This Privacy Policy informs you of our policies regarding the collection, use, and disclosure of personal data when you use our services and the choices you have associated with that data.

We use your data to provide and improve our services. By using our services or providing your personal information, you acknowledge that Hepatitis ACT will handle your information in accordance with this Privacy Policy and applicable privacy laws.

Hepatitis ACT is committed to protecting the privacy and confidentiality of clients, staff, Board members, volunteers and stakeholders in the way information is collected, stored, used and disclosed.

Our Commitment to Privacy
Hepatitis ACT is committed to protecting the privacy and confidentiality of personal information in accordance with:

• Privacy Act 1988 (Cth)
• Australian Privacy Principles (APPs)
• Australian Information Commissioner Act 2010
• ACT Health Records (Privacy and Access) Act 1997 (ACT)

We collect, use, store and disclose personal information only as permitted by law.

What Personal Information We Collect
We may collect:

General personal information

• Name
• Date of birth
• Contact details
• Address
• Demographic information
• Feedback or complaint information

Sensitive and health information

• Hepatitis testing results
• Treatment information
• Medical history relevant to services
• Risk and exposure history
• Clinical notes
• Referral information

Health information is considered sensitive information under the Privacy Act and receives a higher level of protection.

Government-related identifiers

Where necessary and lawful, we may collect:

• Medicare numbers
• Concession card details
• Other government identifiers

We do not use government identifiers as our own identifiers.

How We Collect Personal Information

We collect personal information:

• Directly from you (in person, phone, email, online forms)
• Through referrals from health providers (with consent)
• During clinical consultations and testing
• When you attend education sessions or events
• When you donate or fundraise
• When you apply for employment or volunteer roles
• Through our website (cookies and analytics)

If we receive unsolicited personal information, we will assess whether we are permitted to retain it.

Where required, we provide a collection notice at or before the time personal information is collected, outlining the purpose of collection and relevant disclosures.

Why We Collect Personal Information

We collect personal information to:

• Provide testing, treatment, education and support services
• Maintain clinical records
• Meet ACT Health contractual and reporting obligations
• Process donations and fundraising
• Manage staff, Board members and volunteers
• Respond to complaints and feedback
• Comply with legal and regulatory obligations

We may also use de-identified data for reporting, evaluation and service improvement.

Direct Marketing and Communications

We may use your contact details to provide newsletters, updates about our services, programs, events or fundraising activities that may be of interest to you.

You may opt out of receiving marketing communications from us at any time by using the unsubscribe link in our emails or by contacting us at info@hepatitisact.org.au.

We will not use sensitive health information for direct marketing without your consent.

Consent and Sensitive Information

We collect sensitive and health information:

• With your consent; or
• Where required or authorised by law; or
• Where necessary to provide a health service.

For minors, we assess whether the individual has capacity to consent. Where appropriate, parental or guardian consent may be required.

Young People

Hepatitis ACT delivers education programs in schools and other youth settings. In connection with these activities, we may collect limited personal information from individuals under 18 years of age, such as attendance records or feedback forms.

We do not provide clinical testing or treatment services to individuals under 18 years of age.

Where personal information is collected from young people, we rely on consent processes established with schools or education providers, and we assess consent requirements in accordance with applicable privacy and health legislation.

Disclosure of Personal Information

We may disclose personal information:

• To ACT Health where required under funding agreements
• To medical practitioners, laboratories, or health providers (with consent)
• To service providers assisting with IT, data storage or administration
• Where required by law (e.g., court orders)
• Under mandatory public health reporting requirements

We may also use or disclose personal information where required under program or funding agreements, including ACT Health, the Kirby Institute (in relation to Point-of-Care Testing programs), and Hepatitis Australia (in relation to the HepLink program). Where possible, reporting to funding bodies is provided in de-identified form. Identifiable information is only disclosed where authorised by law or with your consent.

Overseas Disclosure

Some service providers (such as cloud storage providers or website analytics providers) may store data outside Australia.

Where personal information is disclosed overseas, we take reasonable steps to ensure the recipient does not breach the Australian Privacy Principles in relation to that information, unless an exception under the Privacy Act applies.

Website Data and Cookies

Our website may collect:

• IP address
• Browser type
• Pages visited
• Device identifiers
• Date and time of visits

We use cookies and may use analytics services such as Google Analytics to improve website performance.

You may disable cookies in your browser settings.

Data Security

We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification or disclosure.

This includes:

• Secure electronic systems
• Access controls
• Confidentiality agreements
• Staff training
• Secure storage of clinical records

While we take reasonable precautions, no system can guarantee absolute security.

Retention of Information

• We retain personal and health information only for as long as required by law and funding obligations.
• Clinical records are retained in accordance with the ACT Health Records (Privacy and Access) Act and relevant health record retention requirements.
• When no longer required, information is securely destroyed or de-identified.

Notifiable Data Breaches

If a data breach is likely to result in serious harm, we will:

• Notify affected individuals; and
• Notify the Office of the Australian Information Commissioner,

in accordance with the Notifiable Data Breaches Scheme.

Access and Correction

• You may request access to personal information we hold about you.
• You may also request correction if information is inaccurate, out-of-date, incomplete or misleading.
• Requests can be made by contacting info@hepatitisact.org.au.
• We may require identity verification before responding.
• We will respond within a reasonable period.

Anonymity

Where lawful and practicable, you may interact with us anonymously or using a pseudonym.  However, anonymity may limit our ability to provide clinical services.

Complaints

If you believe we have breached your privacy, you may lodge a complaint:

Chief Executive Officer
Hepatitis ACT
PO Box 6259
O’Connor ACT 2602

or via email: info@hepatitisact.org.au

We will respond within a reasonable timeframe.

If you are not satisfied, you may lodge a complaint with:

Office of the Australian Information Commissioner
GPO Box 5218
Sydney NSW 2001
www.oaic.gov.au

Changes to This Policy

We may update this Privacy Policy from time to time. The most current version will always be available on our website.  March 2026