VaccinateWA Privacy Policy

VaccinateWA is provided by the Department of Health (also called WA Health) in Western Australia as part of the State's measures to vaccinate against COVID-19 and other diseases.

Do not use this site:

• if you are under 16 – any use of, or access to VaccinateWA by those under 16 years of age is not permitted and violates the Terms of Use.
• outside Western Australia – VaccinateWA is designed for use only within Western Australia, and any use outside Western Australia is not permitted.

Questions or concerns. If you have any questions, or concerns about VaccinateWA, please call 13 COVID (26843).

Privacy Policy

What this Policy is about. The VaccinateWA Privacy Policy sets out how the WA Health collects, processes, holds, discloses and uses personal information of people who access and use the VaccinateWA site and any associated website or software (collectively referred to as VaccinateWA).

This Policy also outlines your choices, consent and limitations regarding use, access and disposal of personal information.

Deloitte Consulting Pty Ltd (Deloitte) and SFDC Australia Pty Ltd (Salesforce) are the Department's service providers. Deloitte and Salesforce assist WA Health with VaccinateWA. Deloitte and Salesforce has committed to collecting, holding and using your VaccinateWA information in line with this Policy and all other applicable WA Health policies.

Your consent. By using or accessing VaccinateWA, you are agreeing that WA Health, Deloitte and Salesforce may collect, use, hold and disclose your personal information as set out in this Policy.

If you don't agree to this Privacy Policy, then do not access or use VaccinateWA.

Changes to this Policy. WA Health may update this Policy from time to time. If WA Health changes this Policy, it may notify you when you next use VaccinateWA.

If you don't agree with the changes, then do not use VaccinateWA. If you continue to use VaccinateWA, the updated Policy will apply from the time it was changed.

How VaccinateWA works

What it does. VaccinateWA allows people to register to receive a vaccination.

People can use VaccinateWA to:

• create an account;
• provide your details;
• complete a health questionnaire;
• provide consent;
• register to receive a vaccination;
• update your details, and;
• book a vaccination appointment.

For more information on VaccinateWA and what you need to do to use it, see the VaccinateWA Terms of Use.

Information this site collects about you

Individuals. When you create an account for VaccinateWA, the system asks you to provide your details, including:

• name;
• date of birth;
• whether you identify as Aboriginal or Torres Strait Islander;
• email address;
• mobile phone number; and
• other contact details.

When registering to receive a vaccination, the VaccinateWA process also requires you to complete a health questionnaire which includes questions about:

• your vaccination history;
• your current health related to the vaccination and;
• any previous vaccination adverse reactions.

At the end of the registration process you will be asked to provide your consent to receive the vaccine and for WA Health to contact you after the vaccination takes place.

If you consented to receive a vaccine, you may be provided with the opportunity to book a vaccination appointment at a WA Health vaccination clinic. This booking captures the location, date and time of the appointment.

Other information. VaccinateWA also collects other information about you such as information regarding requests you have made for support and links clicked from within system generated emails.

How your personal information is used

WA Health and partner vaccination providers use your personal information to prepare for and administer vaccines you have registered and consented to receive.

Your information may also be used to:

• respond to your comments and questions;
• resolve your support incidents; and
• send you related information.

WA Health and Deloitte will use your personal information to maintain, protect and improve VaccinateWA by:

• understanding and enhancing your experience of VaccinateWA; and
• protecting, investigating and deterring fraudulent, unauthorised or illegal activity.

WA Health will not, or ever, sell or share your personal information other than as detailed in this Policy.

How your personal information is stored

WA Health and Deloitte manage the storage of your information using Salesforce's systems. Deloitte and Salesforce are subject to both Australian and overseas laws that may require the disclosure of your information (in limited circumstances) to government authorities here and overseas.

Your information is encrypted before storing it with Salesforce to make it safer from external attack. Encryption is designed to make data unreadable - and to make it readable again only with the right encryption key. Only Deloitte and Salesforce hold the encryption keys;

Salesforce does not have access to, nor does it use, your information for any purpose other than providing the services required for the operation of VaccinateWA, and to maintain its own services; and

Deloitte requires all its service providers (including Salesforce) to agree to use personal information only for the purpose of providing and maintaining their services.

Yourinformation will be stored confidentially as required in accordance with the State Records Act 2000 and any other applicable State and Commonwealth legislation.

Other use and disclosure and storage of your information

You consent to the information collected from you using the VaccinateWA site being disclosed to, and used by:

• officers and authorities with powers and responsibilities in relation to COVID-19 (and those helping them) such as the State Emergency Coordinator, the Chief Health Officer and other health authorities for the purpose of overseeing and managing WA's COVID-19 response;
• those to whom WA Health must (by law) disclose your information (e.g. a court or tribunal, or another government body); and
• users of WA Health’s Snowflake data platform with authorised access to the VaccinateWA data collection for the purpose of overseeing and managing WA's COVID-19 response;
• OwnBackup, Pty Ltd to enable scheduled backups of Salesforce data. Backup data is encrypted and stored in the OwnBackup AWS environment in the Australia region.
• Adaptus, Pty Ltd to enable anti-malware scanning of files uploaded into the Salesforce envrionment. Uploaded files are scanned by servers in the Adaptus AWS environment in the Australia region.
• Skedulo Pty Ltd to manage vaccination appointment bookings. Data synchronisation between Salesforce and Skedulo ensures name, contact and appointment booking information is accurate. Skedulo data is stored in the Skedulo AWS environment in the Australia region.
• Baidam Solution Pty Ltd provides Akamai's peak surge and security protection services for WA Health's VaccinateWA platform.
• The Trustee for the SmartX Data Unit Trust (trading as SmartVax), who actively monitor the safety of vaccines, and who use and disclose your personal information for the purpose(s) for which it was collected, or as otherwise permitted by law. Refer to the SmartVax Privacy Policy at https://www.smartvax.com.au/wp-content/uploads/2019/12/POLICY-SmartVax-Privacy-Policy.pdf for further information (external link);
• Australian Immunisation Register (AIR), the national register where your vaccinations are recorded operated by Services Australia, pursuant to the Australian Immunisation Register Act 2015 (Cth) which outlines what kind of personal and sensitive information is collected, and for what purpose(s). Refer to the Services Australia Privacy Policy at https://www.servicesaustralia.gov.au/organisations/about-us/corporate-publications-and-resources/privacy-policy for further information (external link);
• WA Health’s other service providers for the purpose of assisting it to operate, manage and use the VaccinateWA system.

Deloitte obligations

Deloitte is responsible for:

• taking reasonable steps to ensure the security of your personal information while it is being collected by, stored or passing through VaccinateWA;
• making sure links from VaccinateWA to other systems and websites are secure; and
• handling your personal information in accordance with privacy laws.

But, while Deloitte will exercise reasonable care, it is not responsible for any loss as a result of your use, or your inability to use, VaccinateWA. This includes any loss, damage, cost or expense, including loss of profits or income, loss or denial of opportunity, loss of use and loss of data.

Your other rights

Access to your personal information. You have the right to access personal information that is collected about you through your use of VaccinateWA. To access your personal information, please call 13 COVID (26843).

Correcting your personal information. If you believe that personal information that is held about you in connection with VaccinateWA is incorrect, incomplete or out-of-date, then please update your details through the VaccinateWA site or call 13 COVID (26843) with the correct, updated information.

Complaints. If you have any enquiries or complaints regarding this privacy policy or the way your personal information is handled, please call 13 COVID (26843).

Contact. For all enquiries relating to VaccinateWA, call 13 COVID (26843).