ASAIMH Ltd. Privacy and Data Protection Policy

Australasian Society for Artificial Intelligence in Mental Health Ltd (ASAIMH)
Approved by the Board: 24th October 2025
Review Date: 24th October 2027

1. Purpose

The purpose of this policy is to ensure that ASAIMH Ltd complies with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and upholds best practices for data security and governance required under the ACNC Governance Standards.

The Society recognises the importance of protecting personal and sensitive information of members, directors, volunteers, donors, contractors, and other stakeholders. This policy establishes how we collect, use, store, disclose, and protect that information.

2. Scope

This policy applies to all individuals associated with ASAIMH Ltd, including:

• Board Directors (Responsible Persons)

• The Managing Director and staff

• Contractors, consultants, and volunteers

• Members and event participants

• Research and industry partners who handle personal data on our behalf

It covers all personal information in any format (digital, paper, audio, or visual).

3. Definitions

Personal Information: Information or an opinion about an identified individual, or an individual who is reasonably identifiable.
Sensitive Information: Information relating to health, racial or ethnic origin, political or religious beliefs, sexual orientation, or criminal record.
Data Breach: Unauthorised access, disclosure, or loss of personal information likely to result in serious harm.
Responsible Person: A director, board member, or officer with governance responsibility under the ACNC Act.

4. Policy Statement

ASAIMH Ltd respects and protects the privacy of individuals and is committed to transparent, lawful, and responsible management of personal information.

We will:

1. 1. Only collect personal information that is necessary for our operations or required by law;

2. 2. Use it solely for legitimate organisational purposes;

3. 3. Securely store it and prevent misuse, loss, or unauthorised access; and

   1. 4. Allow individuals to access and correct their information on request.

We will not sell, trade, or otherwise disclose personal information to unrelated third parties.

5. Guiding Principles

• Accountability: The Board is responsible for oversight of privacy and data security.

• Transparency: We clearly communicate how data is used and stored.

• Integrity: We ensure information is accurate and up to date.

• Security: We maintain robust data-protection measures proportional to our operations.

• Lawfulness: We comply with all relevant legislation, including ACNC and OAIC requirements.

6. Roles and Responsibilities

7. Collection of Personal Information

We collect information directly from individuals wherever practicable, including through:

• Membership applications and renewals

• Event or CPD registrations

• Donations and sponsorships

• Research participation (usually de-identified)

• Email or online enquiries

• Surveys, webinars, and collaborative projects

Types of personal information may include:
name, contact details, role/title, organisation, professional credentials, payment information, and (where relevant) health-related details such as dietary needs or accessibility requirements.

8. Use and Disclosure

Personal information is used for:

• Membership management and communications

• Professional development and event administration

• Financial management, receipting, and reporting

• Research partnerships (de-identified where possible)

• Regulatory and compliance reporting (e.g., ACNC publication of directors’ names and positions)

We may disclose information to trusted service providers (e.g., IT hosts, accountants, payment processors) who are bound by confidentiality and APP compliance agreements.

We will only use or disclose personal information for the primary purpose for which it was collected, unless:

• The individual has consented to a secondary use;

• The use or disclosure is required or authorised by law; or

• It is necessary to prevent serious threats to health, safety, or the public interest.

9. Data Storage and Security

ASAIMH Ltd uses secure cloud-based systems (e.g., Microsoft 365, Xero, webinar platforms) to store and manage data.

Security measures include:

• Multi-factor authentication for accounts

• Password-protected systems and encrypted storage

• Restricted access based on roles

• Regular backups and software updates

• Secure document disposal (digital wiping or shredding)

• Locked filing storage for physical records

All staff and volunteers must complete privacy and cybersecurity induction training.

10. Overseas Disclosure

While we prefer Australian-based data storage, some systems (e.g., email, cloud hosting, webinar platforms) may store data on servers overseas.
We only use reputable providers who comply with data protection standards equivalent to Australian law and have appropriate contractual safeguards.

11. Access and Correction

Individuals may request access to, or correction of, their personal information by contacting the Privacy Officer.
Requests will be acknowledged within 7 days and completed within 30 days unless legally exempt.
Identification may be required to verify requests.

12. Retention and Destruction

Personal and financial records are retained for seven (7) years or as legally required.
Records no longer needed will be securely destroyed or de-identified.

 13. Anonymity and Pseudonymity

Where lawful and practical, individuals may interact with ASAIMH Ltd anonymously (e.g., feedback or surveys).
However, membership, governance, or regulatory functions generally require identification.

14. Data Breach Response

In the event of a suspected or confirmed data breach:

1. The Privacy Officer will immediately assess and contain the incident.

2. The Managing Director and Board will be notified.

3. A determination will be made whether the breach is “eligible” under the Notifiable Data Breach (NDB) Scheme.

4. If serious harm is likely, affected individuals and the Office of the Australian Information Commissioner (OAIC) will be notified.

5. The incident and response will be recorded in the Data Breach Register, and corrective actions will be implemented.

16. Training and Awareness

• All new directors, staff, and volunteers will receive privacy induction training.

• Annual refreshers will be provided for those handling personal or sensitive data.

• The Privacy Officer will maintain training records.

17. Research and De-identification

ASAIMH Ltd prefers to use de-identified or aggregate data for research.
Any identifiable data use requires a lawful basis, explicit consent, and a Data Sharing or Processing Agreement consistent with APPs and ethical standards.

 18. Complaints

Complaints about privacy or data handling can be submitted in writing to:

Privacy Officer
Australasian Society for Artificial Intelligence in Mental Health Ltd
Email: privacy@aimentalhealth.org.au
Postal: [insert address]

We will acknowledge complaints within 7 days and aim to resolve them within 30 days.
If unresolved, individuals may contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or 1300 363 992.

19. Review and Updates

This policy and the accompanying Privacy Management Plan will be reviewed annually by the Board or sooner if legislation or operational practices change.

20. Attribution and Licence

This policy incorporates and adapts material from:

• The Australian Charities and Not-for-profits Commission (ACNC), and

• The Office of the Australian Information Commissioner (OAIC),
  licensed under the Creative Commons Attribution 4.0 International Licence (CC BY 4.0).
  Changes have been made. The ACNC and OAIC do not endorse ASAIMH Ltd.

Approved by the Board of Directors: 24th October 2025

Review Date: 24th October 2027