JR Boon || Privacy & Policy

Privacy Policy

JR BOON Solutions specializes in the development of high quality products and cost effective IT solutions. We are a market and technology driven company and we offer unmatched service to our clients. Our team of professionals are dedicated to provide information technology solutions & branding solutions adapted to global clients.

We have adopted the Australian Privacy Principles (APPs) contained in the Privacy Act 1988 (Cth) (the Privacy Act). The NPPs govern the way in which we collect, use, disclose, store, secure and dispose of your Personal Information.

A copy of the Australian Privacy Principles may be obtained from the website of The Office of the Australian Information Commissioner at www.aoic.gov.au

What is Personal Information and why do we collect it?

Personal Information is information or an opinion that identifies an individual. Examples of Personal Information we collect include: names, addresses, email addresses, phone and facsimile numbers.

This Personal Information is obtained in many ways including correspondence, by telephone and facsimile, by email, via our website www.jrboonsolutions.com.au, from your website, from media and publications, from other publicly available sources, from cookiesand from third parties. We don’t guarantee website links or policy of authorised third parties.

We collect your Personal Information for the primary purpose of providing our services to you, providing information to our clients and marketing. We may also use your Personal Information for secondary purposes closely related to the primary purpose, in circumstances where you would reasonably expect such use or disclosure. You may unsubscribe from our mailing/marketing lists at any time by contacting us in writing.

Sensitive Information

Sensitive information is defined in the Privacy Act to include information or opinion about such things as an individual's racial or ethnic origin, political opinions, membership of a political association, religious or philosophical beliefs, membership of a trade union or other professional body, criminal record or health information.

Sensitive information will be used by us only:

• For the primary purpose for which it was obtained

• For a secondary purpose that is directly related to the primary purpose

• With your consent; or where required or authorised by law.

When we collect Personal Information we will, where appropriate and where possible, explain to you why we are collecting the information and how we plan to use it.

Third Parties

Where reasonable and practicable to do so, we will collect your Personal Information only from you. However, in some circumstances we may be provided with information by third parties. In such a case we will take reasonable steps to ensure that you are made aware of the information provided to us by the third party.

Disclosure of Personal Information

Your Personal Information may be disclosed in a number of circumstances including the following:

• Third parties where you consent to the use or disclosure; and

• Where required or authorised by law.

Security of Personal Information

Your Personal Information is stored in a manner that reasonably protects it from misuse and loss and from unauthorized access, modification or disclosure.

When your Personal Information is no longer needed for the purpose for which it was obtained, we will take reasonable steps to destroy or permanently de-identify your Personal Information. However, most of the Personal Information is or will be stored in client files which will be kept by us for a minimum of 7 years.

Access to your Personal Information

You may access the Personal Information we hold about you and to update and/or correct it, subject to certain exceptions. If you wish to access your Personal Information, please contact us in writing.

JR BOON Solutions will not charge any fee for your access request, but may charge an administrative fee for providing a copy of your Personal Information.

In order to protect your Personal Information, we may require identification from you before releasing the requested information.

Maintaining the Quality of your Personal Information

It is an important to us that your Personal Information is up to date. We will take reasonable steps to make sure that your Personal Information is accurate, complete and up-to-date. If you find that the information we have is not up to date or is inaccurate, please advise us as soon as practicable so we can update our records and ensure we can continue to provide quality services to you.

Policy Updates

This Policy may change from time to time and is available on our website.

Privacy Policy Complaints and Enquiries

If you have any queries or complaints about our Privacy Policy please contact us at:

JR BOON Solutions, Ground Floor, 470 St Kilda Road,Melbourne. VIC 3004.

info@jrboonsolutions.com.au

Telehealth Privacy Policy

This Telehealth Privacy Policy ("Policy") sets out how JR Boon Solutions- Med Live ("Provider") collects, uses, and protects personal information in connection with the provision of telehealth services ("Services") in Australia.

1. Collection of Personal Information

1.1 Types of Personal Information. Provider may collect the following types of personal information:

(a) Contact information, such as name, address, email address, and phone number;
(b) Health information, such as medical history and current health status;
(c) Insurance information, such as policy number and coverage details; and
(d) Other information relevant to the provision of the Services.

1.2 Method of Collection. Provider may collect personal information in the following ways:

(a) Directly from the individual, such as through online forms, emails, or phone calls;
(b) From third parties, such as insurance providers or other healthcare providers; and
(c) From publicly available sources.

2. Use of Personal Information

2.1 Purpose of Use. Provider may use personal information for the following purposes:

(a) Providing the Services;
(b) Managing and administering the Services, including billing and collection;
(c) Communicating with individuals about the Services;
(d) Conducting quality assurance and improvement activities;
(e) Complying with legal and regulatory requirements; and
(f) Other purposes as required or permitted by law.

2.2 Disclosure of Personal Information. Provider may disclose personal information to the following parties:

(a) Healthcare professionals involved in the provision of the Services;
(b) Insurance providers for the purpose of obtaining coverage or payment;
(c) Third-party service providers who assist in the provision of the Services;
(d) Regulators, government bodies, and other third parties as required by law; and
(e) Other parties as required or permitted by law.

3. Security of Personal Information

Provider takes reasonable steps to protect personal information from unauthorized access, use, or disclosure. Provider maintains physical, electronic, and procedural safeguards that comply with applicable laws and regulations.

4. Access and Correction of Personal Information

Individuals may request access to their personal information held by Provider and may request that any inaccurate or incomplete personal information be corrected. Provider will respond to such requests within a reasonable time and in accordance with applicable laws and regulations.

5. Retention of Personal Information

Provider will retain personal information for as long as necessary to fulfil the purposes for which it was collected unless a longer retention period is required or permitted by law.

6. Cross-Border Disclosure of Personal Information

Provider may transfer personal information to countries outside Australia in connection with the provision of the Services. Provider will take reasonable steps to ensure that such transfers comply with applicable laws and regulations.

7. Changes to this Policy

Provider may amend this Policy from time to time by posting an updated version on its website. Individuals should review this Policy regularly to ensure they are aware of any changes.

8. Contact Information

Individuals may contact Provider with any questions or concerns regarding this Policy or the treatment of their personal information. Provider's contact information is as follows:

JR Boon Solutions Ground Floor, 470 St Kilda Road, Melbourne, VIC 3004 Phone: 1800865020 Email: info@jrboonsolutions.com.au

This Policy was last updated on 04/05/2023.

Data Breach Procedure and Response Plan

This Procedure sets out the processes to be followed by JRBS staff in the event that JRBS experiences a data breach or suspects that a data breach has occurred. A data breach involves the loss of, unauthorised access to, or unauthorised disclosure of, personal information.

This Procedure is governed by the JR Boon Solutions Privacy Policy.

JRBS is committed to managing personal information in accordance with the Privacy Act 1988 (Cth) (the Act) and the JRBS Privacy Policy.

This document sets out the processes to be followed by JRBS staff in the event that JRBS experiences a data breach or suspects that a data breach has occurred. A data breach involves the loss of, unauthorised access to, or unauthorised disclosure of, personal information.

The Privacy Amendment (Notifiable Data Breaches) Act 2017 (NDB Act) established a Notifiable Data Breaches (NDB) scheme requiring organisations covered by the Act to notify any individuals likely to be at risk of serious harm by a data breach. The Office of the Australian Information Commissioner (OAIC) must also be notified.

Accordingly, JRBS needs to be prepared to act quickly in the event of a data breach (or suspected breach), and determine whether it is likely to result in serious harm and whether it constitutes an NDB.

Adherence to this Procedure and Response Plan will ensure that JRBS can contain, assess and respond to data breaches expeditiously and mitigate potential harm to the person(s) affected.

This Procedure and Response Plan has been informed by:

• The Office of the Australian Information Commissioner’s “Guide to developing a data breach response plan”
• The Office of the Australian Information Commissioner’s “Data breach notification guide: a guide to handling personal information security breaches”
• The Act and Australian Privacy Principles (Schedule 1 of the Act) .This document should be read in conjunction with JRBS’s Privacy Policy.

3.1 Alert

Where a privacy data breach is known to have occurred (or is suspected) any member of JRBS staff who becomes aware of this must, within 24 hours, alert a Member of the Executive in the first instance.

The Information that should be provided (if known) at this point includes:

a. When the breach occurred (time and date)
b. Description of the breach (type of personal information involved)
c. Cause of the breach (if known) otherwise how it was discovered
d. Which system(s) if any are affected?
e. Which directorate/faculty/institute is involved?
f. Whether corrective action has occurred to remedy or ameliorate the breach (or suspected breach)

3.2 Assess and determine the potential impact

3.2.1 Criteria for determining whether a privacy data breach has occurred

1. Is personal information involved?
2. Is the personal information of a sensitive nature?
3. Has there been unauthorised access to personal information, or unauthorised disclosure of personal information, or loss of personal information in circumstances where access to the information is likely to occur?

3.2.2 Criteria for determining severity

a. The type and extent of personal information involved
b. Whether multiple individuals have been affected?
c. Whether the information is protected by any security measures (password protection or encryption)
d. The person or kinds of people who now have access
e. Whether there is (or could there be) a real risk of serious harm to the affected individuals
f. Whether there could be media or stakeholder attention as a result of the breach or suspect breach

With respect to 3.2.2(e) above, serious harm could include physical, physiological, emotional, economic/financial or harm to reputation and is defined in the Privacy Policy and section 26WG of the NDB Act.

Having considered the matters in 3.2.1 and 3.2.2, the Member of the Executive must notify the Privacy Officer within 24 hours of being alerted under 3.1.

3.3 Privacy Officer to issue pre-emptive instructions

On receipt of the communication by the relevant member of the Executive under 3.2, the Privacy Officer will take a preliminary view as to whether the breach (or suspected breach) may constitute an NDB. Accordingly, the Privacy Officer will issue pre-emptive instructions as to whether the data breach should be managed at the local level or escalated to the Data Breach Response Team (Response Team). This will depend on the nature and severity of the breach.

3.3.1 Data breach managed at the Directorate/Faculty/Institute level

Where the Privacy Officer instructs that the data breach is to be managed at the local level, the relevant Member of the Executive must:

• Ensure that immediate corrective action is taken, if this has not already occurred (corrective action may include: retrieval or recovery of the personal information, ceasing unauthorised access, shutting down or isolating the affected system); and
• Submit a report via the Privacy Coordinator within 48 hours of receiving instructions under 3.3. The report must contain the following:

• Description of breach or suspected breach
• Action taken
• Outcome of action
• Processes that have been implemented to prevent a repeat of the situation.
• Recommendation that no further action is necessary

The Privacy Officer will be provided with a copy of the report and will sign-off that no further action is required.

The report will be logged by the Privacy Coordinator.

3.3.2 Data breach managed by the Response Team

Where the Privacy Officer instructs that the data breach must be escalated to the Response team, the Privacy Officer will convene the Response Team and notify the Management.

The Response team will consist of:

• Privacy Coordinator
• Team lead
• Director of Information Technology (or nominee)
• Director of Marketing and External Relations (or nominee)

3.4 Primary role of the Response Team

There is no single method of responding to a data breach and each incident must be dealt with on a case by case basis by assessing the circumstances and associated risks to inform the appropriate course of action.

The following steps may be undertaken by the Response Team (as appropriate):

• Immediately contain the breach (if this has not already occurred). Corrective action may include: retrieval or recovery of the personal information, ceasing unauthorised access, shutting down or isolating the affected system.
• evaluate the risks associated with the breach, including collecting and documenting all available evidence of the breach having regard for the information outlined in sections 3.2.1 and 3.2.2 above.
• Call upon the expertise of, or consult with, relevant staff in the particular circumstances.
• Engage an independent cyber security or forensic expert as appropriate.
• Assess whether serious harm is likely (with reference to section 3.2.2 above and section 26WG of the NDBAct).
• Make a recommendation to the Privacy Officer whether this breach constitutes an NDB for the purpose of mandatory reporting to the OAIC and the practicality of notifying affected individuals.
• Consider developing a communication or media strategy including the timing, content and method of any announcements to students, staff or the media.

The Response Team must undertake its assessment within 48 hours of being convened. The Privacy Officer will provide periodic updates to the Vice-Chancellor as deemed appropriate.

3.5 Notification

Having regard to the Response team’s recommendation in 3.4 above, the Privacy Officer will determine whether there are reasonable grounds to suspect that an NDB has occurred

If there are reasonable grounds, the Privacy Officer must prepare a prescribed statement and provide a copy to the OAIC as soon as practicable (and no later than 30 days after becoming aware of the breach or suspected breach).

Ifpracticable, JRBS must also notify each individual to whom the relevant personal information relates. Where impracticable, JRBS must take reasonable steps to publicise the statement (including publishing on the website).

The prescribed statement will be logged by the Privacy Coordinator.

3.6 Secondary Role of the Response Team

Once the matters referred to in 3.4 and 3.5 have been dealt with, the Response team should turn attention to the following:

• Identify lessons learnt and remedial action that can be taken to reduce the likelihood of recurrence – this may involve a review of policies, processes, refresher training.
• Consider the option of an audit to ensure necessary outcomes are affected and effective

In line with the JRBS Management Policy, this procedure is scheduled for review every five years or more frequently if appropriate.

Date Major or Minor Revision Description of Revision(s)

Contact for all matters related to privacy, including complaints about breaches of privacy, should be directed as follows:
Privacy Coordinator E: info@jrboonsolutions.com.au
W: www.jrboonsolutions.com.au
T: +61 3 6111 5077
P: Ground Floor, 470 St Kilda Road,Melbourne. VIC 3004.