We apply the Australian Privacy Principles and the Victorian Information Privacy Principles to the collection, holding, use and disclosure of personal information. This Privacy Collection Statement describes our policies and procedures on the collection, holding, use and disclosure of your personal information and should be read together with the Impact Recovery Website Terms of Use and the Privacy Policy on each website.

What is personal information?

When used in this Policy, “personal information” has the meaning given in the Privacy Act. Generally, it means any information or an opinion that could be used to identify you.

How do we collect personal information?

We may collect your personal information if you:

• Make contact with us over the phone, for example if you call via our offices, or via our Helpline, for information, services or support;
• Have contact with us in person;
• Participate in a public or closed survey, questionnaire or opinion poll;
• Register for face-to-face or digital events (such as conferences, training events or webinars);
• Interact with us online, including through our websites, email, webchats, mobile applications or social media channels (such as Facebook, Twitter, YouTube, Instagram or LinkedIn – these social media channels will also handle your personal information for their own purposes and have their own privacy policies);
• Have donated to another organisation and have consented to receiving information from like-minded organisations such as Impact Recovery;
• Apply for or express an interest in a position with us (either as an employee, or as a volunteer, or as a contractor).

This collection may be required to allow you to:

• Access our clinical services or face to face support groups;
• Join one of our websites as a registered user;
• Make a donation;
• Buy goods from us;
• Receive information from us including email or SMS communications;
• Apply to hold a fundraising event;
• Register to use our web counselling services or online support groups;
• Register for or express interest in becoming a volunteer;
• Register as a Change Maker, or representative of Impact Recovery;
• Download or order resources;
• Access training or professional development services for your educational institution or organisation;
• Participate in surveys, polls or research
• Receive information about or become involved in our programs, campaigns or other initiatives;
• Use our mobile applications; and
• Work with us.

Collecting personal information through our websites

When you browse one of our websites, the types of information that may be collected as a result of your visit are:

• The fact that you have visited the website and the date and time of your visit;
• Your server or IP address (the name or number which uniquely identifies the computer through which you are connected to the internet);
• Your top level domain name, e.g. .com, .gov, .au, .uk;
• The pages you have accessed and the documents you have downloaded;
• The search terms you used;
• The previous site you visited (if you have linked to this website); and
• The type of browser you use.

We will not make any attempt to identify you from the collection of this information.

What personal information do we collect?

• Your preferences for receiving further information about our programs, campaigns or activities;
• Additional types of personal information such as title, department name, company information or qualifications;
• Other information relevant to specific surveys or opinion polls;
• Other demographic information;
• Unique identifiers in order to provide you with a more personalised experience or to verify your passwords.

If you want to share personal information about another person with us, for example you want to share a story that includes another person’s experience of disordered eating, an eating disorder, self-harm or suicide in which that person will be identifiable, you must seek permission from the individual or next of kin first and let them know about our Privacy Policy. Some people may not want their experience made public. It is important to consider the impact and respect the wishes of others affected by the same story as you.

How does Impact Recovery use your personal information?

We use your personal information only for the purpose for which you have provided it to us.

The personal information you provide to us may be used by us for the following purposes:

• To provide you with a service;
• To allow you to obtain access to the interactive elements of our mobile applications and websites (including the our online counselling services and support groups, and our campaign websites);
• To provide you with the information, resources or merchandise you have requested;
• To involve you in programs, campaigns, research, activities or other initiatives undertaken by Impact Recovery;
• To include your name and the amount of your donation or sponsorship you may make in our annual report or on our website (unless you choose a private or anonymous donation);
• For the marketing and research purposes of Impact Recovery, its contractors or service providers;
• For internal administrative purposes;
• To respond to enquiries including ‘Contact Us’ form enquiries, general website feedback or assistance, media enquiries;
• To update our records and keep your contact details up to date;
• For research, advice and information, including for bench-marking purposes;
• To send you emails about our programs, campaigns or activities if you have agreed to receive our emails (you will be provided with an opportunity in each email to decline to receive any further emails from us by unsubscribing);
• In the case of marketing automation, to improve the emails that are sent to you and to improve the personalisation, services, programs, content and resources that are offered to you;
• To enable like-minded organisations to contact you with information that may be of interest to you (if you have consented to this);
• To assess any application from you to work or volunteer with us; and
• If you lodge a complaint or query with us, to process and respond to your complaint or query.

If you access any interactive elements of our websites, or online or mobile applications (including online support groups), only your display name will be shown online. We recommend that you do not post information online that may identify you or anyone else such as your address, email address or phone number. If you do post personal information online, your personal information may be identified, recovered and displayed by internet search engines.

Our websites may contain links to other websites of interest, that are not Impact Recovery websites and that are therefore not governed by this Privacy Policy.  We are not responsible for the protection and privacy of any information you provide to another organisation on another website after using such a link to leave our websites.

When entering information on any page on our websites, there may be a ticked box that indicates that you agree to your information being used for marketing purposes, such as receiving emails about similar events or activities in the future. You can choose to indicate that you do not agree to your personal information being used in this way, by unticking the box.

If you have previously agreed to us using your personal information for marketing purposes, you may change your mind at any time. You will be provided with an opportunity in each email to decline to receive any further emails from us by unsubscribing, or you can contact us and request for your details to be removed from our database.

Regardless of where in the world you reside, Impact Recovery may transfer your data to Australia and process and store it there.

Security of your personal information

We take reasonable steps to ensure the security of all information we collect, including that the information is protected from misuse and loss and from unauthorised access, modification or disclosure. For example, your personal information is maintained in a secure environment, which can be accessed only by authorised personnel. However, no data transmission over the internet or information stored on servers accessible through the internet can be guaranteed to be fully secure.

In addition, we take reasonable steps to destroy or de-identify your personal information once we no longer need it or when we have been directly instructed by you to permanently remove or suppress your personal information.

Disclosure of personal information

Personal information will only be disclosed to third parties in accordance with this Privacy Policy.

We only disclose your health information for the purposes for which you gave it to us or for a directly related purpose you would reasonably expect or if you agree.

We may disclose your personal information, including health information, where disclosure is considered necessary to prevent injury to life or health, for example, if we have reason to believe that:

• You are thinking of taking your own life;
• You are thinking of seriously harming yourself;
• You have self-harmed or have been seriously hurt by someone else;
• Your  physical or mental health is such that your require emergency medical treatment;
• You are thinking of harming or have already attempted to harm someone else.

Information may be provided to third parties where services relating to the purpose for which the personal information is collected are outsourced or you would reasonably expect us to disclose it to a third party for a particular purpose. For example, we may disclose your personal information to:

• Our service providers that host our website servers;
• Our service delivery partners or contractors;
• Marketing service providers;
• Professional advisors (such as accountants, auditors and lawyers); and
• The funders of particular programs.

We may also disclose your personal information if:

• You have consented to the disclosure; or
• It is required or authorised by or under an Australian law or a court/tribunal order.

We do not directly disclose personal information to recipients located overseas.

Accessing and correcting personal information

You may request access to your personal information collected by us, and ask that we correct that personal information. You can ask for access or correction by contacting us and we will usually respond within 30 days.

We may require you to verify your identity before we can assist you.

If we refuse to give you access to, or correct, your personal information, we will notify you in writing setting out the reasons.

Notifiable Data Breaches Scheme

In the event of any unauthorised access or unauthorised disclosure or loss of your personal information that is likely to result in serious harm to you, we will investigate and notify you and the Office of the Australian Information Commissioner in accordance with the Privacy Act.

Privacy Collection Statement

A Privacy Collection Statement is information provided at the time of collecting personal information (or as soon as practicable thereafter) that explains such things as the purpose of collecting the information. The provision of a privacy collection statement is a requirement of the Privacy and Data Protection Act 2014 (Vic).

We provide a Privacy Collection Statement on each of our websites.

Complaints about your privacy

If you believe your privacy has been breached or you have a complaint about how we have handled your personal information, please contact us in writing.  We will respond within a reasonable period (usually within 30 days).

If you are not satisfied with our response, then you may lodge a formal complaint with the Office of the Australian Information Commissioner (for more information, please see www.oaic.gov.au).

Changes to this Privacy Policy

This Privacy Policy may change from time to time. Any updated versions of this Privacy Policy will be posted on our websites and will be effective from the date of posting.

This Policy was last updated in August 2024.

How to contact us

By email: privacy@impactrecovery.org.au
By post: Att: Privacy Officer, Impact Recovery Ltd., PO Box 2979, Bendigo DC VIC 3554