Description and Scope

The Health Careers International (HCI) is committed to providing quality training and assessment in accordance with the Standards for Registered Training Organisations (SRTOs 2015). As such, HCI is required to comply with Federal law regarding Privacy and confidentiality of employees, clients and contractors. The purpose of this policy is to outline how HCI complies with the Privacy Act 1988 and the Australian Privacy Principles (APPs) 2014, in accordance with the Standards for Registered Training Organisations (SRTOs 2015) and the Higher Education Support Act 2003 and the VET Student Loan Act and Rule 2016.

HCI is bound by the Australian Privacy Principles (APPs) that have replaced the previous National Privacy Principles in the Privacy Act 1988 (Commonwealth) and the Higher Education Support Act 2003 (NPPs) for organisations from 12 March 2014 as well as other applicable laws and codes affecting the personal information that it collects from staff and students. HCI is committed to respecting the right to privacy and protecting the personal information of its staff and clients.

This Privacy Policy covers HCI’s treatment of personally identifiable information that HCI collects through any means as part of the provision of its services. This Privacy and Security Statement does not apply to the practices of companies that HCI does not own or control or to people that HCI does not employ or manage.

HCI Privacy Policy is technology neutral, applying equally to paper based and digital environments. This is intended to preserve the relevance and applicability, in a context of continually changing and emerging technology.

The updated policy is easily available for all staff and students on the Knowledge hub (KH).

2. Responsibility

The Chief Operation Officer (COO) has the overall responsibility of this policy.

3. Definitions

Personal Information: Information or an opinion (including information or an opinion forming part of a database), whether true or not, and whether recorded in a material form or not, about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion.

Student/s: refers to all persons enrolled in a unit of study who are, or would be, entitled to apply for a VET Student Loan under the VET Student Loan Act 2016 or FEE-HELP assistance under Clause 43 of Schedule 1A of the Act. and

Client: refers to student and also means a learner, enterprise or organisation that uses or purchases the services provided by the Health Careers International as defined by Standards for Registered Training Organisations 2015

Staff: All the present and past employees of the Health Careers International (HCI) group of companies including but not limited to HCI

4. Privacy Statements

4.1 Collection of Personal Information:

Personal information will not be collected unless:

  • the information is collected for a purpose directly related to students; and
  • the collection of the information is necessary for or directly related to that purpose.
  • the purpose for which the information is being collected;
  • if the collection of the information is authorised or required by law and
  • with whom the information may be shared (such as the Australian Government or Tuition Assurance Scheme).
  • the information collected is relevant to that purpose and is up to date and complete; and
  • the collection of the information does not infringe upon the personal affairs of the student in an unreasonable manner.

Personal information will not be collected by unlawful or unethical means.

Where personal information is collected for inclusion in a record or in a generally available publication, the Health Careers International will take all reasonable and practicable steps to ensure that, the student concerned is made aware of:

  • the purpose for which the information is being collected;
  • if the collection of the information is authorised or required by law and
  • with whom the information may be shared (such as the Australian Government or Tuition Assurance Scheme).

Where the Health Careers International solicits and collects personal information for inclusion in a record or in a generally available publication it will take reasonable steps to ensure that:

  • the information collected is relevant to that purpose and is up to date and complete; and
  • the collection of the information does not infringe upon the personal affairs of the student in an unreasonable manner

HCI is committed to comply with obligation under the Privacy Act 1988, and the associated Australian Privacy Principles (APPs), in the way it specifically collects, uses, secures and discloses personal information. HCI is committed to safeguarding any confidential information obtained by the RTO.

HCI will ensure that:

It maintains and provides a current Privacy Policy;

  • Information gathered for the express purpose of training and assessment matters will not be disclosed to a third party unless prior written consent is provided by the individual concerned, or in the case that it is required by law;
  • There is provision for the secure storage of all records;
  • All information maintained on records is held in strict confidentiality.
Anonymity and Pseudonymity

HCI respects and acknowledges the choice of anonymity and pseudonymity by individuals dealing with HCI. HCI provides opportunities for individuals to interact anonymously or by pseudonym with HCI where appropriate. For example of anonymous dealings may include an unidentified individual telephoning an RTO to make a general enquire about its courses or services.

Pseudonymity requires that an individual may contact an RTO and use a name, term or descriptor that is different from the person’s actual name. Examples may include an email address that does not contain the person’s actual name, and/or a user name that a person uses when participating in an online forum. Personal information should only be linked to a pseudonym if this is required or authorised by law.

Situations where it is impractical to implement Anonymity and/or Pseudonymity

While HCI acknowledges Anonymity and Pseudonymity as a privacy principle, there are instances where identification is necessary to proceed with a matter.

The following are examples where it may be impracticable to deal with an individual who has not disclosed their actual identity:

  • Dispute resolution: it would be impracticable to investigate and resolve an individual’s particular complaint about how their case was managed or follow up on a staff member’s behaviour unless the complainant provided their name, contact detail and other relevant information.
  • Personal information requests: in responding to an individual’s request for personal information, the RTO would require evidence of the person’s identity before proceeding with the enquiry; and
  • Eligibility for government subsidies or support: in responding to an individual’s course enquiry and potential government subsidy, the RTO may not be able to provide definitive information without knowing the potential applicant’s identity, education history and/or personal circumstances.

5. Underpinning Principles

Personal Information is defined in the Privacy Act 1988 as “information or an opinion about an identified individual, or an individual who is reasonably identifiable:

  • whether the information or opinion is true or not; and
  • whether the information or opinion is recorded in a material form or not”.

Sensitive Personal Information is defined in the Privacy Act 1988 as “information or an opinion about an individual’s” that is also personal information, such as:

  • racial or ethnic origin;
  • political opinions;
  • membership of a political association;
  • religious beliefs or affiliations;
  • philosophical beliefs;
  • membership of a professional or trade association;
  • membership of a trade union;
  • sexual orientation or practices; or
  • criminal record.
Information about students:

HCI collects personally identifiable information that students provide when they register or enrol for any educational courses or programs, when they use certain HCI online services or products, or when they enter promotions. The Institute’s preferred source of personal information is the individual concerned. However, HCI may also receive information from other sources such as other members of the Health Careers International Group.

Under the Freedom of Information Act, Vic 1982, the Health Careers International will permit a Student to apply for and receive a copy of their VET personal information that the provider holds on the student’s record.

Information about Staff:

HCI collects personal information from its staff which may be used for Selection, Appointment, Promotion, General Administration or Provision of Services to staff. The Institute’s preferred source of personal information is the individual concerned. However, HCI may also receive information from other sources such as

  • previous employers and referees nominated by prospective and current staff members;
  • academic assessors;
  • promotion and performance review assessments.

HCI takes all reasonable steps to ensure that information collected:

  • is necessary for the Institute’s purposes;
  • is relevant to the purpose of collection; and
  • is collected in a fair way, without unreasonable intrusion.
5.1 Release of information on staff employed by the Institute:

Personal and confidential information about individual staff members will not be released, without the staff members consent or request, to persons within or outside the Institute, except in circumstances required by law (e.g. income tax certificate).

Information about staff members employed by the Institute is considered confidential although some staff members may be identified publicly in publications such as hand books. The Institute is also required to comply with external authorities and submit general statistics about itself. These statistics do not specific identify individuals.

In certain circumstances relating to the employment of staff members, the Institute releases information to other organisations. For example, if a staff member of the Health Careers International resigns from their position to work for another organisation, it may be necessary to release information to the other organization, such as details of tha staff member’s study and long service leave credits and superannuation agreement. In such matters, the Institute will act as if it has the member’s consent unless informed to the contrary.

At the written request of a staff member, the Institute may release personal information to another organisation stating, for example, that the person is a staff member of the Institute, the position they occupy and the remuneration they receive.

5.2 Release of information about students of the Institute:

The Institute does not release personal information about any student without the student’s written consent. Information on a student’s individual file is only accessible to Institute staff whose official responsibilities involve them in student and student related matters.

Releasing confidential information (including units attempted, units passed, grades, address, and phone number) to anyone other than the student or authorised Institute personnel, or as part of legal reporting requirements to relevant and authorised authorities is strictly prohibited.

If a student wishes to have information released concerning their enrolment at HCI, they must:

  • Write and submit a signed and dated letter of request. The letter will be retained in the student’s file.
  • Each request will require a separate written authorization.
  • The Institute has the right to withhold a request if there is any financial debt to the Institute or any disciplinary action pending in relation to that student.

The Institute may receive telephone messages for a student (and thereby acknowledge the students enrolment) but no personal details are disclosed to any caller.


In some circumstances, HCI uses cookies to enhance the functionality of its website and offer improved services. A cookie is a packet of information that allows the server to identify and interact more effectively with computers using the website. HCI do not store any personal details using cookies. Users can configure their browser to accept all cookies, reject all cookies, or notify them when a cookie is sent by referring to their browser instructions. If users reject all cookies, they may be unable to use HCI web sites.

5.3 Sharing Information with Third Parties

Unless instructed otherwise, personal information may be shared with related companies within Institute of Health and Nursing (IHNA) where it will remain confidential. HCI does not collect or compile personally identifiable information for the dissemination or sale to outside parties for consumer marketing. It will only disclose information when:

  • Required by the regulators.
  • Required by the law.
  • The individual has consented to disclosing the information.
  • It is needed to share in order to provide the product or service that was requested.
  • In certain circumstances HCI may rely on outside contractors to carry out specialised activities on their behalf such as the mail out of HCI Information, or the dispatch of high volume Internet messages, (e-mail) or short messaging service (SMS).

These outside contractors act on behalf of HCI and do not operate their own personal agendas while processing personal information. At times personal information may be provided to these outside contractors to undertake the contracted task. All information remains the property of HCI at all times and the outside contractors are bound by specific confidentiality and non-disclosure agreements.

Where personal information is disclosed for the purposes of enforcement of the criminal law or of a law imposing a pecuniary penalty, or for the purpose of the protection of the public revenue, the record-keeper shall include in the record containing that information a note of the disclosure. This will be noted on staff/student file.

A person, body or agency to whom personal information is disclosed will not use or disclose the information for a purpose other than the purpose for which the information was given to the person, body or agency.

5.4 Storage and Security of Data

HCI takes the protection of customers, their information and their profile most seriously.

HCI adheres to strict industry procedures and professional standards of conduct for the operation of enrolments and online education systems. It utilises high-level security practices and employs multiple layers of security mechanisms to ensure that all data is protected and secure.

Health Careers International will ensure that:

  • all records are protected, by robust security safeguards that are reasonable in the circumstances to ensure against loss, unauthorised access, use, modification or disclosure, and against other misuse; and
  • if it is necessary for a record to be given to a person in connection with the provision of a service to a VET Provider, the Provider will take every reasonable precautions within its power to safeguard and prevent unauthorised use or disclosure of information contained in the record.
5.5 Collection of Personal Information for online payment

While registering or paying for a course through HCI’s website (, HCI will need to collect the credit card details (if paying by credit card) along with other personal information. This allows HCI to process and complete the enrolment.

HCI utilises the Bank of Melbourne Payway facility for the receipt and processing of all electronic card payments. HCI does not store any information about an individual’s credit card.

5.6 Access and Correction of Data
Access of data available with HCI

HCI acknowledges that as per the new APP 12, it is required to provide access to all of an individual’s personal information it holds, even if that information is also the personal information of another individual, unless there are mitigating circumstances precluding access or legal grounds to refuse access.

HCI shall consider whether the individual has a right of access to the information under other legislation. If not, HCI may make a discretionary decision to either grant or deny access to the information.

Verifying an individual's identity

HCI must be satisfied that a request for personal information under APP 12 is made by the individual concerned, or by another person who is authorised to make a request on their behalf, for example, a legal guardian or authorised agent.

It would be impracticable for HCI to deal with an anonymous request for personal information.

The steps appropriate to verify an individual’s identity will depend on the circumstances. In particular, whether the individual is already known to or readily identifiable by the RTO. The minimum amount of personal information needed to establish an individual’s identity will be sought. Where possible, the information may be sighted rather than copied or collected for inclusion in a record. For example, in a face-to-face dealing with an individual HCI may reserve the right to record that an identity document was sighted without copying the document.

HCI shall consider an application to access information not exceeding 30 calendar days after the request has been raised by an individual or other parties and after the necessary verifying process is completed.

HCI also provides that, without limiting APP 12.5, ‘access may be given through the use of a mutually agreed intermediary.' where direct access would otherwise be refused.

For example, an intermediary may need to be a qualified health service provider if used to give access to health information

Correction of Data available with HCI

In line with the APP 13.1, HCI will take reasonable steps to correct personal information it holds, to ensure it is accurate, up-to-date, complete, relevant and not misleading, having regard for the purpose for which it is held.

The requirement to take reasonable steps applies in two circumstances:

  • Where HCI is satisfied, independently of any request, that personal information it holds is faulty; or
  • Where an individual requests HCI to correct their personal information.

HCI will follow minimum procedural requirements in relation to correcting personal information, by:-.

  • Providing a written notice to an individual when a correction request is refused, including the reasons for the refusal and the complaint mechanisms available to the individual;
  • Responding in a timely manner to an individual’s request to correct personal information or to associate a statement with the information; and
  • Not charging an individual for making a request to correct personal information or associate a statement, or for making a correction or associating a statement.
5.6 Resolving Concerns on Privacy Issues

If an individual wishes to raise or discuss any issues about the Privacy Policy, they can:

  • Speak directly to a staff member who will do their best to resolve the issue.
  • Call the Feedback Line on 1800 22 52 83 during normal business hours.
  • Email the issue to
  • If an investigation is required HCI will keep the individual advised of the progress. If staff is unable to resolve the matter, it will be escalated as appropriate to facilitate a solution.

For Complaints and Appeals:

  • A complaint should initially be made to HCI using any of the above avenues
  • Follow HCI’s Complaints and Appeals Policy located at HCI website.
  • Allow reasonable time (usually 30 days) for HCI to respond.