ALTAIRA PRIVACY POLICY

Document Name: Privacy Policy
Authorised by: Head of Corporate Compliance
Document Group: Policies
Version No: 8
Document Number: QMSP002
Issue Date: 18/08/2026

1. Overview

Altaira respects your right to privacy.

We are committed to managing your health information in a respectful way by adhering to Commonwealth and State privacy laws, including the Australian Privacy Principles (APPs) contained within the Commonwealth Privacy Act 1988.

The APPs set out the way in which organisations like Altaira can collect, use, disclose, store and provide access to personal information, which includes health information. This Policy sets out the way we will handle your personal information, consistent with the requirements of the APPs and State privacy laws.

2. Application

This Policy applies to all staff at Altaira as well as clients, service providers, contractors, website visitors, and anyone else whose personal data Altaira collects, including other businesses.

3. Collections

Altaira collects different types of information about you.

Personal Identifying Information

This includes information from which you may be identified, such as your:

  • name, address, contact details
  • your occupation, qualifications and certifications for the role
  • Information in the CV or resume, and details of referees
  • It may also include information required for billing purposes, such as your health fund and Medicare information

Health Information and other Sensitive Information

This is identifiable information that relates to your medical history, your reason for seeking treatment and may include records or results from other providers and records and results of the treatment provided Altaira.

Altaira may also collect information about you from affiliated healthcare professionals and contracted service providers such as hospitals and pathology.

Other sensitive information that Altaira collects includes Police Clearance, NDIS worker screening checks vaccination records and other medical records required under the relevant Aged Care legislation and per the Altaira Mandatory Checks Policy.

4. Use and disclosure of your personal information

Altaira collects and uses your Information for:

  • providing you with health care and health advice sharing where required with Doctors, nurses, and affiliated health care providers.

Please note Altaira’s allied health professionals must document that an appropriate consent process has taken place by a signed and dated entry in the client health record, indicating that the client gave consent to a program of management outlined by the health professional. Please refer to the Allied Health Privacy Consent Policy for further information.

  • to verify information you have provided us such as qualifications, registrations, screening clearances and other mandatory compliance requirements forming part of Altaira’s recruitment, onboarding and mandatory checks framework. Please refer to Altaira’s Mandatory Checks Policy for further information.
  • training, quality assurance and quality improvement activities.
  • related purposes including marketing or promotional campaigns and customer satisfaction surveys.

You may request not to receive any marketing or promotional information from Altaira at any time by contacting us using the details at the end of this document.

  • administrative and internal business purposes, including disclosure of employee information to Altaira clients. Where an Altaira client is a Registered Provider under the Aged Care Act, the client may require access to employee information to meet its legal obligations in delivering safe and high-quality aged care services.
  • complying with legal obligations, which may involve disclosure of identifying or de-identified information to external parties, including undertaking mandatory or voluntary disclosures to regulatory bodies.

5. Consent

Altaira must obtain Privacy Consent at or before the time of collection or use of disclosure of Personal Information from Individuals.

From time-to-time Altaira may request that individuals attend a photo or video shoot with the resulting content to be used for promotional purposes including on social media.

If you have consented to the use of your images/video footage for marketing or promotional purposes, you may also be given the option to consent to or decline AI-based editing, enhancement, or analysis of the content.

We will only use your images/video footage with AI tools in accordance with the specific consent you have provided.

This is set out in the Media Consent Form.

Marketing

Individuals may request not to receive marketing communications by contacting us, or by using the opt out function provided for in those communications.

If individuals do not opt out in either of these ways then the individual will be taken to have consented to receiving such communications from us.

6. Use of Artificial Intelligence (AI) and Automated Technologies

We may use technologies to support, enhance, or automate certain elements of our services, including content generation, data analysis, image processing, quality assurance, customer support, and operational efficiency. These technologies may include both internal tools and commercially or publicly available AI platforms provided by third-party vendors. We will only use your images/videos with AI tools in accordance with the specific consent you have provided. This is set out in the Media Consent Form.

Information Shared With or Processed by AI Tools or Automated Technologies

When using AI tools, we may provide certain types of information to these third-party services so they can generate outputs or assist us in delivering our services. This may include:

  • text-based information (such as enquiries, feedback, or documents you provide)
  • images or photographs (where you have given consent for their use) and
  • de-identified or anonymised data sets

How AI Tools or Automation May Use Your Information

Third-party AI tools may process your information to generate outputs such as summaries, classifications, translations, insights, or enhanced content.

7. Use of personal information collected through our Website or Marketing Channels

We will collect your personal information through our website. We may also collect information that may be considered personal information through third party cookies and pixels. We will take all reasonable steps to minimise the data collected by third party cookies and pixels, and will only use the information for a purpose identified in this Privacy Policy.

The primary purpose for which we collect your information on the Website is for administrative and internal business purposes related to the services we provide or may provide to you. Secondary purposes may include marketing and promotional activities.

Some third-party providers, including the AI tools, may store or process data overseas (most are US-based).

Cookies

Cookies are small files that are stored on your computer, tablet or mobile phone by a website which record your visit and collect statistical information.

Altaira uses cookies via our website to improve your browsing experience, track the number of website views and provide you with relevant information across our website and on third party sites including other websites and social media pages.

We use the information sourced from these cookies to help improve our website experience by creating more effective content and developing better user experiences.

Pixels and other tracking tools on Altaira website

Altaira sites currently runs tracking tools: Meta (Facebook) Pixel, TikTok Pixel, LinkedIn Insight Tag, and Google – Analytics, reCAPTCHA and the YouTube video player).

A consent banner is used to stop these firing until the visitor opts in. This tracking only runs if you accept it via the banner. Your choice can changed or withdrawn at any time.

Accepting “Marketing” means Altaira may show you ads on Facebook, TikTok or LinkedIn based on your visit, and how to opt out (via the banner selection).

Meta (Facebook) Pixel

Collects: pages visited, referring page, device and browser information, and a Meta cookie identifier that links the visit to the person’s Facebook/Instagram account if you have one.

Data goes to Meta Platforms and is used for ad measurement and retargeting (showing Altaira ads on Facebook/Instagram to past visitors).

TikTok Pixel — ID D6KGKCJC77U7OH6C2AKG

Collects: pages visited, device/browser information, and a TikTok identifier. Data goes to TikTok and is used for ad measurement and retargeting.

LinkedIn Insight Tag — Partner ID 8958388

Fires on every page.

Collects: pages visited (including job and career pages), IP address, device/browser information, and links the visit to the person’s LinkedIn profile if logged in. Data goes to LinkedIn and is used for ad analytics and retargeting.

Google

Three components:

  1. Google Analytics — collects pages visited, session behaviour, and device information for site analytics;
  2. reCAPTCHA — loads on all pages to protect the contact form, collects device/interaction signals to distinguish humans from bots;
  3. YouTube video player on the homepage — sets YouTube/Google cookies when the page loads.

All three send data to Google.

Altaira Allied Health site also runs Google Ads conversion tracking and a Birdeye reviews widget, both of which share data with third parties.

All platforms store data on servers outside Australia (US and elsewhere).

8. Quality and security of your personal information

Altaira takes all reasonable steps to ensure that the personal information we collect is accurate, up-to-date and complete.

These steps include maintaining and updating your personal information when you advise us of any changes to your personal information.

Altaira takes all reasonable steps to ensure your personal information is protected against misuse, interference and loss, and unauthorised access, modification or disclosure.

Electronic records are stored in data centres and the data backups stored with cloud providers with facilities within the Australian territory.

Altaira uses anti-virus software Sophos on devices- some devices have US hosted version of Sophos.

We require all third party service providers to comply with the Privacy Act and impose, as far as possible, confidentiality and privacy obligations at least as demanding as those that apply to us.

Records are maintained for a minimum of 7 years.

When your personal information is no longer needed for any purpose, or required to be kept under law, Altaira will take reasonable steps to destroy the information or ensure that the information is de-identified. Any hard copy documents are stored securely and once digitally stored, destroyed through secure shredding storage bins.

9. Access and correction

Altaira will correct any personal information that is incorrect, out-of-date or incomplete. Any correction will maintain the original information, make note of your request to correct and the amendment.

You may request to access or correct your personal information by contacting humanresources@altaira.com.au.

When you request to access or correction of your personal information, we will respond to your request within a reasonable time (usually within 30 days).

We will allow you to access or correct your information unless there is a sound reason under the Privacy Act or other relevant law not to do so, such as where giving access to the information would involve an unreasonable interference in the privacy of another person or pose a serious threat to the life, health or safety of an individual or to public health or safety.

If we refuse your request for access or correction, we will provide you with written reasons for the refusal, and how you may dispute the decision.

Where we have corrected your personal information, and the correction is relevant to third parties that have previously received your information, we will act on your request to notify those third parties of the correction, unless it would be impracticable or unlawful.

10. Complaints

If you believe that there has been a breach of your privacy and would like to make a complaint, then you may contact our Privacy Officer using the contact details below, who will respond to you within a reasonable time (usually within 30 days).

If you do not wish to make a complaint directly to Altaira, then you may contact the Office of the Australian Information Commissioner (OAIC) or the relevant privacy complaint handling body where you live.

If you require access to or correction of your records, wish to make a complaint, wish to be removed from mailing lists, wish to stop receiving marketing or promotional materials, or need clarification about how we handle your personal information or any other information contained in this document, please contact us at humanresources@altaira.com.au.

11. Intellectual Property

All intellectual property developed by employees during their employment with, including discoveries or inventions made in the performance of their duties related in any way to the business of Altaira will remain the property of Altaira.

Employees may be given access to confidential information, data, business property, keys to premises or any other business related property/information in the performance of their duties. This must be protected and used only in the interests of Altaira.

Employees must not:

  • disclose or use any part of any confidential information outside of the performance of their duties and in the interests of Altaira;
  • authorise or be involved in the improper use or disclosure of confidential information; or
  • during or after their employment without the Employer’s written consent, other than as required by law.

‘Confidential information’ includes any information in any form relating to Altaira’s business functions, and related bodies, clients or businesses, which are not in the public domain.

Employees must act in good faith towards Altaira and must prevent (or if impractical, report) the unauthorised disclosure of any confidential information.

Failure to comply with this policy may result in performance improvement proceedings including dismissal, and Altaira may also pursue monetary damages or other remedies.