privacy POLICY
Effective date: 1 January 2025 | Version 2.0
1. Our commitment to your privacy
The Victor Chang Foundation (ACN 002 762 745, ABN 18 002 762 745); ("VCF", "we", "us" or "our") was founded by Dr Victor Chang AC in 1984 to advance cardiac surgery through education, training and innovation. We value the trust of our donors, supporters, Fellows and partners, and we are committed to handling personal information openly, responsibly and securely.
This policy explains what personal information we collect, why we collect it, how we use, share and protect it, and how you can access or correct it or make a complaint. We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and, where we hold health information, the Health Records and Information Privacy Act 2002 (NSW).
Please note: The Victor Chang Foundation is a separate organisation from the Victor Chang Cardiac Research Institute. This policy applies only to the Victor Chang Foundation. We do not share supporter information with the Institute.
2. Who this policy applies to
This policy applies to personal information we handle about:
• donors, regular givers and other supporters;
• people who leave a gift in their Will, and the executors and solicitors of estates;
• fundraisers and participants in events and community campaigns we run or benefit from;
• newsletter subscribers and people who contact us or follow us on social media;
• applicants for, and recipients of, our surgical Fellowships and innovation grants, and their referees;
• partner organisations, sponsors and their contacts;
• volunteers, contractors, job applicants, directors and company members; and
• visitors to our website.
3. Key terms
Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether or not it is true and whether or not it is recorded in a material form.
Sensitive information is a special category of personal information that includes information about a person's health, racial or ethnic origin, religious beliefs, criminal record and membership of professional associations. Health information is a type of sensitive information. We only collect sensitive information with your consent or where the law allows it.
4. What personal information we collect
The information we collect depends on how you interact with us. It may include:
• Donors and supporters: your name, postal and email address, phone number, date of birth (if provided), donation history, payment method and the last digits of your card (not full card numbers), communication preferences, and any reason you tell us for giving (for example, a gift in memory of a loved one).
• Gifts in Wills: your intentions (if you choose to tell us), and correspondence with executors, trustees and solicitors administering an estate.
• Fundraisers and event participants: registration details, fundraising page details and amounts raised, usually supplied to us by the event or fundraising platform.
• Fellowship and grant applicants and recipients: contact details, CV, qualifications, surgical training and employment history, professional registration, referee reports, passport and visa details, and information needed for a hospital placement, such as health, immunisation or criminal history checks required by the host hospital. This may include sensitive information.
• Partners, volunteers, contractors and job applicants: contact and role details, and information relevant to engagement or recruitment.
• Website visitors: technical and usage information collected through cookies and analytics (see section 12).
• Photos, video and stories: images or stories of Fellows, supporters and event participants, which we only publish with consent.
5. How we collect personal information
Wherever reasonable and practicable, we collect personal information directly from you, for example when you donate, sign up to our newsletter, apply for a Fellowship or grant, attend an event, or contact us by email, phone, post, our website or social media.
Sometimes we receive personal information from third parties, including:
• fundraising and event platforms (for example, when you raise funds for VCF through a community event such as City2Surf);
• payment and donation processors;
• host hospitals, universities and referees in connection with Fellowships and grants;
• executors and solicitors administering an estate; and
• publicly available sources, such as professional registers or published information about a Fellowship applicant's training.
When we collect information about you from someone else, we take reasonable steps to make sure you are aware of it. If we receive personal information we did not ask for, and it is not reasonably necessary for our activities, we will destroy or de-identify it as soon as practicable, where lawful to do so.
6. Why we collect and use personal information
We collect, hold and use personal information to:
• process donations and issue tax-deductible receipts;
• thank and recognise supporters, where you agree to be recognised;
• keep you informed about our work, appeals, events and impact;
• manage gifts in Wills and estate administration;
• assess, award, administer and report on Fellowships and grants, including arranging hospital placements and visas;
• work with partners, sponsors, volunteers and contractors;
• improve our website, communications and programs;
• meet our legal, tax, audit and regulatory obligations, including to the ACNC and the ATO; and
• respond to enquiries, feedback and complaints.
If you do not provide the information we ask for, we may not be able to process your donation, issue a tax receipt, consider your application or respond to your enquiry.
We will only use or disclose your personal information for another purpose if you consent, if you would reasonably expect it and it is related to the original purpose, or if the law requires or allows it.
7. Direct marketing and your choices
We may contact you by email, post, phone or SMS with news, appeals and event invitations, where you have agreed to this or where the law otherwise allows it. We comply with the Spam Act 2003 (Cth) and the Do Not Call Register Act 2006 (Cth).
You can opt out at any time by using the unsubscribe link in any email, or by contacting us (see section 20). We will action your request promptly. We never sell, rent or swap our supporters' personal information.
8. Sensitive information
We only collect sensitive information, including health information, where it is reasonably necessary for our activities and you consent, or where the law requires or allows it. In practice, this mostly relates to Fellowship recipients, where host hospitals require health, immunisation or criminal history checks before a placement. Sensitive information is only accessed by people who need it for that purpose.
9. Who we share personal information with
We may disclose personal information to:
• service providers who help us operate, such as our donation and payment processors (Donorbox, Stripe and PayPal), email and CRM platform (Brevo), website host (Squarespace), online forms provider (Cognito Forms), IT, mailing and printing providers;
• our accountants, auditors, legal and other professional advisers, and insurers;
• host hospitals, universities and training bodies involved in our Fellowships and grants, including a Fellow's home institution;
• event organisers and fundraising platforms, where relevant to your participation; and
• government agencies and regulators (such as the ATO, ACNC or law enforcement) where required or authorised by law.
We require our service providers to protect personal information and use it only for the services they provide to us.
10. Overseas disclosure
Some of our service providers store or process information outside Australia. As a result, personal information may be held or accessed in the United States. In addition, because our Fellowships train surgeons from across Asia, information about Fellowship applicants and recipients may be shared with their home institutions in countries including China and Japan.
We take reasonable steps to ensure overseas recipients handle personal information in a way that is consistent with the APPs.
11. Online donations and payment security
Online donations are processed through a secure, PCI-DSS compliant payment provider (Stripe or PayPal via Donorbox). Your full card details are entered directly into the provider's secure system and are not stored by VCF. We receive the details needed to record and receipt your gift, such as your name, contact details, donation amount and date.
12. Our website, cookies and analytics
Our website uses cookies (small files placed on your device) and similar technologies. We use them to:
• make the website work properly, including our donation pages;
• understand how visitors use our website, using tools such as Google Analytics and
• measure and improve our advertising, including through Google Ads and Meta (Facebook and Instagram), which may show you VCF messages on other websites and platforms.
Analytics information is generally reported in aggregate and does not identify you personally. You can manage or block cookies through your browser settings, opt out of Google Analytics using Google's browser add-on, and manage ad preferences in your Google and Meta account settings. Blocking some cookies may affect how our website works.
Our website may link to other websites. We are not responsible for their privacy practices, and we encourage you to read their privacy policies.
13. Social media
We communicate through platforms including Facebook, Instagram and LinkedIn. When you interact with us on these platforms, the platform's own privacy policy also applies to how it handles your information. Please do not share sensitive information with us through public comments.
14. Anonymity and pseudonyms
You can browse our website and make general enquiries without identifying yourself. You can also ask for your donation to be recorded anonymously or ask not to be publicly acknowledged. However, we need your name and contact details to issue a tax-deductible receipt, and we cannot consider Fellowship or grant applications anonymously.
15. How we store and protect personal information
We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. These include access controls limited to authorised people, multi-factor authentication on key systems, secure cloud-based platforms, and secured storage for any paper records. Our directors, staff, contractors and volunteers are required to keep personal information confidential.
No method of transmitting information over the internet is completely secure, so we cannot guarantee the security of information you send to us online.
16. How long we keep personal information
We keep personal information only for as long as we need it for the purposes described in this policy, or as required by law. For example, we keep financial and donation records for at least seven years to meet our tax and charity reporting obligations. Records about unsuccessful Fellowship and grant applications are kept for 3 years. When information is no longer needed, we securely destroy or de-identify it.
17. Data breaches
If we become aware of a data breach involving personal information we hold, we will act promptly to contain and assess it. If the breach is likely to result in serious harm, we will notify the people affected and the Office of the Australian Information Commissioner (OAIC) in line with the Notifiable Data Breaches scheme. If you think your information held by us has been compromised, please contact us straight away.
18. Automated decisions and artificial intelligence
VCF does not use computer programs, including artificial intelligence, to make decisions that could significantly affect your rights or interests without human involvement. All decisions about Fellowships, grants and other matters that affect individuals are made by people. We use AI tools only in line with our AI Policy, and we do not enter supporters' sensitive information into public AI tools.
19. Accessing and correcting your information
You can ask to see the personal information we hold about you, or ask us to correct it or update your communication preferences, by contacting us (see section 20). We will need to verify your identity. We will respond within 30 days and there is no charge for making a request. If we cannot give you access or make a correction, we will explain why in writing, unless it would be unreasonable to do so.
20. Questions, complaints and contacting us
If you have a question or complaint about how we have handled your personal information, please contact us:
• Email: info@victorchangfoundation.com.au
• Post: Victor Chang Foundation, 48 Kensington Street, Chippendale NSW 2008
Please give us as much detail as you can. We will acknowledge your complaint within 7 days and aim to respond in full within 30 days. If we need longer, we will tell you why and when to expect a response.
If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner at www.oaic.gov.au or on 1300 363 992.
21. Changes to this policy
We review this policy at least every two years, or sooner if our practices or the law change. The current version will always be available on our website, and changes take effect when published. If we ever plan to use personal information in a way that is significantly different from what we told you when we collected it, we will let you know beforehand by email or with a clear notice on our website. This policy was last updated on 01 January 2025.