St John NT Privacy Policy
St John Ambulance Australia (NT) Inc. (St John NT) supports the importance of maintaining confidentiality of individuals’ personal and/or sensitive information. This extends to the collection and management of information held in records regarding individuals.
St John NT, in addition to providing the Territory community with emergency road ambulance services, is a volunteer-based charity providing first aid services, social inclusion and youth development programs to the NT community.
We value the privacy of personal information. Our procedures ensure that personal information (also referred to as information or details) and privacy rights are protected.
St John NT is bound by the Information Act 2002 (NT) and the Australian Privacy Principles (APPs) under the Commonwealth Privacy Act 1988 (Privacy Act). These principles regulate the way that we collect, hold, use and disclose information. You can find out more about these principles by calling the Office of the Privacy Commissioner or visiting the website at www.oaic.gov.au.
Scope
This policy applies to all St John NT personal and sensitive information collected, used, stored, or disclosed by St John NT. It covers individuals who interact with St John NT, including patients, volunteers, employees, contractors, and website users.
Roles & Responsibilities
The Chief Executive Officer (CEO), or their authorised delegate, is responsible for the implementation, review, and maintenance of this policy to ensure ongoing compliance with the Commonwealth Privacy Act 1988 (Privacy Act), Information Act 2002 (NT) and associated regulations.
All workers, employees, contractors, and volunteers of St John NT are required to adhere to the principles outlined in this policy and to handle personal information in a manner that upholds the privacy rights of individuals. Breaches of this policy may result in disciplinary action, up to and including termination of employment or engagement.
Collection of personal information
Types of information we may collect
St John NT collects and holds personal information from customers, employees, contractors, and from other individuals. We only collect personal information that is reasonably necessary for what we do.
The type of personal information we may collect includes the following:
contact information (both home and work) such as full name (first and last), e-mail address, current postal address and phone numbers;
date of birth;
employment details, including but not limited to job title, any training and skills;
opinions via surveys and questionnaires, if applicable; and unless otherwise stated as anonymous;
details relating to the goods and services obtained from us;
details relating to your donations made to us;
any relevant payment or billing information (including bank account details, credit card details, billing address and invoice details); and
username and password when setting up an account on our website.
Collection of Personal and Sensitive Information
In addition to the types of personal information already described, St John NT may collect the following information where it is reasonably necessary for our functions and activities:
Medical Information and Medical History while delivering Ambulance Services
We may collect health and medical information, including:
Nature of the emergency, location, and any relevant circumstances.
Information on the time, duration, and technical details of calls made to St John NT, including emergency calls.
- We monitor and record calls received at defined emergency call centres, including within the Joint Emergency Services Communication Centre (JESCC) and Alice Springs St John NT Ambulance Centre. As an emergency service provider, we are exempt from notifying callers that their calls are being recorded, as allowed by the Telecommunications (Interception and Access) Act 1979 (TIA Act).
If you or someone calling on your behalf contacts triple zero (000) from a mobile device, we collect, use, and share information about the caller's likely location to assist us in responding to the emergency.
- medical history,
- current medications, allergies, and treatment details, to ensure that we can provide safe, effective, and appropriate care to patients. This information is only collected where it is directly relevant to the provision of our health services, emergency response, training, or community support activities.
Recruitment and Employment Information
When you apply for a role with St John NT, whether paid or volunteer, we may collect information relevant to assessing your suitability, including:
Police history checks and criminal record information;
Ochre Card (Working With Children Clearance) details;
Vaccination and immunisation status;
Qualifications, licences, and references;
Other information you provide during the recruitment process.
This information is collected to meet our legal obligations, ensure the safety of patients, staff, and volunteers, and to determine your suitability for the role you have applied for.
Direct collection
As much as possible, we will collect information directly from an individual, unless it is unreasonable or impracticable for us to do so (in which case we may collect information from other sources). We may also collect individuals' personal information from publicly or commercially available sources.
Optional activities
St John NT may collect personal information through the conduct of certain activities, such as when individuals purchase a product, sign up for a service, enter a contest or promotion, fill out a survey or send us feedback. Participation in these activities is voluntary.
Mandatory information
Depending upon the reason for requiring the information, some of the information we ask for may be identified as either mandatory or voluntary. If mandatory information (or any other information we require) is not provided, we may be unable to effectively provide our services or products. For example, we will not be able to process donations if we do not receive the relevant payment or billing information.
Website “cookies”
Our website may utilise "cookies" which enable us to monitor traffic patterns and to serve users more efficiently. A cookie does not identify individuals personally but it does identify their computer. Browser settings can notify the receipt of a cookie and provide an opportunity to either accept or reject it in each instance.
IP addresses may be gathered as part of our business activities and to assist with any operational difficulties or support issues with our services. This information does not identify individuals personally.
Use and disclose of personal information
Use and disclosure
We will only use or disclose personal or sensitive information for the primary purposes for which it was collected, or where otherwise permitted by law (or as consented to by individuals and/or as set out in this section). We will generally not use or disclose the information for another purpose (that is, a secondary purpose) without the individual's consent, or in the circumstances set out in this section.
The purposes for which we use or disclose personal information generally include:
if required, the verification of your identity;
medical information and medical history to deliver safe and appropriate treatment, including ongoing patient care with hospitals, health services, and other treating professionals;
medical information will only be disclosed to treating health professionals, emergency services, or as otherwise legally required, and always in line with privacy obligations.
fundraising, including the processing of your donations and grants;
the processing of commercial transactions;
undertaking and publishing the results of research and related documentation;
processing your orders, including to communicate concerning such orders;
the provision of our goods and services to you (as applicable), including but not limited to commercial transactions, volunteering and fundraising;
the administration and management of your donations or our goods and services, including charging, billing, credit card authorisation and verification and collecting debts to the extent that such information is not directly provided to our third party hosted payment system for processing;
the improvement of our services (including contacting you about those improvements and participation in surveys about the goods and services);
the maintenance and development of our goods and services, products, business systems and infrastructure;
sending you direct marketing information about our products, services, events, fundraising, and other promotional activities, which we consider may be of interest to you (including by direct mail, telemarketing, email, SMS and MMS messages);
to provide our customer service functions, including handling customer enquiries and complaints;
to offer you updates, or other content or products and services
our compliance with applicable laws;
your employment (or potential employment) by us; and
to St John NT’s superannuation fund and/or your chosen superannuation fund;
to St John NT’s insurers;
to St John NT’s accountants and auditors
to St John NT’s legal representatives
any St John NT investigator (internal or external), WorkSafe investigator, mediator (internal or external) if required for mediation purposes
any other person holding a St John NT role as is necessary for credentialling obligations and/or operational requirements or third party for the purposes of finalising credentialling requirements.
any other matters reasonably necessary to facilitate the primary purpose and to continue to provide our goods and services.
Circumstances where we may not seek consent
We may use or disclose personal information without consent:
for a secondary purpose, where the individual would reasonably expect us to use or disclose their information for that purpose, and where that secondary purpose is related to the primary purpose of collection (or directly related, in the case of sensitive information);
if we reasonably believe the use or disclosure is necessary to lessen or prevent a serious threat to an individual’s life, health or safety or to lessen or prevent a threat to public health or safety;
if we have reason to suspect that unlawful activity or misconduct of a serious nature, relating to St John NT’s functions or activities, has been, or is being, engaged in, and we reasonably believe the use or disclosure is necessary in order to take appropriate action; or
if the use or disclosure is required or authorised by or under an Australian law, or a court or tribunal order, or otherwise where the Privacy Act permits us to do so.
Freedom of Information
St John NT is a non-government organisation and is not subject to requirements outlined in the Freedom of Information Act 1982 (FOI Act) or the Information Act 2002 (NT). As such, St John NT is not legally required to respond to FOI requests from individuals.
However, when contracted by a government agency (such as NT Health) to provide services, certain contractual obligations may apply. In these cases:
The government agency that engaged St John NT may still be subject to FOI laws and can process requests related to contracted services.
St John NT will reasonably cooperate with FOI requests received from NT Health where it aligns with contractual requirements and privacy obligations.
St John NT may reasonably refuse requests that fall outside of these obligations or where compliance would breach privacy laws.
Opt-outs
If you have received communications (such as direct marketing materials) from us or from organisations that work with us, and you no longer wish to receive those sorts of communications, please contact our Privacy Officer:
by email governance@stjohnnt.asn.au
by telephone on 08 8922 6200
by post to PO Box 40221, Casuarina NT 0810 and we will ensure you are removed from the relevant mailing lists and that the relevant communications cease.
Cross Border Disclosure
Disclosure of personal information overseas
St John NT acknowledges the importance of protecting personal information and takes reasonable steps to ensure that information when used by third parties, including overseas service providers, stored securely and in accordance with the terms of this Privacy Policy and the Privacy Act.
Personal information may also be processed by staff or by other third parties operating outside Australia who work for us or for one of our suppliers, agents, partners or other St John Ambulances.
Prior to disclosing personal information to third party service providers operating outside Australia, St John NT takes reasonable steps (in those circumstances) to ensure an overseas recipient will handle that information in a way that does not breach the APPs. Any St John NT engaged third party service provider operating outside Australia will be required to comply with the Privacy Act and the APPs.
Data quality and security
Security
At all times we will take reasonable steps to ensure personal information is safe including:
making sure that the personal information we collect, use or disclose is accurate, complete up to date and relevant;
protecting personal information from misuse, interference, loss, unauthorised access, modification or disclosure both physically and through computer security methods; and
destroying or permanently de-identifying personal information if it is no longer needed for any purpose for which we are permitted to use or disclose it.
We cannot guarantee the security of all transmissions or personal information, especially where the Internet is involved. Notwithstanding this, we have implemented appropriate internal procedures to respond to the unauthorised access, modification or disclosure of personal information in a manner which constitutes a data breach (Security Incident) including, but not limited to, taking reasonable steps to contain the Security Incident, undertaking a preliminary assessment of the Security Incident and (where appropriate following the results of that assessment) implementing appropriate changes. Where required under the Privacy Act, or in any instance where we feel it is appropriate to do so, we will notify affected individuals and the appropriate authorities if a Security Incident occurs.
Access, correction and deletion of personal information
Access
An individual is entitled to have access to personal information relating to them which we possess, except in some circumstances provided by law. We may also charge a fee for providing access (which will be limited to the amount of our reasonable expenses incurred in responding to your request, including photocopying and administrative expenses). We will not charge a fee for you to lodge a request for access. Refer section 4.6 regarding contacting our Privacy Officer.
Correction
The accuracy of your personal information held by us depends largely on the information you provide to us. If you become aware that the personal information we hold about you is inaccurate, incomplete, out of date, irrelevant or misleading, then you should contact us. We will correct our records of your personal information.
If we disagree with you about the accuracy of the personal information we hold about you, we will keep a record that there is a difference of opinion about that information.
If we do not correct your personal information, as requested, we will give you a written notice setting out our reasons for refusal, along with details of how you may complain about the refusal.
Individuals wishing to access, or to correct or update their personal information should contact the Privacy Officer.
Destruction of personal information
Generally, we will destroy or de-identify personal information we no longer need for the purposes for which we collected it, or for the purposes of fulfilling our legal obligations. However, we do maintain some personal information, such as past transactions for our accounting and audit requirements.
Health and medical information is retained for the period required under relevant legislation and health record-keeping standards. After the required retention period has expired, and where the information is no longer needed for patient care, clinical governance, or legal purposes, records will be securely destroyed or permanently de-identified.
Information collected during recruitment (including police checks, Ochre Card details, vaccination status, and related documents) will be securely destroyed when no longer required to assess your suitability for a role, unless we are required by law to retain it. For successful applicants, relevant information will form part of your ongoing employment or volunteer record and will be retained and destroyed in line with our employee records management requirements.
All personal and sensitive information scheduled for destruction is managed in a secure manner to prevent unauthorised access, use, or disclosure.
St John NT may amend this Privacy Policy from time to time to reflect changes in the law, or its business functions or activities. A current version of the Privacy Policy will at all times be posted on the St John Ambulance Australia (NT) Inc website. Alternatively, a copy may be requested from the Privacy Officer.
Contacting our Privacy Officer
St John NT has appointed a Privacy Officer to:
address compliance with the Privacy Act generally;
address concerns about the manner in which St John NT collects, uses and discloses personal information; and
handle any complaints about an alleged breach of the Privacy Act by St John NT
Any complaints about an alleged breach of the Privacy Act must be made in writing to the Privacy Officer at the contact details set out below. St John Ambulance Australia (NT) Inc. aims to respond to any requests for access and queries (or complaints) at first instance within 30 days of the date of receipt of the request or query (or complaint).
Please contact our Privacy Officer by email at governance@stjohnnt.asn.au or write to us:
PO Box 40221, Casuarina NT 0810
If you are not satisfied with the manner in which we have handled your request, enquiry or complaint, you are entitled to contact the Australian Privacy Commissioner by telephone on:
1300 363 992 or by email: enquiries@oaic.gov.au.
More information about Privacy Act and the APPs is available from the Office of the Australian Information Commissioner at www.oiac.gov.au.
St John NT reserves the right to change this Privacy Policy at any time and to notify its customers by posting an updated version of the policy on our website: https://www.stjohnnt.org.au/