Privacy Policy

Mindful Health Foundation Privacy Policy

Version 1.0
Last Updated: 29 August 2026
Effective from publication

1. Our commitment to privacy

Mindful Health Foundation (“Mindful Health”, “MHF”, “we”, “our” or “us”) is committed to treating personal information responsibly, respectfully and transparently.

Our work is built around public benefit, health education, evidence-informed information, community participation and responsible governance. Protecting the information entrusted to us is part of maintaining that trust.

We manage personal information in accordance with applicable Australian privacy laws, including the Privacy Act 1988 (Cth) and the Australian Privacy Principles where they apply to us. We also use those principles, together with guidance from the Australian Charities and Not-for-profits Commission, as a benchmark for good information-management practice.

This policy explains how we collect, hold, use, disclose, protect and manage personal information.

Privacy enquiries may be directed to:

Mindful Health Foundation
Email: support@mindfulhealth.org.au

2. What is personal information?

Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable.

Depending on the circumstances, personal information we handle may include a person’s name, contact details, professional information, qualifications, interests, participation records, communications with us and other information connected with their relationship with Mindful Health Foundation.

Some information may be considered sensitive information under Australian privacy law. Examples can include health information and information about certain personal characteristics, beliefs, associations or circumstances.

We aim to collect sensitive information only where it is reasonably necessary for our activities, lawful to collect and, where required, collected with the person’s consent.

3. The information we may collect

The kinds of personal information we may collect depend on how a person interacts with us.

For website visitors and members of the public, this may include contact details, enquiries, feedback, newsletter or communication preferences, event or program registrations, website interactions and information voluntarily submitted through a form.

For volunteers, committee members, reviewers, advisers, contributors and prospective participants, this may include identity and contact details, professional role, organisation, qualifications, professional experience, areas of expertise, professional registration details where relevant, availability, declared conflicts of interest, governance acknowledgements, consent records, review assignments, review comments and participation history.

Where public recognition has been specifically authorised, we may also hold an approved biography, professional title, organisation information, website or professional profile links, headshot, organisation logo and records of the permissions granted for their use.

For supporters, donors, partners, funders, suppliers and other organisations we work with, we may collect relevant contact, relationship, transaction, correspondence and administrative information.

We do not seek to collect information merely because it might become useful in the future. We aim to collect only the information reasonably necessary for a defined purpose.

4. How we collect information

We usually collect personal information directly from the individual.

This may occur when a person completes a website or onboarding form, contacts us by email or another communication channel, registers for an activity, participates in a program or event, volunteers with us, provides feedback, contributes to governance or editorial activities, subscribes to communications, or otherwise interacts with Mindful Health Foundation.

In limited circumstances, information may be provided to us by another person, organisation or publicly available professional source. Where appropriate, we will take reasonable steps to ensure the individual is aware of the collection and its purpose.

People providing information about another person should only provide information they are authorised to share and should avoid supplying unnecessary sensitive information.

Where practicable and appropriate, people may interact with us anonymously or using a pseudonym. Identification may be necessary where we need to verify a person’s identity, qualifications, authority, eligibility, consent or involvement in a governance, volunteer or operational process.

5. Why we collect and use personal information

We may collect, hold and use personal information to carry out the charitable, educational, governance and community activities of Mindful Health Foundation.

This can include responding to enquiries; administering programs, events and activities; communicating with supporters and participants; managing volunteers and contributors; assessing suitability for governance or review roles; verifying relevant qualifications or credentials where appropriate; matching subject-matter expertise to appropriate research or content reviews; recording conflicts of interest; documenting review, approval and governance processes; operating the Health Digital Library; managing partnerships; improving our resources and services; maintaining appropriate organisational records; managing complaints and feedback; protecting our systems and users; and meeting legal, regulatory, contractual and governance obligations.

We may use aggregated or de-identified information for evaluation, reporting, service improvement, research, planning or statistical purposes where individuals are no longer reasonably identifiable.

We will not use personal information for an unrelated purpose where doing so would be inconsistent with the person’s reasonable expectations, consent or applicable law.

6. Volunteer, governance and editorial information

Mindful Health Foundation maintains records necessary to operate its volunteer governance and editorial processes responsibly.

Submitting an expression of interest, onboarding form or consent form does not automatically make a person a Governance Committee member, authorised reviewer, approver, publisher or Wix collaborator.

We may use onboarding information to assess suitability, verify relevant credentials where appropriate, understand areas of expertise, manage conflicts of interest, assign suitable review activities, maintain governance records and communicate with the participant.

Public recognition permissions are separate from operational participation. Declining public recognition does not prevent a person from being considered for a volunteer governance or review role.

Where a person changes or withdraws an optional public-recognition permission, we will apply that change to future uses within our reasonable control. Material already lawfully published, distributed or archived may not always be capable of being completely recalled.

7. Public profiles and community recognition

We do not assume that a volunteer, reviewer, adviser or contributor wishes to be publicly identified.

A person’s name, professional title, biography, photograph, organisation, logo, professional links or contribution story will only be used publicly where the relevant permission has been provided or another lawful basis clearly applies.

Mindful Health Foundation works with Deals Colony as a Community Engagement Partner to assist the Foundation in connecting with, amplifying and engaging the wider community around its health, wellbeing and social-impact initiatives.

Where an individual has specifically selected the relevant community-recognition permission, Mindful Health Foundation may provide Deals Colony with the public-profile elements that the individual has separately authorised for that purpose.

We do not treat a general relationship with a partner as permission to disclose a volunteer’s personal information.

Deals Colony is responsible for its own privacy practices when it independently handles personal information. Its Privacy Policy and frequently asked questions are available on the Deals Colony website.

If Mindful Health Foundation proposes a materially different use or disclosure involving Deals Colony or another community partner, we will provide further information and obtain additional consent where appropriate.

8. When we disclose personal information

We may disclose personal information where reasonably necessary to operate Mindful Health Foundation and where the disclosure is permitted by law.

Recipients may include authorised MHF volunteers, Responsible People, committee members, reviewers or personnel who need the information for their role; technology, website, communications, cloud-storage and administrative service providers; professional advisers; contractors or service providers acting for us; regulators, government agencies or law-enforcement bodies where disclosure is required or authorised; and specifically identified community or project partners where the individual has consented or another lawful basis applies.

We do not sell personal information.

We do not provide personal information to unrelated third parties for their own marketing purposes without appropriate permission.

Access to internal information should be based on role and need. Membership of a committee or volunteer program does not automatically provide unrestricted access to personal information or MHF systems.

9. Overseas processing and storage

Some of the technology services used to operate Mindful Health Foundation may process or store personal information outside Australia.

Our website and Wix Forms infrastructure is provided by Wix. Wix is based in Israel and advises that personal information may be stored or processed through infrastructure or service providers in locations including the United States of America, Ireland and Israel, as well as other jurisdictions used in delivering its services.

Other technology or cloud providers we use may also operate infrastructure outside Australia.

Where personal information is likely to be disclosed to an overseas recipient, we aim to take reasonable steps appropriate to the circumstances to understand the provider’s privacy and security practices and to protect the information.

We will update this policy where material changes to our service providers or overseas information flows make additional disclosure appropriate.

10. Direct communications and marketing

We may send newsletters, Foundation updates, invitations, program information or other communications where a person has requested them, consented to receive them, or where the communication is otherwise permitted by law.

People may unsubscribe or ask us to stop sending optional communications at any time.

Operational communications necessary to administer an existing volunteer, governance, event, program or other relationship may continue where required for that purpose.

11. Website information, cookies and analytics

When someone visits our website, certain technical information may be collected automatically by our website platform or associated services.

This may include information such as browser or device characteristics, approximate location derived from technical data, pages visited, referring pages, session information and interactions with website features.

Cookies and similar technologies may be used for security, functionality, preferences, website performance and analytics.

Where legally required or appropriate, we will provide cookie choices or additional information about these technologies.

Browser settings may also allow users to control or delete certain cookies, although disabling some technologies may affect website functionality.

12. Security

We take reasonable organisational and technical measures to protect personal information from misuse, interference, loss, unauthorised access, modification and disclosure.

Measures may include access controls, role-based permissions, password and account protections, secure technology providers, appropriate storage practices, limited access to confidential material, staff and volunteer guidance, governance processes and review of information-handling practices.

No electronic system can be guaranteed to be completely secure. We therefore also aim to minimise the amount of personal information we collect and retain.

People participating in governance or editorial activities may be required to protect unpublished material, personal information and confidential organisational information entrusted to them.

13. Data breaches

If we become aware of a suspected loss, unauthorised access or disclosure involving personal information, we will assess and respond to the incident as appropriate.

Our response may include containing the incident, investigating what occurred, assessing potential harm, taking steps to reduce further risk, reviewing affected systems or practices and communicating with affected individuals where appropriate.

Where the Notifiable Data Breaches scheme or another legal notification requirement applies, we will take the steps required by law, including notifying the Office of the Australian Information Commissioner and affected individuals where required.

14. How long we keep information

We retain personal information only for as long as it is reasonably needed for the purpose for which it was collected, a related legitimate organisational purpose, or a legal, regulatory, contractual, governance, insurance or record-keeping requirement.

Governance records may need to be retained after a person stops volunteering where they form part of the Foundation’s evidence of consent, conflict management, research review, approval, publication or organisational decision-making.

When personal information is no longer reasonably required and there is no legal or governance reason to retain it, we will take reasonable steps to securely destroy it or de-identify it.

Retention decisions should take into account both the value of the record and the privacy and security risk created by continuing to hold it.

15. Accessing or correcting personal information

Individuals may contact Mindful Health Foundation to request access to personal information we hold about them or to ask that inaccurate, out-of-date, incomplete, irrelevant or misleading information be corrected.

Requests can be sent to support@mindfulhealth.org.au.

We may need to verify the requester’s identity before providing access or making changes.

There may be circumstances in which access cannot be provided in full, for example where doing so would unreasonably affect another person’s privacy, reveal confidential material that cannot appropriately be disclosed, or where an Australian law permits or requires us to refuse access.

Where appropriate, we will explain the reason for a refusal.

16. Changing or withdrawing consent

Where our handling of personal information relies on consent, an individual may contact us to change or withdraw that consent.

Withdrawal generally applies to future handling and does not necessarily invalidate uses or disclosures that were lawful before the withdrawal.

For volunteer and governance participants, withdrawing a consent that is essential to administering the role may mean that we can no longer continue or activate that person’s participation.

Optional public-profile and community-recognition permissions remain separate from core governance participation.

17. Privacy enquiries and complaints

Anyone who has a question or concern about the way Mindful Health Foundation has handled personal information may contact us at support@mindfulhealth.org.au.

Please provide enough information for us to understand the issue and, where relevant, identify the information or interaction concerned.

We will aim to acknowledge and investigate privacy complaints promptly, deal with them fairly and communicate the outcome within a reasonable period.

If a person is not satisfied with our response and the Privacy Act applies to the matter, they may also be able to raise the matter with the Office of the Australian Information Commissioner.

18. Children and young people

Some Mindful Health Foundation resources and initiatives may be intended for or accessible to young people.

Where we intentionally collect personal information from a child or young person, we will take reasonable steps appropriate to their age, maturity, circumstances and the nature of the information involved.

Where appropriate, this may include providing age-appropriate explanations, minimising the information collected and involving a parent, guardian or other authorised adult.

We will exercise particular care where sensitive information about a child or young person is involved.

19. Third-party websites and services

Our website and communications may link to third-party websites, research databases, publishers, community organisations, social media services or other external platforms.

Mindful Health Foundation is not responsible for the independent privacy practices of those third parties.

People should review the privacy information of an external service before providing personal information to it.

20. Governance and accountability

Responsible information management is a governance responsibility, not only a technology issue.

Mindful Health Foundation aims to ensure that people with access to personal information understand the limits of their role, that access is proportionate to need, that conflicts and confidentiality are appropriately managed and that information-management practices are periodically reviewed.

We aim to consider privacy and security risks when introducing new systems, forms, partnerships and programs.

Where our information-handling practices materially change, we will review this policy and related collection notices.

21. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our activities, technology, partnerships, legal obligations or information-management practices.

The current version will be made freely available through the Mindful Health Foundation website and will show its version or most recent update date.

Material changes may also be communicated through other appropriate channels.

22. Contact us

For privacy enquiries, requests for access or correction, consent changes or privacy complaints, contact: