COLOSTOMY ASSOCIATION OF VICTORIA PRIVACY POLICY (June 2026)
The Colostomy Association of Victoria (CAV) is a not-for-profit association dedicated to the support of ostomates enrolled in Australia’s Stoma Appliance Scheme under the Authority of the Department of Health and Aged Care.
The Colostomy Association of Victoria (CAV) abides by The Privacy Act 1988 and the Australian Privacy Principles (APP) and has developed this APP Privacy Policy to outline our ongoing obligations with respect to how personal information provided to us is managed.
1. COMPLIANCE WITH THE NATIONAL PRIVACY POLICY
There are ten Australian Privacy Principles (APPs) (previously the National Privacy Principles (NPPs)) contained in the Privacy Act 1988 (the Privacy Act). These APPs came into effect on 21 December 2001 and govern the way in which we collect, use, disclose, store, secure and dispose of your Personal Information. They also allow individuals to access that information, and have it corrected if it is wrong.
CAV has adopted 9 of these 10 APPs. We are unable to fully comply with APP #8 (Anonymity – wherever it is lawful and practicable, individuals must have the option of not identifying themselves when entering transactions with an organisation) as CAV must specifically identify and verify the eligibility of all individuals wishing to claim ostomy appliances via the Federal Government’s Stomal Appliance Scheme (SAS). A Plain English Summary of the APPs is included within this Policy document.
If you want more detail, the full text of the APPs and the APP Guidelines may be obtained from the website of The Office of the Federal Privacy Commissioner at www.privacy.gov.au.
2. WHAT IS PERSONAL INFORMATION AND HOW DO WE COLLECT IT?
Personal Information is information that identifies an individual. Examples of Personal Information collected by the Organisation include names, addresses, email addresses, phone numbers, facsimile numbers, third party contacts, Medicare and concession card numbers and information related to your participation in the Stoma Appliance Scheme. This Personal Information is obtained in many ways including through interviews, correspondence, by telephone, by facsimile, by email, via our website, through SAS appliance order placement and from third parties. We do not use cookies but cannot guarantee other website links or the policy of authorised third parties.
We collect your Personal Information for the primary purposes of providing our services to you and for providing information to you. We may also use your Personal Information for secondary purposes closely related to the primary purpose in circumstances where you would reasonably expect such use or disclosure.
3. WHAT IS SENSITIVE INFORMATION?
Sensitive information is defined in the Privacy Act as information or opinion about such things as an individual’s racial or ethnic origin, political opinions, membership of a political association, religious or philosophical beliefs, membership of a trade union or other professional body, criminal record or health information. Examples of sensitive information that may be collected by the Organisation include information related to a client’s stoma including type of stoma and a record of products used.
Sensitive information will be collected and used by us only:
4. AUTHORISATION OF A THIRD PARTY
With the member’s written or verbal consent, CAV may accept instructions or enquiries from a third party. This includes ordering ostomy supplies, updating member details, and managing CAV Member Portal registration and activity on the member’s behalf. Authorisation can be provided verbally by calling CAV and supplying the full name and date of birth of the party being nominated for authority. This can be provided in writing via post or email as well. All nominee information is handled in accordance with this CAV Privacy Policy. Authorised third parties may update most account information, including contact details, delivery preferences, and payment arrangements, but cannot change a member’s legal name or date of birth without written or photographic evidence. Agencies responsible for a member’s care or finances must provide proof of authority unless they have been directly nominated by the member, or another authorised third party (typically a family member).
If a member is medically incapable of providing consent, CAV may accept authorisation from a legal guardian, person with medical power of attorney, or healthcare decision-maker, upon receipt of valid supporting documentation.
Where reasonable and practical, CAV will collect personal information directly from the member. However, in limited cases — such as when processing supply orders or addressing urgent health or care concerns — CAV may accept relevant information from an unauthorised third party, such as a family member or medical professional. In such instances, CAV will take all reasonable steps to ensure the member is made aware of the information received.
5. DISCLOSURE OF PERSONAL INFORMATION
It is the policy of the Organisation not to disclose your Personal Information except where:
The Organisation is unlikely to disclose your personal information to overseas recipients.
6. SECURITY OF PERSONAL INFORMATION
Your Personal Information is stored in a manner that reasonably protects it from misuse, loss, unauthorised access, modification or unauthorised disclosure. When your Personal Information is no longer needed for the purpose for which it was obtained, we will take all reasonable steps to destroy it or to permanently de-identify it. However, some Personal Information is required to be kept by law and will be stored in our files and kept by us for a minimum of 7 years.
7. ACCESS TO YOUR PERSONAL INFORMATION
You have a right to access the Personal Information we hold about you and to update and/or correct it, subject to certain exceptions. If you wish to access your Personal Information, please make your request to us in writing. CAV will not charge any fee for your access request but may charge an administrative fee for providing a copy of your Personal Information.
To protect your Personal Information, we will require identification from you before releasing such information.
8. MAINTAINING THE QUALITY OF YOUR PERSONAL INFORMATION
It is an important part of providing our services to you that your Personal Information is up to date, and we will take all reasonable steps to make sure that your Personal Information is accurate and complete. To assist with this process, it is important that you advise us at the earliest opportunity of any changes to your Personal Information so that our records can be updated.
9. POLICY UPDATES
This Policy may change from time to time. A copy of our Privacy Policy is available by contacting the Organisation.
10. PRIVACY POLICY QUERIES
If you have any queries about our Privacy Policy, please contact the CAV Secretary.
11. COMPLAINTS
Complaints about any alleged breach of our Privacy Policy must be made in writing to:
The Secretary
COLOSTOMY ASSOCIATION OF VICTORIA
PO Box 65
FLINDERS LANE POST OFFICE
MELBOURNE VIC 8005
PLAIN ENGLISH SUMMARY OF THE AUSTRALIAN PRIVACY PRINCIPLES (APPs)
APP 1: COLLECTION
Describes what an organisation should do when collecting personal information, including what they can collect, collecting from third parties and, generally, what they should tell individuals about the collection.
APP 2: USE AND DISCLOSURE
Outlines how organisations may use and disclose individuals’ personal information. If certain conditions are met, an organisation does not always need an individual’s consent to use and disclose personal information. There are rules about direct marketing.
APPs 3 & 4: INFORMATION, QUALITY AND SECURITY
An organisation must take steps to ensure the personal information it holds is accurate and up to date and is kept secure from unauthorised use or access.
APP 5: OPENNESS
An organisation must have a policy on how it manages personal information and make it available to anyone who asks for it.
APP 6: ACCESS AND CORRECTION
Gives individuals a general right of access to their personal information, and the right to have that information corrected if it is inaccurate, incomplete or out-of-date.
APP 7: IDENTIFIERS
Generally, prevents an organisation from adopting an Australian Government identifier for an individual (e.g. Medicare numbers) as its own.
APP 8: ANONYMITY
Where possible, organisations must give individuals the opportunity to do business with them without the individual having to identify themselves.
APP 9: TRANSBORDER DATA FLOWS
Outlines how organisations should protect personal information that they transfer outside Australia.
APP 10: SENSITIVE INFORMATION
Sensitive information includes information such as health, racial or ethnic background, or criminal record. Higher standards apply to the handling of sensitive information.