Privacy Policy

In this policy, the following terms have the meanings given to them under the Privacy Laws, which can be summarised as follows:

• Personal Information – information or an opinion about an identified individual, or an individual who is reasonably identifiable; and
• Sensitive Information – including information or an opinion about an individual’s racial or ethnic origin, politics, beliefs, membership of a professional or trade association or union, sexual orientation or practices, criminal record, or health information.

Personal Information and Sensitive Information

BCT generally only collects Personal Information (including Sensitive Information and health information) that is reasonably necessary for one or more of its functions or activities, such as conducting breast cancer clinical trials research and fundraising and communication related activities.

From donors, supporters and the general public

Where you have consented, BCT generally collects information from you for the purposes of receiving and managing donations, facilitating and supporting participation or registration in an event or activity, providing information about breast cancer research and fundraising activities, and to seek support for the BCT research program.

The type of Personal Information collected from or relating to individuals may include but is not limited to:

• name;
• address;
• telephone / mobile;
• email address;
• date of birth;
• donation details – including: cheque and/or bank account details, credit card number, receipt number, amount, channel of giving and campaign/appeal responded to, etc.; and
  other Personal Information such as reason for giving, age, acquisition channel, prior response to appeals or participation/registration in events or activities, via appeals, responses to information provided by BCT, survey responses and any other Personal Information you may volunteer (such as your experiences or connection to breast cancer), etc.

From clinicians, principal investigators, other medical research staff, participating institutions, BCT’s members and other persons

BCT collects information from you which is necessary to properly manage our activities and provide our services to you. The type of information that BCT may collect includes but is not limited to:

• contact details including name, phone, email, address;
• position;
• affiliation details, including name of
• organisation etc.;
• where required, a full or abbreviated CV;
• where required, relevant information to meet regulatory and program specific requirements, for example relevant financial information such as bank account details, etc.;
• payment details for clinical trial reimbursement payments to participating institutions;
• reasons for joining various programs that we may offer, which may include disclosure of health information; and
• annual general meeting registration details – including method of payment, cheque and bank details, credit card number.

From participant’s in BCT’s clinical trials and research programs

BCT collects information from you which is necessary to enable you to participate in clinical trials and research programs (the Clinical Trial Information). The Clinical Trial Information which BCT may collect from trial participants includes:

• relevant medical and disease information as required by the particular clinical trial protocol which may include your health history, family history, past and current treatments, lifestyle factors etc.;
• biological samples and medical imaging (mammogram, MRI, etc.) related information as required by the particular clinical trial protocol;
• contact details (including name, email, phone) and any other information which is necessary for the conduct of the trial;
• gender and demographic information (race/ethnicity, residential post code,); and
  date of birth.

Any information that we collect to provide, and in providing, the clinical trial services to you is likely to be classified as health information, and therefore Sensitive Information, under the Privacy Act.

Collection of Sensitive Information requires your explicit and ongoing consent. You will have consented to the collection of all Clinical Trial Information at the time you entered the clinical trial. BCT does not collect information about you that you have not previously consented to.

From job applicants

BCT generally collects information from you which is necessary to assess and engage applicants. This includes collecting Personal Information such as your name, address, email, phone, professional experience, qualifications, references and past employers, and any other information which is necessary to assess your suitability for employment.

This Privacy Policy does not apply to our handling of information about our employees. Our handling of employee records is exempt from the Australian Privacy Principles under the Privacy Act if the act or practice is directly related to:

• either a current or former employment relationship between us and the individual; and
• an employee record held by us relating to the individual.

For information about our practices relating to employee records, please contact us at the contact details listed below.

Marketing and Fundraising purposes

BCT may use Personal Information we hold about you, with the exception of Clinical Trial Information, to send marketing and fundraising materials to you regarding fundraising and communication activities, clinical trials and research programs and other information we believe will be relevant to you.

We only use or disclose your Personal Information for marketing and fundraising purposes where you have consented or, if the information is not Sensitive Information, where it is allowed by applicable laws. For Sensitive Information, we only use or disclose it for these purposes where you have expressly consented and the purpose is directly related to the reason it was collected.

Our communications to you may be sent in various forms such as by offline methods and by electronic means including email and SMS.

We want to communicate with you only if you want to hear from us. If you wish to cease receiving Marketing and Fundraising materials, please contact us directly on the contact details listed below asking to be removed from our mailing and/or digital communication lists, or use the ‘unsubscribe’ or ‘update your preferences’ facilities included in our email and SMS communications.
In the case of trial participants, we will never use your Clinical Trial Information for direct marketing purposes.

General purposes

With the exception of Clinical Trial Information, we may also use your Personal Information for purposes including:

• to conduct and improve our services, activities and programs;
• to communicate with you generally, including answering your questions and providing you with information or advice;
• to notify you about fundraising activities, surveys, events, and upcoming clinical trials and research programs;
• to respond to your interaction with BCT;
• to carry out administrative, marketing, service development and fraud prevention activities;
• to enforce agreements;
• to comply with contractual, legislative and policy requirements;
• to assist in providing services you have requested or that we need in order to fulfill our activities we may provide your Personal Information to third parties such as delivery service providers, data analysis providers and providers who manage our communications to you;
• to deal with complaints made by you; and
  to comply with laws or regulations or to comply with any directions given by relevant authorities.

Consequences of not providing Personal Information

If you do not provide the requested Personal Information or if any of the Personal Information you provide is incomplete or inaccurate, we may not be able to undertake our activities properly or provide our services to you.

We will generally collect your personal information directly from you, including through:

• research, such as clinical trials and membership applications;
• fundraising and communication activities, such as media campaigns, direct mail solicitation, social media, online activities, digital campaigns and advertising, telemarketing, event registration and participation, and corporate sponsorship opportunities;
• our website (including through online forms);
• email enquiries, online and hard copy forms and phone calls; and
• as otherwise required and/or permitted under the Privacy Laws.

However, sometimes it might be impracticable or unreasonable to collect information directly from you. Accordingly, your personal information may be collected from third parties such as:

• clinicians, principal investigators, and other medical research staff involved in the conduct of BCT clinical trials program;
• specific website platforms which facilitate donations, events and other fundraising and communication activities, such as Fundraising, Raisely;
• telemarketing suppliers engaged by BCT;
• members of BCT;

When collecting personal information BCT will take reasonable steps to inform you (such as by including it in this policy) of:

• the fact that the information is being collected;
• the purpose for which the information is being collected;
• any third parties we usually disclose Personal Information to;
• the identity of BCT;
• if we did not collect the information directly from you, that we collected the information, and the circumstances of the collection;
• if the collection of Personal Information is required or authorised under an Australian law or court/tribunal order, the law/order that authorises or requires the collection;
• the consequences for you if all or some of the Personal Information is not collected by us;
• how the information is likely to be used; and
• if we are likely to disclose your Personal Information overseas, the countries in which the recipients are likely to be located.

Types of Sensitive Information collected by BCT includes Clinical Trial Information, and health information if volunteered by donors, supporters and the public.

BCT will only collect Sensitive Information about an individual who consents to the information being collected and the information is reasonably necessary for one or more of BCT’s functions or activities, or if the collection is otherwise permitted by the Privacy Laws.

When collecting Clinical Trial Information from participants in clinical trials conducted by BCT, BCT follows the following procedure:

• informed consent is obtained from each participant to the collection of the information, subject to the participant having the capacity to provide such consent. This is obtained before entering the trial and may be withdrawn at any time; and
• the participants are informed of the purposes for which their information may be collected, used and disclosed.

If you provide us with Personal Information about another individual, in doing so you will be representing to us that you have that person’s consent for us to collect and handle their Personal Information in accordance with this privacy policy – and we will be collecting the information on that basis.

BCT will generally only use or disclose an individual’s Personal Information, (including Sensitive Information) for the primary purpose for which it was collected, or as otherwise permitted by Privacy Laws.

In all other circumstances, BCT will generally seek the individual’s consent prior to using or disclosing any Personal Information (including Sensitive Information) for another purpose, unless BCT is required or permitted by law (including the Privacy Laws) to do so without seeking an individual’s permission.

Information collected by BCT is not generally used by BCT or disclosed to any third parties except:

• as required by the data flow requirements of a clinical trial protocol (informed consent for this will be sought at the outset);
• to comply with law;
• to conduct our internal management, quality assurance, risk management, audit and other administrative purposes;
• for fundraising and communication activities and/or in respect of services provided on our behalf; and/or
• with the consent from the individual.

Personal information collected by BCT may be disclosed to overseas recipients if BCT first takes reasonable steps to ensure the overseas recipient does not breach Privacy Law unless:

• BCT believes that the recipient will be subject to the same or similar requirements as those that BCT is subject to under the Privacy Laws and the individual will have the ability to enforce the relevant law;
• where you have provided informed consent for the disclosure, and it is necessary for the purposes of conducting a trial approved by BCT; and/or
• the disclosure is required or authorised under applicable law.

Where we seek your consent to disclose your Personal Information to overseas recipients, we will first inform you that if you provide such consent, we are not required to take steps to ensure they do not breach the Privacy Act in relation to your Personal Information.

The regions where we may disclose Personal Information include Europe including the United Kingdom, North America including Canada and the United States of America, Asia including Japan and Korea, and other countries from time to time.

Our Website does not attempt to identify you as an individual user and it will not generally collect Personal Information about you unless you specifically provide this to us.

a) Third Party sites

Our Website may contain links to third party websites. Except where they are our contracted third party service providers, we are not responsible for the content or privacy practices employed by websites that are linked to our Website. You should review the privacy policy and terms of use for those websites each time you visit them.

b) Cookies

Our Website does collect cookies from visitors, including members who log in to our Website. Cookies are small data files placed on your machine or device which lets BCT identify and interact more effectively with your computer, to improve your experience on the website. Cookies do not identify individual users, but they do identify your web requests, internet service provider, browser type, browser language and the date and time of your request. You have the ability to turn cookies off on your computer via the setting in your browser.

We collect cookies to enhance your browsing experience, personalise content, and deliver targeted advertising, including retargeting and reminders such as abandoned cart emails. By using our website, you consent to the use of cookies in accordance with this Privacy Policy.

BCT may sometimes use computer programs to help make decisions or manage tasks more efficiently.

These programs follow set rules and use data to either make a decision automatically or suggest an option for a person to review. They do not use artificial intelligence — they simply apply pre-defined steps to speed up routine processes.

Examples of decisions these systems may help with include matching a donation to a supporter file in our secure database, which could include your contact details such as your name and address; or, if you are a participant in our clinical trials, the allocation to clinical treatments (a process called randomisation) which could use your health and medical information.

We work hard to make sure these systems are fair, but because they follow programmed rules, there is a small risk of mistakes or bias. If you’d like to know more about what information we use or how these systems work, please contact us using the details below.

In the event BCT introduces Artificial Intelligence platforms to engage with external members of the public you will be made aware you are engaging with an AI platform and we will ensure those platforms comply with the Australian Government’s AI Ethical Principles.

Data Storange, Security and Cybersecurity

BCT stores data in both hard copy and electronic forms. BCT strives to ensure the security, integrity and privacy of Personal Information, and will take reasonable steps to protect your Personal Information from misuse, interference, loss, unauthorised access, modification or disclosure. BCT reviews and updates (where necessary) its security and cybersecurity measures.

Some of the measures that BCT has implemented to ensure that your Personal Information is not lost, misused or subject to any unauthorised access, modification or disclosure, include:

(a) Site

BCT’s premises have a security system, including ID cards, alarms and cameras.

(b) Computer network

BCT operates under a computer network system that is secured by usernames and passwords. This system is protected from external access via a secure firewall. Each computer ‘locks’ after a nonoperational period of 15 minutes to ensure security of information stored. User passwords must be changed regularly.

The Personal Information collected by BCT is stored on secure databases which are also password protected, and which have internal security measures regarding levels of access for certain users. All staff require two-factor authentication to access systems and databases.

(c) Transmission of information

BCT encrypts and/or password protects any Personal Information sent electronically to off-site third party service providers or via a File Transfer Protocol. Any off-site locations have security processes in place to ensure the security of Personal Information. All other confidential or secure information is transmitted verbally or by direct face-to-face communication.

(d) Staff

All BCT’s staff sign an employment contract which includes confidentiality at the start of their employment. All temporary staff are also required to sign a confidentiality statement. BCT only employs temporary staff from staff employment agencies which fulfil the obligations of the Privacy Laws. Our staff are trained on how to manage and protect Personal Information.

(e) Visitors

Where applicable, BCT’s visitors are required to sign confidentiality deeds.

Transactions and Donations

Payments, donations and funds raised are processed via secure systems. Credit card transactions are processed using secure payment gateways and the credit card number is not stored or retained by us except as required by law. Other transactions such as those received by cheque or through the supply of bank account details are also securely processed and held as required by law.

Once Personal Information held by BCT is no longer required for any permitted purpose (such as fundraising) and is not legally required to be retained, BCT aims to remove, de-identify and/or securely destroy the Personal Information.

We may, however, retain Personal Information for as long as is necessary to comply with any applicable law, for the prevention of fraud, for insurance and governance purposes, in our IT back-up, for the collection of any monies owed and to resolve disputes.

A notifiable data breach scheme is currently in place in Australia. We are committed to adhering to this scheme as an important step in preventing and managing serious privacy breaches.

A ‘data breach’ means unauthorised access to, or disclosure, alteration, loss, or destruction of, Personal Information or, an action that prevents us from accessing Personal Information on either a temporary or permanent basis. An ‘eligible data breach’ occurs when there is a data breach that is likely to result in serious harm to any of the individuals to whom the information relates and this cannot be remediated.

If we suspect a privacy breach has occurred, our priority is to contain it, reduce the risk of harm and assess the suspected breach. We will determine the cause and extent of the breach, analyse the type of harm (including where Sensitive Information is involved), consider who may have contained access to the information and determine whether there is an ‘eligible data breach’. If so, we will notify the regulator and all affected individuals to assist them to take such steps as might be necessary.

We welcome the General Data Protection Regulation (GDPR) as an important step forward in encouraging high standards of personal data security. Australian businesses of any size may need to comply if they have an establishment in the European Union (EU), if they offer goods and services in the EU (irrespective of whether a payment is required), or if they monitor the behaviour of individuals in the EU (where that behaviour takes place in the EU).

Under the GDPR and the Data Protection Act 2018 (UK), we may have some additional obligations with respect to the processing of “personal data” collected from residents of the EU and/or United Kingdom (UK). The meaning of personal data is similar to Personal Information—however, it is broader as it includes any information relating to an identified or identifiable natural personal.

Where required, we will take appropriate steps to ensure that the personal data of EU and/or UK residents is:

• (a) processed lawfully, fairly and in a transparent manner;
• (b) collected for legitimate purposes;
• (c) accurate and up to date;
• (d) kept for no longer than is necessary for the purposes for which it was collected; and
• (e) secure and protected against unauthorised or unlawful processing and against accidental loss, destruction or damage.

We will comply with all obligations imposed on data importers under the GDPR and the Data Protection Act 2018 (UK) with respect to the personal data of EU and UK residents, including the Standard Contractual Clauses, to the extent that they may apply to us and our relationships with third parties.
EU and UK residents have the right to access personal data we hold about them and to request that personal data be corrected, updated, deleted or transferred to another organisation.

EU and UK residents are also able to request that the processing of their personal data be restricted or objected to their personal data being processed. To make any of these requests, please contact us according to section 14 below.

BCT will generally ensure that individuals are given access to their Personal Information that is held by BCT. BCT will generally only refuse to allow access if it is legally required or entitled to do so.

Under the Privacy Laws, individuals have the right to request correction of their Personal Information held about them. BCT will respond to a request for access to or correction of Personal Information as soon as reasonably practicable and, in any event, no later than 20 working days after BCT receives the request.

There is no fee for requesting a correction. No fee will be incurred for requesting access, but if your request for access is accepted, you will be notified of the fee payable (if any) for providing access if you choose to proceed with your access request.

A request for: access to Personal Information; to be removed from any further communications; further information about how BCT manages Personal Information; and/or for BCT to correct or update Personal Information, can be made by contacting BCT via:

• phone: + 61 2 4925 3022 (within business hours);
• letter: Privacy Officer, Breast Cancer Trials, PO Box 283, The Junction NSW 2291, AUSTRALIA
• email: privacy@bctrials.org.au

Individuals who have a question, or wish to complain about the management of their Personal Information, should also contact BCT via the above listed methods.

If you are not satisfied with how we deal with your question/complaint, including the outcome, you can lodge a complaint with either the Office of Australian Information Commissioner or the New Zealand Office of the Privacy Commissioner.

More information about your rights and our obligations in respect to privacy and information on making a privacy complaint are available from the Office of the Australian Information Commissioner at:

Website: www.oaic.gov.au
Post: GPO Box 5218, Sydney NSW 2001
Email: enquiries@oaic.gov.au