- 1. Introduction
- 2. Privacy, Personal Information, Personal Data and Employee Records
- 3. Purpose
- 4. Scope and Applicability
- 5. About this Privacy Policy
- 6. Consent
- 7. Privacy Principles Governing the Handling of Personal Information
- 8. Complaints, Enquiries and Access to Information Requests
- 9. How to Make a Complaint, Enquiry or Access to Information Request
- 10. Skill, Diligence and Care
- 11. Data Breach Notification
- 12. Governing Law
We will post any modifications or changes to this Privacy Policy on this page.
1. Introduction
Flourish 360 (we, us, our) is a privately held entity that provides the Flourish 360 platform, a cloud and smartphone based software solution for workplaces wanting to understand and promote positive employee mental health.
Flourish 360 applies the science of work design and positive psychology to assess psychosocial hazards and leading indicators of employee mental health. The Flourish 360 platform and related products include an expansive resource library for self-development and risk mitigation.
Under the Privacy Act 1988 (Cth) (Privacy Act), a 'health service' includes any activity that involves assessing, maintaining, improving or managing a person's physical or psychological health. As such, Flourish 360 is subject to the Privacy Act.
Flourish 360 is based in Melbourne, Victoria, and currently provides its services and solutions within Australia.
2. Privacy, Personal Information, Personal Data and Employee Records
This Privacy Policy and Collection Statement (Policy) concerns information or an opinion about an identified individual, or an individual who is reasonably identifiable (you). For the purpose of this Policy, 'privacy', 'personal information' and 'personal data' (PI) have the same meaning. PI either identifies, or has the potential to identify, an individual.
Flourish 360 processes identifying PI and also special categories of PI involving physical or mental health and other conditions (Sensitive PI).
We make no distinction between employee records and other sources of PI. Nor do we discriminate between different formats of PI (electronic records, paper records, voice files, etc.), or whether the information or opinions are true or not. All PI that we process and hold (where we have possession or control of a record), or use and disclose (where the information is outside our possession or control), is treated with the same respect, security and high standards.
3. Purpose
The purpose of this Policy is to inform you about the personal information that we 'process' (hold, collect, record, organise, structure, store, adapt, alter, retrieve, consult, use, disclose, transmit, disseminate or make available, align, combine, restrict, erase, destroy and profile) about you, how we handle it, and to inform you about your choices.
4. Scope and Applicability
The scope of this Policy extends to all personal information that we process in the course of providing the Flourish 360 platform and related services, in complying with law and in managing risk.
In providing the service, this Policy extends to our business activities, which include our client relationships, internal operations (management, employees, temporary staff, contractors) and external operations (third parties such as business partners and service providers).
The scope of this Policy extends to our external client-facing activities, such as our website, and to the personal information that is collected through our website and the use of email for general communications and marketing purposes.
This Policy does not extend to third-party websites or to social media accessed via links on our website or in email communications. Use of third-party links and social media will be governed by the privacy policies and terms of use of the relevant service providers.
5. About this Privacy Policy
This Policy is written in simple language so that it is easy to understand. If something is not clear, we invite you to contact us so that we can provide assistance.
This Policy outlines the current personal information handling practices of Flourish 360. We will update this Policy when our information handling practices change, and we will publish updates on our website and, where appropriate, through our email distribution lists.
While we publish our Privacy Policy on our website so that it is easily accessible, we will also make copies available on request in paper format. In most circumstances we do not charge a fee for providing a copy of the Policy. If, however, a request is made for a copy in another format (for example, foreign language requirements or those linked to disabilities such as sight or hearing impairment), special arrangements may need to be made and a charge may apply.
6. Consent
In all cases where consent is required, whether express consent (verbal, in writing, click-wrap tick box) or implied consent (browse-wrap without a tick-box and other behaviour which indicates consent through continued use), it must be voluntary, current, specific and based on adequate information about the circumstances and choices available to you as an individual. You must have the capacity to understand, give (for example, be 16 years or older) and communicate consent. If you are unable to provide consent, you must not access our services until a parent or guardian is able to consent on your behalf. Individuals who are unsure about giving consent are encouraged to contact us.
7. Privacy Principles Governing the Handling of Personal Information
Flourish 360 is committed to making every reasonable effort to manage personal information in an open and transparent way and in compliance with the Privacy Act and any other applicable privacy-related laws.
7.1 Open and Transparent Management of Personal Information
To support this commitment, we have implemented practices, procedures and systems to align our handling of personal information with the Australian Privacy Principles and relevant international standards and best practice.
These practices, procedures and systems are intended to regulate our internal and external business operations through the use of administrative, technical and physical controls. The legal notices published on our website are examples of our administrative controls. Technical and physical controls are generally not made publicly available for security reasons.
This Policy, together with our Terms of Service, sets out how we provide for open and transparent management of personal information, so that individuals can make informed choices about Flourish 360's services and communications with us.
7.2 Anonymity and Pseudonymity
As an individual, you can choose to remain anonymous (you cannot be identified and we do not collect personal information), or you can choose to use a pseudonym (a name, term or description that is different from your own) when dealing with us.
Circumstances where we give individuals the option to remain anonymous or use a pseudonym include, for example, where individuals prefer not to be identified, to be left alone, to avoid direct marketing, to keep their whereabouts and choices from others, and to express views in the public arena without being identified.
Examples of circumstances where we will need to know the identity of the person we are dealing with relate to the provision of the Flourish 360 services, where identification is required or authorised by law, where a refund is requested, for dispute resolution, where access to information is requested for correction, and where it becomes excessive or impractical to deal with a request without knowing the identity of the individual concerned.
7.3 Collection of Solicited Personal Information
Information we generally collect
We are committed to collecting personal information by lawful and fair means, and wherever possible only collecting it directly from the individual concerned.
We collect personal information from individuals where the information is reasonably necessary for one or more of Flourish 360's functions, activities and legal obligations relating to the services we provide.
In providing Flourish 360's services to individuals, we may collect Sensitive PI. This Sensitive PI is provided by the individual themselves, or by an organisation, partner or other stakeholder. Where we collect Sensitive PI, we always ask for prior consent in writing, where writing includes electronic forms of writing including, but not limited to, email and ticking a box in an online form.
Broadly, we collect and process PI and Sensitive PI such as name, age, email address, location (city and country), sex and other demographic data that is applicable to the workplace context.
The Flourish 360 platform contains surveys that collect different levels of information. This includes employees' perceptions of their work experiences, related outcomes and general wellbeing. Our platform offers surveys that clients can customise to their organisation's context. The aim of these (and possible future) online surveys is to provide a periodic assessment of wellbeing and the social and environmental determinants of wellbeing.
For internal human resourcing, we also collect sensitive personal information, such as religious beliefs, trade union memberships and health information when required for employment reasons, or by law. We may solicit or request personal information from a third party, such as an employment agency or referees, in the context of employment.
In most instances, even for non-sensitive PI, we only collect personal information after a direct request to, and with the consent of, the individual to whom the information relates.
In exceptional circumstances, and for human resourcing, or when authorised or required by law, we may collect personal information from a source other than the individual themselves.
Where we provide Flourish 360's services to an organisation, such as a workplace, we may solicit personal information from the organisation about an individual, but we still require the consent of each individual before their personal information is shared with us. Our service agreement with workplace clients requires that your consent is provided to the workplace and then to us.
Information specific to account administrators
Single sign-on (SSO): If you choose to register or log in using a third-party account (such as a Microsoft or Google workplace account), the authentication of your login details is handled by that third party, and we only collect the information you expressly agree to share with us at the time you give permission to link your Flourish 360 account with the third-party account.
Human resources information system data: If a client uses a third-party human resource information system to import information into the services, we will also receive information from that third party (for example, your name, email address and demographic data).
Billing details: If you use a credit card for billing, our payment processor may collect information such as the cardholder's name, billing address, email address, credit card number, expiry date and credit card security code. Flourish 360 does not itself store full payment card details.
7.4 Dealing with Unsolicited Personal Information
Personal information is sometimes provided to us in circumstances where we have not requested it. Where information is unsolicited, we will examine whether it could have been collected in the circumstances described in section 7.3 above. We will then decide whether the unsolicited information should be retained, de-identified or destroyed, and implement that decision within a reasonable time.
7.5 Notification of the Collection of Personal Information
This Policy, other legal notices published on our website, and our internal practices, procedures and systems are our way of ensuring that individuals know about the personal information Flourish 360 collects.
We are committed to making all reasonable efforts to inform individuals about the personal information we collect before we collect it, for example by making this Policy and our other legal notices publicly available. We will also inform individuals about collection at the time we collect personal information, for example when workplaces engage us to provide our services, through website activity, and through other forms of communication such as email.
In exceptional circumstances where this does not happen, for example when we receive unsolicited personal information from a third party which we decide to retain, we will inform individuals as soon as reasonably possible after collection.
Through this Policy and other legal notices published on our website, we seek to ensure individuals are informed about the reasons for collection, and know how to contact us.
7.6 Use or Disclosure of Personal Information
Where we hold personal information about an individual that was collected for a particular purpose (the primary purpose), we will not use or disclose the information for another purpose (a secondary purpose) unless required or authorised by law, the individual has consented, or the individual would reasonably expect us to use or disclose it for a related purpose. An example of a related purpose might be disclosure to a next-of-kin or healthcare provider in the case of an employee.
In some circumstances, for example where we believe the Flourish 360 service may be improved through new technologies such as data analytics, or where we see a benefit to individuals, we may use personal information provided to us by the individual, or received from third parties, for a purpose different from that for which it was originally given. Where we do this, we will use and/or disclose the personal information in a de-identified format.
Broadly speaking, we use (process, handle and manage) personal information internally for two reasons: to provide the Flourish 360 services (examples include name, address, telephone number and cookies); and for internal human resourcing (examples include name, address, health information, medical service provider and counsellor details, next-of-kin, spouse or partner, banking details, tax details, photo identity, trade union membership, religious beliefs, gender, cultural and ethnic identity, and qualifications). We do not collect biometric forms of personal information such as fingerprints.
We also use and retain personal information records that are required to be retained for legal, business and evidential reasons. Sometimes these come from external sources and third parties.
Broadly speaking, we disclose personal information for the same primary reasons listed above: to provide the service, for human resourcing, and where there is a legal obligation to do so.
7.7 Direct Communications
When we provide a service to individuals and workplaces, we ask for consent to communicate directly with the individuals concerned in order to provide the service.
Whenever we do, we allow individuals to opt out of receiving direct communications. When individuals ask us to stop communicating with them, we will comply with that request. However, we will still need to send certain account-related emails, such as purchase details or password reset requests, to fulfil our service obligations.
We would also like to send you information about our services that we think may be relevant to you. If you have agreed to receive marketing, you may opt out at any later date.
If an individual asks how we came to have their personal information, we will respond and provide the source wherever possible, within a reasonable time (thirty (30) business days).
We do not disclose, sell or share personal information with third parties for direct marketing purposes unless the individual opts in to receiving such information from third parties.
7.8 Cookies and Tracking Technologies
Cookies are text files placed on your computer to collect standard internet log information and visitor behaviour information. When you visit our website or use our services, we may collect information from you automatically through cookies or similar technology.
We and our marketing partners or service providers use technologies such as cookies to analyse trends, administer our website, track users' movements around the website, and gather demographic information about our user base. We may receive data based on the use of these technologies on an individual and aggregated basis. We may share some limited aspects of this data with third parties for advertising purposes.
We use cookies to remember users' settings and preferences, and for session management, so that we can make our website and services more intuitive to use. Users can control the use of cookies at the individual browser level. If you reject cookies, you may still use our services, but functionality may be reduced.
Please see our Cookie Policy for more information on the cookies and tracking technologies we use in our services.
7.9 Cross-Border Disclosure of Personal Information
Flourish 360 operates from Melbourne, Victoria, and may add additional locations as the business grows.
We do not currently share or disclose your personal information with any recipient located outside Australia. If this changes as Flourish 360's operations grow, we will update this Policy and, wherever reasonably possible, employ recognised mechanisms such as contractual clauses to protect any personal information disclosed overseas.
7.10 Quality of Personal Information
We are committed to taking reasonable steps to ensure that the personal information we collect, hold, use and disclose is, having regard to the purpose of the use or disclosure, accurate, up-to-date, complete and relevant.
We provide various technical means, including email notifications and user registration access, where individuals can access, verify and update the personal information records we hold. We encourage individuals to use the access and correction facilities described in sections 7.12 and 7.13 below.
7.11 Security of Personal Information
We are committed to taking reasonable steps to protect personal information that we hold from misuse, interference and loss, and from unauthorised access, modification and disclosure.
To comply with law and manage risk, our practices, procedures and systems aim to protect the confidentiality, integrity and availability of our information systems and information, especially the personal information that we collect, hold, use and disclose.
Where there is no legal obligation to retain records and evidence, and where we no longer need personal information for the purposes for which it may be used or disclosed under Australian law, we take reasonable steps to destroy or de-identify the information.
Where our data handling practices are outsourced to third parties, we endeavour to bind those third-party service providers through appropriate legal agreements and to monitor their privacy and security practices where possible.
7.12 Access to Personal Information
Where we hold, or have the right to deal with, personal information, we will, on request by an individual, normally give that individual access to their information.
In considering a request for access, we will require identification. We reserve the right not to give access in some circumstances, for example where provided for in law, in instances of commercial sensitivity, or where a third party may be negatively affected. We will provide reasons if access is refused.
We will respond to a request for access within a reasonable time (thirty (30) business days). No charge applies to making an access request, though we reserve the right to charge a fee where we incur costs, for example for photocopying or postage.
7.13 Correction of Personal Information
Where we hold personal information, we will take reasonable steps to correct it so that it is accurate, up-to-date, complete, relevant and not misleading.
You may request that we correct personal information we hold about you where you believe it is inaccurate, out of date, incomplete, irrelevant or misleading. We will require identification of the requesting individual and will consider reasonable requests.
We will respond to a request to correct information within a reasonable time (sixty (60) business days), although changes sought may take longer, for example because we may need to contact and notify other organisations or individuals. No charge applies for making or actioning a correction request.
7.14 Retention Period
We will keep your personal information for up to one (1) year after the cessation of any services that involve processing your PI. Once this period has expired, we will delete or de-identify your data, unless a longer retention period is required by law.
Where we use personal information in a de-identified format for analytics or service improvement purposes, we may retain that de-identified data for an indefinite period.
8. Complaints, Enquiries and Access to Information Requests
In most circumstances, the Office of the Australian Information Commissioner (OAIC) will not investigate a complaint if an individual has not first raised the matter with us. For this reason, we ask individuals to submit complaints relating to this Policy to us first, so that we have an opportunity to resolve them before they proceed to any relevant authority.
If you feel that Flourish 360 has not addressed your concern in a satisfactory manner, you may contact the Office of the Australian Information Commissioner.
9. How to Make a Complaint, Enquiry or Access to Information Request
Individuals wanting to lodge a complaint, make a general enquiry, or request access to their information, can do so in writing to us, including by email.
We will respond to complaints within a reasonable time (thirty (30) business days). A longer response time may be needed in some cases, for example because we need to contact and notify other organisations or individuals affected by the complaint — in that case we will endeavour to respond within sixty (60) business days.
If you feel that Flourish 360 has not addressed your concern in a satisfactory manner, you may contact the Office of the Australian Information Commissioner.
10. Skill, Diligence and Care
Flourish 360 will exercise reasonable skill, diligence and care as may reasonably be expected from a similar service provider.
11. Data Breach Notification
If Flourish 360 suspects or becomes aware of a breach of its network or information systems resulting in unauthorised access to, or unauthorised disclosure of, personal information likely to result in serious harm to any individual to whom the information relates, or where information is lost in circumstances that may lead to unauthorised access or disclosure, Flourish 360 will: take remedial action; notify the individuals concerned; and notify the Office of the Australian Information Commissioner, in accordance with the Notifiable Data Breaches scheme under the Privacy Act.
If you suspect or become aware of a breach or an impending breach, please contact us as a matter of urgency.
12. Governing Law
The principles outlined in this Privacy Policy and Collection Statement shall be governed by and interpreted in accordance with the laws of Victoria, Australia.
Related documents