Privacy Policy

This Privacy Policy describes how Innosano Pty Ltd ABN 12 701 136 629 (Innosano, we, us or our) collects, holds, uses, discloses, protects and otherwise manages personal information.

This Privacy Policy applies across Innosano’s current and future platforms, applications, websites, systems, services, products, modules and capabilities.

Our capabilities include:

• GroundCtrl and its industry applications
• Workplace Drug Testing
• Sample Collection and Management
• Digital Medical Passports
• occupational health and medical management
• health surveillance
• injury and rehabilitation management
• workforce and organisational management
• identity and access management
• sporting and participant services
• membership and engagement
• communications
• transactions
• analytics
• automation
• artificial intelligence functionality
• integrations
• other digital services

Some of the information entrusted to Innosano is highly sensitive. We consider privacy, confidentiality, security and appropriate access to information to be fundamental requirements of our systems and our business.

Where a particular collection, service, customer arrangement or activity requires more specific information, we may also provide a collection notice, consent form, supplementary privacy notice or other privacy information. Those documents operate together with this Privacy Policy.

Innosano is an Australian company based in New South Wales.

Our handling of personal information is governed by applicable Australian and New South Wales law, including the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

Where applicable to health information, our practices are also governed by the Health Records and Information Privacy Act 2002 (NSW) and its Health Privacy Principles.

Other Australian and New South Wales laws may impose additional obligations depending on the information, activity, customer, industry or service involved.

Where more than one privacy requirement applies, Innosano seeks to manage information in a manner that satisfies all applicable requirements.

Innosano’s role can differ depending on the service being provided and the relationship between the individual, Innosano and the organisation using the relevant service.

An individual may deal directly with Innosano. In other circumstances, Innosano may provide technology or services to an employer, sporting organisation, health provider, laboratory, collection organisation or other customer that has its own relationship with the individual.

Several parties may have legitimate but different responsibilities concerning the same information. A health professional may require access to clinical information, while an employer, site operator or sporting organisation may require only an appropriate clearance, restriction, availability or fitness status.

The fact that information exists within an Innosano system does not mean that every organisation or user of that system is entitled to access it.

Access depends on role, legitimate purpose, applicable law, authority, consent where required, contractual arrangements and the permissions established within the relevant service.

Personal information generally means information or an opinion about an identified individual or an individual who is reasonably identifiable.

The kinds of personal information Innosano collects and holds depend on the relevant service and the individual’s relationship with Innosano or an organisation using our services.

Personal information may include:

• identity and contact information
• employment and organisational information
• professional qualifications and credentials
• membership and participation information
• transaction information
• communications
• digital identity and access information
• device and technical information
• health and medical information
• workplace testing information
• sample collection information
• other information reasonably necessary to provide the relevant service

We may also hold information generated, derived or inferred from other information. Where generated, derived or inferred information is personal information, we treat it accordingly.

A number of Innosano capabilities involve occupational health, medical information, workplace testing, sample collection, injury management, fitness and health related services.

Health information may include information concerning:

• an individual’s physical or mental health
• medical history
• medical assessments
• injuries
• symptoms
• treatment
• medications
• vaccinations
• health surveillance
• pathology or testing
• exposure information
• fitness
• restrictions
• rehabilitation
• return to work or return to play
• other information concerning health or health services

Under Australian privacy law, health information is sensitive information.

Innosano only collects sensitive information where the collection is permitted by law. Where consent is required, appropriate consent must be obtained.

We seek to collect no more sensitive information than is reasonably necessary for the authorised purpose.

Innosano’s Workplace Drug Testing capability supports the digital management of workplace drug and alcohol testing programs.

Information handled through this capability may include:

• participant or donor identity information
• employer and workplace information
• testing program information
• testing reason or selection category
• appointment and booking information
• identity verification
• consent and authorisation records
• collection information
• electronic chain of custody records
• screening information and results
• laboratory information and confirmation results
• Medical Review Officer information and outcomes
• refusal and non compliance information
• dispute information
• notifications
• communications
• compliance records
• audit records

Workplace drug and alcohol testing information can constitute health information and sensitive information.

Access is restricted according to the role, authority and legitimate requirements of the relevant participant. An employer or other organisation is not entitled to underlying clinical information merely because it commissioned or administers a testing program.

Sample Collection and Management is a distinct Innosano capability supporting the collection, identification, handling, movement, tracking, testing and management of samples and the information associated with those activities.

Depending on the particular program, information may include:

• collection requests and bookings
• participant or donor identification
• consent and authorisation
• collection instructions
• collector identification and credentials
• collection date, time and location
• specimen or sample identifiers
• chain of custody records
• transfer and transport information
• laboratory or testing provider information
• sample status
• testing or analysis information
• results where applicable
• storage, retention or disposition information
• audit and compliance information

Information connected with a sample may be personal information, health information or sensitive information where it identifies or can reasonably identify an individual.

A physical specimen and the information associated with that specimen are not the same thing. This Privacy Policy principally governs personal information associated with a specimen. Other legal, contractual, clinical, laboratory or operational requirements may govern possession, handling, storage, transport and disposal of the physical specimen itself.

Innosano may provide digital passport, credential or portable record capabilities that enable individuals to hold, access or use verified information relating to their health, employment, participation, qualifications, clearances or other authorised matters.

These capabilities are intended to enable verified information to be used without unnecessarily disclosing the underlying record.

For example, an organisation may need to know that an individual holds a current medical clearance without requiring access to the clinical information underlying that clearance.

Where technically and operationally appropriate, Innosano seeks to apply the principle of minimum necessary disclosure.

Some Innosano services require reliable identification of an individual.

We may collect and use information necessary to establish, verify or manage identity, accounts, credentials, roles and access permissions.

Depending on the service, this may include:

• names
• photographs
• signatures
• identifiers
• contact information
• employment or membership information
• authentication information
• records of access activity

We do not collect biometric information merely because a technology is capable of doing so.

If an Innosano capability uses biometric information or biometric templates for identification or verification, we will treat that information as sensitive information where required by law and implement appropriate notice, consent, security and retention controls.

GroundCtrl and other Innosano services may support sporting organisations, employers and other organisations.

Depending on the implementation, information may relate to:

• employees
• workers
• contractors
• visitors
• athletes
• coaches
• officials
• members
• supporters
• sponsors
• customers
• other participants

The information handled may include:

• profiles
• roles
• schedules
• communications
• attendance
• credentials
• training
• competency
• access
• membership
• ticketing
• merchandise
• hospitality
• events
• engagement
• organisational records
• other authorised information

Where health information is held within the same broader platform, access controls are used to distinguish health or clinical information from general operational information.

Where reasonable and practicable, we collect personal information directly from the individual concerned.

We may also receive information from an organisation or person authorised or permitted to provide it, including an employer, sporting organisation, health professional, collector, laboratory, Medical Review Officer, service provider, contractor or other organisation using an Innosano service.

Information may also be collected through authorised integrations, transactions, applications, devices, websites, identity or access systems and through an individual’s interaction with our services.

Where we receive personal information from another source, we consider the purpose, authority and circumstances of the collection and any notice or consent requirements that apply.

This Privacy Policy describes Innosano’s overall privacy practices. It does not replace a specific collection notice or consent process where one is required.

When personal information is collected, Innosano or the organisation responsible for the collection may provide additional information explaining what is being collected, why it is required, who may receive it, the consequences of not providing it and other matters required by law.

Where Innosano relies on consent, we seek consent that is appropriately informed, voluntary, current and specific to the relevant circumstances.

An individual’s agreement to use an Innosano platform is not treated as unlimited consent for unrelated uses of personal information.

We use personal information for the purposes for which it was collected and for other purposes permitted by law.

Depending on the service, these purposes may include:

• providing and administering platforms and services
• verifying identity
• managing accounts and permissions
• coordinating appointments and services
• supporting health and occupational health processes
• administering workplace testing and sample collection
• recording clearances and outcomes supplied by authorised persons
• managing workforce or sporting activities
• maintaining records
• supporting safety and compliance
• processing transactions
• providing communications and support
• maintaining system security
• investigating incidents or complaints
• improving authorised services
• complying with legal obligations

Sensitive and health information is not available for unrestricted use merely because it is held within an Innosano system.

Innosano provides digital infrastructure, information management, workflow, analytics and related technology capabilities.

Innosano does not provide medical diagnosis, treatment or clinical care through its platforms merely by providing the technology through which information is collected, managed, analysed, displayed or communicated.

Innosano platforms, services and capabilities do not make clinical decisions. Clinical judgments and decisions remain the responsibility of appropriately qualified health professionals or other authorised human decision makers.

Innosano platforms, services and capabilities are not intended to replace professional clinical judgment.

Innosano does not represent its platforms, services or capabilities as medical devices merely because they may store, process, organise, analyse or display health information. Any particular functionality that is expressly developed, supplied or regulated as a medical device would be separately identified and governed accordingly.

Innosano may use artificial intelligence, analytics and automation to analyse information, identify patterns, organise information, support workflow, produce reports, highlight matters for attention, generate insights or otherwise assist authorised users.

Artificial intelligence used within Innosano services is intended to support human analysis and decision making. It does not make clinical decisions and is not intended to substitute for the judgment of a clinician, Medical Review Officer, employer, sporting organisation or other authorised human decision maker.

Where artificial intelligence or analytics produces an output, recommendation, indicator, summary, score, alert or other analysis, that output is information for consideration by an authorised human user. Responsibility for any consequential decision remains with the person or organisation authorised to make that decision.

Innosano will manage personal information used in artificial intelligence, analytics and automation in accordance with applicable privacy law, applicable contractual restrictions, purpose limitations, access controls and security requirements.

Where Australian privacy law requires transparency about the use of personal information in computer programs connected with decisions that could reasonably be expected to significantly affect an individual’s rights or interests, Innosano will provide the transparency required by law, while accurately reflecting that Innosano’s artificial intelligence does not itself make the clinical or operational decision.

A central privacy principle within Innosano is that access should follow legitimate need and authority.

Our systems may provide different views of the same underlying process or record.

• A health professional may require clinical detail.
• A laboratory may require information necessary to perform an authorised test.
• A collector may require information necessary to perform and document a collection.
• An employer may require an appropriate workplace outcome or clearance.
• A sporting organisation may require an appropriate availability or participation status.
• An individual may require access to their own information.

Innosano seeks to configure access so that each authorised participant receives the information reasonably required for their role without unnecessarily exposing information beyond that requirement.

Innosano may disclose personal information for the purpose for which it was collected, for a permitted related purpose, with consent where required, or where otherwise authorised or required by law.

Recipients may include:

• organisations using our services
• health professionals
• collectors
• laboratories
• Medical Review Officers
• service providers
• technology providers
• professional advisers
• regulators
• government authorities
• courts or law enforcement bodies where appropriate

We seek to limit disclosure to information reasonably necessary for the authorised purpose.

We do not sell an individual’s health information.

Innosano may communicate with customers, users and other individuals about relevant services where permitted by law.

Individuals may opt out of direct marketing communications.

We do not treat possession of health information or other sensitive information as permission to use that information for advertising or unrelated commercial targeting.

Sensitive information will only be used or disclosed for direct marketing where permitted by Australian law and where any required consent has been obtained.

Service communications, safety notices, testing notifications, appointment information, account information and other operational communications may continue where necessary to provide the relevant service.

Some Innosano services, particularly sporting and participant services, may involve children and young people.

We recognise that their personal information requires particular care.

Depending on the circumstances, safeguards may include:

• age appropriate privacy information
• parent or guardian involvement
• appropriate consent or authorisation
• restricted access
• purpose specific permissions
• data minimisation
• additional protections concerning health and sensitive information

We assess capacity to consent having regard to the individual, the circumstances and applicable Australian law.

Innosano will adapt relevant services to applicable requirements of the Australian Children’s Online Privacy Code when those requirements take effect.

Innosano takes reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure.

Our security measures are determined having regard to the nature and sensitivity of the information, the service involved, foreseeable risks and available security measures.

Controls may include:

• encryption
• authentication
• role based permissions
• access logging
• audit trails
• monitoring
• secure infrastructure
• environment separation
• backup and recovery
• vulnerability management
• personnel controls
• supplier controls
• incident response processes

No information system can be guaranteed to be completely secure. We therefore treat information security as an ongoing process rather than a one time technical control.

For Australian deployments, personal information held on Innosano platforms is stored in Australia.

Some technology, communications, support or service arrangements may nevertheless involve an overseas recipient or overseas access.

Where Innosano proposes to disclose personal information to an overseas recipient, we will comply with applicable Australian privacy requirements, including Australian Privacy Principle 8 where it applies.

Where required and practicable, we will identify the countries in which overseas recipients are likely to be located.

Innosano assesses the privacy and security implications of third party and overseas service arrangements rather than assuming that use of a technology provider transfers responsibility for privacy to that provider.

We retain personal information only for as long as it is reasonably required for the purposes for which it is held or as required or permitted by applicable law, contractual obligations, clinical requirements, regulatory requirements or legitimate evidentiary requirements.

Different information may require different retention periods. This is particularly relevant to health records, testing information, sample collection and chain of custody records, employment related information, compliance records and audit logs.

Where personal information is no longer required and continued retention is not required or permitted, we take reasonable steps to securely destroy or de identify it.

We take reasonable steps to ensure that personal information used or disclosed by us is accurate, up to date, complete and relevant for the relevant purpose.

In some regulated, clinical or evidentiary contexts, maintaining the history and provenance of a record is important.

A correction may therefore be made through an amendment, annotation or auditable correction process rather than by erasing the original historical entry.

Individuals may request access to personal information Innosano holds about them and may request correction of information they believe is inaccurate, out of date, incomplete, irrelevant or misleading.

We will deal with requests in accordance with applicable Australian and New South Wales privacy law.

We may need to verify the identity and authority of the person making the request.

Where information is held through a service provided to another organisation or forms part of a record for which another organisation or health professional has particular legal responsibility, we may coordinate the request with that organisation.

Any lawful grounds for refusing or limiting access will be applied only where appropriate.

Innosano maintains processes for identifying, investigating, containing and responding to suspected privacy and security incidents.

Where an incident constitutes an eligible data breach under the Notifiable Data Breaches scheme, we will comply with the notification requirements of the Privacy Act 1988 (Cth), including notifying affected individuals and the Office of the Australian Information Commissioner where required.

Other notification or response obligations may apply under New South Wales or industry specific law.

Innosano undertakes research, development and innovation.

Personal information held within an Innosano service is not automatically available for research or product development simply because Innosano technically holds or can access it.

Before personal information is used for research, analytics or development, we consider:

• the purpose
• legal authority
• sensitivity of the information
• applicable consent
• contractual restrictions
• security requirements
• whether de identified or aggregated information can reasonably be used instead

Where New South Wales health information is used or disclosed under a research or health service management exception, applicable requirements of the Health Records and Information Privacy Act 2002 (NSW) and any relevant statutory guidelines will be observed.

Where appropriate, Innosano may use information that has been aggregated or de identified.

We take reasonable steps appropriate to the circumstances to reduce the risk that de identified information can be re identified.

If information remains reasonably capable of identifying an individual, we continue to treat it as personal information.

Our websites, applications and services may use cookies and similar technologies for authentication, security, preferences, analytics and service operation.

We may collect technical information such as IP addresses, device information, browser information, application activity, login records, security events and system usage.

Additional notices or choices may be provided where appropriate to the relevant service.

Where lawful and practicable, individuals may have the option of interacting with Innosano anonymously or using a pseudonym.

This will not be possible where accurate identity is reasonably required.

For example, reliable identification may be necessary for medical records, sample collection, workplace testing, chain of custody, employment clearances, digital credentials, building or site access, regulated activities or transactions.

A person who believes Innosano has not handled their personal information appropriately may contact our Privacy Officer.

We will investigate privacy complaints and seek to respond within a reasonable period.

If a person is dissatisfied with our response, they may be entitled to complain to the Office of the Australian Information Commissioner.

Where a matter falls within the jurisdiction of the Health Records and Information Privacy Act 2002 (NSW), a person may also have rights through the NSW Privacy Commissioner and the Information and Privacy Commission NSW.

For questions about this Privacy Policy, requests to access or correct personal information, requests concerning de identification or deletion, or privacy complaints, please contact our Privacy Officer.

Privacy Officer
Innosano Pty Ltd
ABN 12 701 136 629
iAccelerate, Suite 9, Building 239
Innovation Campus, Squires Way
North Wollongong NSW 2500
Australia
Email: privacy@innosano.com
Telephone: +61 2 8006 8111

Please do not send health information, test results or clinical information by ordinary email.

If your enquiry concerns your own health record, you may contact the organisation that provided you with access to the relevant Innosano service, or contact our Privacy Officer so that an appropriate secure method of dealing with your enquiry can be arranged.

We may amend this Privacy Policy as Innosano’s services, technology, information handling practices or legal obligations change.

The current version will be made available through the Innosano website or otherwise on request.

Where a change materially alters the way personal information is collected, used or disclosed, we will consider whether additional notice, consent or other action is required.

Access to personal information should be determined by legitimate purpose, authority and need, not merely by technical availability.

This principle is particularly important where health and sensitive information is involved.

Innosano seeks to design its systems so that individuals, clinicians, employers, sporting organisations, collectors, laboratories, service providers and other participants can each perform their legitimate role without automatically receiving information intended for somebody else.

For Innosano, privacy is a requirement of how our systems are designed, governed and operated.