Privacy Statement

Evia Health is committed to protecting the privacy of an individual's personal information. The following sets out how we aim to protect the privacy of your personal information, your rights in relation to your personal information managed by us, and the way we collect, use and disclose your personal information.

In handling your personal information, we will comply with the Privacy Act 1988 (Cth) (Privacy Act) and with the thirteen Australian Privacy Principles in the Privacy Act.

We have policies and procedures in place to ensure that:

• personal information is managed in an open and transparent way
• the privacy of personal information of participants and staff are protected
• we collect and handle personal information fairly
• personal information we collect is used and disclosed for legally permitted purposes only
• we regulate access to and correction of personal information
• we maintain the confidentiality of personal information through appropriate storage and security.

The kinds of information we collect

Consumer personal information is collected to provide care and services. Personal information we collect could include your:

• name, address, telephone number and email address
• date of birth
• gender
• advocate or emergency contact's telephone number and email
• health information
• diversity status (ethnicity, lifestyle preferences).

Information collected through our website

When you visit our website or submit a form through our website (such as an enquiry or referral form), we may collect:

• your name, email address, telephone number, and the content of your message
• the type of enquiry or referral you are making
• technical information such as your browser type, operating system, and IP address, which may be collected automatically by our website hosting provider.

We use cookies and similar technologies on our website. Cookies are small files stored on your device that help our website function correctly. You may choose to disable cookies by adjusting the privacy settings in your browser, but this may affect your experience on our website.

How we collect personal information

Participant personal information may be collected from:

• you, the participant
• your family members or significant others
• your advocate
• your doctor or other service providers or facilities
• our website, when you submit an enquiry or referral form.

We will collect personal information directly from you unless:

• we have your consent to collect the information from someone else
• we are required or authorised by law to collect the information from someone else
• it is unreasonable or impractical to do so.

You can withdraw your consent at any time by contacting us; although you should be advised that this may impact on our capacity to provide services.

Purpose of collecting personal information

Personal information is collected for the purposes of providing care and services. The information may be used to:

• provide support services
• enable service providers and medical practitioners to provide care and services
• respond to enquiries or referral requests submitted through our website
• communicate with you about our services.

Disclosure of personal information

We may disclose your personal and health information, for the purpose of your care and services, to:

• service providers who assist us in providing care and services, medical practitioners, external health agencies such as the ambulance service, hospitals, the National Disability Insurance Scheme, and other relevant government organisations
• a person you have nominated as being your advocate, e.g. parent, child or sibling, spouse, a relative, a member of your household, a guardian, an enduring power of attorney, or a person you have nominated to be contacted in case of emergency, provided they are at least 18 years of age.

We may not use or disclose personal information for a purpose other than providing care and services, unless:

• you have consented
• the purpose is related to providing care and services, and you would reasonably expect disclosure of the information for that purpose
• we believe on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to your life, health or safety or a serious threat to public health or public safety
• we have reason to suspect unlawful activity and disclosure is required or authorised by law.

Third-party service providers

We use trusted third-party service providers to support the operation of our website and communications. These providers may have access to personal information you submit through our website in the course of providing their services to us. This includes providers of website hosting, form processing, and email notification services.

We take reasonable steps to ensure that our third-party service providers handle your personal information in accordance with the Australian Privacy Principles and do not use your personal information for any purpose other than providing services to us.

Disclosure of personal information to overseas recipients

Our website is hosted by a third-party service provider based outside Australia. As a result, personal information you submit through our website (such as enquiry or referral form data) may be processed or temporarily stored on servers located outside Australia, including in the United States.

Before disclosing any personal information to an overseas recipient, we take reasonable steps to ensure that your personal information is protected to a standard comparable to the protections afforded under Australian privacy law. Our overseas service providers are bound by contractual obligations regarding the handling, security, and confidentiality of personal information.

By submitting personal information through our website, you consent to the transfer of that personal information to overseas recipients in accordance with this Privacy Statement.

Personal information collected and managed directly by Evia Health for the purpose of providing care and services (such as health records and participant files) is stored in Australia and is not disclosed to overseas recipients unless otherwise stated above.

Security of personal information

We take all reasonable steps to ensure that the personal information we hold is protected against misuse, loss, unauthorised access, modification or disclosure. We hold personal information in both hard copy and electronic forms in secure databases on secure premises and on secure, cloud-based technology, accessible only by our authorised staff.

Our third-party service providers are required to maintain appropriate security measures to protect any personal information they process on our behalf. However, no method of transmission over the Internet, or method of electronic storage, is completely secure. While we use reasonable efforts to protect your personal information, we cannot guarantee its absolute security.

Accessing the personal information that we hold about you

Under the Privacy Act, you have a right to access your personal information that is collected and held by us. If at any time you would like to access or change the personal information that we hold about you, or you would like more information on our approach to privacy, please contact us.

To obtain access to your personal information, you will have to provide us with proof of identity. We will take all reasonable steps to provide access to your personal information within seven (7) days from your request.

Data retention

We will retain your personal information only for as long as is necessary for the purposes for which it was collected, or as required by law. When personal information is no longer needed, we will take reasonable steps to destroy or de-identify it.

Personal information submitted through our website (such as enquiry and referral forms) is retained by our website hosting provider in accordance with their data retention policies and may be deleted by us once the enquiry or referral has been actioned.

Employee information

Records of current and past employees which are related to the employment relationship are managed in accordance with workplace laws. Privacy laws may apply to employee personal information if the information is used for something that is not related to the employment relationship between our organisation and the employee.

Volunteer records

Personal information collected and held by us in relation to our volunteers will be managed in accordance with the Privacy Act.

Privacy data breaches

In the event that your personal information is lost, stolen or subject to unauthorised access or disclosure, we will implement our Management of Data Breach Policy and Procedure. Where required under the Privacy Act, we will notify affected individuals and the Office of the Australian Information Commissioner of an eligible data breach.

Privacy complaints

All complaints regarding privacy can be lodged via our complaint handling process.

At all times, privacy complaints will:

• be treated seriously
• be dealt with as promptly as possible
• be dealt with in a confidential manner
• not affect your existing obligations or affect the commercial arrangements between you and us.

You will be informed of the outcome of your complaint following completion of the investigation.

Contact us

If you have any questions about this Privacy Statement, or you would like to make a request regarding your personal information, please contact us:

Email: feedback@eviahealth.com.au
Telephone: 0488 689 934

Changes to this Privacy Statement

We may update this Privacy Statement from time to time to reflect changes in our practices or legal requirements. The updated statement will be made available on our website. We encourage you to review this Privacy Statement periodically.

Last updated: February 2026