookie on your device to recognise you across different websites, services, devices and/or browsing sessions. You can disable cookies through your internet browser but our websites may not work as intended for you if you do so.

Cookies may be either “persistent” cookies or “session” cookies: a persistent cookie will be stored by a web browser and will remain valid until its set expiry date, unless deleted by the user before the expiry date; a session cookie, on the other hand, will expire at the end of the user session, when the web browser is closed.

Cookies that we may use

We use cookies for the following purposes:

• authentication and status – we use cookies to identify you when you visit our website and as you navigate our website, and to determine if you are logged into the website;
• personalisation – we use cookies to store information about your preferences and to personalise the website for you;
• security – we use cookies s an element of the security measures used to protect user accounts, including preventing fraudulent use of login credentials, and to protect our website and services generally;
• analysis – we use cookies to help us to analyse the use and performance of our website and services; and
• cookie consent – we use cookies to store your preferences in relation to the use of cookies more generally.

Cookies used by our service providers

Our service providers use cookies and those cookies may be stored on your computer when you visit our website.

Managing cookies

Most browsers allow you to refuse to accept cookies and to delete cookies. The methods for doing so vary from browser to browser, and from version to version. You can however obtain up-to-date information about blocking and deleting cookies via these links for the more common browsers:

• https://support.google.com/chrome/answer/95647 (Chrome);
• https://support.mozilla.org/en-US/kb/enable-and-disable-cookies-website-preferences (Firefox);
• https://help.opera.com/en/latest/security-and-privacy/ (Opera);
• https://support.microsoft.com/en-gb/help/17442/windows-internet-explorer-delete-manage-cookies (Internet Explorer);
• https://support.apple.com/en-gb/guide/safari/manage-cookies-and-website-data-sfri11471/mac (Safari); and
• https://privacy.microsoft.com/en-us/windows-10-microsoft-edge-and-privacy (Edge).

Blocking all cookies will have a negative impact upon the usability of many websites. If you block cookies, you will not be able to use all the features on our website.

Enquiries, requests & complaints

Enquiries regarding this Privacy Policy or the personal data we may hold on you, should be addressed to the Privacy Officer at info@restacare.com.au.

If you think your personal data, held by us, may have been compromised in any way or you have any other Privacy related complaints or issues, you should also raise the matter with the Privacy Officer.

We will ensure your claims are investigated and a formal response will be provided to you, within a reasonable time, considering the circumstances of your claims. If any corrective action is determined to be required, as a result of that investigation, we will take all reasonable steps to rectify the situation and advise you of such, again within a reasonable time considering the circumstances.

If we do not resolve your enquiry, concern or complaint to your satisfaction or you require further information in relation to any privacy matters, please contact the Office of the Australian Information Commission, whose contact details are below.

Office of the Australian Information Commission

Telephone                     1300 363 992

Email                            enquiries@oaic.gov.au

Office Address              Level 3, 175 Pitt Street, Sydney NSW 2000

Postal Address             GPO Box 5218, Sydney NSW 2001

Website                        www.oaic.gov.au

LAST UPDATED: 16 December 2024