Privacy Policy

Privacy Notice Policy Statement

This is the Privacy Policy of AEIOU Foundation as required by the Privacy Act 1988 (Cth) (Privacy Act). It explains the type of information AEIOU may collect, why this information is needed, how it is used, stored and safeguarded.  

AEIOU respects the privacy and confidentiality of all people who engage with us, and we are committed to safeguarding personal and sensitive information.

When you provide personal information to AEIOU, we will seek your consent for its collection, use and disclosure of that personal information at the point of collection, in accordance with the terms of this Privacy Policy. Your engagement with our services signifies your understanding of these terms. AEIOU may modify or update this privacy policy from time to time by publishing it on our website. 

The information we collect, and why it is collected

AEIOU collects personal information to establish, manage and administer our services. When we collect information, the primary purpose for collecting it will be made clear, and employees will assist an individual who requires more information. People can provide information anonymously. However, we may be unable to respond if insufficient information is provided. Employees will disclose any consequences of not providing personal information, which may affect the provision of services at AEIOU.

Examples of information AEIOU may require:

• contact details such as name, address, email and phone number  
• personal details such as date of birth, gender, income  
• information about personal issues and experiences, relationships, family background, family supports 
• health information and/or medical history/medical reports 
• assessment reports and educational reports 
• credit card information and/or bank account details  
• details of any family benefits or funding assistance being received  
• photographs and/or videos (i.e., for assessment, delivery of therapy, communication with employees and families about services, portfolios, or training) 
• information specific to projects which a person agrees to participate in 
• CCTV camera images captured on AEIOU premises 

When and how information is collected

We may collect personal information in many different ways. For example, information is collected when a person seeks access to AEIOU’s service by contacting us and providing details, or though participating through surveys, interviews or any type of AEIOUs service delivery; Personal information about donors and potential donors is collected when we conduct fundraising activities; CCTV cameras installed inside and outside AEIOU buildings may capture images of children, visitors and workers.

Use and disclosure of personal information

The purposes for which AEIOU collect, hold and use personal information include, but are not limited to:

• delivering individualised therapy and care within an AEIOU centre 
• providing support to families during enrolment and/or while accessing the National Disability Insurance Scheme 
• receiving and providing referrals or liaise with other professionals or organisations with a direct interest in the service delivery for your child that would reasonably be expected in the coordination of service  
• monitoring or evaluating existing services and plan for future services  
• producing annual reports and for research purposes, which may involve contracted organisations  
• complying with legal obligations  
• processing payments or issue receipts  
• providing information about AEIOU’s services and initiatives  
• ensuring the safety and wellbeing of children. For example, we will record the contact details of the child’s parents/guardians/carers and other responsible authorised adults who might be called to collect a
• child, authorise medical treatment and other authorisations during the enrolment with us 
• collecting research data regarding autism and the service provision of early intervention; noting, participation in research activity is not essential and families may choose to opt in, or out of this process 
• conducting fundraising activities 
• monitoring access, safety and security of children, visitors, employees, students and volunteers inside and outside the premises through CCTV cameras, by authorised personnel only. Images may be stored for
• a short period of time on our secure business systems, until recorded over, depending on the CCTV system. 

In the process of administering our services, AEIOU may be required to disclose personal information to our agents, contractors or third party providers to the extent necessary for them to perform their duties to us.  All parties that we disclose information to will be required to keep such information confidential and secure. 
We will not use the information collected for another purpose unless we have notified you about the secondary purpose and received your consent, or unless there is a legal obligation for us to do so under the exemptions outlined in the Privacy Act.

Sensitive information

AEIOU may seek to collect sensitive personal information. This may include information regarding racial or ethnic origins, religious beliefs or affiliations and health information. This will ordinarily be for the purpose of ensuring the well-being, protection and development of children in AEIOU’s care. For example, staff may include reference to a child’s country of origin within an individual therapy or care plan. AEIOU will collect such information in a non-intrusive, lawful and fair manner, and only with the consent of the person/party.

Marketing and fundraising activities

As a registered charity, AEIOU may seek to market and undertake fundraising activities and seek donations through a range of avenues if it chooses to do so as part of the approved fundraising plan. For example, could include through social media, unsolicited email, direct marketing, telemarketing, events or other campaigns. AEIOU will ensure relevant activity related legislation are complied with.

Calling times for any telemarketing will be adhered to between 9.00am – 8.00pm Monday to Friday, 9.00am – 5.00pm Saturday, not on Sunday’s or on national public holidays.  AEIOU will usually have permission from the person who will receive the information, however, can utilise exemptions that apply to registered charities for unsolicited commercial electronic messages and designated commercial electronic messages. SMS and email marketing will contain clear sender information and contact details and make it easy to Opt Out.

Messages will:

• identify AEIOU Foundation as the sender 
• contains AEIOU Foundation contact details  
• make it easy to unsubscribe 
• designated commercial electronic messages will contain factual information 

AEIOU will be guided by the best practice guidelines developed on responsible electronic messaging practices by the Association for Data-driven Marketing & Advertising.  

Email address and phone numbers provided to AEIOU as part of donor information or volunteer information may be used by AEIOU for fundraising purposes or to deliver surveys and information related to our service. They will not be used for any other purpose.

Emails issued from an official database or mailing list by AEIOU to provide information about our services and topics we think may be of interests to our customers will include an option to unsubscribe from future projects by clicking on a link. Unsubscribing will not change enrolment records but will remove the party from future group email correspondence from AEIOU.

Security of your personal information

EIOU will maintain and update personal information to ensure it is accurate and current. Client files are stored in either password protected electronic media or in locked cabinets in paper form. Only authorised employees have access to personal or sensitive information as it relates to the duties associated with their role. Our contracts with IT suppliers ensure that appropriate data-backup regimes are in place to protect against loss, damage and retrieval of information and unauthorised access.

Information is stored locally in Australia. If information were to be stored overseas, we would ensure our agreements with the supplier require them to adhere to privacy and data protection laws equivalent to those in Australia and we would advise you of this.

AEIOU’s website is secured using industry standard technology, including encryption technology to ensure your information is protected. However, as internet-based data transmissions may in principle have security gaps, absolute protection cannot be guaranteed.

Our website contains links to other websites. We are not responsible for the privacy practices or the content of those websites.

Data Retention and Destruction 

AEIOU retains personal information for as long as necessary to provide our services and to comply with our legal and regulatory obligations. When personal information is no longer needed for any purpose for which it was collected, we will take reasonable steps to destroy or permanently de-identify it. You may also request that we destroy or de-identify your personal data, which we will do unless we are legally required to retain it.

Data Breach Response 

AEIOU is committed to protecting personal information and has procedures in place to manage a data breach effectively. In the event of a data breach, we will take all reasonable steps to contain the breach and minimise any harm. We will conduct a prompt assessment to determine if the breach is an 'eligible data breach' under the Notifiable Data Breaches (NDB) scheme of the Privacy Act. If it is, we will notify the Office of the Australian Information Commissioner (OAIC) and affected individuals as required by law and take action to prevent a recurrence. 

Cookies 

AEIOU uses cookies on its website to store information and may also use cookies on social media sites including Facebook and Instagram. By using these you consent to the use of cookies. You may delete cookies or instruct your web browser to delete or refuse cookies. Instructions on how to do this can be found in help pages of the web browser being used. If cookies are deleted or not accepted then certain features may not be available, preferences may not be stored, and some pages might not display properly.

CCTV cameras for safety and security

AEIOU may install CCTV cameras to help ensure the safety and security of children, employees and visitors to our service and office locations. Surveillance footage may be used to minimise or eliminate immediate risks to children, employees or visitors, may be used to investigate serious reportable incidents, or it may be used as evidence in any matter which involves the Police or Courts/Tribunals. It may be used in the event of a break-in or malicious damage and information is stored for security and insurance purposes for a limited time. There is no intention to either film or review footage for the purpose of observing employees or visitors.

If we install CCTV cameras we will comply with privacy and other legislative requirements by: 

• notifying employees and families in writing at least 14 days before use: 
  • that CCTV cameras will be used for security and safety purposes 
  • when they will start recording 
  • whether they will record footage continuously or intermittently 
  • the period of surveillance i.e., a specific period or for an ongoing period 
  • how long the footage will be kept 
  • who has access to the footage – i.e., employees who use it to ensure the safety of children, families or visitors, the Police, legal representatives in the event of a Court case, and employees whose role it is to maintain or delete the video 
  • when and how the footage will be deleted 
  • that they may raise questions or any concerns and consult with the Centre Management Team about the conduct of the surveillance at centre services 
  • that they may raise questions or any concerns and consult with the Chief Executive Officer regarding central office surveillance 
• displaying signs at each entrance telling people that CCTV cameras are in use and they may be recorded 
• recording vision but not sound 
• ensuring there is no external access to the footage e.g., families can’t log in and view it  
• ensuring there is no surveillance of adult or children’s toilets, bathrooms or change rooms and no surveillance of lactation rooms.  This does not prevent CCTV vision of the entrance/exit to these areas. 

During the 14-day notice period the AEIOU management will consult in good faith with employees and families who raise issues about the surveillance by giving them a genuine opportunity to influence the conduct of the surveillance.

Once the CCTV is in operation, AEIOU management will direct new employees or families to the CCTV Policy within the Privacy Notice Policy before they start at the service. 
The authorisation of and use of any stored CCTV footage is strictly controlled in accordance with AEIOU policies.

Accessing or changing your personal information

A person may request access to their personal information or request correction of information held about them by AEIOU subject to the provisions in the Privacy Act. This can be done by contacting the relevant AEIOU contact such as the Centre Manager and/or AEIOU Management.

A parent/guardian may seek access to their child’s record. In some instances, AEIOU will require a subpoena in respect of this documentation. The Centre Management will provide advice, and where appropriate, AEIOU will seek legal advice. Any subpoena should be addressed to the AEIOU Management and should be accompanied by appropriate conduct money.

In some circumstances AEIOU may decline access to personal information. If a request for access is unable to be met, AEIOU will explain why. For example, access may be declined if: 

• providing access would pose a serious threat to the life, health or safety of a person or to public health and / or public safety  
• providing access would create an unreasonable impact on the privacy of others  
• providing access would prejudice negotiations with the individual making the request  
• access would be unlawful  
• any other reason that is provided for in the Australian Privacy Principles or in the Privacy Act.

Complaints

If a party wishes to complain about the handling of personal information, we encourage the person to:

1. First, complain directly to AEIOU on the details set out at the end of this Privacy Policy. We will investigate your complaint and respond to you in writing. 
2. If you are unhappy with our response, you could contact the Office of the Australian Information Commissioner (OAIC) for more information. You may download an online complaint form via https://www.oaic.gov.au/individuals/how-do-i-make-a-privacy-complaint, or you may contact the OAIC by post, fax or email.

How to contact AEIOU

A person can contact AEIOU Foundation, if they wish to access their personal information, have a query in relation to this Privacy Notice Policy or would like to make a complaint about AEIOU’s handling of personal information, by contacting us either: 

• In person  
• By phone, contact your local AEIOU centre, or Central Office - https://aeiou.org.au/contact    
• In writing:  
  Email - info@aeiou.org.au, or  
  Post - PO Box 107 Spring Hill Qld 4004 
• Website Online form  - https://aeiou.org.au/feedback  
• Using the Compliments, Complaints and Feedback Form, available at our centres 
• By video or audio recording and sent to us.

A range of processes are in place to support the implementation of this policy with details provided in the core Privacy Notice Policy – Internal framework and associated procedures.