Medical Directions Privacy Policy: the legal stuff

1. Introduction

Medical Directions respects your right to privacy and is committed to safeguarding the privacy and confidentiality of the personal information we collect from our candidates, clients and website visitors.

This policy sets out how we collect and treat your personal information. We adhere to the Australian Privacy Principles contained in the Privacy Act 1988 (Cth), and the 13 Privacy Principles (NZ IPPs) in the New Zealand Privacy Act 2020 and to the extent applicable, the EU General Data Protection Regulation (GDPR).

Medical Directions will only collect information that is reasonably necessary for the performance of our business activities and functions as a recruitment agency, and none of the information collated will be used for unlawful discrimination. During the course of your interaction with Medical Directions, you may provide us with unsolicited information, we will take reasonable steps to ensure information is purged from our systems as long as it is not required for the performance of our business activities and functions as a recruitment agency.

 

2. Information Collection

As a recruitment business, it is essential that we collect personal information, which will be gathered at the point at which you have registered with Medical Directions via our website or by contacting us via email or by phone.

Types of information we collect and hold:

The type of personal information that we collect, and hold is information that is reasonably necessary for the proper performance of our functions and activities as a medical recruitment agency (see section 3 – ‘Purposes’) and is likely to differ depending on whether you are:

• A Worker - i.e. someone who is looking for a placement or work through us; or whom we have identified as a person who might be receptive to an offer of a placement or work through us;
• A Client - i.e. someone other than a Workseeker who is looking to acquire our services as a medical recruitment agency or whom we have identified as someone who might be interested in acquiring our services;
• A Referee - e. a person from whom we have sought facts or opinions regarding the suitability of one of our Workseekers for work or positions through us; and who may be a Referee nominated by the Workseeker, an Employer or us;
• Medical Directions Employee - i.e. a person who is paid to work for Medical Directions .

Sensitive information is only collected with consent and where it is necessary for the performance of our functions and activities as a medical recruitment agency. Sensitive information will need to be collected where it relates to a genuine occupational requirement or an inherent requirement of the job or work being considered.  Our collection of some types of sensitive information is also governed by equal opportunity and anti-discrimination laws.

When we collect personal information, we:

• Check that it is reasonably necessary for our functions or activities (see section 3 – ‘Purposes’) as a medical recruitment agency;
• Check that it is current, complete and accurate. This will sometimes mean that we cross-check the information that we collect from you with third parties (e.g. AHPRA, MCNZ);
• Record and hold your information in our Information Record System (see section 19 – ‘How your personal information is held’). Some information may be disclosed to overseas recipients but only if necessary, as part of our functions and activities as a medical recruitment agency (see section 22 – ‘Disclosures’);
• Retrieve your information when we need to use or disclose it for our functions and activities as a medical recruitment agency (see section 3 – ‘Purposes’). At that time, we check that it is current, complete, accurate and relevant. This will sometimes mean that we cross-check the information that we collect from you with third parties once again—especially if some time has passed since we last checked;
• Subject to some exceptions, we permit you to access your personal information in accordance with APP:12 of the APPs and Principle 6 of NZPP’s;
• Correct or attach associated statements to your personal information in accordance with APP:13 of the APPs and Principle 7 of NZPP’s;
• Destroy or de-identify your personal information when it is no longer needed for any purpose (see section 3 – ‘Purposes’) for which it may be used or disclosed provided that it is lawful for us to do so. We do not destroy or de-identify information that is contained in a Commonwealth Record. (See: https://www8.austlii.edu.au/cgi-bin/viewdoc/au/legis/cth/consol_act/aa198398/s3.html)
• We will not use government related identifiers for the purpose of identifying you unless this is required by law.

 

3. Purposes

3.1 For Workseekers

The type of information that we typically collect, and hold can range from personal to sensitive data, and will be requested as is necessary to assess suitability for work offers and work availability or to manage the performance in work obtained through us.

Including but not limited to:

• Personal information including contact details;
• Information about personality, character, skills, qualifications, work experience, work performance career path and preferences;
• Information submitted and obtained from Workseekers and other sources (e.g. Referees or Clients) in connection with applications for work;
• Tax file number, ABN, NZBN or any other relevant payrolling information for the purposes of invoicing Clients on a Workseekers behalf and for direct payment during/following placement with some Clients;
• Information required to undertake criminal history checks and obtain criminal history records;
• Information required to ascertain a Workseekers right to work in Australia i.e. confirmation of citizenship, residency or visa status;
• Health and immunisation records;
• Information about incidents in the workplace;
• Information submitted and obtained in relation to absences from work due to leave, illness or other causes.

Information that we collect, hold, use and disclose about you is typically used for:

• Work placement operations;
• Recruitment functions;
• Staff management;
• Payment purposes;
• Training needs assessments;
• Risk management;
• Work health and safety operations;
• Marketing services to you; but only where this is permitted and whilst you are registered with us;
• Statistical purposes and statutory compliance requirements.

How your personal information is collected:

Personal information will be collected from you directly when you fill out and submit one of our application forms or any other information in connection with your application to us for work. By providing us with personal information, you consent to the supply of that information subject to the terms of this Privacy Policy. Medical Directions Australia will use personal information only for the purposes that you consent to.

Personal information is also collected when:

• We receive or give any reference about you;
• We receive results of inquiries that we might make of your former employers, work colleagues, professional associations or registration body;
• We receive the results of any competency, psychometric, or medical test;
• We receive performance feedback (whether positive or negative);
• We receive any complaint from or about you in the workplace;
• We receive any information about a workplace accident in which you are involved;
• We receive any information about any insurance investigation, litigation, registration or professional disciplinary matter, criminal matter, inquest or inquiry in which you are involved;
• You provide us with any additional information about you.

We collect personal information about you from publicly available sources including newspapers, journals, directories, the internet and social media sites for inclusion in our records only as is reasonably necessary for the performance of our functions and activities as a medical recruitment agency and this information is managed in accordance with our Privacy Policy.

3.2. For Clients

The type of information that we typically collect and hold about Clients is information that is necessary to help us manage the presentation and delivery of our services and includes:

• Client relationship information;
• Information about position, contracting and hiring authority;
• Information about team structures and roles;
• Information about incidents in the workplace;
• Client facility addresses, key personnel and contact details;
• Information regarding current and predicted business levels (patient numbers etc.);
• Credit history checks;
• Company Financial.

Personal information that we collect, hold, use and disclose about Clients is typically used for:

• Client and business relationship management;
• Work placement operations;
• Recruitment functions;
• Training needs assessments;
• Risk management;
• Work health and safety operations;
• Marketing services to you;
• Statistical purposes and statutory compliance requirements.

Personal information about you may be collected:

• When you provide it to us for business or related social purposes;
• Electronically through our telecommunications and technology systems. See section 6 — ‘Electronic Transactions’.

We may also collect personal information about you from a range of publicly available sources including newspapers, journals, directories, the Internet and social media sites for inclusion in our records only as is reasonably necessary for the performance of our functions and activities as a medical recruitment agency and this information is managed in accordance with our Privacy Policy.

3.3 For Referees

The type of information that we typically collect and hold about Referees is information that is necessary to help to make determinations about the suitability of one of our Workseekers for particular jobs or particular types of work and may include:

• Information about work position, authority to give a reference and preferred contact details;
• Opinions of the Referee regarding the Workseeker’s character and work performance or work environment;
• Facts or evidence in support of those opinions, sometimes involving the Referee's own knowledge and experience of having worked with the Workseeker.

Personal information that we collect, hold, use and disclose about Referees is typically used for:

• Confirmation of identity and authority to provide references;
• Workseeker suitability assessment;
• Recruitment functions;
• Risk management.

3.4 For Medical Directions Employees

The Type of information we typically collect and hold about Medical Directions employees ranges from personal to sensitive and is used to perform the normal business functions of an employer. Information may include:

• Information submitted and obtained and other sources in your process of work application;
• Information about career path and preferences;
• Information about your work entitlements;
• Tax File Number, Bank Details and other relevant payrolling information for the purpose of making payment;
• Work performance information;
• Information about incidents in the workplace;
• Information submitted/obtained in relation to absences from work due to leave, illness or other causes.

 

4. Direct Marketing

We may use your personal information for the purposes of direct marketing except where you have specifically requested we don’t. Where it is practicable to do so, we will obtain your consent, and you will be provided with the option to unsubscribe from direct marketing at any time. When it is not practicable to obtain consent, you will be provided with the option to unsubscribe from direct marketing once communications are sent. We market to Candidates and Clients using a variety of methods including email, phone, SMS, and print.

We provide all Candidates and Clients the option to opt out of receiving marketing material from us. Upon receipt of this request their marketing preferences are updated on our systems. If you do not wish to have your personal information used for direct marketing purposes, you may contact your recruitment consultant or our Privacy Coordinator and request not to receive direct marketing communications from us, at which time your marketing preferences will be updated on our systems.

 

5. Photos and Images

We may request proof of identification from you including copies of your passport, visa and or driver’s license and will only do so for the performance of our functions and activities as a medical recruitment agency. 

 

6. Electronic Transactions

This section explains how we handle personal information collected from our website meddirections.com.au and by other technology in the course of electronic transactions.

It is important that you understand that there are risks associated with use of the Internet and you should take all appropriate steps to protect your personal information.  It might help you to look at the OAIC's resource on Privacy for individuals. 

It is important that you:

• Know your rights: read our privacy policy, collection statement and consent to electronic transactions;
• Be careful of the information you share on the Internet;
• Make sure your anti-virus and data protection software is up to date.

Please contact us by phone on +61 2 9357 2448 if you have concerns about making contact via the Internet.

Sometimes, we collect personal information that individuals choose to give us via online forms or by email. For example, when individuals:

• Ask to be on an email list such as a job notification list;
• Register as a site user to access facilities on our site such as a job notification board;
• Make a written online enquiry or email us through our website;
• Submit a resume by email or through our website;
• Make a job application to us through an external job board or website;
• Follow and communicate with us via social media such as LinkedIn, Facebook and Twitter.

 

7. Social Networks and Web Searches

In order to assess your suitability for positions and to assist you to find work, we will conduct background checking via social network media sites, Google, regulatory and immigration sites and medical registration boards, for the purposes of assessing suitability for representation by Medical Directions Australia.

 

8. Web Browsing

When you come to our website (meddirections.com.au), we may collect certain information such as browser type, operating system, website visited immediately before coming to our site, etc. This information is used in an aggregated manner to analyse how people use our site, such that we can improve our service.

 

9. Cookies

We may from time to time use cookies on our website. Cookies are very small files which a website uses to identify you when you come back to the site and to store details about your use of the site. Cookies are not malicious programs that access or damage your computer. Most web browsers automatically accept cookies but you can choose to reject cookies by changing your browser settings.

However, this may prevent you from taking full advantage of our website. Our website may from time to time use cookies to analyse website traffic and help us provide a better website visitor experience. In addition, cookies may be used to serve relevant ads to website visitors through third party services such as Google AdWords. These ads may appear on this website or other websites you visit.

 

10. Third party sites

Our site may from time to time have links to other websites not owned or controlled by us. These links are meant for your convenience only. Links to third party websites do not constitute sponsorship or endorsement or approval of these websites. Please be aware that Medical Directions Australia is not responsible for the privacy practises of other such websites. We encourage our users to be aware, when they leave our website, to read the privacy statements of each and every website that collects personal identifiable information.

When you look at our website, our website host makes a record of the visit and logs (in server logs) the following information for statistical purposes:

• Your server address;
• Your top-level domain name (for example .com, .gov, .org, .au, etc);
• The pages you accessed, and documents downloaded;
• The previous site you visited and;
• The type of browser being used.

We do not identify users or their browsing activities except, in the event of an investigation, where a law enforcement agency may exercise a warrant to inspect the Internet service provider's server logs.

We do not accept responsibility for the privacy policy of any other site to which our site has a hyperlink, and it is advisable to look at the privacy policy of other sites before disclosing personal information.

 

11. Web Bugs (Web Beacons)

If we use web bugs, we will display a clearly visible icon on the page. The icon will include the name of the company collecting information and will be labelled as a tracking device. The Web bug will be linked to a page disclosing what data is collected, how it is used, and which companies receive the data. Web visitors will be able to opt out of data collection by Web bugs. Web bugs will not be used to collect sensitive information.

 

12. Cloud Computing Services

In cases where we use cloud computing services, we will take reasonable steps to ensure that our Cloud computing services provider’s terms of service recognise that we are bound by obligations to protect the privacy of your personal information and that they will not do anything that would cause us to breach those obligations.

 

13. Emails

Our technology systems log emails received, sent, may include voting, read and receipt notifications to enable tracking. Our mass email technology systems also collect usage data such as receipts, bounce backs, open, open location and click-through rates and subsequent meddirections.com.au website actions.

When your email address is received by us because you send us a message, the email address will only be used or disclosed for the purpose for which you have provided it and it will not be added to a mailing list or used or disclosed for any other purpose without your consent other than as may be permitted or required by law.

 

14. Call and Message Logs

Our telephone technology (systems and mobile phones) logs telephone calls, messages received and sent and enables call number display, which may include your profile picture if you have provided it. When your call number is received by us because you phone us or send us a message, the number (and profile picture) will only be used or disclosed for the purpose for which you have provided it and it will not be added to a phone list or used or disclosed for any other purpose without your consent other than as may be permitted or required by law.

 

15. Teleconferences and Video Conferences

Teleconferences and video conferences may be recorded with your consent. In cases where it is proposed that they be recorded, we will tell you first the purpose for which they are to be used and retained.

 

16. Database

We use a recruiting database to log and record recruitment operations. This database contains the information and documentation you have provided us. This database operates from servers that permit disclosure to cross-border recipients. Your information will only be used or disclosed as reasonably necessary for the performance of our functions and activities as a recruitment agency.

 

17. Mobile Access

Our staff use laptops, tablets, phones and other portable electronic devices that allow them to access, retrieve and store your personal information. This is used for recruitment purposes and will only be used or disclosed for the purpose for which you have provided it.

 

18. Paperless Office

Recognising the environmental advantages and efficiencies it provides, we operate a partially paperless office as a result of which your paper-based communications with us may be digitised and retained in digital format. The paper-based communications may be culled.

It is therefore important that, except where specifically requested, you do not send us originals of any paper-based document and that you retain copies for your own records.  

Where we do request original paper-based documents, we will return them to you once they are no longer required by us for the purpose for which they may be used or disclosed.

 

19. How your Personal Information is held

Medical Directions Australia may disclose your personal information to any of our employees, officers, insurers, professional advisers, agents, suppliers or subcontractors insofar as reasonably necessary for the purposes set out in this privacy policy.

When your personal information is collected it will be held in our Information Record System until it is no longer needed for any purpose for which it may be used or disclosed, at which time it will be de-identified or destroyed provided that it is lawful for us to do so.

There are some inherent risks in the use of Internet communications and other technologies. It is important that you read the section on Electronic Transactions and Cross-Border Disclosure if you are using Internet Communications or other technologies to communicate with us.

 

20. General Data Protection Regulation (GDPR) for the European Union (EU)

Medical Directions Australia will comply with the principles of data protection set out in the GDPR for the purpose of fairness, transparency and lawful data collection and use.

• We process your personal information as a Processor and/or to the extent that we are a Controller as defined in the GDPR.
• We must establish a lawful basis for processing your personal information. The legal basis for which we collect your personal information depends on the data that we collect and how we use it.
  We will only collect your personal information with your express consent for a specific purpose and any data collected will be to the extent necessary and not excessive for its purpose. We will keep your data safe and secure.
• We will also process your personal information if it is necessary for our legitimate interests, or to fulfil a contractual or legal obligation.
• We process your personal information if it is necessary to protect your life or in a medical situation, it is necessary to carry out a public function, a task of public interest or if the function has a clear basis in law.
  We do not collect or process any personal information from you that is considered "Sensitive Personal Information" under the GDPR, such as personal information relating to your sexual orientation or ethnic origin unless we have obtained your explicit consent, or if it is being collected subject to and in accordance with the GDPR.
• You must not provide us with your personal information if you are under the age of 16 without the consent of your parent or someone who has parental authority for you. We do not knowingly collect or process the personal information of children.

Your rights under the GDPR

If you are an individual residing in the EU, you have certain rights as to how your personal information is obtained and used. Medical Directions Australia complies with your rights under the GDPR as to how your personal information is used and controlled if you are an individual residing in the EU except as otherwise provided in the GDPR, you have the following rights:  We may ask you to verify your identity before acting on any of your requests.

• To be informed how your personal information is being used;
• Access your personal information (we will provide you with a free copy of it);
• To correct your personal information if it is inaccurate or incomplete;
• To delete your personal information (also known as "the right to be forgotten");
• To restrict processing of your personal information;
• To retain and reuse your personal information for your own purposes;
• To object to your personal information being used; and
• To object against automated decision making and profiling

 

21. Information Security

We will take all reasonable steps to ensure the information you provide us remains secure and confidential and is only used for the performance of our activities or functions as a medical recruitment agency.  We take a range of measures to protect your personal information from misuse, interference and loss, unauthorised access, modification or disclosure. These measures include:

• Staff training;
• Password protection of cloud-based database and document storage system;
• "Clean desk" procedures;
• Secure office premises with restricted access;
• Need-to-know and authorisation policies;
• Policies on laptop, mobile phone and portable storage device security;
• Document naming protocols for sensitive information;
• Document culling procedures including shredding and secure disposal.

In the unlikely event that Medical Directions Australia experiences a breach in data security, affected parties will be notified in line with the requirements of the Privacy Amendment (Notifiable Data Breaches) Act 2017 and the Guidelines of the Privacy Commissioner, Te Mana Matapono Matatapu.

 

22. Disclosures

This section deals with our disclosure policies. Personal Information that we hold about you is only disclosed for the primary and related purposes for which it was collected. In this section you will find out about our policies dealing with:

• General Disclosures
• Related Purpose Disclosures
• Cross Border Disclosures

22.1 General Disclosures

We may disclose your personal information for any of the purposes for which it is primarily held or for a related purpose where lawfully permitted. We may disclose your personal information where we are under a legal duty to do so, including circumstances where we are under a contractual duty to disclose information. Disclosure will usually be:

• Internally and to our related entities;
• To our Clients;
• To Referees for suitability and screening purposes.

In addition to disclosures for general purposes, we may also disclose your personal information for a range of related purposes.

 22.2 Related Purpose Disclosures

We outsource a number of services to contracted service suppliers (CSPs) from time to time.  Our CSPs may see some of your personal information. 

Typically, our CSPs would include:

• Software solutions providers;
• T. contractors;
• Database designers and Internet service suppliers;
• Legal and other professional advisors;
• Insurance brokers, loss assessors and underwriters;
• Travel-booking agents;
• Background checking and screening agents.

We take reasonable steps to ensure that terms of service with our CSPs recognise that we are bound by obligations to protect the privacy of your personal information and that they will not do anything that would cause us to breach those obligations.

22.3 Cross-Border Disclosures

Information that we collect may from time to time be stored, processed in or transferred between parties or sites located in countries outside of Australia. These may include, but are not limited to Australia and New Zealand.

We and our other group companies have offices and/or facilities in Australia and New Zealand. Transfers to each of these countries will be protected by appropriate safeguards, these include one or more of the following: the use of standard data protection clauses adopted or approved by the European Commission which you can obtain from the European Commission Website; the use of binding corporate rules, a copy of which you can obtain from Medical Directions Australia's Data Protection Officer. Some of your personal information is likely to be disclosed to overseas recipients. 

The likely countries, type of information disclosed, and likely recipients are indicated, so far as is practicable, in the following table:

 

We will take such steps as are reasonable in the circumstances to ensure that the overseas recipient does not breach the Australian and New Zealand Privacy Principles. However, we cannot guarantee that any recipient of your personal information will protect it to the standard to which it ought to be protected. The costs and difficulties of enforcement of privacy rights in foreign jurisdictions and the impracticability of attempting to enforce such rights in some jurisdictions will mean that in some instances, we will need to seek your consent to disclosure.

 

23. Access, Correction, and Deletion

You have a right to access, correct and request deletion of personal information under the Australian Privacy Principles (APPs), the New Zealand Privacy Principles (NZPPs) and EU General Data Protection Regulation (GDPR) and to the extent applicable the EU GDPR. This section sets out our policy dealing with:

• Access
• Correction
• Deletion

23.1 Access

Subject to some exceptions that are set out in privacy law, you can gain access to the personal information that we hold about you.  Important exceptions include:

• Evaluative opinion material obtained confidentially in the course of our performing reference checks and access that would impact on the privacy rights of other people. We do refuse access if it would breach any confidentiality that attaches to that information or if it would interfere with the privacy rights of other people. In many cases evaluative material contained in references that we obtain will be collected under obligations of confidentiality that we make and which the communicator of that information is entitled to expect will be observed.
• If you wish to obtain access to your personal information you should contact our Privacy Coordinator on +61 2 9357 2448. You will need to be in a position to verify your identity. We might impose a moderate charge in providing access. Our Privacy Coordinator would discuss this with you. You should also anticipate that it may take a little time to process your application for access as there may be a need to retrieve information from storage and review information in order to determine what information may be provided. We will generally respond to your request for access within five (5) working days.
• If we refuse to give access to the personal information or to give access in the manner requested by you, we will give you a written notice that sets out:

               -  The reasons for the refusal except to the extent that, having regard to the grounds for the refusal, it would be unreasonable to do so, and

               -  The mechanisms available to complain about the refusal.

23.2 Correction

If you find that personal information that we hold about you is inaccurate, out of date, incomplete, irrelevant or misleading, you can ask us to correct it by contacting us on +61 2 9357 2448. We will take such steps as are reasonable in the circumstances to correct that information to ensure that, having regard to the purpose for which it is held, the information is accurate, up to date, complete, relevant and not misleading.

If we have disclosed personal information about you that is inaccurate, out of date, incomplete, irrelevant or misleading, you can ask us to notify the third parties to whom we made the disclosure and we will take such steps (if any) as are reasonable in the circumstances to give that notification unless it is impracticable or unlawful to do so.

You should also anticipate that it may take a little time to process your application for correction as there may be a need to retrieve information from storage and review information in order to determine what information may be corrected. We will generally respond to your request for access within five (5) working days. There is no charge to correct information.

In some cases, we may not agree that the information should be changed. If we refuse to correct your personal information as requested by you, we will give you a written notice that sets out:

• The reasons for the refusal except to the extent that it would be unreasonable to do so; and
• The mechanisms available to complain about the refusal.

You may also ask us to associate a statement that the information is contested as being inaccurate, out of date, incomplete, irrelevant or misleading and we will take such steps as are reasonable to do so.

23.3 Deletion

You have the right to request deletion of your personal information Please note, however, that we may need to retain certain information for record-keeping purposes, to complete transactions or to comply with our legal obligations. If you wish to request that your personal information be deleted, you should contact our Privacy Officer on +61 2 9357 2448. You will need to be in a position to verify your identity.

 

24. Complaints

You have a right to complain about our handling of your personal information if you believe that we have interfered with your privacy.

How to complain

If you are making a complaint about our handling of your personal information, it should first be made to us in writing. You can make complaints about our handling of your personal information to our Privacy Co-ordinator on +61 2 9357 2448 or [email protected] 

When we receive your complaint:

• We will take steps to confirm the authenticity of the complaint and the contact details provided to us to ensure that we are responding to you or to a person whom you have authorised to receive information about your complaint;
• Upon confirmation we will write to you to acknowledge receipt and to confirm that we are handling your complaint in accordance with our policy;
• We may ask for clarification of certain aspects of the complaint and for further detail;
• We will consider the complaint and may make inquiries of people who can assist us to established what has happened and why;
• We will require a reasonable time (usually 30 days) to respond;
• If the complaint can be resolved by procedures for access and correction, we will suggest these to you as possible solutions;
• If we believe that your complaint may be capable of some other solution, we will suggest that solution to you, on a confidential and without prejudice basis in our response.

If the complaint cannot be resolved by means that we propose in our response we will suggest that you take your complaint to the Recruitment and Consulting Services Association, Australia and New Zealand (RCSA) the industry association of which we are a member. RCSA administers a Code of Conduct for the professional and ethical conduct of its members.  The RCSA Code is supported by rules for the resolution of disputes involving members.

Complaints may also be referred to the Office of the Australian Information Commissioner and or New Zealand’s Privacy Commissioner, Te Mana Matapano Matatapu.

 

25. Future Changes

Medical Directions may update this policy considering future changes to privacy laws, technology and business practice. It is important that you check this policy regularly to ensure that you are aware of the extent of any consent, authorisation or permission you might give.

 

26. References and Related Documents

Australian Privacy Act (1988)

Australian Privacy Principles or APPs in the Privacy Act 1988

New Zealand Privacy Act (2020)

New Zealand Privacy Principles EU General Data Protection Regulation (GDPR)