Rocky Bay Limited Privacy Policy
Retained Information

Rocky Bay Limited shall collect personal information (including sensitive information) about clients, donors, potential donors and staff that is required in order to conduct the business of the organisation. This may include, though not be limited to, name, contact details, medical history, treatment case notes, next of kin, carers/guardians, places of education, date of birth, health identifiers, personal situation, nature of disability and, funding. This information will only be collected with the consent of the individual.

This information and process shall also be mindful of the Disability Services Act and Health & Disability Services (Complaints) Act guiding principles to show appropriate respect for the privacy and dignity of persons receiving care.

Personally identifiable information shall be held in a combination of paper copies and within electronic systems, as is most appropriate to operations. Systems shall have well managed security access policies relevant to individual staff roles.

Accessing Personal Information

Personally identifiable information shall only be provided to the individual to which the information relates or their legal guardian. Rocky Bay Limited reserves the right to deny access to information held about an individual in the following circumstances:

  1. a) Where disclosure may present a threat to health or safety of any individual or public health or safety
    b) Where disclosure may unreasonably impact upon privacy of others
    c) Where disclosure relates to pending or existing legal action between Rocky Bay Limited and the individual
    d) Where disclosure may reveal commercially sensitive information
    e) Where disclosure to specific information is unlawful or would prejudice enforcement proceedings

A register will be maintained that documents all circumstances where disclosure has been made under this section of the Policy.

Third Party Disclosure

Rocky Bay Limited will never disclose personally identifiable information to any third party, either locally or overseas, for any purposes other than the following:

  1. a) Required by law to disclose information to a government agency
    b) Required by the courts to disclose information
    c) Agreed by Rocky Bay Limited and with the consent of the individual to disclose information to a third party
    d) Where the information is otherwise publicly available

A register will be maintained that documents all circumstances where disclosure has been made under this section of the Policy.

Direct Marketing

Rocky Bay Limited will not use personal or sensitive information about an individual for the purposes of direct marketing without the prior knowledge of the individual.
At any point individuals will always be able to opt-out of receiving direct marketing materials. Contact Rocky Bay Limited to change your user preferences.

Correction of Information

Rocky Bay Limited may at any time determine to amend personal information where it has been identified as being incorrect.

The individual or legal guardian may request that changes are made to their personal information if it is considered incorrect or misleading. To do so, please contact our Customer Engagement Team by Phone – (08) 6282 1900 or Email –

In the event Rocky Bay Limited chooses not to amend the information as requested it will always provide the requester with reasons for the refusal. In this event the requester may thereafter request that a statement regarding the correction be appended to the record.

Where corrections are made to held information Rocky Bay Limited will take all reasonable steps to notify any relevant third parties of such corrections, within the bounds of Third Party Disclosure section of this policy.

Privacy Complaints

All complaints regarding a breach of the Australian Privacy Principles or this policy should be submitted.

Complaints can be lodged at no cost to the complainant.

Submit your feedback

Data breach /Unauthorised access

In the event of a data breach/unauthorised access to personal and sensitive information, that is likely to result in serious harm to the individual, Rocky Bay Limited will notify affected individuals promptly either directly via telephone, SMS or email. Where it is not practicable to notify individuals or Rocky Bay Limited is unable to successfully contact individuals, a copy of the data breach statement, sent to the OIAC, will be published on the Rocky Bay Limited website.

Updated March 2021

In regards to matters of privacy Rocky Bay Limited shall primarily follow the Australian Privacy Principles outlined within the Privacy Act 1988 and subsequent amendments. This will ensure best practice in the collection, storage and disclosure of personally identifiable information held by the organisation.