What is the purpose of this privacy supplement?

Epworth HealthCare and its related entities (Epworth) is committed to protecting the privacy and confidentiality of your personal information, including in the specific circumstances of the ongoing COVID-19 pandemic due to the severe acute respiratory syndrome coronavirus 2 (SARS-CoV-2). This document supplements our Privacy Policy (available at https://www.epworth.org.au/who-we-are/privacy-policy) and applies in respect of the personal information we collect in connection with a COVID-19 related purpose, including COVID-19 related health information that we collect from you or that you provide to us. To the extent our Privacy Policy applies to your personal information collected by Epworth, our Privacy Policy will continue to apply to this information except to the extent a narrower restriction is set out in this supplement.

By providing your COVID-19 related personal information to us, you consent (to the extent that we require your consent under privacy laws to do these things) to Epworth collecting, using and disclosing your personal information in accordance with this privacy supplement.

What additional personal information does Epworth collect regarding the COVID-19 pandemic?

The personal information that we may collect from employees, contractors, students, job applicants, service providers, patients, VMOs, other staff, volunteers, visitors, and others in connection with COVID-19 includes:

  • the results of any recent COVID-19 tests you have undertaken
  • information about whether you have been potentially exposed to a positive COVID-19 case 
  • your vaccination status (no vaccination, one dose, two doses and third or booster doses) and vaccine type
  • information about any bookings or appointments you have made to receive a COVID-19 vaccine
  • a copy of your vaccination certificate
  • if you provide us with evidence of a medical exemption from receiving the vaccine (if applicable), a copy of that evidence and the reason for the medical exemption
  • contact tracing information including information about who you may have been in close contact with while at our premises, and
  • a scan of your temperature (if it is above the acceptable range prescribed by the relevant health authorities we will note this).

Depending on your answers (and where temperature scanning is conducted, your result), or if you do not provide the requested information to us, you may be directed not to enter or remain on our premises or not to interact with us in-person at this time. For Epworth Personnel who are not vaccinated or who do not provide this information to us, please refer to the Epworth COVID-19 Staff Vaccination Protocol for further information.

Where we ask if you have been in contact with a confirmed COVID-19 case, we will generally only be asking for you to provide information that does not identify the person who is the confirmed COVID-19 case. If you provide us with personal information relating to another person (such as a next of kin), you warrant that you have informed that person of the information set out in the relevant collection form and this supplement and obtained their consent to disclose their information to us for use in accordance with our Privacy Policy and this supplement.

How Epworth uses this personal information

Epworth will use the personal information noted in this supplement to allow us to (as relevant):

  • comply with health and safety obligations and any legal requirement to collect this information
  • ensure the health and safety of individuals including our staff, contractors, patients and visitors, as well as the security of our premises
  • manage our facilities and staff rostering, while adapting to the constantly changing working and regulatory environments brought about the COVID-19 pandemic
  • make appropriate decisions in respect of rostering and work allocation in the safest reasonable manner
  • inform a third-party employer if we have refused one of their personnel entry to our premises
  • contact you (and your employer where you are providing third party services to, or at, Epworth), and report information including your contact details to appropriate health authorities, for COVID-19 contact tracing purposes, and
  • verify your COVID-19 test results, vaccine appointment bookings, vaccination status, vaccination certificate or medical exemption.

We may also use this personal information to create aggregated data sets, generally on an anonymised basis, to provide to health authorities and other third parties. We may analyse this aggregated data to help make decisions about our business and our workforce in a way that allows us to continue our work while protecting the health and safety of our people and our patients.

Who Epworth discloses this personal information to

Epworth may disclose this personal information to:

  • health authorities, to report to and assist health authorities to undertake contact tracing for COVID-19
  • other entities who are part of the Epworth group
  • other persons as necessary to enable contact tracing or to assist compliance with occupational health and safety obligations 
  • your employer (where you are providing third party services to, or at, Epworth), to inform them if we have refused you entry to or permission to remain on our premises
  • our third-party technology service providers who provide the capabilities for us to collect, and securely store and manage this COVID-19 related personal information, or
  • other third parties as set out in our Privacy Policy or if required by law.

We may also disclose de-identified, aggregated data sets publicly, for example to publicly disclose the percentage of vaccinated employees, workers, patients or visitors.

Will your personal information be transferred or disclosed overseas?

Ordinarily, Epworth will not transfer your personal information to any person or organisation outside Australia, without your permission. However, Epworth may enter into arrangements with service providers who may store some of Epworth’s data (which may include personal information) overseas. If we do, we will ensure we comply with any privacy law requirements that relate to cross border disclosures of personal information.

How we protect your personal information

Epworth has implemented measures to protect your personal information from misuse, interference, loss, unauthorised access, modification and disclosure as set out in our Privacy Policy.

We may retain your personal information for as long as necessary to fulfil the purposes we collected it for, unless a shorter or longer period is required by law, and except as specified below. Epworth will destroy or permanently de-identify any of your information which we no longer require for the purpose for which we collected it, provided we are not required under law or otherwise to retain the information.

Please note that all retention periods may be extended where required by law, where advised or requested by health authorities, or where we need to preserve and use personal information for the purposes of bringing or defending a legal claim. 

Our contact details

If you have any questions about this privacy supplement, you may contact us in any of the following ways:

By letter

Privacy Officer, Legal Services,
Epworth HealthCare Corporate Office,
c/- 89 Bridge Road, Richmond VIC 3121


Through the feedback form on the Patient Feedback page of our website.

Current as at 14 October 2021