Privacy and Information Handling Policy

1. Purpose

Riding for the Disabled Association of Victoria Inc (RDAV) collects and holds personal information about participants, families, carers, volunteers, coaches, staff, horse owners, donors, supporters and other people connected with RDAV.

Some of this information is sensitive, including information about disability, health, medications, support requirements, children, incidents, complaints and safeguarding matters.

This policy sets out how RDAV collects, uses, stores, shares, protects, provides access to and disposes of personal and health information.

RDAV will collect only the information it reasonably needs and will handle that information respectfully, securely and for legitimate RDAV purposes.

2. Privacy framework

RDAV handles health and disability information in accordance with the Health Records Act 2001 (Vic) and the Health Privacy Principles. The Victorian legislation applies to health information and to personal information collected in providing disability services.

Where the Privacy Act 1988 (Cth) and Australian Privacy Principles apply to RDAV, RDAV will comply with those requirements. RDAV will use the Australian Privacy Principles as its general organisational standard for handling personal information even where a particular activity may not be directly covered by them. Not-for-profit organisations can be covered by the Privacy Act because of their turnover or particular activities, including providing a health service.

Other laws may also require RDAV to collect, retain, use or disclose information, including child safety, safeguarding, employment, occupational health and safety, taxation and insurance requirements.

3. Scope

This policy applies to:

• the RDAV Board and committees;
• State Office;
• RDAV centres;
• staff;
• coaches;
• volunteers;
• contractors and consultants;
• service providers handling information for RDAV; and
• anyone given access to RDAV information or systems.

It applies to information held in RDAV’s CRM, website, online forms, email, finance and payroll systems, document systems, centre records, paper records, photographs, video, incident and complaint records and other approved RDAV systems.

4. RDAV’s approach

RDAV will:

• collect only information reasonably required for its work;
• explain why information is being collected and how it may be used;
• obtain consent where required;
• take additional care with health, disability, child safety and other sensitive information;
• restrict access according to role and operational need;
• take reasonable steps to keep information accurate and current;
• protect information against loss, misuse and unauthorised access or disclosure;
• not sell personal information;
• not use information for unrelated purposes unless authorised or permitted by law;
• provide appropriate access and correction processes;
• respond promptly to privacy and data breaches;
• retain information only for as long as required;
• maintain a register of the systems, paper documents and providers that hold personal information for RDAV including the country on where that information is stored; and
• consider privacy when designing systems, forms and processes.

Information will not be collected simply because a form, database or CRM provides a field in which it could be stored.

5. Information RDAV collects

The information RDAV collects depends on a person’s relationship with RDAV.

5.1 Participants

RDAV may collect:

• name and contact information;
• date of birth;
• parent, guardian, carer and emergency contact information;
• disability and relevant health information;
• medications, allergies and emergency health information;
• mobility and physical support requirements;
• communication and sensory needs;
• behavioural or emotional support information relevant to participation;
• participation goals and preferences;
• height and weight where relevant to safety and horse welfare;
• participant assessment and rider-horse matching information;
• attendance records;
• incident and injury information;
• consent information;
• billing or NDIS-related information where relevant;
• complaints and feedback; and
• photographs or video where appropriate consent has been provided.

RDAV does not require a participant’s complete medical history simply because they have a disability.

Information attained or held by RDAV in respect to participants is only done so in so far as it relates to what RDAV reasonably needs to know to support the participant, make appropriate adjustments, manage safety and provide RDAV activities.

5.2 Children and young people

Information about children and young people must be handled with particular care.

Information may be provided by a parent, guardian, school, support worker, health professional or another authorised person.

Children and young people should be involved in decisions about their information in a way appropriate to their age, understanding and communication needs.

5.3 Volunteers and coaches

RDAV may collect:

• contact and emergency information;
• Working with Children Check and screening information;
• centre and role;
• induction and training records;
• qualifications;
• safeguarding and first aid records;
• coaching qualifications and accreditation;
• renewal and centre designation information;
• attendance;
• relevant safety information;
• complaints, incidents or conduct information; and
• declarations and acknowledgements.

5.4 Staff and contractors

RDAV may collect information required to manage employment or engagement, including contact, payroll, taxation, superannuation, qualification, screening, emergency, performance, health and workplace information.

5.5 Donors, supporters and partners

RDAV may collect contact details, donation and transaction history, communication preferences, relationship history, event attendance, correspondence and information required for receipts, grants, sponsorships and partnerships.

RDAV will not sell or rent donor or supporter information to another organisation for marketing.

5.6 Horse owners and equine contacts

RDAV may collect owner contact details, property information, agreements, veterinary contacts, emergency decision-maker information, insurance information and other information required to manage horses used in RDAV programs.

6. How information is collected

RDAV will usually collect information directly from the person concerned or their authorised representative.

Information may be collected through:

• the RDAV website and online forms;
• participant registration and assessment;
• volunteer registration and onboarding;
• coach registration and renewal;
• RDAV’s CRM;
• telephone and email;
• centre activities;
• paper forms;
• incidents, complaints and feedback;
• horse forms and agreements;
• employment processes;
• events and fundraising; and
• approved integrations between RDAV systems.

Information may also be obtained from a parent, guardian, carer, health practitioner, school, disability provider, RDAV centre, referee, emergency service, insurer, regulator or other authorised source where reasonably necessary.

Appropriate privacy collection notices are included in forms and collection processes where required.

7. Health, disability and sensitive information

RDAV will only collect health or sensitive information reasonably required for:

• safe participation;
• appropriate support;
• reasonable adjustment;
• emergency response;
• rider-horse matching;
• volunteer or worker safety;
• safeguarding;
• legal requirements; or
• another legitimate RDAV purpose.

Access will be based on operational need.

A coach may, for example, need to know about a participant’s seizure risk, mobility requirements or communication needs. This does not mean the coach or other volunteers require access to unrelated medical information.

Information about disability should be used to understand what support, communication and adjustments are required rather than simply recording a diagnosis.

Information about disability, health, weight, behaviour, personal care or support needs must be handled discreetly.

8. Rider weight information

RDAV may collect rider weight where required for horse welfare, carrying-capacity assessment and rider-horse matching.

Weight information:

• is collected for safety and horse-welfare purposes;
• must be kept confidential;
• must not be publicly displayed or discussed unnecessarily;
• should only be available to people who require it for their role; and
• must be handled respectfully.

Where weighing is required, it must be undertaken privately.

9. How information is used

RDAV may use personal information for:

• providing RDAV activities;
• participant assessment and support;
• reasonable adjustments;
• waiting-list management;
• rider-horse matching;
• horse welfare and safety;
• volunteer allocation;
• coaching;
• emergency planning and response;
• incident management;
• safeguarding and child safety;
• complaints;
• volunteer and coach management;
• training and compliance;
• centre administration;
• insurance and claims;
• billing and finance;
• fundraising and communications;
• evaluation and improvement;
• governance and risk management; and
• legal and regulatory compliance.

Information must not be used for a materially different purpose merely because it is available within an RDAV system.

10. Disclosure of information

RDAV may disclose information where reasonably necessary and authorised to:

• relevant RDAV staff, centres, coaches or authorised volunteers;
• parents, guardians or authorised representatives;
• health practitioners and emergency services;
• insurers and professional advisers;
• technology and information-system providers;
• government agencies and regulators;
• police or other law-enforcement agencies;
• safeguarding bodies; or
• another person or organisation authorised by the individual.

Only the information reasonably required for the purpose should be disclosed.

Privacy must not be used as a reason to ignore or conceal a genuine child-safety or safeguarding concern. Information may be disclosed where required or authorised by law or otherwise lawfully necessary to protect a child, participant or another person.

11. CRM and digital information

RDAV is progressively establishing its CRM as the primary organisational record for participants, volunteers, coaches, centres, donors and other relationships managed through the system.

RDAV will apply the following requirements to its CRM and related digital systems:

• access will be based on role and operational need;
• centre users should ordinarily have access only to information relevant to their centre and role;
• health, disability, complaint and safeguarding information will have appropriately restricted access;
• access will be removed or changed when a person’s role changes or ends;
• website forms and other systems should feed into the central record where practicable rather than creating unnecessary duplicate records;
• exports containing personal information must be limited to legitimate purposes and stored securely;
• identifiable sensitive information should not ordinarily be used in testing or training systems;
• new integrations must be approved before personal information is exchanged with another system; and
• significant new CRM modules or systems involving sensitive information must be reviewed for privacy impacts before implementation.

Centres must not establish unnecessary parallel databases where information can be managed through an approved RDAV system.

Personal email accounts, personal cloud storage and privately maintained spreadsheets must not become permanent repositories for sensitive RDAV information.

The Australian Privacy Principles require organisations covered by them to explain how personal information is collected and held, including the use of third-party storage arrangements, but do not require the public privacy policy to contain every internal system control.

12. Automation and artificial intelligence

RDAV may use automated processes for routine administration, including reminders, renewals, communications, form processing and identifying incomplete records.

Decisions about participant suitability, rider-horse matching, safeguarding, complaints, disciplinary matters, volunteer suitability and coach approval or suspension will not be made solely by an automated system.

Sensitive participant, health, child-safety, complaint or safeguarding information must not be entered into an AI system that has not been approved by RDAV for that purpose.

Where RDAV introduces computer-based decision-making that could significantly affect a person’s rights or interests, the privacy implications must be reviewed before implementation. Where RDAV uses automated processes in decisions that could significantly affect a person's rights or interests, RDAV will ensure appropriate human oversight and comply with applicable privacy requirements.

13. Security and storage

RDAV will take reasonable steps to protect personal information from loss, misuse, unauthorised access, modification or disclosure. Victorian privacy requirements similarly require reasonable protection of health information.

Controls may include:

• role-based access;
• passwords and multi-factor authentication;
• approved systems and devices;
• secure storage;
• access reviews;
• staff and volunteer training;
• backups;
• audit information where available; and
• secure disposal.

RDAV may use third-party providers for CRM, website hosting, email, finance, payroll, document storage, communications, donations and other operational functions.

RDAV will take reasonable steps to ensure providers handling personal information have appropriate privacy and security arrangements.

14. Overseas storage and processing

Some technology providers or their service providers may store, access or process personal information outside Australia.

Where reasonably practicable, RDAV will prefer Australian hosting for core systems containing sensitive information and will consider overseas processing when approving material providers and integrations.

Where RDAV is likely to disclose personal information to overseas recipients, it will identify the likely countries in this policy where practicable, as required under the Australian Privacy Principles where those principles apply.

15. Photography and communications

Consent to participate in RDAV is not automatically consent to public photography, video or media use.

Photography and video involving identifiable participants will be managed through appropriate consent arrangements. Photography or video of a child requires the consent of a parent or legal guardian and, where the child is able to express a view, the agreement of the child. RDAV will not use an image or recording in a way that identifies a participant’s disability, diagnosis or support needs without specific consent to that use.

People may withdraw consent for future use. A person may withdraw consent at any time. Withdrawal applies to future use. RDAV will make reasonable efforts to remove existing material from RDAV channels where practicable.

RDAV may communicate with participants, volunteers, coaches, donors, supporters and others with whom it has a relationship.

People may ask to stop receiving promotional or fundraising communications. Operational communications necessary for participation, safety, volunteering, coaching or compliance are separate from promotional communications.

16. Accuracy, access and correction

RDAV will take reasonable steps to keep personal information accurate and current.

Participants, families, volunteers, coaches and others should advise RDAV when relevant information changes.

A person may request access to personal information RDAV holds about them and may ask for inaccurate or outdated information to be corrected.

The Health Records Act provides individuals with rights of access to health information held by Victorian private-sector organisations, subject to permitted exceptions.

RDAV may require reasonable proof of identity or authority before providing access.

Requests should be made to the contact listed in section 19.

17. Retention and destruction

RDAV will retain information for periods required by law, insurance, safeguarding, employment, financial, governance and legitimate operational requirements.

A Records Management and Retention Procedure will set the retention periods for major categories of RDAV records.

When information is no longer required and there is no reason or obligation to retain it, RDAV will securely destroy or permanently de-identify it where appropriate.

18. Data breaches

Any suspected loss, unauthorised access, disclosure or misuse of personal information must be reported promptly to RDAV State Office.

RDAV will:

• contain the incident;
• determine what information and people are affected;
• assess the risk of harm;
• take action to reduce further harm;
• notify insurers, regulators or affected people where required;
• record the incident; and
• review and improve relevant controls.

For entities covered by the Commonwealth Notifiable Data Breaches scheme, breaches likely to cause serious harm may require notification to affected individuals and the Australian Information Commissioner.

Detailed requirements will be contained in the RDAV Data Breach Response Procedure.

19. Privacy concerns and complaints

A person who has concerns about RDAV’s handling of their information may contact:

Riding for the Disabled Association of Victoria Inc
400 Epsom Road
Flemington Victoria 3031

Email: privacy@rdav.org.au
Telephone: 03 9258 4730

RDAV will acknowledge, review and respond to privacy concerns fairly and promptly.

A person will not be disadvantaged in their participation, volunteering or other relationship with RDAV because they have raised a privacy concern in good faith.

Where appropriate, RDAV will provide information about external complaint avenues, including the Victorian Health Complaints Commissioner for matters within its jurisdiction and the Office of the Australian Information Commissioner where the Privacy Act applies. The Health Complaints Commissioner handles complaints concerning breaches of the Victorian Health Records Act and Health Privacy Principles.

20. Responsibilities

The Board approves this policy and oversees material privacy and information risks.

The Chief Executive Officer is responsible for implementation, information-system governance, significant privacy matters and escalation of material incidents. The CEO is required to report breaches to the board in accordance with the organisational procedures on this matter.

State Office administers approved systems, manages access, maintains central records, supports centres and manages privacy requests and incidents.

Centres are responsible for protecting information held locally, using approved systems, limiting access and reporting privacy concerns or incidents.

Staff, coaches and volunteers must only access information required for their role, maintain confidentiality and report suspected loss, misuse or unauthorised disclosure.

Access to RDAV information is provided because it is required for an RDAV role. It is not a personal entitlement.

21. Training

Privacy and information handling will form part of relevant staff, volunteer, coach, centre and CRM-user induction.

People with access to sensitive information must understand what they may access, why they may access it and what must remain confidential.

22. Review

This policy will be reviewed every two years or earlier where:

• relevant law changes;
• RDAV introduces a significant new information system;
• CRM, automation or AI arrangements change materially;
• RDAV’s regulatory status changes;
• a significant privacy or data breach occurs;
• a complaint identifies a material weakness;
• the Audit and Risk Committee recommends review; or
• the Board directs review.