SPP Privacy & Confidentiality Policy

1. Introduction and Purpose

Proveda is committed to protecting the privacy of our customers, service provider partners and their employees.

We adhere to the Privacy Act 1988 (Cth) including the Australian Privacy Principles, the Health Records and Information Privacy Act 2002 (NSW), and other privacy laws such as the requirements in aged care legislation.

The purpose of this privacy policy is to set out how we handle personal information in relation to our Service Provider Platform (SPP). This document should be read in conjunction with:

• the general privacy policy on our website: www.proveda.com.au

• the privacy policy on the integrated mobile App for care workers

• our ‘Service Agreement’ with you

• our Code of Conduct

2. Definitions

‘Personal information’ includes a broad range of information or an opinion that could identify an individual.

‘Sensitive information’ is a subset of ‘personal information’ that includes information or an opinion about specific matters (such as racial or ethnic origin, religious beliefs or affiliations and sexual orientation or practices) and also health information.

‘Service Provider Platform’ (SPP) means our digital platform which supports the effective delivery of services to Proveda customers by Proveda’s provider partners and their employees

SPP App means the mobile application (App) which is integrated with the SPP

‘You’ means the service provider who has registered or will register to use our SPP

‘Your employee(s)’ means the care workers you employ who deliver or will deliver services to Proveda customers (referred to as ‘sub-vendor’ in the SPP)

‘Us’ and ‘We’ means Proveda

3. Personal information we collect

The personal information we collect from you through the SPP is for the primary purpose of operating the platform and may include:

• Usernames and passwords

• Contact details such as physical address, email address, phone number and Internet Protocol (IP) address

• Financial information such as bank details for invoicing

• Employee names so that you can assign services to your employees

We may also collect sensitive information through the SPP about customers, such as health information, when you communicate with us via the ‘Communication’ tool.

4. How we hold personal information

Access to and use of the SPP1 is controlled by us and restricted to our provider partners who are registered as users of the SPP.

Proveda employees who have an operational need will access and use the SPP. Proveda employees are bound by our Code of Conduct and our internal policies and procedures, including our ‘Privacy and Confidentiality Policy’.

Pre-filled data about you and your employees has been migrated to the platform by us using information which was collected during the onboarding process of you as a provider partner. Once registration to use the SPP is approved, you are asked to set up your profile in the platform, which includes reviewing and updating the information.

Personal information held in connection with the SPP is stored in electronic format on servers in Australia.

Customer details and Care Plan information is stored outside the SPP in our internal customer management system (AlayaCare) and held on servers in Australia. The information is extracted from AlayaCare and is available to view and download through the SPP. Access to customer personal information, including Care Plans is controlled and can only be viewed by you and your relevant employee when we accept a service proposal on behalf of a customer, and the information is applicable to the type of service.

5. Purpose for which we collect, hold, use and disclose personal information

The personal information we collect, hold, use and disclose to offer the SPP to our provider partners and facilitate the delivery of quality care and services to our customers, is for the purposes of:

• confirming identity and ensuing that only authorised persons access and use the SPP;

• confirming identity and ensuring that only authorised persons access and use the App;

• providing a streamlined process to manage service requests and scheduling of visits for our customers

• making customer care plans available to our provider partners and their employees who deliver a service to our customers, where the information is needed and relevant to the service

• invoicing and billing

We may also use and disclose your personal information if there is a legal obligation or legitimate reason to do so (for example to respond to a request from the Aged Care Quality and Safety Commission).

We will retain your personal information for as long as needed, for the purpose for which the information was obtained.

6. Access to personal information and seeking correction to personal information

The SPP provides the facility for you to update your profile. We rely on the accuracy of the personal information provided to us about you and your employees and we ask that you review and maintain your profile and your employee details so that the information remains correct and up to date.

You also have the right to ask for access to personal information that we hold about you and you may ask that we correct that personal information.

If you wish to request access or seek correction, please contact the relevant Care Circle or write to our Privacy Officer (see section 9).

On receipt of a request, we will assess the nature and scope and endeavour to provide a response within 14 days. A longer period, not exceeding 30 days, may be required depending on the complexity of the request.

If we refuse a request for access or correction, we will provide the reasons in writing. You may also make a complaint if you are not satisfied with the outcome or how we have dealt with your request (see section 8).

7. Interacting with us anonymously

Where possible, we will allow you to communicate with us anonymously or using a pseudonym. For example, you may ask a general question without the need to identify yourself. However, in order for us to use your services or respond to a request, query or complaint fairly, efficiently, and in a meaningful way, we will usually need to verify identity before we can interact with you.

8. Complaints

If you wish to make a complaint about how we have handled your personal information, please write to the relevant Care Circle or to our Privacy Officer (see section 9).

On receipt of a complaint, we will undertake an investigation and determine what action we should take to resolve the complaint.

A response to a complaint will be provided as soon as possible and no later than 30 days of receipt.

While we hope to resolve any complaints without the need to involve third parties, if you are not satisfied with our response, the way in which it was handled by us, or you have an unresolved concern, you can make a complaint to the Office of the Australian information Commissioner (OAIC). The contact details are:

OAIC website: www.oaic.gov.au

OAIC’s Enquiries Line: 1300 363 992

9. Contact us

Proveda’s Privacy Officer can be contacted by:

Email: privacy@proveda.com.au | Phone: 1300 002 262

Letter: PO Box 195, Frenchs Forest, NSW, 1640

10. Updates to this policy

This policy may be updated from time to time to reflect changes in our practices, external complaint processes or when there is an amendment to privacy law.

When we make changes to this policy, we will publish the latest version on the SPP.

This policy was last updated on: 1 February 2024