1. About this policy

Health-e Workforce Solutions Pty Ltd (Health-e, we, us, our) provides workforce analytics, planning and operations software and advisory services to hospitals, health services and health departments in Australia and New Zealand.

We take the privacy of personal information seriously. Much of the information we handle belongs to the employees of our client health services, and we treat it accordingly.

This policy explains what personal information we collect, why we collect it, how we use, disclose, store and protect it, and how you can access it, correct it or complain about how we have handled it.

This policy applies to our website, our marketing and sales activities, our software platform, our advisory services, and our dealings with job applicants, contractors and suppliers.

This policy is available free of charge at healthewfs.com.au/privacy. If you need it in another format, contact us using the details in section 19 and we will provide one.

This policy does not cover the privacy practices of our client health services. Where we handle workforce information on behalf of a client, that client remains responsible for that information and its own privacy policy governs it. See section 6.

2. The laws we comply with

We handle personal information in accordance with:

• the Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs), including the Notifiable Data Breaches scheme;
• the Health Records Act 2001 (Vic) and the Health Privacy Principles, where we handle health information in Victoria;
• the Privacy and Data Protection Act 2014 (Vic) and the Information Privacy Principles, where we act as a contracted service provider to a Victorian public sector body and our contract requires it;
• the Privacy Act 2020 (New Zealand) and the Information Privacy Principles, where we handle personal information of individuals in New Zealand; and
• the equivalent privacy legislation of other Australian states and territories, where it applies to our work for a client in that jurisdiction.

Where two of these apply to the same information, we apply the higher standard.

3. What personal information we collect and hold

3.1 Workforce information provided by our clients

To deliver our platform and advisory services, our clients supply us with extracts from their HR, payroll, rostering, finance and time-and-attendance systems. This information can include:

• name, employee number and other workforce identifiers;
• work email address, work phone number and business unit;
• position, classification, award, agreement and pay level;
• FTE, contracted hours, employment type and employment status;
• rostered, worked, overtime, agency and leave hours;
• cost centre, general ledger code and labour cost data;
• start and end dates, and length of service;
• qualifications, skills, competencies and credentialing status, where a client provides them;
• for some clients, limited demographic data such as age band or gender, used for workforce planning.

Wherever a client's requirements can be met without it, we ask clients to de-identify, pseudonymise or omit direct identifiers before sending data to us.

Health information. Our services are not designed to collect health information about patients, and we ask clients not to send patient data to us. Some workforce data (for example, personal leave, workers' compensation or fitness-for-work information) may constitute health information about an employee. Where we hold it, we treat it as sensitive information under the APPs and as health information under the Health Records Act 2001 (Vic).

3.2 Client and prospective client contacts

For the people we deal with at health services and health departments, and at prospective clients, we collect: name, job title, employer, work email address, work phone number, and records of our correspondence, meetings, proposals, support requests and contract dealings with you.

3.3 Website visitors and marketing contacts

When you use our website or engage with our marketing, we may collect:

• information you give us in a contact form, demonstration request, newsletter subscription, event registration or download form, typically name, work email, organisation, role and your enquiry;
• your IP address, browser type, device type, operating system, referring page, the pages you view, and the dates and times of your visits;
• your interactions with our emails, such as whether you opened one or clicked a link;
• information from cookies and similar technologies (see section 10).

3.4 Job applicants, employees and contractors

We collect information from people who apply to work with us, including CVs, contact details, work history, qualifications, referee comments, right-to-work status and the results of any background checks you consent to.

Under the employee records exemption in the Privacy Act, the APPs do not apply to our handling of our own current and former employees' records where that handling is directly related to the employment relationship. We nonetheless handle those records in line with the standards set out in this policy. This exemption does not apply to workforce information we hold about our clients' employees, that information is fully protected under this policy and the APPs.

3.5 Identifiers

Where a client's credentialing or compliance requirements make it necessary, we may hold professional registration identifiers such as an AHPRA registration number or a New Zealand responsible authority registration number. We do not adopt government-related identifiers (such as tax file numbers, Medicare numbers or Centrelink reference numbers) as our own identifier for an individual, and we do not use or disclose them except where the Privacy Act permits.

3.6 Information we do not seek

We do not seek to collect sensitive information (such as racial or ethnic origin, political opinions, religious beliefs, sexual orientation or criminal record) except where it is reasonably necessary for our services, permitted by law, or you consent. Please do not send us sensitive information we have not asked for.

4. How we collect personal information

We collect personal information:

• directly from you, when you contact us, fill in a form on our website, subscribe to our communications, attend an event, apply for a job, or use our platform;
• from our clients, where a client supplies workforce data extracts, integrations or system feeds so we can deliver our services to them;
• automatically, through cookies, analytics and marketing technologies on our website and in our emails (see section 10);
• from third parties, such as publicly available sources, professional networking sites, business directories, referees you nominate, background-checking providers, and our clients' own systems and integration partners.

Where we collect your personal information from someone other than you and it is reasonable and practicable to do so, we will take reasonable steps to make you aware of that collection and of this policy. Where a client provides us with information about its employees, the client is responsible for notifying those employees under its own privacy policy and collection notices.

Unsolicited information. If we receive personal information we did not ask for and could not lawfully have collected, we will destroy or de-identify it as soon as practicable, unless we are required to retain it by law.

5. Why we collect, hold, use and disclose personal information

We collect, hold, use and disclose personal information for these purposes:

Purpose	Examples
Delivering our platform	Producing dashboards, reports, rosters, allocations, budgets and workforce forecasts for the client that provided the data
Delivering advisory services	Workforce reviews, benchmarking, modelling and implementation support
Support and account management	Responding to support requests, managing user access, resolving incidents
Product operation and improvement	Diagnosing faults, testing, maintaining and improving our software and models
Sales and marketing	Responding to enquiries, sending newsletters and product updates, running events, understanding which content is useful
Business administration	Contracting, invoicing, credit management, insurance, record keeping and audit
Recruitment	Assessing and communicating with job applicants
Legal and regulatory	Meeting our legal obligations, responding to lawful requests, and establishing or defending legal claims

We will not use or disclose your personal information for a purpose unrelated to the one we collected it for unless you would reasonably expect it, you have consented, or the law permits or requires it.

We do not sell personal information, and we do not disclose personal information to third parties for their own direct marketing.

Aggregated and de-identified data. We may create aggregated, de-identified benchmarks and statistics from workforce data and use them to improve our services and produce sector insights. We only do this where our client agreement permits it, and we take reasonable steps to ensure individuals and, where required, individual health services cannot be re-identified from the result.

6. Our role when we handle client workforce data

When a client health service engages us, the client decides what workforce information is collected from its employees, and why. We handle that information on the client's behalf and under the client's instructions, as set out in our services agreement with them.

This means:

• we use client workforce data only to deliver services to that client, and for the limited purposes set out in section 5;
• we do not use one client's workforce data to deliver services to another client, except in aggregated and de-identified form as described in section 5;
• each client's data is logically separated from every other client's data;
• if you are an employee of one of our clients and you want to access or correct your workforce information, please contact your employer in the first instance. We will assist your employer to respond. You can also contact us directly using the details in section 19, and we will refer your request to your employer and help them action it.

7. Who we disclose personal information to

We may disclose personal information to:

• the client that provided it, including its authorised staff and its nominated advisers or contractors;
• our service providers, who are bound by contractual confidentiality and security obligations, including cloud hosting and infrastructure providers, customer relationship and marketing platforms, email and productivity providers, analytics providers, IT support and security providers, and professional advisers (legal, accounting, insurance and audit);
• regulators, courts and law enforcement, where we are required or authorised by law to do so;
• a purchaser or prospective purchaser of our business or assets, subject to appropriate confidentiality protections;
• any other person, with your consent.

8. Overseas disclosure and cross-border data flows

Where we store information. We store personal information in data centres located in Australia. Personal information relating to our New Zealand clients and their workforce may be stored in Australia and accessed from New Zealand, and personal information relating to Australian clients may be accessed from New Zealand by authorised personnel supporting those clients.

Recipients outside Australia. As a result, personal information we hold may be disclosed to, or accessed from, recipients in New Zealand.

Some of our service providers, in particular providers of marketing, analytics, email, support and security tooling, are global businesses that may store or process limited personal information (mainly the website and marketing information described in section 3.3) outside Australia, including in the United States and other countries in which they operate.

Before disclosing personal information overseas, we take reasonable steps to ensure the recipient does not breach the APPs, generally by imposing contractual obligations that require the recipient to protect the information to a standard consistent with the APPs.

For New Zealand individuals: we will only disclose personal information to a recipient outside New Zealand where IPP 12 of the Privacy Act 2020 (NZ) permits it, generally, where the recipient is subject to comparable privacy safeguards or is required by agreement to protect the information to a comparable standard.

9. Direct marketing

We may send you information about our services, research, events and product updates where you have asked for it, where you are a client contact, or where you would reasonably expect it. Our marketing is directed at people in a professional capacity at health services and related organisations.

Every marketing email we send includes an unsubscribe link. You can also opt out at any time by emailing privacy@healthewfs.com.au. We will action your request within a reasonable period and at no cost to you.

If you ask us, we will tell you where we obtained your information, unless it is impracticable or unreasonable to do so.

Opting out of marketing does not stop us sending you service, support, security, billing or contractual communications relating to a service you or your employer receives.

10. Cookies, analytics and website tracking

Our website uses cookies and similar technologies to make the site work, remember your preferences, understand how the site is used, and measure the effectiveness of our marketing.

We use:

• Essential cookies, required for the site to function and to remember your cookie choices;
• Analytics cookies, to understand which pages are visited and how visitors move through the site;
• Marketing and CRM cookies, including the HubSpot tracking code, which links website activity to a contact record where you have identified yourself to us (for example, by submitting a form) and helps us understand which content is useful.

You can block or delete cookies through your browser settings. If you do, some parts of our website may not work as intended. Most browsers also offer a "Do Not Track" setting; where our tools support it, we will honour it.

We do not use cookies to build profiles for advertising by unrelated third parties.

11. Automated decision-making and artificial intelligence

Our platform produces forecasts, allocations, budget scenarios and recommendations from workforce data. These outputs are decision support tools for our clients. They are not decisions we make about you. Our clients decide how to act on them, and a person at the client makes the operational decision.

We do not use automated processing to make decisions about individuals that have legal or similarly significant effects on them, without human involvement.

Where our software or models are used, we take reasonable steps to ensure they are tested, monitored for accuracy and bias, and documented, and that our clients understand their limitations.

(From 10 December 2026, APP 1.8 of the Privacy Act requires privacy policies to describe certain computer-assisted decisions that significantly affect an individual's rights or interests. We will update this section before that date to reflect our platform's capabilities as they then stand.)

12. How we protect personal information

We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. Our controls include:

• encryption of data in transit and at rest;
• multi-factor authentication for all staff accounts, with phishing-resistant methods enforced on managed devices;
• role-based access control and least-privilege access, so staff only access what their role requires;
• logical separation of each client's data;
• security monitoring, logging and alerting;
• managed, patched and endpoint-protected devices;
• background checks and confidentiality obligations for personnel, and privacy and security training;
• contractual security obligations on our service providers;
• documented incident response and business continuity processes;
• secure destruction or de-identification of information we no longer need.

No method of transmission or storage is completely secure. While we work hard to protect your information, we cannot guarantee absolute security.

13. How long we keep personal information

We keep personal information only for as long as we need it for the purposes described in this policy, or for as long as we are required to keep it by law or under our agreement with a client.

• Client workforce data is retained for the term of our agreement with the client, and is returned or securely destroyed at the end of that agreement in accordance with the client's instructions and our contractual obligations.
• Marketing and enquiry data is retained while you remain a contact of interest and for a reasonable period afterwards, unless you ask us to delete it.
• Unsuccessful job applications are retained for up to 12 months, unless you ask us to delete them earlier or consent to us keeping them longer.
• Business records (contracts, invoices, tax and corporate records) are retained for the periods required by Australian law, generally at least seven years.

When we no longer need personal information, we destroy it or de-identify it securely.

14. Data breaches

We maintain a data breach response plan. If we suspect a data breach, we will contain and assess it promptly.

If a breach is likely to result in serious harm to any individual, we will notify the affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme, and the Office of the Privacy Commissioner (New Zealand) where the Privacy Act 2020 (NZ) applies.

Where a breach affects workforce data we hold for a client, we will notify that client without undue delay and work with them to meet their notification obligations.

15. Accessing and correcting your information

You can ask us for access to the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading.

To make a request, email info@healthewfs.com.au or write to us at the address in section 19. We may ask you to verify your identity.

We will respond within a reasonable period, generally within 30 days. There is no fee to make a request. If a request requires significant work, we may charge a reasonable cost-based fee for access (never for correction), and we will tell you before we do.

We may refuse access or correction in the limited circumstances allowed by law, for example, where granting access would unreasonably affect another person's privacy, or where the information relates to anticipated legal proceedings. If we refuse, we will tell you why in writing and explain how to complain.

If you are an employee of one of our clients, requests about your workforce data are usually best directed to your employer, who controls that information. See section 6.

16. Dealing with us anonymously

You can deal with us anonymously or under a pseudonym where it is lawful and practicable, for example, when making a general enquiry about our services. In most cases, however, we will need to know who you are to respond to you, to provide services, or to act on a privacy request.

17. Complaints

If you think we have breached the Australian Privacy Principles, the Health Privacy Principles, the New Zealand Information Privacy Principles or this policy, please tell us first so we can put it right.

Step 1: Contact us. Email info@healthewfs.com.au with the details of your complaint. We will acknowledge it within 5 business days and aim to give you a written response within 30 days. If we need longer, we will tell you why and when you can expect a response.

Step 2: Escalate. If you are not satisfied with our response, you can complain to:

• Office of the Australian Information Commissioner (OAIC): 1300 363 992, oaic.gov.au
• Office of the Victorian Information Commissioner (OVIC): 1300 006 842, ovic.vic.gov.au (for information handled under the Privacy and Data Protection Act 2014 (Vic))
• Health Complaints Commissioner (Victoria): 1300 582 113, hcc.vic.gov.au (for health information handled under the Health Records Act 2001 (Vic))
• Office of the Privacy Commissioner (New Zealand): 0800 803 909, privacy.org.nz
• the privacy regulator in your own state or territory, where one applies.

18. Changes to this policy

We review this policy at least annually and may update it from time to time to reflect changes in our services, our systems or the law.

The current version is always available at healthewfs.com.au/privacy. The effective date at the top of this policy tells you when it was last changed. Where a change is significant, we will take reasonable steps to notify you, for example, by notice on our website or by email to our client contacts.

19. How to contact us

Privacy Officer
Health-e Workforce Solutions Pty Ltd
17 Albert Street, Ballarat Central VIC 3350, Australia

Email: info@healthewfs.com.au
Phone: (03) 5332 4888

ABN 15 122 930 287