Privacy Policy

Who we are (APP 1)

The Australian Veteran Community (AVC) is a veteran-run advocacy organisation. We record what veterans, families and DVA-funded providers experience, and we use that evidence to hold the system to account. This policy explains what we collect, why, how we store it, who else can see it, and what you can do about it. If any part of it is unclear, ask us — we will explain it.

You can stay anonymous (APP 2)

You do not have to tell us who you are. The submitter portal works with a login that is independent of your real identity: use any email address you control, choose a pseudonym, and set your record to anonymous. We only need an email address so you can get back into your account and so we can send you a security notice if we ever have to.

You can also raise an issue with us without an account at all, though we then cannot show you what we hold or let you edit it.

What we collect (APP 3, APP 4, APP 5)

We collect only what we reasonably need for our advocacy work:

• Contact and account details — email address, and a name and phone number only if you give them.
• Case information — what happened with DVA or a provider, dates, the health and financial impact you choose to describe, and any DVA claim number you give us as evidence.
• Subscription details — name, email, postcode and state if you sign up for updates.
• Technical information — pages visited and approximate location through website analytics.

Every form that collects personal information shows a short collection notice immediately above the consent tick boxes, so you know who we are and what happens to the information before you type it — not buried behind a link.

If someone sends us information we did not ask for, we assess whether we could lawfully have collected it. If not, we destroy or de-identify it, and we review unsolicited material within 30 days.

Sensitive information and granular consent (APP 3, APP 6)

Health information — and information about membership of a professional association — is sensitive information under section 6(1) of the Privacy Act. It carries a higher bar than ordinary personal information, so we ask for your explicit consent before we collect it, and we record that consent with a timestamp.

We never use one blanket tick box. Each use of your information is a separate permission you can grant or withdraw at any time in the portal:

• Collect my sensitive information — I consent to AVC collecting health, service and claims information about me so my case can be recorded and advocated. Without this we cannot open a case.
• Use my case in de-identified statistics — AVC may count my case in aggregate evidence (for example, average delay times) with nothing that identifies me.
• Use my case publicly, named — AVC may quote my case publicly using my name — in submissions, media or to Parliament. You can withdraw this at any time.
• Contact me about my case — AVC may contact me using the details I provide, to follow up on my case or ask for more information.
• Refer my case for legal or advocacy support — AVC may share my case with an advocate, legal service or parliamentary office acting on veterans' behalf.

Withdrawing a consent stops that use from the moment you withdraw it. It does not undo something already lawfully published, but we will always discuss removal with you.

How we use and disclose it (APP 6, APP 8)

We use your information to respond to you, to record and advocate on your case, and to build de-identified evidence of systemic problems for submissions, media and Parliament. De-identified means we report the pattern in aggregate, with nothing that identifies you. We do not sell or rent personal information. We disclose it outside AVC only where you have separately consented, or where we are required by law.

Our systems are hosted in Sydney, Australia (ap-southeast-2). Where a supporting service processes data outside Australia, we take reasonable steps to ensure it handles your information consistently with the Australian Privacy Principles.

Direct marketing (APP 7)

We never use case information or sensitive information for direct marketing. Our newsletter is a separate, opt-in list, and every email includes a one-click unsubscribe link.

Storage, security and hosting (APP 11)

Information is held in an access-controlled database with row-level security, so a person can only reach records they are entitled to. Administrative accounts require multi-factor authentication. Evidence files are held in private storage. Access, content changes and security remediation are recorded in audit logs that cannot be edited or deleted. We keep information only as long as we need it for our advocacy work or as the law requires, and we destroy or de-identify it after that.

Government identifiers (APP 9)

We never adopt a government identifier as our own. Your record is identified by a system reference we generate. A DVA claim number, if you give us one, is stored only as a field of evidence inside your case.

Access, correction and deletion (APP 10, 12, 13)

Sign in to the portal and you can see everything we hold about you, edit it, download a copy, or delete a case outright. If information about you was submitted by someone else — a partner, an advocate, a provider — you can lodge a correction request. We respond to access and correction requests within 30 days, and we tell you in writing if we decline and why.

If something goes wrong

We maintain a data breach response plan under the Notifiable Data Breach scheme. If a breach is likely to cause serious harm, we contain it, assess it, notify the Office of the Australian Information Commissioner, and tell affected people what happened, what was involved and what to do. Because some people deal with us anonymously, we also publish breach notices inside the portal so you are told even where we hold no contact details for you. Given who our community is, we treat psychological harm as a serious harm in its own right.

Complaints

Privacy questions or complaints go to privacy@australianveterancommunity.com.au or (02) 6103 0948. We acknowledge complaints within 5 business days and respond within 30 days. If you are not satisfied, you can take it to the Office of the Australian Information Commissioner at oaic.gov.au or 1300 363 992.

If any of this has raised something distressing, Lifeline provides free 24-hour support on 13 11 14.