Privacy Policy

Who does this policy apply to?

This privacy policy applies to anyone whose personal information is collected by RSL LifeCare including residents, clients, visitors, next of kin, guardians, health professionals, employees, employment applicants, service providers, supporters including donors and volunteers. This privacy policy also applies to anyone who has access to personal information held by RSL LifeCare such as contractors, suppliers and employees in order to establish the expectations of the management of personal information held by RSL LifeCare.

What personal information is collected?

1. RSL LifeCare collects a variety of personal information to enable it to provide services and operate its business. The type of information we collect depends on how you interact with us. You may have made inquiries about our services, made a donation, we may provide services directly to you, you may represent a person who receives our services, or you have applied for a job or volunteer with us. Personal information we may collect from you can include your:

• name and date of birth;
• contact details;
• photograph;
• marital status;
• records of military service;
• family or representative details including personal information relating to, or about, your next of kin, supporter, legal guardian or person appointed as power of attorney;
• financial information including your bank account or credit card details, income and credit-worthiness, pension, Centrelink and DVA details;
• education history, previous work experience, reference checks and the types of employment you may be interested in;
• tax file numbers, medicare numbers and health fund details;
• image and/or voice and other personal information (such as your car licence plate) collected by CCTV surveillance systems installed in our retirement villages, residential care facilities or veterans hubs; and
• device ID, device type, geo-location information, IP address, browsing information and any other information.

2. If you are applying for employment with or providing services to RSL LifeCare we may also need to collect sensitive personal information about you such as any criminal history or membership of political, professional or trade association trade unions.

3. If you make enquiries about or receive healthcare services while receiving services provided by us, RSL LifeCare will need to collect health information from you in order to undertake assessments and ensure you receive the appropriate services and care. We do this on a regular basis to ensure such information is relevant and up-to-date. This may include your:

• medical/dental records including but not limited to immunisation records, allergies, diagnoses;
• information about health services you’ve received in the past, are receiving in the present or may receive in the future;
• specialist reports, discharge summaries and test results;
• prescriptions and pharmaceutical requirements;
• genetic information;
• religious beliefs;
• wishes about future health services including advance care directives/advance care plans and end of life wishes.

4. In this policy, when we refer to information, we mean personal information, sensitive personal information and health information as required by the context.

How personal information is collected

1. We may collect your personal information directly from you where possible, or from your legal guardian, representative or supporter. This information may be collected in person, face to face, over the telephone, via a web portal, from emails, or from documents or information you provide to us. We will only collect personal information that is reasonably necessary for us to provide our services to you and conduct our business.

2. Sometimes it may be necessary to collect your information from others, including your family or carers, your supporter or representatives, your allied health or medical practitioners, other residential care or retirement village providers, government departments such as Centrelink, Medicare, DVA or your accountant. In relation to employment applications, we may collect information about you from recruitment agencies or referees. In such cases RSL LifeCare will only collect the personal information required to provide the services, respond to your enquiry or assess your employment application.

3. If you provide us with personal information about another person, you represent, and we collect it on the basis, that you have the individual’s consent for us to collect and handle their personal information accordance with this policy.

4. From time to time we may also acquire details such as your name and contact details from other third parties in order to communicate with you about donations, products or services, campaigns, causes or events that we think might be of interest to you.

5. In assessing your suitability to receive our services, for employment or volunteering, or as a service provider or someone we may do business with, we may obtain and share personal information in the process of undertaking due diligence such as reference checks, credit checks or to verify and validate details to reduce the risk of payment fraud and to help ensure that electronic funds transfers from RSL LifeCare go to the right payee.

Collection from websites and information technology

1. We collect information about you and your interactions with us, for example, when you enquire about or use any of our products or services, call us or otherwise visit our website. The information we collect from you may include your identity and contact details, your history of interacting with us and use of our services and details of enquiries or complaints you make.

2. We may collect information about how you access, use and interact with our website and digital platforms. We do this by using a range of digital reporting

tools, customer relationship platforms and 3rd party digital advertising platforms. This information may include:

• the location from which you have come to the site and the pages you have visited; and
• technical data, which may include IP address, the types of devices you are using to access the website, device attributes, browser type, language and operating system.

3. We use cookies on our website. Cookies are pieces of information that a website transfers to your device to store and sometimes track information about your use of the website. We use cookies to distinguish you from other users in order to better serve you when you revisit our website and may share this information with our providers. You can set your browser to notify you when you receive cookies, providing you with an opportunity to either accept or reject it. You can also refuse all cookies by turning them off in your browser. If you refuse cookies, certain parts of our website may not function properly.

Free Wi-Fi Service

We may offer free Wi-Fi network services at our retirement villages, facilities or premises. If you are carrying a device within range of our Wi-Fi networks and have Wi-Fi and Bluetooth enabled, we may pick up certain data transmitted from your device whether or not you join our Wi-Fi network including:

• your device ID, device type, IP address and MAC address; and
• geo-location information and any movement of your device throughout our premises.

If you request to join our Wi-Fi network, we may collect other personal information which you provide to us while accessing our Wi-Fi networks (for example, your name, email address, details of the websites or mobile applications whilst you are connected to our network).

In each case, we will only use information or data collected this way in accordance with, and for the purposes set out in this policy, or as permitted by law. If you do not want this information collected, you can disable Wi-Fi and Bluetooth on your device and elect not to sign into the Wi-Fi network.

How we use and disclose personal information

1. It may be necessary for us to use personal information in order to appropriately manage our business and provide our services. Examples of how we may use your personal information include:

• assessing your eligibility to receive RSL LifeCare’s services;
• providing you with promotional information about RSL LifeCare’s services;
• determining amounts payable by you for RSL LifeCare’s services;
• in the course of providing services, communicating with you regarding the services being provided, including regarding your satisfaction with the services and options for new services or interacting with you as a contractor;
• identification of individuals in order to maintain security at our facilities;
• managing insurance;
• attaching photos to your medical or other records or room in order to help identify you or provide you with appropriate care or services;
• processing job applications and advising you of job opportunities in the future;
• for fundraising, bequests and communications purposes including providing grant providers or other funders details of service delivery partners and providers;
• complying with our legal and regulatory obligations;
• for statistical and data analysis, operational purposes and operational design, and reporting to improve our services; and
• tailoring RSL LifeCare’s services to your needs.

2. RSL LifeCare may also use and disclose your personal information to third parties in the following circumstances:

• where you are a resident in a retirement village, by providing your contact details or other information to a Resident’s Committee to facilitate communication;
• discussing the services being provided to you with your family, supporter, representative or guardian;
• to provide or facilitate the provision of medical care, allied health, lifestyle services or other services to you;
• to effectively communicate with third parties, such as health practitioners or others involved in your care or providing you services;
• in newsletters or other updates about activities in our villages, residential care facilities or veterans hubs;
• as required to appropriately deal with government agencies such as Centrelink, the Department of Health and Aged Care, the Aged Care Quality and Safety Commission and the Department of Veteran Affairs;
• other companies, service providers or individuals who assist us in providing our services or managing our operations, including employees or contractors, third party service providers in the management of our villages or facilities, consultants or agents acting on our behalf;
• to external service providers so that they may perform services for us or on our behalf, including due diligence, reference checks and technology providers;
• to assess your suitability for employment, or volunteer work, with RSL LifeCare;
• to manage our business operations, such as disclosures required to police, government bodies, our insurers, clinical, legal and financial advisors;
• for statistical and data analysis, operational purposes and operational design, and reporting to improve our services;
• where you have given your consent for us to use or disclose your information;
• where use or disclosure is required or permitted by law; and
• social media channels on which we have a presence such as Facebook, Instagram, LinkedIn or other similar social media channels, for example, when you attend events. Generally, in these cases we limit disclosure to your image or your name or details that that you are willing to share.

3. RSL LifeCare may use or disclose personal information in relation to applying for appropriate government subsidies available to it such as under the Aged Care Act 2024 or the National Disability Insurance Scheme Act 2013. These subsidies, and the disclosures made to obtain them, are necessary to enable RSL LifeCare to support the delivery of high quality care and services to its clients and in accordance with its not-for-profit purpose. Wherever reasonable and practicable RSL LifeCare will either limit the personal information disclosed to that which is reasonably necessary or will undertake to de-identify the information prior to its disclosure.

4. RSL LifeCare will only disclose personal information which is reasonably and practicably necessary to fulfil the purpose of the disclosure.

CCTV at RSL LifeCare Retirement Villages, Residential Care or Veterans’ Services facilities

We may use CCTV surveillance systems to monitor and record activities at our sites for the purpose of maintaining a safe and secure environment for our employees, residents, clients and visitors. This means we may use your personal information from CCTV for security and risk management, loss prevention, incident investigation purposes and other purposes as set out in this policy if permitted by law or otherwise with your consent.

We securely discard data collected from our CCTV surveillance systems when it is no longer required for business or legal purposes.

Direct Marketing

1. RSL LifeCare may use your personal information to offer you products, services or opportunities we believe may interest you or to keep you updated about our events, programs and purpose, but we will not do so if you tell us not to. These products, services or opportunities may be offered by us, our related entities, our other business partners or our service providers, and may include entities that facilitate marketing activities to you on behalf of RSL LifeCare.

2. Where you receive electronic marketing communications from us, or by third parties engaged by us to carry out the marketing campaigns, you may opt out or ‘unsubscribe’ from receiving further marketing communications by following the opt-out instructions provided in the communication or by letting us know.

Third Party Links

Our websites and mobile applications may contain links to websites owned and operated by other organisations. When you click on one of those links, you are moving to another website. Unless stated otherwise, we are not responsible for the privacy policies and other terms that apply to those websites as they may differ from this Policy.

How personal information is held and stored

1. We store most information about you in computer systems and databases operated by either us or our external service providers. Some information about you is recorded in paper files that we store securely.

2. RSL LifeCare takes the security of your personal information seriously and implements and maintains processes and security measures to help protect personal information we hold from misuse or loss and from unauthorised

access, modification or disclosure. These processes and systems include, but are not limited to:

• storing any electronic information on password protected and secure servers and the use of identity and access management technologies to control access to systems on which information is processed and stored;
• log and monitor certain security activities in line with the appropriate security standard within the information security management system;
• all business critical systems use Single Sign On (SSO) with Multi Factor Authentication (MFA) as well as conditional access policies to help ensure security rigor and compliance;
• requiring employees to comply with internal information security policies and undertake training to help keep information secure;
• ensuring any physical copies of personal information are kept in a secure area and archived according to RSL LifeCare’s document retention, destruction and archiving policy;
• taking steps to ensure that all subcontractors are obliged to comply with the Act and where possible to this policy; and
• ensuring that any access to personal information by RSL LifeCare employees, contractors and advisors is limited to those employees with a need to know that information for the provision of services.

3. Although RSL LifeCare endeavours to take steps to provide a secure environment to hold your personal information, there is no guarantee that the electronic information about you is totally secure due to the nature of the internet and information systems. However, once we detect any unauthorised access or any kind of potential loss or misuse, where required by any applicable law, we will notify you and take the appropriate remedial steps as early as practicably possible.

4. RSL LifeCare uses third party systems or providers to process or hold some of the data we collect, including some providers that are based outside of Australia such as Europe, Canada and the United States. We take reasonable steps to ensure the contractor has appropriate controls in place to comply with the standards imposed by the Act and our Privacy Policy.

5. Personal information may be retained for such periods as required by relevant laws. If RSL LifeCare no longer requires personal information for any purpose, we will take steps to permanently de-identify or securely destroy the information in

line with organisational procedures unless RSL LifeCare is otherwise permitted or required by law or court or tribunal order to retain such information.

Access, accuracy and correction of personal information

1. RSL LifeCare will take reasonable steps to ensure that all personal information held is accurate, complete and up-to-date, accordingly RSL LifeCare may from time to time contact you directly for the purposes of verifying your information.

2. You have a right to request access to your personal information and to request changes, including to correct, update or delete your personal information. Such requests should be made in writing to RSL LifeCare’s Privacy Officer (details below). We will endeavour to respond to your request to change your personal information held by us within 10 business days after the request is made.

3. When requesting access or correction of personal information RSL LifeCare will require you to verify your identity.

4. While RSL LifeCare will generally comply with your request for access to personal information, there may be instances where we cannot comply with your request. For example, if a legal exception under the Act applies, where granting access would interfere with the privacy of others or result in a breach of confidentiality, or where we are required to retain and cannot delete the information for legal or regulatory compliance reasons. If this happens we will inform you and explain the reasons why.

5. Additional restrictions around providing access to any CCTV footage exist, including restrictions under workplace surveillance laws and where there is an investigation or legal action pending.

Anonymity and pseudonymity

You are not required to provide personal information to us. However. if you do not provide us with the personal information we require, it may affect our ability to provide you with the services you are seeking, provide you with information or updates or respond to your enquiry. RSL LifeCare will be able to discuss its services or operations in a general nature, including costs and charges which it might ordinarily charge for those services, prior to obtaining your identity.

Changes to our Privacy Policy

We may amend, modify or replace this privacy policy at any time. Updates will take effect from the date the amended, modified or replacement privacy policy is published on our website.

Contact Us

1. If you wish to contact us to make a complaint about RSL LifeCare’s collection, use or disclosure of any personal information, or about any potential breach of the policy, you have a right to contact the RSL LifeCare Privacy Officer. The Privacy Officer may request additional information to assist with the proper investigation of the complaint and take such reparatory action as necessary.

2. Once a complaint is received the RSL LifeCare Privacy Officer will investigate the circumstances of the complaint and determine whether a misuse of personal information has occurred and if so how it may be rectified and whether/what action should be taken in relation to any RSL LifeCare employee or representative involved. RSL LifeCare will endeavour to investigate and respond to your complaint within 10 Business Days.

3. Should you not be satisfied with RSL LifeCare’s handling of your complaint then you are entitled to refer the matter to the Office of the Australian Information Commissioner by submitting an online form through the Information Commissioner’s website www.oaic.gov.au or by calling 1300 363 992.

4. RSL LifeCare’s Privacy Officer can be contacted using the details below. Phone: 02 9919 3742 Email: [email protected] Mail addressed to: Privacy Officer RSL LifeCare Level 4, 40 Mount Street, North Sydney NSW 2060