Privacy Policy

1. About this policy

Touchstone Life Care Pty Limited (ACN 626 986 409) (“we”, “us” and “our”) provides a digital advance care planning service. This policy explains what personal information we collect, why we collect it, who we share it with, and what you can do about it.

We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles. 

Most of the information we hold is health information, which is sensitive information under the Privacy Act. We collect it with your consent, and we handle it accordingly.

2. What we collect

We collect and hold the following personal information:

• personal details such as your name, title and gender
• images of you
• contact details such as your address, postcode, email address and telephone numbers
• information about your health, health conditions, values, preferences and beliefs relevant to your future health care
• directions about your future health care
• personal information about people you nominate as being relevant to, or to have access to, your advance care plan, such as your spouse, your general practitioner, family members or friends
• details of your responsible person or persons, including their name, address, phone number, email address and their relationship to you
• personal details provided in relation to support calls, enquiries and complaints
• information you provide through customer surveys
• your opinion and feedback about our services
• usage details such as information and feedback about your use of our products and services
• online details such as your use of our website, including cookies, web beacons and IP addresses
• information collected by Google Analytics, Google Ads and Google AdSense

If you do not provide this information, we will not be able to give you access to our services.

We do not currently collect or hold an Individual Healthcare Identifier for you. See section 4.

3. Anonymity

You can contact us with a general enquiry without giving your name. You cannot create or share an advance care plan anonymously or under a pseudonym, because the document has to identify you to be of any use to the people who rely on it.

4. My Health Record and the Healthcare Identifiers Service

We are building a connection to My Health Record. It is not yet in operation.

At present, we do not send your details to the Healthcare Identifiers Service, we do not collect or hold an Individual Healthcare Identifier for you, and we do not upload anything to My Health Record.

When the connection starts, using it will be your choice, and you will be able to use our service without it. We will update this policy before it starts, so that you can see exactly what is involved before you decide. 

5. Where we hold your information

Other than information collected by Google, we hold all information in an Amazon Web Services instance located in Australia.

The applicable AWS policy is at https://aws.amazon.com/compliance/australia-data-privacy/

Information collected using Google Analytics, Google Ads and Google AdSense is held by Google. The applicable Google policy is at https://policies.google.com/privacy?hl=en

Other than data collected by Google, and information sent to people you have nominated to receive your plan, we do not disclose any of your information outside Australia.

These providers and policies may change from time to time and we will tell you if that happens.

For the purposes of the General Data Protection Regulation, we are the data controller, and AWS and Google (and their associated parties as set out in their respective privacy policies) are data processors.

6. How we use and disclose your information

We use and disclose personal information for the following purposes:

• to respond to you
• to provide you with the services you have contracted for
• to give you access to, including a free trial of, one or more of our products or services
• to process and manage a subscription to a product or service
• to give a person you have nominated access to your advance care plan
• to give people who scan your QR code and enter the security PIN access to your advance care plan
• to give health care providers access to your plan
• to communicate information contained in your advance care plan for your benefit
• to protect personal information, including health information, that we transmit, store or process
• to carry out quality assurance, including checking whether a product or service is working as promised
• to monitor, detect and respond to cybersecurity or privacy incidents
• where required or authorised by law or by a court or tribunal order
• to provide it to nominated trusted partners and care management services we may integrate with in future, for the purpose of quality care planning and management, and subject to any applicable third-party privacy policies

We do not use or disclose your information for any purpose outside these, which are the purposes you gave it to us for. 

7. Direct marketing

We only send marketing communications where you have opted in twice — once when you enter your details and again by confirming through a link we email you. Every marketing message has an unsubscribe link. Messages about your account, your plan or a service issue are not marketing and will still be sent.

8. Security

We protect your information as follows:

• all personal and health information is encrypted in transit and at rest
• access to patient information is restricted to those who need it, and every access is logged
• our systems are hosted in Australian data centres that comply with the Australian Privacy Principles
• we assess and respond to privacy and security incidents, and will notify you and the Office of the Australian Information Commissioner if an eligible data breach occurs

9. De-identified information

We keep de-identified information about the advance care plans stored on this database for research and analytics. De-identified means the information cannot reasonably be used to identify you.

10. Access, correction and complaints

You can ask for access to, or correction of, any personal information we hold about you, or make a complaint about how we have handled it, using the contact details below. Most information can also be viewed and updated directly in your account, and you can delete your account.

We will acknowledge your request or complaint promptly and aim to respond within 30 days.

If you are not satisfied with how we have handled your complaint, you can contact the Office of the Australian Information Commissioner at https://www.oaic.gov.au/privacy/privacy-complaints

11. Changes to this policy

We review this policy at least once a year and whenever our services change in a way that affects how we handle your information. The current version and its effective date are shown at the top of this page.

12. Contact us

Privacy Officer
Touchstone Life Care Pty Limited
141 McCarrs Creek Road
Church Point NSW 2105
Australia
Email: [email protected] (attention Privacy Officer)