1. About this policy

IMgateway.net is operated by UNITYHEALTH PTY LTD (ACN 096 381 949), referred to in this policy as "IMgateway", "we", "us" or "our".

We respect your privacy and are committed to protecting your personal information. This policy explains how we collect, use, store and disclose personal information when you use the IMgateway website, mobile application, learning management system and related services.

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

2. Personal information we collect

Depending on how you use IMgateway, we may collect:

• your first and last name;
• your email address;
• your mobile telephone number;
• your profession and professional details;
• the workplace or organisation with which you are associated;
• your membership and account status;
• your account identifiers and login information;
• your training enrolments, progress, completion results and completion dates;
• information about certificates or continuing professional development activities;
• technical information about your device, operating system and application version;
• email delivery and engagement information; and
• application, security and server log information.

We only collect information that is reasonably necessary to operate IMgateway and provide our services.

3. How we collect personal information

We may collect personal information:

• directly from you when you register, update your account or contact us;
• when you use the IMgateway website, application or learning modules;
• from your clinic, employer, professional organisation or another organisation that arranges access for you;
• from the learning management system as you enrol in and complete training;
• through automated application and server logs; and
• from service providers that assist us with communications, hosting, support or notification delivery.

If you do not provide requested information, we may be unable to create or maintain your account, provide training, issue completion records or deliver other features of the service.

4. How we use personal information

We may use personal information to:

• create, authenticate and administer your account;
• provide access to learning modules and other IMgateway services;
• enrol you in training and record your progress and completion;
• issue certificates or other evidence of completed training;
• synchronise training records between our systems;
• associate your account with your clinic, workplace or professional group;
• provide service, account and training-related communications;
• send email campaigns where permitted;
• send push notifications when you have enabled them;
• provide technical support and respond to enquiries;
• maintain the security, reliability and performance of our systems;
• investigate faults, suspected misuse or security incidents;
• analyse participation and improve our learning content and services;
• meet our contractual and legal obligations; and
• exercise or defend legal rights.

We do not sell or rent members’ personal information.

5. Disclosure to service providers and other parties

We may disclose personal information to trusted service providers where reasonably necessary to operate IMgateway. These providers may include:

• Australian hosting and infrastructure providers;
• learning management and training-system providers;
• email campaign and communications providers;
• Apple, Google, Firebase and Expo for push-notification delivery;
• technical support, security and professional service providers;
• participating companies in the limited circumstances described in Section 5; and
• regulators, law-enforcement bodies or other parties where disclosure is required or authorised by law.

Service providers may only use the information for the services they provide to us, subject to their contractual and legal obligations.

We do not sell or rent personal information to third parties.

6. Email communications and direct marketing

We use ActiveCampaign to manage email campaigns and member communications.

Only a member’s first name and email address are provided by IMgateway to ActiveCampaign. ActiveCampaign may also generate information about email activity, such as whether an email was delivered or opened, whether a link was selected and whether the member unsubscribed.

ActiveCampaign contact data for IMgateway is primarily hosted in Australia. ActiveCampaign and its service providers may nevertheless access or process limited information outside Australia when providing support, security, email delivery or related services.

Members may unsubscribe from marketing emails using the unsubscribe link included in those emails. Unsubscribing from marketing does not prevent us from sending essential account, service, security or training-related communications where appropriate.

Completion information provided to a participating company under Section 5 is not provided for marketing purposes.

7. Australian hosting and overseas processing

The principal IMgateway systems are hosted in Australia. This includes:

• the IMgateway API database;
• the learning management and training database;
• system backups; and
• application and server logs.

Some third-party services used by IMgateway may process or access limited information outside Australia. These services include:

• Apple Push Notification service;
• Google Firebase Cloud Messaging;
• Expo push-notification services; and
• ActiveCampaign and its support or infrastructure providers.

For push notifications, this information is generally limited to device identifiers, push tokens, platform information, message-delivery information and notification content.

For email communications, overseas processing may include a member’s first name and email address, together with email delivery and engagement information generated by ActiveCampaign.

Where practical, we select Australian hosting regions and take reasonable steps to ensure that third-party providers protect personal information consistently with applicable Australian privacy requirements.

8. Storage and security

We take reasonable technical and organisational measures to protect personal information against misuse, interference, loss and unauthorised access, modification or disclosure.

These measures may include:

• access controls and authentication;
• encrypted network connections;
• controlled database and server access;
• system monitoring and logging;
• backups and recovery processes; and
• limiting staff and service-provider access according to operational requirements.

No electronic storage or transmission system is completely secure. If we become aware of a data breach, we will assess and respond to it in accordance with applicable legal requirements, including the Notifiable Data Breaches scheme where relevant.

Users are responsible for keeping their login details secure and should notify us promptly if they believe their account has been accessed without permission.

9. Retention and deletion

We retain personal information for as long as reasonably necessary to:

• provide and administer the IMgateway service;
• maintain training and completion records;
• meet contractual, legal, accounting and reporting obligations;
• resolve disputes;
• prevent fraud or misuse; and
• maintain system security and continuity.

Retention periods may vary depending on the type of information and the reason it was collected.

When information is no longer reasonably required, we take reasonable steps to delete it or make it anonymous, unless we are required or permitted by law to retain it.

Removing the mobile application from a device does not automatically delete the member’s IMgateway account or training records. Members may contact us to request account deletion. Some information may need to be retained where required by law or for legitimate record-keeping purposes.

10. Accessing and correcting personal information

You may request access to the personal information we hold about you or ask us to correct information that is inaccurate, incomplete or out of date.

Some account information may be updated directly through the IMgateway service. Other requests may be submitted using the contact details in Section 14.

We may need to verify your identity before providing access or making a correction. In limited circumstances, we may decline a request where permitted by law. If that occurs, we will generally explain the reason and the available complaint options.

11. Privacy enquiries and complaints

If you have a question or complaint about how we handle personal information, please contact us using the details in Section 14.

We aim to acknowledge a privacy complaint within five working days and generally provide a substantive response within 30 calendar days. If we require additional time because the matter is complex, we will notify you.

We will investigate complaints fairly and take reasonable steps to resolve any identified issue.

If you are dissatisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) through www.oaic.gov.au.

12. Third-party websites and services

IMgateway may contain links to third-party websites or services. Those third parties are responsible for their own privacy practices.

We encourage you to review the privacy policy of a third-party service before providing personal information to it. This policy does not govern third-party services that are not controlled by IMgateway.

13. Changes to this policy

We may update this privacy policy from time to time to reflect changes to our services, technology, providers or legal obligations.

The current version will be made available through the IMgateway application or website. Where a change is significant, we may also notify members through the application, by email or by another reasonable method.

14. Contact us

For privacy enquiries, access or correction requests, complaints or account-deletion requests, contact: