1.  About this Privacy Policy

My Occ Health Record Pty Ltd ACN 627 619 701 and Healthbook Pty Ltd ACN 630 277 860 (MOHR, we, us, our) operate the MOHR Platform — software that supports occupational health assessments for employers, health providers and the individuals they direct to us.

All references to ‘you’ and ‘your’ in this Privacy Policy are references to:

• end users: individuals who access the Platform to complete a pre-employment, in-employment or other occupational health assessment;
• commercial subscribers: employers, health providers, clinicians and channel partners, and their authorised representatives;
• job applicants: individuals who apply for employment or engagement with MOHR; and
• website visitors.

We publish this Privacy Policy so you can understand what personal information we collect, why we collect it, how we use and disclose it, and what rights you have to access or correct it.

When this Privacy Policy refers to ‘personal information’, that term has the meaning given to it by the Privacy Act 1988 (Cth) (Privacy Act) in Australia and the Privacy Act 2020 (NZ) (also, the Privacy Act) in New Zealand. Personal information broadly, is considered information or an opinion about an identified individual, or an individual who is reasonably identifiable. This includes health information and other sensitive information.

We are committed to protecting your personal information in accordance with the Privacy Act, the Australian Privacy Principles, and the Privacy Act 2020 (NZ), the Information Privacy Principles and the Health Information Privacy Code 2020 (in New Zealand).

If you have questions about this Privacy Policy, please contact us using the details in section 11.

2.  A bit about the MOHR Platform

To understand how we handle personal information, it helps to understand how the Platform works.

The MOHR Platform supports occupational health assessments. It operates across three parties:

• An employer (or prospective employer) requires an occupational health assessment for an employee or job candidate. The employer may engage a health provider who refers the individual to the platform or may directly engage a clinician.
• The health provider (such as an occupational health clinic) engages a clinician and creates an assessment on the Platform for an individual.
• The individual receives an invitation to the Platform, accepts the Terms of Use, and provides the information needed for their assessment. The clinician uses the Platform to conduct the assessment.
• The assessment outcome is made available to the health provider and the employer, and the individual, in accordance with the scope of the assessment.

MOHR is the platform operator only. We are not a treating clinician and we do not provide medical advice. The clinician, health provider and employer each have their own privacy obligations under applicable law and we also encourage you to familiarise yourself with those documents in addition to our own. This Privacy Policy covers MOHR’s role only as it applies to your personal information.

3.  The types of personal information we collect

3.1  If you are an end user

We collect personal information about you in one of the following ways:

• directly from you when you access or use the Platform;
• directly from you when you apply for a job; or
• from the health provider or employer who set up your assessment.

The types of personal information we may collect include:

General personal information:

• name, date of birth, gender and contact details (such as email address and phone number);
• employment details (such as employer name, job title and role); and
• device and login information.

Sensitive information (including health information):

• medical history and current health conditions;
• medications and immunisation status;
• clinical test results and fitness-for-work outcomes; and
• any other health information the clinician needs to conduct the assessment.

We only collect sensitive information with your consent, or as otherwise permitted by law. If you do not provide certain information, the clinician may not be able to complete your assessment — we will let you know this at the point of collection.

Note: MOHR does not store your credit card details. If a payment is processed via the Platform, it is handled by a secure third-party payment provider.

3.2  If you are a commercial subscriber or their representative

The types of personal information we may collect about you include:

• name, job title and contact details;
• login credentials;
• financial, billing and credit information;
• professional registration details (for clinicians); and
• information about your use of the Platform (such as log-in activity and feature usage).

3.3  If you are a website visitor

If you visit our website, we may collect statistical and usage information via cookies. This is generally collected on an anonymised basis unless you are a registered user. See section 13 (Cookies) for more detail.

3.4  If you are a job applicant

If you apply for employment or engagement with MOHR, we collect and handle personal information about you as part of our recruitment process. This may include:

• your name and contact details;
• your CV or resume, cover letter and employment history;
• your qualifications, professional registrations and referee details;
• the results of any pre-employment or background checks (such as right-to-work, reference or, where permitted by law, criminal history checks); information you provide during interviews or assessments; and
• any other information you choose to give us in support of your application.

We collect this information directly from you and, where relevant and with your authority, from your referees, recruitment agencies and background-checking providers. We use it to assess your suitability for roles with us, to communicate with you about your application, to verify the information you have given us, and to meet our obligations as an employer. If your application is unsuccessful, we may keep your information for a reasonable period so that we can consider you for future opportunities, unless you ask us not to, after which we will destroy or de-identify it.

4.  How personal information is collected

We collect personal information in the following ways:

• Directly from you when you register, access or use the Platform or website.
• If you are a job applicant, directly from you via the submission of your CV or cover letter.
• From commercial subscribers (such as an employer or health provider) who provide end user details to set up an assessment.
• From clinicians or health providers, in the form of assessment records and outcomes.
• Via cookies and analytics tools on our website and Platform (see section 13).

If we receive personal information about you that we did not request, we will assess whether we are permitted to hold it. If not, we will destroy or de-identify it as soon as practicable.

5.  How personal information is used and disclosed

5.1  If you are an end user

We will never sell or exploit your personal information.

We will use your personal information (including health and other sensitive information) for the primary purpose for which it was collected, including:

• giving you access to the Platform;
• supporting your occupational health assessment;
• making assessment outcomes available to the health provider and employer in accordance with the scope of the assessment;
• operating, maintaining and improving the Platform;
• sending you service, support and security communications; and
• complying with our legal obligations.

We will only use your personal information for secondary purposes if you have given consent, or if you would reasonably expect it and it is related to the primary purpose.

Sensitive information (including health information) will only be used for the purpose for which it was collected, a directly related secondary purpose, or with your consent.

We may disclose your personal information to:

• the clinician conducting your assessment;
• the health provider that engaged the clinician;
• your employer or prospective employer, in accordance with the scope of the assessment;
• our service providers (including hosting, software, support, payment processing and professional advisers) — who are bound by confidentiality obligations and only given access to what they need;
• a successor entity in connection with a corporate transaction (with notice to you); and
• government agencies or other parties as required or authorised by law.

5.2  If you are a commercial subscriber or their representative

We will use your personal information for the primary purposes of providing you with access to the Platform and managing our commercial relationship, including:

• communicating with you about the Platform and your account;
• managing billing and payments;
• verifying your identity; and
• providing technical support.

We may also use your personal information for secondary purposes, such as:

• communicating with you about our goods and services;
• our own marketing and promotions; and
• competitions, surveys and questionnaires.

We will only disclose your personal information to third parties where reasonably necessary to operate the Platform and our business, or as required or authorised by law.

6.  Derived data and analytics

MOHR may use de-identified or aggregated information — information that does not identify any individual — for:

• analytics and platform performance reporting;
• benchmarking and research;
• developing and improving the Platform;
• preparing industry-level insights and reports (for example for insurers or industry bodies); and
• such other purpose as it may determine from time-to-time.

This derived information is not personal information under the Privacy Act. MOHR will not use derived data in a way that re-identifies any individual.

Use of artificial intelligence: MOHR may use artificial intelligence, machine learning and similar technologies as part of, or to support, the Platform and our services. Such usage may be to assist with data processing, quality assurance, security and fraud monitoring, and/or to otherwise improve the Platform. Where these technologies process personal information (including health information), we handle that information in accordance with this Privacy Policy and applicable law.

7.  Overseas recipients

All personal information collected through the Platform is hosted on servers located in Australia.

Some of our service providers may be based overseas — for example, in the United States of America. Those service providers are required to comply with confidentiality restrictions and are only given access to limited identifiable information. The countries to which we may disclose personal information may change from time to time.

8.  Opting out

You may ask us to stop collecting your personal information, or to de-identify personal information we hold about you. Please note that doing so may mean we are unable to provide some or all of our services. To make this request, contact us using the details in section 11.

You may also opt out of receiving marketing or promotional communications from us at any time by following the unsubscribe instructions in the relevant communication. Opting out of marketing does not affect core service messages or other transactional communications.

9.  Keeping your personal information secure

We take reasonable precautions to protect your personal information from unauthorised access, disclosure, misuse and loss. These precautions include:

• securing our physical facilities and electronic networks;
• encrypting personal information when it is stored and transferred;
• implementing access controls that limit who can access particular information;
• requiring our team and service providers to comply with confidentiality obligations; and
• reviewing changes to the Platform for privacy compliance before they are deployed.

Your personal information is stored in secure, encrypted electronic format in Australia.

We will only retain personal information for as long as necessary to fulfil the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

If a data breach is reasonably likely to result in serious harm to any individual, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches (NDB) scheme under the Privacy Act (and, for individuals in New Zealand, the Office of the New Zealand Privacy Commissioner in accordance with the notifiable privacy breach provisions in Part 6 of the Privacy Act 2020 (NZ)). Please note that the transmission of information over the internet is not completely secure or error-free. While we take reasonable steps to protect your information, we cannot guarantee the security of information transmitted to us by email.

10.  How to access, correct or update your personal information

Under the Privacy Act, you have the right to request access to, or correction of, the personal information we hold about you.

To make a request, you can:

• update your personal information directly from within your Platform account (where that option is available); or
• contact us using the details in section 11.

If you contact us directly, we will take reasonable steps to:

• correct any errors within a reasonable time of receiving written notice of those errors; or
• provide you with access within 30 days of receipt of a written request if you are an Australian resident, or within 20 days of receipt of a written request if you are a New Zealand resident.

We may charge a reasonable fee for the costs of providing access. We will let you know about any fee before we process the request.

If we deny access or refuse to correct your personal information, we will give you our reasons in writing.

If you wish to withdraw consent to a particular use of your personal information, please contact us using the details in section 11. Withdrawing consent may affect our ability to provide certain services.

11.  Contacting us and complaints

All questions, concerns or complaints about this Privacy Policy or the way we handle your personal information can be directed to our Privacy Officer:

Email privacy@myocchealthrecord.com

Post: Privacy Officer, My Occ Health Record Pty Ltd, Level 5/50-56 York St, South Melbourne VIC 3205

We will aim to resolve any issue raised with you directly and promptly.

If you are not satisfied with our response, you can lodge a complaint with:

Office of the Australian Information Commissioner (OAIC):

• Phone: 1300 363 992
• Website: www.oaic.gov.au

Office of the New Zealand Privacy Commissioner — for individuals in New Zealand:

• Phone: 0800 803 909
• Website: www.privacy.org.nz

Health Complaints Commissioner (Victoria) — for health information complaints in Victoria:

• Phone: 1300 582 113
• Website: www.hcc.vic.gov.au

12.  Changes to this policy

From time to time we may update this Privacy Policy. If we do, we will post the updated version on our website. We encourage you to review this Privacy Policy periodically. Any revised Privacy Policy, once published on our website, will apply to all personal information we handle.

13.  Cookies

We may use cookies or similar tracking technologies on our website and Platform. Cookies are small files stored on your device that help us track usage patterns and remember your preferences. We may also use persistent cookies (which remain after you close your browser) and session cookies (which expire when you end your session). When you visit our website, our servers may also automatically log information such as your IP address, operating system, browser type, the pages you access and the duration of your visit. This information is used for statistical and administrative purposes.

You can disable cookies in your browser settings at any time. However, if you do, some parts of the Platform or website may not work as intended.

Where cookies collect information that identifies you, that information is treated as personal information under this Privacy Policy. Our website and Platform may contain links to third-party websites. Those links are provided for convenience only. We are not responsible for the privacy practices of those websites and encourage you to review their privacy policies before providing any personal information to them.