Privacy Policy

1. Who we are

Breastfeeding Medicine Network - Australia/New Zealand Ltd (ACN 634 040 618, ABN 91 634 040 618) is an Australian public company limited by guarantee. We have been a registered charity with the Australian Charities and Not-for-profits Commission (ACNC) since 24 June 2019, as a Health Promotion Charity, and we are endorsed as a Deductible Gift Recipient. Our main business location is in the Australian Capital Territory.

Our purpose is to advance breastfeeding and lactation medicine through education, collaboration, advocacy and professional leadership, supporting clinicians to deliver evidence-based care to families. We are a not-for-profit organisation of medical doctors in Australia and Aotearoa New Zealand. We do not provide health services and we do not treat patients. The doctors in our Practitioner Directory practise independently of us.

We have no subsidiaries or related entities. Our Board and committees are volunteers, supported by a small administration team. This policy applies to our directors, committee members, volunteers, administrators and anyone else who handles personal information for us. They must handle it as this policy says.

2. The laws we follow

We handle personal information in line with the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth). Whether or not that Act requires this of an organisation of our size, we have chosen to follow the APPs.

We have members and directory listings in Aotearoa New Zealand, so we also follow the Information Privacy Principles (IPPs) in the Privacy Act 2020 (NZ) for the information of people in New Zealand. Where this policy mentions a New Zealand rule, it applies to you if you are in New Zealand.

When we send emails we follow the Spam Act 2003 (Cth) and the Unsolicited Electronic Messages Act 2007 (NZ). If personal information is lost or exposed we follow the Notifiable Data Breaches scheme in Australia and the notifiable privacy breach rules in New Zealand. We also keep the records that the Corporations Act 2001 (Cth) and the Australian Charities and Not-for-profits Commission Act 2012 (Cth) require.

This Privacy Policy is a statement of how we handle personal information. It is not a contract and does not create contractual rights, promises or warranties. Your rights under privacy law do not depend on it. It works together with our Website Terms and Conditions and, for members, our Membership Terms and Conditions. Where those documents refer to privacy, they mean this Privacy Policy.

3. What personal information is

Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether or not it is true and whether or not it is recorded in a material form. Under New Zealand law it means information about an identifiable individual. Examples are your name, contact details, professional registration number, CV, signature and the answers you give on our forms.

Sensitive information is a kind of personal information that Australian law protects more strictly. It includes health information and membership of a professional or trade association. Section 5 explains the sensitive information we may hold.

Information that does not identify anyone, such as the number of visitors to a page or the number of members in a state, is not personal information.

4. What we collect

We collect only what we need for the purpose you deal with us for. Our forms mark each answer as private, public if listed, or sensitive, so you can see how each one is treated. What we collect depends on how you deal with us. Find the group that applies to you below.

Members and applicants for membership

• Membership type (Professional or Student), title, first name, surname, mobile number, email address and, if you give it, a mailing address.
• Occupation, qualifications, workplace name and address (if any), areas of special interest and, for students, your university and expected graduation year.
• For Professional applicants: the body you are registered with (Ahpra, the Medical Council of New Zealand or the Dental Council of New Zealand), your registration number, whether you hold valid, unrestricted registration for clinical practice and, if not, your explanation.
• Where you mainly practise and, if your state has a BMNANZ network, whether you want to be connected to it.
• Whether you are an IBCLC and whether you perform tongue-tie release and, if you choose to be listed, the Practitioner Directory details described in section 8.
• Your declarations (the tick boxes), your signature (drawn or typed) with the time you signed and your device’s time zone, the version of the form and collection notice you saw, and the country your connection came from.
• Once you are a member: your membership status and dates, your bank transfer reference, whether and when your fee was paid, the Board’s decision on your application, a log of the emails we sent you (without their text), and your choices about the directory and the state network.

Board Director nominees and committee applicants

• Full name, suburb and state (or town and country), email address, phone number, qualifications, current workplace and role, and whether you are a BMNANZ member.
• Your experience: involvement in breastfeeding medicine patient care (without patient details) and organisations, Board, committee and volunteer roles, and your statement about why you are applying and what you would like to achieve.
• Your CV, including the names, roles and contact details of your referees.
• For Board nominees: the name and email address of the Professional Member who nominates you. For committee applicants: the committees you apply for and your first preference.
• Your conflict of interest declaration, including any competing interests or affiliations you list and the people or organisations involved.
• Your declarations, your signature with the signing time and your device’s time zone, the version of the form and collection notice you saw, and the country your connection came from.
• If you are elected or appointed: the records of your role and term, and the further details the law requires us to report to regulators such as the ACNC, which publishes the names of a charity’s directors on its public register.

People listed in the Practitioner Directory

• The details published on your listing: your name as it should appear, post-nominals, whether you are an IBCLC, whether you perform tongue-tie release, whether you offer telehealth (and to patients in Australia, New Zealand or both) and home visits, the languages you consult in, and up to five practice locations.
• For each practice location: clinic name, street address (optional), suburb or town, state or region, postcode, clinic phone, clinic email and website, as you gave them.
• A map position for each practice location, which we work out from the address using Geoscape G-NAF and OpenStreetMap address data.
• Saved versions of your listing, requests to change it, and a record of who approved each change.
• If you were listed in our previous directory and are not a member yet: an email address to invite you to join and confirm your listing. It is your own address from our earlier membership form or newsletter list or, if we have neither, your clinic’s email address from your listing. We use it only for that invitation, and delete it when you join, when your listing is removed, or when you ask us to.

Referees and nominators

If you are named as a referee in a CV, we hold your name, role and contact details as the applicant gave them. If you nominate a Board candidate, we hold your name and email address as the candidate gave them. We use these details only to confirm a nomination or to ask you about the applicant. We do not add you to any mailing list. Section 6 explains what we do when we collect information about you from someone else.

People who contact us

Through our contact form: your name, email address, whether you are a parent or family member, a doctor, another health professional or someone else, the topic, and your message. The form asks you not to include health details, because we cannot give medical advice. Your message stays in our records system: our mailbox is told only that a message has arrived.

By email to info@breastfeedingmed.com.au: your email address, your name and whatever you write. By phone or in person at an event: what you tell us and any notes we make to follow up.

Newsletter subscribers

Members receive our newsletter unless they answer “No” to the newsletter question on their membership application. Anyone else can subscribe on our website. Our newsletter is sent by Flodesk, which holds your name and email address and records whether you open our newsletters and which links you click. Flodesk’s privacy policy also applies.

Event and course participants and buyers (future)

Conference and workshop registration currently runs on third-party event platforms (for example EventsCloud). Those platforms collect your registration and payment details under their own privacy policies and give us the attendee details we need to run the event.

If we sell courses, educational material, workshop places or conference tickets through our website in future, we will collect your name, contact details, what you buy, your learning progress where a course platform records it, and the details needed for receipts and CPD statements. Card payments will be processed by Stripe, and we will never hold your card number.

Donors (future)

If we accept donations through our website in future, we will collect your name, contact details, the amount and the details needed to give you a receipt. Gifts of $2 or more to BMNANZ are tax deductible in Australia. Card payments will be processed by Stripe.

Website visitors

Cloudflare’s network handles every request to our website and keeps the technical logs it needs to deliver the site and protect it from attack, under its own privacy policy. When you send a form, we keep the country your connection came from, not your IP address. Section 11 explains cookies, browser storage, maps and analytics.

Administrators

People who administer our records sign in through Cloudflare Access with a one-time code sent to their email address. We hold their name, email address and role, and a log of every action they take in the records portal.

5. Sensitive information

We do not ask for health information about you. Some information we collect may still be sensitive information under Australian law:

• Your explanation if your registration is restricted, which may mention health or other personal circumstances.
• Qualifications, post-nominals and conflict of interest declarations that show membership of a medical college or another professional association.
• Health details that someone includes in a contact message or an application, even though we ask people not to.

We collect sensitive information only with your consent or where the law requires or allows it. We use it only for the purpose we collected it for, a directly related purpose, or as the law allows. Our forms mark sensitive answers so that our systems treat them with extra care and fewer people can see them.

Please do not send us patient details or health information about yourself or anyone else. Our contact form and application forms ask you not to. If we receive health information we do not need, we delete it (see section 19).

6. How we collect your information

Directly from you

Most of what we hold comes from you: through our online forms, by email to info@breastfeedingmed.com.au, through the contact page, by phone, or in person at our events. If we run social media accounts, what you post or send there is also covered by the platform’s own privacy policy.

Each online form shows a collection notice before you send it. It tells you who collects the information, why, who sees it, where it is stored, how long we keep it and your rights. We record the version of the notice you were shown with your application, so we can always show you the words you saw.

Giving us your information is voluntary. But if you do not give what a form asks for, we cannot consider your application or act on your request.

From other people

Sometimes we collect information about you from someone else. When we do, we take reasonable steps to make sure you know about it, as Australian Privacy Principle 5 and New Zealand Information Privacy Principle 3A require. Usually we do this by asking the person who gives us your details to tell you, and by publishing this policy. The main cases are:

• Referees: a Board or committee applicant lists you in their CV. The applicant must tell you that they have listed you and that BMNANZ may contact you. We contact you only to ask about the applicant.
• Nominators: a Board candidate names you as their nominator. We may email you to confirm the nomination.
• Someone reports an error in your directory listing. We may contact you to check it. We do not pass the reporter’s details to you without their agreement.
• A state network lead, Board member or committee member tells us something relevant to your membership or role.
• A referee or nominator tells us about an applicant. The applicant knows this may happen, because they gave us the referee’s details and the form says we may contact them.

From public registers and other public sources

Before approving a Professional membership, the Board checks your registration on the public register of Ahpra, the Medical Council of New Zealand or the Dental Council of New Zealand. The register may show your registration type, any conditions and your registration history. We may also check public information, such as a practice website, to confirm directory details. We do not buy lists and we do not collect information about you from data brokers.

From our providers

Our providers give us some information that they generate: Cloudflare tells us the country a form was sent from and whether its security check passed, Flodesk tells us whether a newsletter was opened, and Stripe will tell us whether a payment succeeded. We do not receive your card number.

7. Why we collect, hold, use and disclose personal information

We collect, hold, use and disclose personal information to run BMNANZ and to deal with you. In particular, to:

• assess applications for membership, Board nominations and committee roles, including checking registration, eligibility, referees and nominators;
• set up and manage memberships, including recording and following up fees, keeping the register of members the law requires, and sending membership and governance notices such as fee notices, notices of general meetings and candidate lists;
• publish and maintain the Practitioner Directory if you ask to be listed, and look into reported errors;
• invite doctors listed in our previous directory to join BMNANZ and confirm their listing;
• connect you with your state-based BMNANZ network if you ask;
• run the Board, committees and general meetings, including sharing candidate details with members before an election;
• answer your messages and requests;
• send our newsletter to members (unless they ask not to receive it) and to people who subscribe, and tell members and subscribers about our workshops, conferences and courses (see section 12);
• if you register for or buy events, courses or materials from us: register you, take payment, give you access, issue receipts and CPD statements, and send you information about the event or course;
• if you donate: receipt your gift and thank you;
• keep our website and records secure, prevent spam and misuse, and look into suspected fraud, misconduct or breaches of our rules;
• handle complaints, disputes and legal claims;
• meet our legal duties, including under the Corporations Act, the ACNC Act, tax law and privacy law, and respond to lawful requests from regulators, courts and law enforcement; and
• keep statistics about our membership and website in a form that does not identify anyone.

We use personal information only for the purpose we collected it for, for a related purpose you would reasonably expect, with your consent, or where the law requires or allows. We do not sell, rent or trade personal information.

8. The Practitioner Directory

The Practitioner Directory lists doctors who have asked to be listed, so that families and referrers can find a doctor with expertise in breastfeeding medicine. A listing is public: anyone on the internet can see it, search engines index it, and people may copy it. Listing in the directory is not an endorsement of any doctor.

Being listed is your choice. Students cannot be listed. A Professional applicant is listed only if they tick the directory box on the membership form, and only after the Board approves their membership. Only the answers in the sections marked ‘public if listed’ are published. Everything else on your application stays private.

The listing shows your name as you asked it to appear, your post-nominals, your services (IBCLC, tongue-tie release, telehealth, home visits), the languages you consult in, and your practice locations with the clinic contact details you gave. If you leave the street address blank, only the suburb is shown. Each location is placed on a map.

To change or remove your listing, use the Update a listing form on your listing page, or email info@breastfeedingmed.com.au. The administration team checks every change before it goes live. We act on removal requests promptly. Once a listing is removed it no longer appears on our website, but search engines and other sites may keep copies for a time.

Anyone can report an error in a listing. We may contact the listed doctor to check it, but we do not pass on the reporter’s name or details without asking the reporter first.

Directory contact details are published so that families and referrers can contact a doctor about care. They must not be collected for marketing, mailing lists or any purpose other than seeking care or making a professional referral. Our Website Terms and Conditions set out these rules.

9. Who we disclose personal information to

We share personal information only when we need to, with:

• our Board, our administration team, and committee members who need it for their role. Access to our records portal is limited by role, and every action in it is logged;
• Full Members, as our Constitution defines them: if you are nominated for the Board, your name, qualifications, current role and statement are shared with them before the Annual General Meeting, as you agree on the nomination form;
• the lead of your state-based BMNANZ network, if you ask to be connected: your name and contact details;
• the public, for anything you ask us to publish in the Practitioner Directory;
• your referees and nominator, when we contact them about your application: the fact that you have applied and what we need to ask;
• the service providers named in section 10, who store, send or process information for us;
• event platforms, when you register for an event they run, and the venue or other people we need to run an event, for the details needed for that event;
• a not-for-profit organisation with similar purposes, if we merge with it or transfer our activities to it (see section 23);
• our professional advisers, such as lawyers, accountants and auditors, under a duty of confidence;
• regulators, courts, law enforcement and others, where the law requires or allows us to: for example, the ACNC and ASIC for directors’ details, the Australian Taxation Office for donation records, or a court order.

We do not give or sell member or directory lists to anyone for marketing, and we do not disclose personal information to advertisers.

10. Overseas providers

We are a small organisation and use specialist providers to run our website, records and email. Some are based outside Australia and New Zealand, so personal information is stored or processed overseas. Australian Privacy Principle 8 and New Zealand Information Privacy Principle 12 govern this. Our providers act for us: they may use your information only to provide their service to us, under their contracts and privacy commitments. We send each provider only what it needs.

• Cloudflare, Inc. (United States): hosts our website, forms, records system and member portal, stores our files and nightly encrypted backups, sends our transactional emails, and runs the Turnstile security check, administrator sign-in (Cloudflare Access) and Cloudflare Web Analytics. We create our database and files with Cloudflare’s Oceania location setting, so they are kept in that region where Cloudflare allows it, but this is not guaranteed. Data may be processed in the United States or elsewhere, and website requests pass through Cloudflare’s global network.
• Google LLC (United States): Google Workspace runs our info@breastfeedingmed.com.au mailbox and our Board members’ email, so your emails to us and our replies are stored there. Google Search Console shows us how our site appears in Google search and collects nothing from visitors to our site. Google Maps opens when you click a Directions link in the directory, under Google’s privacy policy.
• Flodesk, Inc. (United States): runs our newsletter sign-up and sends our newsletter. We give it the name and email address of each new member who has not asked us not to send the newsletter. It records opens and clicks.
• GitHub, Inc. (United States): holds our monthly encrypted backup copy in a private repository. GitHub cannot read it. The backup can only be opened with the Board’s private backup key, which is kept offline.
• OpenStreetMap Foundation (United Kingdom): serves the map tiles on our Find a Doctor pages. When a map loads, your browser sends your IP address and the map area you are viewing to its servers, under its privacy policy.
• Stripe (United States): will process card payments when we offer them, for membership fees, courses, events or donations. Stripe receives your card details directly. We never hold card numbers.
• Event platforms (for example EventsCloud) collect conference and workshop registrations under their own privacy policies. If we use an online learning platform or a new event platform in future, we will name it here before it starts collecting information for us.

The privacy laws of these countries differ from Australian and New Zealand law, and these providers may not be bound by the APPs or the IPPs. We choose providers that commit to recognised security standards and keep information confidential, we encrypt the most sensitive records and all backups, and we keep our own encrypted copies so that we do not depend on any one provider.

If you are in New Zealand: our cloud providers hold information on our behalf, so under the Privacy Act 2020 we remain responsible for it and for your rights in it. By giving us your information, you accept that it may be stored or processed by the providers named above in the countries named above.

11. Website, cookies, browser storage, maps and analytics

Cookies and browser storage

Our website does not use advertising cookies and does not build profiles of visitors. It uses your browser’s storage for a few practical things:

• While you fill in a form, your typed answers (not files or signatures) are kept in your browser’s session storage so you do not lose them if the page reloads. They are removed when you send the form or close the tab.
• If you close a site notice, the site remembers that so it does not show the notice again: in session storage for the current visit, and in one local storage entry named bmnanz.ack.
• Cloudflare Turnstile, the security check on our forms, may set what it needs to tell a person from an automated program.
• Administrators who sign in to our records portal receive sign-in cookies from Cloudflare Access. Visitors and members do not.
• Other sites we link to or use, such as the Flodesk sign-up page, event platforms, Google Maps and OpenStreetMap, set their own cookies under their own policies.

You can clear or block browser storage in your browser settings. If you block it, you may lose unsent answers if a page reloads, and a form may not send if the Turnstile check cannot run.

Maps

The Find a Doctor pages show practice locations on a map. The map tiles load from OpenStreetMap Foundation servers in the United Kingdom, so your browser sends your IP address and the map area you view to them. Directions links open Google Maps. Practice positions are worked out from Geoscape G-NAF and OpenStreetMap address data.

Analytics we use

We use Cloudflare Web Analytics to understand how our site is used. It does not use cookies, does not fingerprint your device, and does not build a profile of you. It gives us aggregated counts: page views, referring sites, countries, browsers and device types.

We use Google Search Console, which reports how our site appears in Google search results. It collects nothing from visitors to our site.

Cloudflare’s network keeps the security and performance logs it needs, including IP addresses, to deliver the site and block attacks. We do not use these logs to identify visitors. We may use them if we reasonably believe someone has attacked or misused our site, or where the law requires or allows.

Google Analytics and Google Ads measurement (not in use)

We may in future add Google Analytics 4 or Google Ads conversion measurement, mainly to measure advertising we run under the Google Ad Grants program for charities. If we do, these tools will load only if you agree through a cookie choice shown on the site. Without your consent they will not run and will set no cookies. We will update this section when we add them.

If we add these tools, the site will show a cookie choice that you can change at any time, and this section will explain how. You can also install Google’s browser add-on for opting out of Google Analytics, or block cookies in your browser.

12. Emails and direct marketing

Membership and governance emails

If you apply or are a member, we send emails about your application and membership: confirmations, the Board’s decision, fee notices, requests to check your details, notices of general meetings and candidate lists. By applying, you agree to receive notices, including notices of general meetings, by email to the address you give (Corporations Act 2001 (Cth), section 249J).

These emails carry no promotion, and you cannot unsubscribe from them while you are a member. They are sent through Cloudflare’s email service from info@breastfeedingmed.com.au. We do not track whether you open them or click their links. Replies go to our info@breastfeedingmed.com.au mailbox on Google Workspace.

Our newsletter and promotional emails

Members receive our newsletter unless they answer “No” to the newsletter question on their membership application. Anyone else can subscribe on our website. Every newsletter has an unsubscribe link. Flodesk records whether you open a newsletter and which links you click. We use this to see which content is useful, not to make decisions about you.

We tell people about our workshops, conferences and courses through the newsletter and our website. If we email you directly about an event or course, for example because you attended a previous one or asked us to, the email will identify BMNANZ and have a way to unsubscribe. We send promotional emails only with your consent, as the Spam Act 2003 (Cth) and the Unsolicited Electronic Messages Act 2007 (NZ) require. For members, that consent comes with joining, unless you tick that you do not want the newsletter, and you can withdraw it at any time by unsubscribing.

Every promotional email identifies BMNANZ, gives a way to contact us, and has a working unsubscribe link. We act on an unsubscribe within 5 business days. You can also unsubscribe by emailing info@breastfeedingmed.com.au. Unsubscribing does not stop the membership and governance emails above while you are a member.

Directory contact details

Directory contact details are published so that families and referrers can contact a doctor about care. They must not be harvested or used to send unsolicited marketing. Doing so may breach the Spam Act, the Unsolicited Electronic Messages Act and our Website Terms and Conditions. We do not give your details to other organisations for their marketing.

13. Security

We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. The steps we take today are:

• Everyone who administers our records signs in with two steps: their email address and a one-time code, through Cloudflare Access.
• Access is limited by role, so each administrator sees only what their role needs.
• Every administrator action in the records portal is logged, and the log is kept for 7 years.
• CVs and signatures are stored encrypted.
• Our records are backed up every night in encrypted form, and the database can be restored to any point in the past 30 days. A monthly encrypted copy is kept long term in a private GitHub repository. Backups can be opened only with the Board’s private backup key, which is kept offline.
• Our forms check that a person, not a program, is sending them (Cloudflare Turnstile), limit what each form can contain, and do not accept files other than a PDF CV.
• Information travels between your browser and our website over an encrypted connection.
• Card details, when we take card payments, go straight to Stripe and never pass through our systems.

No system is completely secure, and sending information over the internet carries some risk. We cannot guarantee the security of information in transit. If you believe your information with us has been lost or exposed, please tell us straight away (see section 21).

14. How long we keep information

We keep personal information only as long as we need it for the purposes in this policy and to meet our legal duties. Our records system applies fixed retention rules automatically. The main periods are:

• Membership applications: reduced to a stub (reference number, type, outcome and dates) 12 months after approval, 6 months after a decline, 3 months after withdrawal, or 12 months after the last activity if never decided.
• Board nominations: a nomination that goes to the AGM is kept, with its conflict of interest declaration, as part of our register of interests. Other nominations are reduced to a stub 6 months after the AGM, or 3 months after withdrawal.
• Committee applications: an application that leads to an appointment is kept, with its conflict of interest declaration, as part of our register of interests. Other applications are reduced to a stub 6 months after a decision not to appoint, 3 months after withdrawal, or 12 months after the last activity if never decided.
• CVs: deleted 30 days after the AGM (Board) or the decision (committee). Conflict of interest declarations: deleted at the same time, unless the nomination goes to the AGM or the applicant is appointed. You can ask us to delete a kept declaration once you no longer hold the role, or if you are not elected.
• Member records, including directory choices and fee payment marks: kept while you are a member and deleted 2 years after your membership ends.
• Directory change requests: deleted 12 months after the decision. Saved versions of a listing: 2 years.
• Contact form messages: deleted 30 days after we receive them. Log of emails sent (without message text): 12 months.
• Privacy requests, including access, correction, deletion and complaints: 2 years after completion.
• Administrator activity log: 7 years.
• Emails in our Google Workspace mailbox: as long as needed to deal with the matter and to meet our record-keeping obligations.

When a period ends, we delete the information or reduce the record to a stub that shows only that an application was made, its type, its outcome and the dates. The stub no longer holds your details.

Some records must be kept by law whatever the periods above, for example the register of members, financial records and donation receipts, which are generally kept for 7 years under the Corporations Act, the ACNC Act and tax law.

Backups: nightly encrypted backups are kept for 30 days. A monthly encrypted copy is kept long term in a private GitHub repository, readable only with the Board’s private backup key. Information deleted from our live records stays in the nightly backups until they roll off and in the monthly copies. We use backups only to restore our records after loss, and we do not restore deleted personal information unless the law requires us to.

If you ask us to delete your information, we delete it from our live records within 30 days, unless the law requires us to keep it. Copies already in our encrypted backups are not changed: the nightly backups are deleted after 30 days, and a monthly copy is kept long term. Only the Board can open them.

15. Data breaches

A data breach happens when personal information is lost, or is accessed or disclosed without authority. If we have a breach that is likely to cause serious harm to anyone, we will tell the people affected and the Office of the Australian Information Commissioner, under the Notifiable Data Breaches scheme in the Privacy Act 1988 (Cth). Where people in New Zealand are affected, we will also tell the Office of the Privacy Commissioner, under the Privacy Act 2020 (NZ). We will do this as soon as practicable.

We assess a suspected breach promptly, contain it, and record it. If we need to tell you, we will say what happened, what information was involved, what we are doing about it and what you can do.

16. Automated decisions

We do not use computer programs to make decisions that could significantly affect your rights or interests. The Board decides every application for membership, every Board nomination and every committee appointment. People review every change to the directory before it goes live.

Our website does use automated checks: Cloudflare Turnstile confirms that a person is sending a form, forms check that answers are in the right format (for example, that a registration number looks right), and our records system deletes information on the fixed schedule in section 14. None of these decides anything about you. If an automated check stops you sending a form, contact us through the contact page or by email and a person will help.

We make this statement to meet Australian Privacy Principles 1.7 to 1.9, which require privacy policies to explain automated decision-making. If this changes, we will update this section before any automated decision is used.

17. Access and correction

You can ask to see the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading. Email info@breastfeedingmed.com.au or use the contact page. There is no fee to ask. We will need to confirm your identity, usually by replying to the email address we hold for you.

We will respond within 30 days. If you are in New Zealand, we will respond within 20 working days, as the Privacy Act 2020 requires, and we will tell you if we need more time and why. We give you the information in the form you ask for where that is reasonable.

We never charge for a correction. If retrieving information takes a lot of work, for example from backups, we may ask for a reasonable amount to cover our costs, and we will tell you before we do.

We may refuse access or correction in limited cases: for example, where giving access would unreasonably affect someone else’s privacy (such as a referee’s comments), would prejudice a legal claim, or where the law requires us to refuse. If we refuse, we will tell you why in writing and how you can complain. If we refuse to correct something, you can ask us to attach a statement to the record saying you believe it is wrong, and we will.

If we correct information that we had earlier given to someone else, you can ask us to tell them about the correction, and we will where that is reasonable and practicable. Listed doctors can also update their own listing through the Update a listing form on their listing page.

18. Anonymity and pseudonyms

You can read our website without telling us who you are. You can contact us using a name other than your own if you prefer, but we need an email address to reply.

For membership, Board and committee applications, directory listings, listing changes, payments and donation receipts, we need your real identity. We must check who you are, check your registration, keep the records the law requires, or issue a receipt in your name.

19. Unsolicited information

If we receive personal information we did not ask for, we decide within a reasonable time whether we could have collected it under this policy. If not, we delete it or de-identify it, as long as it is lawful and reasonable to do so.

This includes health details in a contact message, patient details in an application, and information about other people that an applicant includes beyond what we asked for.

20. Complaints

If you think we have mishandled your personal information or breached the APPs or the IPPs, please tell our Privacy Officer first, by emailing info@breastfeedingmed.com.au or through the contact page. Say what happened and what you would like us to do.

We will acknowledge your complaint, look into it, and give you a written response within 30 days. If we need longer, we will tell you why and when to expect our answer.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC): www.oaic.gov.au (opens in a new tab), telephone 1300 363 992. If you are in New Zealand, you can complain to the Office of the Privacy Commissioner: www.privacy.org.nz (opens in a new tab), telephone 0800 803 909. You do not have to complain to us first, but it is usually the quickest way to fix a problem.

A complaint about a doctor’s care is not a privacy complaint, and we cannot deal with it. Contact the doctor’s registration body (Ahpra or the relevant New Zealand council) or the health complaints body in your state or country.

21. How to contact our Privacy Officer

Our Privacy Officer handles privacy questions, access and correction requests, deletion requests, reports of possible breaches and complaints.

Email info@breastfeedingmed.com.au with ‘Privacy’ in the subject line, or use the contact page on our website. We do not publish a postal address. If you need to write to us by post, email us first and we will give you an address.

22. Changes to this policy

We review this policy at least once a year and whenever our systems, our providers or the law change. We post the current version on our website with the date it was last updated at the top. Earlier versions are available on request.

If we make a significant change, for example a new provider, a new country where information is stored, or a new use of information, we will tell members by email and note the change on the website. We do not treat your continued use of our website as agreement to a change. This policy is a notice of what we do, and your rights under privacy law do not depend on it.

23. If BMNANZ merges or winds up

If BMNANZ merges with, or transfers its activities to, another not-for-profit organisation with similar purposes, as our Constitution allows on winding up, the records needed to continue those activities, including member and directory records, may transfer to that organisation. It would have to handle them under this policy or one at least as protective. We would tell members before the transfer, and where the law allows you could ask for your information to be deleted instead.

If BMNANZ winds up without a transfer, we will delete personal information that no longer needs to be kept, and keep only the records the law requires, for as long as it requires.