This Privacy Policy (“Policy”) explains how we collect, hold, use, disclose and otherwise handle personal information about individuals who interact with us.

Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable.

In this Policy, references to “you” or “your” include donors, fundraisers, supporters, volunteers, event attendees, visitors to our website and social media pages, job applicants, prospective students, patients, former patients and patient advocates, research participants, researchers, research platform users, collaborators and any other individuals we deal with in the course of managing our organisation and providing our services.

If you participate in a clinical trial or research study conducted by ONJCRI, the Participant Information Sheet and Consent Form or other participant materials provided as part of the consent process will contain additional, study-specific information about how your personal and health information will be handled. Those materials should be read together with this Policy.

We may update this Policy from time to time. We will publish any changes on our website (onjcri.org.au). Where changes are material, we will take reasonable steps to notify individuals with whom we hold an ongoing relationship.

The types of personal information we collect depend on who you are and how you engage with us. We only collect personal information that is reasonably necessary to perform our functions or activities.

The kinds of personal information we may collect when dealing with you may include:

• Contact information: name, email address, postal address and phone number.
• Event attendance: registration details, dietary and accessibility requirements, job title and preferences or consents relating to photography and video at the event.
• Demographic information: age, date of birth, gender, preferences and interests.
• Payment information: billing address, payment records.
• Communications: records of your correspondence and other interactions with us, including emails.
• Feedback and survey data: information you provide in surveys or when giving feedback.
• Images and recordings: photographs, videos, audio recordings, interview content and personal stories.
• Technical and website usage information: IP address, browser and device information, pages visited and information about how you interact with our website.

Some of the information we collect may be ‘sensitive information’ under the Privacy Act, including health and medical information. We treat sensitive information with a higher level of care and will only collect it with your consent, or as otherwise permitted or required by law.

Depending on who you are and how you interact with us, the personal information we collect may also include the following:

Donors

If you make a donation to us, we may collect:

• your name;
• your contact details (email, phone number and address);
• payment details required to process your donation; and
• in whose name (if any) the gift is made.

Fundraisers and Supporters

If you support or engage with us in other ways, such as attending an event, participating in fundraising activities, subscribing to updates, volunteering, advocating for our work or interacting with us through our website or social media channels, we may collect:

• your name and contact details;
• your communication preferences;
• records of your engagement with us, including event registration, dietary or accessibility requirements and your preferences or consents relating to photos and videos at the event;
• information relevant to your fundraising activities, such as details of your fundraising campaign and, where you choose to provide them, your social media handles; and
• any other information you choose to provide to us.

We value the stories of individuals impacted by cancer. If you are a patient, former patient or patient advocate who generously chooses to engage with us to support our research, fundraising, communications, advocacy or community engagement activities, we may collect personal information about you, including health information where relevant.

For example, if you provide input or consultation in relation to research, grant applications or other ONJCRI activities or participate in interviews, media stories, promotional activities, campaigns, events or advocacy initiatives, we may collect:

• your name and contact details;
• information about your background, experiences and connection to cancer research, including health information you choose to provide;
• photographs, videos, audio recordings and interview content featuring you;
• information relating to your participation in events, campaigns or promotional activities;
• where you are engaged on a paid basis, payment and administrative information necessary to manage those arrangements (such as bank account details, tax information and payment records); and
• any other information you choose to provide to us.

If you participate in a clinical trial or research study conducted by ONJCRI, we may collect, depending on the study:

• your health information and medical history, family history of cancer or disease, treatment information, biological samples, biometric information, clinical and digital imaging, and behavioural and lifestyle information;
• emergency contact or nominated contact person information; and
• other information necessary to conduct the study or that you otherwise provide to us in connection with the study.

The specific information collected will depend on the study and will be described in the Participant Information Sheet and Consent Form provided to you as part of the consent process for the study.

When recruiting staff, prospective students, work experience students and volunteers, we may collect personal information that is reasonably necessary to assess and process applications, including:

• your name and contact details;
• your employment history;
• your qualifications and experience;
• your eligibility to work in Australia; and
• any other information relevant to your application with us.

We typically collect personal information directly from you. For example, we may collect personal information when you contact us by phone or email, interact with us through our website (onjcri.org.au) or other campaign websites (“Websites”) or social media pages, including by making an enquiry or otherwise interacting with us online.

We may also collect personal information when you visit us in person, participate in our activities or events, apply for employment, student placements or volunteer opportunities with us, or participate in a research study or clinical trial.

We may also collect personal information through third-party platforms that support our activities. For example, when you apply for a position, register for an event, fill out a survey or complete a document with electronic signature. Those platforms may also collect and handle personal information in accordance with their own privacy policies.

We may also collect personal information from third parties. For example, if you participate in a research study or clinical trial, we may collect information from your treating doctor, healthcare provider, hospital or a research collaborator. We will only collect personal information from third parties with your consent or where otherwise permitted or required by law.

Virtual meetings

To support meeting efficiency, we may use an online transcription service to summarise key points, decisions and action items discussed during virtual meetings. Participants will be notified of the use of a transcription tool at the start of the session or prior to the session.

The service generates a text summary of meeting discussions, which may include participants’ spoken contributions and decisions made. We will take reasonable steps to:

• destroy or de-identify any personal or sensitive information recorded through the service that is not reasonably necessary for our activities; and
• ensure the accuracy of transcribed information.

In some instances, you may be able to interact with us anonymously or using a pseudonym, for example, when making a general enquiry.

However, in some circumstances we will need to know who you are or collect certain personal information to provide a service or carry out an activity. For example, if you wish to donate online, we require certain personal information to process your donation.

We use your personal information for purposes connected with our functions and activities, including the following:

We may use your personal information to:

• process your donation and issue receipts;
• organise events, fundraising activities and supporter engagement initiatives;
• manage your participation in volunteer, advocacy, communications or community engagement activities;
• respond to your queries, feedback and complaints;
• assess and process applications for employment, student placements, volunteer roles and other opportunities with ONJCRI;
• manage access to our research platforms or equipment;
• operate, administer and improve our website, systems and activities;
• manage payments and other administrative arrangements where you are engaged by us on a paid basis; and
• comply with our legal, regulatory, ethics, governance and reporting obligations.

If you participate in a research study or clinical trial conducted by ONJCRI, we may use your personal information to conduct, administer and support that study or trial in accordance with the applicable study protocol, ethics approvals, Participant Information Sheet and Consent Form, and applicable legal and regulatory requirements governing clinical trials and medical research.

The particular purposes for which your information will be used will depend on the study and will be described in the applicable Participant Information Sheet and Consent Form.

We may use your personal information to inform you about our research, events and activities through email communications. You may opt out of receiving these email communications at any time by using the unsubscribe link in our communications or by contacting us using the details provided below.

If ONJCRI would like to use your personal information or story in external communications, you will be invited to sign an Image and Content Release Form to record your consent. For example, this may include sharing your personal experience of cancer on our website or social media channels to highlight the value of cancer research.

We may also use photographs, videos, audio recordings, interview content and other materials in accordance with the preferences and consents you have provided.

We take reasonable steps to ensure your personal information is protected from misuse, loss, and unauthorised access, modification or disclosure, including by:

• restricting access to personal information to authorised employees, students and contractors who require access to perform their duties;
• requiring staff, students and other relevant personnel to comply with confidentiality obligations;
• implementing appropriate IT security measures and controls;
• securely storing physical records; and
• maintaining policies, procedures and practices designed to safeguard personal information throughout its lifecycle.

We hold your personal information in electronic or hard-copy form. Some personal information may be held on third-party cloud-based platforms. We retain personal information for the periods required by law or, where no specific period applies, for as long as it is needed for the purpose for which it was collected. After this time, we will take reasonable steps to destroy or permanently de-identify the information.

Personal information provided when you make a donation may be processed or held by third-party fundraising platforms. Donation payments are processed by third-party payment processors, including Stripe and PayPal, which collect and handle payment information in accordance with their own privacy policies. Donation and supporter information may also be recorded in our Customer Relationship Management (CRM) system.

Some third-party platforms and service providers may store or access personal information outside Australia. Further information about our overseas handling of personal information is provided below.

While we take reasonable steps to protect your personal information, no method of transmission over the internet is completely secure. Any information you send to us online is transmitted at your own risk.

We may disclose your personal information for the purpose for which it was collected or for another purpose where permitted by law, including where:

• you have consented to the disclosure;
• you would reasonably expect the disclosure and the purpose is related to the purpose for which the information was collected, or directly related in the case of sensitive information; or
• the disclosure is required or authorised by law.

Depending on how you interact with us, we may disclose your personal information to:

• third-party service providers that support our activities, including providers of IT, cloud hosting, data storage, payment processing, fundraising, event management, website hosting, analytics, recruitment, communications and professional advisory services;
• research collaborators, sponsors, study sites, healthcare providers, hospitals, laboratories, Human Research Ethics Committees, research institutions, funders and regulators involved in conducting, administering, funding or overseeing research studies and clinical trials;
• government agencies, regulators, law enforcement bodies, courts and tribunals where permitted or required by law; and
• other persons or organisations with your consent or where otherwise permitted or required by law.

If you make a donation, we may publish your name in our annual report or other ONJCRI publications in accordance with your stated preferences. We will not publish your name if you have asked to remain anonymous.

Overseas disclosure

Some of our third-party service providers, platforms and research collaborators may be located outside Australia or may store or access personal information from locations outside Australia. This may occur, for example, in connection with cloud-based services, payment and fundraising platforms or international research collaborations.

Where we disclose personal information to an overseas recipient, we take reasonable steps to ensure that the recipient does not breach the Australian Privacy Principles in relation to that information, unless an exception under the Privacy Act applies. The countries in which overseas recipients are likely to be located include the United States, the United Kingdom, countries within the European Union and other countries in which our service providers or their subcontractors operate.

Where you participate in a research study or clinical trial, further information about any overseas disclosures may be included in the applicable Participant Information Sheet and Consent Form.

We do not typically disclose sensitive information overseas. Where we need to do so, we will not proceed without your consent.

A cookie is a small file that a website sends to your computer or device. It records information necessary for certain website functions, such as remembering your preferences or settings. Pixel tags are small pieces of code that allow us to understand how users interact with our Websites.

We use these technologies for analytics and website improvement purposes, such as measuring traffic, understanding usage patterns and improving functionality. The information collected through these technologies may not identify you by name, but may include certain technical and usage information (such as IP address or device identifiers).

We may collect information about how our Websites are accessed and used through third-party platforms such as Google Analytics. This may include your IP address, browser type and version, pages visited, time and date of visit, time spent on pages and unique device identifiers.

Third-party providers may also collect and handle information through cookies, pixels or similar technologies in accordance with their own privacy policies.

You can manage your preferences for non-essential cookies and similar technologies through the cookie settings available on our Websites, where applicable, or through your browser settings. You will still be able to access most content, but some interactive functions may be unavailable.

Our Websites may contain links to other websites. This Policy does not apply to those websites, and we are not responsible for their privacy practices or content.

In the event that personal information we hold is involved in a data breach, we will take all reasonable steps to investigate the incident, mitigate any potential harm and comply with our obligations under the Notifiable Data Breaches scheme (Part IIIC of the Privacy Act).

Where required, we will notify affected individuals and the Office of the Australian Information Commissioner (“OAIC”) of the breach, including information about the nature of the incident, the kinds of personal information involved, and steps individuals can take to protect themselves.

You may request access to the personal information we hold about you by submitting your request using the contact details provided in the “Contact us” section below.

We will respond to your request within a reasonable period and, where reasonable and practicable, provide access in the manner requested. In some cases, we may be unable to provide access where permitted by law. If we refuse access, we will provide written reasons for the refusal and information about how you may make a complaint.

If you believe any personal information we hold about you is inaccurate, incomplete, irrelevant, misleading or out of date, you can request a correction using the contact details provided in the “Contact us” section below. If we agree that the information should be corrected, we will take reasonable steps to update it. If we do not agree with the requested change, we will provide our reasons in writing and let you know how to lodge a complaint.

If you wish to make a complaint about how we have handled your personal information, or if you believe we have not complied with our obligations under the Privacy Act, you may make a complaint to us in the first instance using the contact details below.

We may ask you to provide further information so that we can investigate the matter. We will consider your complaint, determine what action may be required and advise you of our response in writing within a reasonable period.

If you are not satisfied with our response, you may contact the OAIC to lodge a complaint:

Online: https://www.oaic.gov.au/about-us/contact-us

Phone: 1300 363 992

Mail:    Office of the Australian Information Commissioner, GPO Box 5288, Sydney NSW 2001

If you have any questions about this Policy or how we handle personal information, wish to request access to or correction of your personal information, or wish to make a privacy complaint, please contact our Privacy Officer:

Email:  enquiries@onjcri.org.au (ATTN: Privacy Officer)

Mail:    Privacy Officer, Olivia Newton-John Cancer Research Institute

Level 5, Olivia Newton-John Cancer Centre

145 Studley Road, Heidelberg VIC 3084