In simple terms - We respect your privacy and handle your personal information carefully to support our work in children's cancer research while maintaining your trust.
The Children’s Cancer Institute (“we, us”) respect and value the trust you provide when we collect, use, disclose and store your personal or sensitive information.
This Privacy Statement has been developed in accordance with the privacy laws and regulations which are applicable to us, including thePrivacy Act 1988(Cth) (“the Privacy Act”), The Australian Privacy Principles (“the APPs”) and theHealth Records and Information Privacy Act 2002(NSW), as amended from time to time.
The purpose of this Privacy Statement is totell you how we collect personal informationand how we will use or disclose that information. It also details how we manage Personal Information, including in relation to -
- our website located at https -//www.ccia.org.au/ (our Website);
- the mobile application ‘86k for a Cure’ which is accessible via the ‘Google Play Store’ and ‘App Store’ (App) which is developed by Funraisin & Made by Ed (https -//www.funraisin.co/privacy-policy); and
- how stakeholders can make a complaint regarding any privacy issue or concern.
Respecting privacy is important to us and we understand it is important to you. We are grateful to you and your contribution to helping us achieve our mission to save the lives of all children with cancer and improve their long-term health, through research. In managing the generosity of our community and partners we need to collect, store, use and disclose a range of information. Children's Cancer Institute is committed to protecting your privacy, keeping the information you provide us safe and working with you to ensure we manage your data in a way that fosters trust.
What personal information do we collect?
In simple terms -We collect different information depending on how you're involved/or engage with us; from basic details like your name to health information for research.
The personal information we collect from you will vary depending on your interaction with Children's Cancer Institute.
General information we collect
For most people who engage with us, we may collect:
- Name, address, email address, phone number, and other contact details
- Date of birth and gender (where relevant)
- Records of your communications and interactions with us
- Your preferences regarding communications from us
- Information you provide through surveys, feedback, or enquiries
- Online identifiers such as IP address when you visit our website
If you choose not to provide certain personal information, we respect that choice, but it may affect our ability to provide you with services or include you in our activities. For example, we cannot send you updates about our research without your contact details, or process a donation without required payment information.
For donors, supporters, partners and suppliers
If you support our work through donations or fundraising, we may also collect:
- Donation history, including amounts, frequency, and payment methods
- Tax file numbers (for payroll giving programs)
- Bank/Credit Card details
- Information about your engagement with our fundraising communications
- Your connection to childhood cancer (if you choose to share this)
- Your philanthropic interests and capacity
- Records of your attendance at our events
- Your history of volunteering or advocacy on our behalf
- Limited health data through our '86k for a Cure' App where expressly permitted by you. This includes fitness and activity information to support fundraising challenges and community engagement.
For researchers and collaborators
If you are working with us as a researcher or collaborator, we may also collect:
- your professional qualifications
- employment details
- research interests
- publication history
- and institutional affiliations.
We may also collect information about your:
- research proposals
- ethics approvals
- collaborative agreements with Children's Cancer Institute.
For research participants
For individuals participating in our research studies, we may also collect:
- Detailed health and medical information
- Biological samples and associated data
- Family medical history
- Genetic information
- Clinical trial participation data
- Treatment responses and outcomes
- All research information is collected with specific informed consent and under the oversight of Human Research Ethics Committees.
What information do we collect about job applicants, employees, and volunteers?
If you apply for a position or work with us, we may also collect:
- Employment history, qualifications, and professional affiliations
- References and background check information
- Tax file numbers and financial details (for payment purposes)
- Working With Children Check or police check information
- Emergency contact details
- Health information relevant to your employment
Why do we collect your information and what do we use it for?
In simple terms -?We need your information to provide receipts for donations, send you updates about our research, and conduct important cancer research. We collect information that helps you better engage with us.
For all stakeholders
We use personal information to respond to your enquiries and provide you with information you've requested. We also use your information to communicate with you about collaborations, activities, events, and campaigns. We also collect and use your information to comply with any legal requirements and conduct our day-to-day operations effectively.
For donors, supporters, partners and suppliers
If you are supporting a Children's Cancer Institute fundraising initiative, we collect your personal information to provide you with a tax-deductible receipt should you make a donation. We also collect your personal information for marketing and fundraising purposes, such as sending you updates about our initiatives and research or so you can obtain the full benefit of our Website or App. We process supplier and partner information to manage contracts, payments, and ongoing business relationships. We use your data to analyse giving patters to improve our fundraising programs and invite you to events and engagement opportunities.
For researchers and collaborators
We collect your professional information to assess research proposals, manage collaborative projects, apply for funding opportunities, ensure appropriate expertise is available for research activities, and maintain records of our research partnerships and outputs.
For research participants
When you participate in research activities, we collect health and other relevant information to conduct research. This information is essential for the specific research study you are participating in and contributes to our broader understanding of childhood cancer. This information is only collected with appropriate consent and ethical approval. We collect and use this information to support clinical trials and translational research while maintaining records of research participation.
How do we communicate with families impacted by childhood cancer?
In simple terms - We treasure and respect the stories of families impacted by cancer. We only use these stories in line with their consent and permission.
When engaging with families we recognise the emotional challenges facing families affected by childhood cancer and communicate with appropriate care and respect. We aim to provide straightforward explanations about how personal information will be used. We acknowledge family dynamics and respect privacy preferences within family units. When sharing stories or experiences of children with cancer, we obtain appropriate permissions and aim to maintain dignity in all representations. We value the generosity of families willing to share their stories and manage their information in line with the consent they provide at collection.
What if you don’t want to provide us with the information requested?
In simple terms - If you don’t provide us with information requested we may be unable to provide you with services relevant to your engagement with us. We respect your choices, but be aware it will limit what we can do for you.
If you do not provide all the personal information requested, we may be unable to provide your tax-deductible receipt should you donate, send you other information or updates about Children's Cancer Institute, include you in research activities, or manage research collaborations effectively.
How do we collect your information?
In simple terms - We usually get information directly from you, but sometimes through others like your employer, research institutions, or people organising fundraising for us.
For all stakeholders
We usually collect your personal information directly from you when you contact us or engage with us including by phone, email, through online enquiries, in person or from our forms and our App. In some cases we may also collect limited personal information through the use of cookies when you access our website.
For donors, supporters, partners and suppliers
We may collect your personal information from your employer for workplace donors, from other individuals who arrange fundraising events or activities on your behalf, through data-swaps with other like-minded charities, and from other individuals who may make a donation on your behalf and who provide your details for acknowledgement of correspondence.
App users
Our '86k for a Cure' App requires permissions to access certain data on your device, including your location. When you first open the App, you will receive requests for permission to access your location, camera and gallery, and to enable push notifications. For android users you will also receive a request to install and setup 'Health Connect' which reads and writes distance, exercise type, steps and total calories burned data. If you provide read access, the app can read new data and data from the past 30 days. You can revoke these unique read and write permissions at any time via the App.
For apple users you will also receive a request to allow health access which allows the syncing of steps, distance and workout data with the Apple 'Health App'. You can revoke this permission at any time via the App. The data across both 'Health Connect' and the Apple 'Health App' allows for live activity tracking which provides a user with accurate calculations of total distance, time taken, starting latitude and ending longitude coordinates. For completeness, our App facilitates integration with social media platforms like Facebook through the device's native social sharing capabilities, however, no information is collected or stored by our App when providing these integrations with social media platforms.
The App also collects aggregated, anonymised data which does not personally identify you, to monitor and improve the App's performance. The App collects, tracks and stores background device location data using Google Maps and device GPS location, including the starting latitude and longitude and the ending latitude and longitude, as well as the total distance travelled and the duration of your activity to calculate the total distance and time travelled. This collection will occur while the App is open, minimised in the background, or open while your device is locked. This collection is necessary for the functionality of the activity tracking features, and to ensure app functionality. However, if you would like to stop the device location tracking, you may do so at any time by adjusting your device settings.
For researchers and collaborators
We may collect your information from research institutions, universities, professional bodies, grant applications, published research papers, and through professional networks and conferences.
For research participants
We collect your health information directly from you or your treating practitioner with your consent through research protocols, medical examinations, tests, medical reports and procedures as part of the specific research study. We may also collect information from your healthcare providers and previous medical records.
When collecting information from or about children under 18 years of age we obtain consent from a parent or guardian as required by law before collecting a child's personal information. Where possible, we provide explanations suitable to the child's age and maturity level. We limit collection to information that is necessary for research or support purposes.
When you visit our website
When you access our website, we may send a "cookie" to your computer. This enables us to recognise your computer and greet you each time you visit our website without bothering you with a request to register. It also enables us to keep track which pages or events you view so that, if you consent, we can send you information about those topics or events. We also use cookies to measure traffic patterns, to determine which areas of our website have been visited and to measure transaction patterns in the aggregate. We use this to research our users' habits so that we can improve our online services. If you do not wish to receive cookies, you can set your browser so that your computer does not accept them. We may log IP addresses to analyse trends, administer the website, track users' movements, and gather broad demographic information. You can learn more about how we use cookies in our Cookies Notice.
What safeguards do we have in place for AI?
We do not use automated decision-making processes for any decisions that would have a significant effect on individuals without human review, in accordance with OAIC guidance on AI use and privacy protection. This means that significant decisions about research participants, donors, or staff are always made by appropriate team members.
We are committed to using AI technology and data analytics ethically and responsibly. Some of the safeguards we use are:
- All AI systems and outputs are reviewed by qualified team members. No important decisions are made by AI alone.
- Where possible, we regularly test our AI technologies to identify and minimise bias, inaccuracies, and potential risks. Our data validation processes help ensure high-quality inputs and outputs.
- We are open about when and how we use AI in our operations and research. Where appropriate, we inform individuals when we are interacting with AI systems.
- We conduct privacy impact assessments for new AI applications and build privacy protections into our systems from the start.
- We limit the personal information used in AI systems to what is necessary for the specific purpose.
- We periodically review our AI systems to ensure they continue to operate as intended and comply with privacy regulations.
How do we use artificial intelligence?
In simple terms - We may use AI tools to support specific aspects of our work, with strict safeguards to protect your privacy and ensure human oversight.
Children's Cancer Institute may use artificial intelligence technologies in limited and controlled ways to support our mission. We want to be transparent about our use of these technologies and the protections we have in place. AI allows us to streamline administrative functions, this means your donations go further.
For all stakeholders
Children's Cancer Institute may use artificial intelligence and automated systems to support our work. AI may help us improve how we respond to enquiries and personalise communications we send to supporters. We also use AI for routine tasks and administrative processes which allows more resources to be directed at our life-saving research.
For donors, supporters, partners and suppliers
We may use AI to create engaging marketing material or to improve our fundraising approaches and ensure our communications are relevant to your interests. We may use AI to alleviate some administrative processes so that we can be more efficient.
For research participants
AI and advanced data analytics are increasingly important tools in research. When we use these tools we do so in line with the OAIC Guidance on privacy and the use of commercially available AI products that have gone through rigorous security testing and vetting. We use closed AI algorithms to analyse complex de-identified genomic, molecular, and clinical data sets that would be impossible to process manually. This helps us identify patterns, potential treatment targets, and biomarkers for childhood cancers more efficiently. AI helps us develop more personalised approaches to childhood cancer treatment by identifying which therapies might work best for specific cancer types. We use computational models to simulate how potential treatments might work, helping to identify promising new therapies more quickly. Machine learning algorithms help us recognise patterns in research data that might be missed by traditional analysis methods, potentially leading to new insights about childhood cancer.
How do we protect your information?
In simple terms -We use multiple security measures including locked filing, encryption and regular monitoring to keep your information safe.
For all stakeholders
Children's Cancer Institute will make every effort to ensure your personal information is stored securely both within our hard copy data files and in electronic forms. We take security steps to protect against the misuse, loss, unauthorised access, modification or disclosure of personal information. We secure any paper files in locked locations with restricted physical access. We also take measures to de-identify or destroy personal information that is no longer needed for any purpose.
Other steps we take include a network firewall, encrypted transmission of electronic data, up-to-date anti-virus software, regular monitoring of all network traffic. We carefully evaluate the security practices of third-party service providers who may handle personal information on our behalf and require appropriate safeguards through contractual arrangements.
Despite these protections, no data security measures can guarantee absolute protection. We continuously work to improve our security practices to address evolving risks and threats.
For donors, supporters, partners and suppliers
All supporters and volunteers of Children's Cancer Institute are provided with a unique identification number once they are entered into our database. This unique number helps Children's Cancer Institute identify you for the purposes of carrying out our functions efficiently. This number is normally printed on our written correspondence to you.
For App users
Any data which is accessed, read, synced, written or used as part of the permissions set by users of the App, are managed in accordance with this Privacy Statement and the Privacy Policy of 'Fundrasin' and 'Made by Ed'. App data is contained in Funraisin and secured by authenticated API. Data is only used to record fitness activities on an entrant record. Data does not transit back to the Children's Cancer Institute Australia outside of the web platform where your fundraising page is displayed. Data, including raw data, that is sent from the mobile app to the web platform is encrypted in transit.
For researchers and collaborators
Professional information is stored in secure research databases with appropriate access controls limited to authorised research staff.
For research participants
Health information is stored according to strict research and security protocols with additional security measures including restricted access, audit trails, and compliance with Good Clinical Practice guidelines. Research data is often stored in purpose-built secure research databases with enhanced encryption and monitoring.
How long do we keep your information?
In simple terms -We keep your information only as long as we need it for our work and legal requirements, then we safely destroy it.
For all stakeholders
We retain your personal information only to allow us to properly conduct our services and meet legal requirements. We regularly review information we hold and take measures to de-identify or destroy personal information that is no longer needed for any purpose. When we destroy information, we use secure methods for both paper files and electronic records. For job applicants we hold your information for a reasonable period to send you any similar opportunities that may arise, after that time we will delete your information.
For donors, supporters, partners and suppliers
Donation and financial records are kept for seven years to comply with tax and accounting laws. Marketing and communication preferences are maintained while you remain engaged with our organisation and for a reasonable period thereafter.
For researchers and collaborators
Professional information and research collaboration records are kept for the duration of projects and for periods required by funding bodies and institutional requirements.
For research participants
Research information may be kept for longer periods as required by research ethics committees and to enable long-term studies that could benefit future patients. Specific retention periods are outlined in the consent forms for each research study, but may extend for decades to enable ongoing research that could lead to new treatments. De-identified research data is a gift that we do not take for granted.
Who do we share your information with?
In simple terms -We only share your information when necessary to provide our services, research partnering, or when the law requires it.
For all stakeholders
Your personal information may be made available to our accountants, auditors, lawyers and law enforcement agencies as required by law. We may disclose your personal information if we are legally required to do so, particularly in relation to protecting the privacy of children.
We may disclose your information to external contractors who provide services on our behalf such as mail-outs, data management, marketing campaigns. If we provide your personal information to external contractors, Children's Cancer Institute will disclose your personal information only to the extent necessary for these external contractors to perform the requested services. In engaging with a third party, we will take steps to ensure that the privacy and security of your personal information is protected under privacy standards consistent with the Privacy Act 1988 and the Australian Privacy Principles.
For donors, supporters, partners and suppliers
We processes your donations using third-party payment processors. Our third-party payment processors collect and use personal information in accordance with their privacy policies. Personal information which may be collected, stored and used includes identification information, contact details and financial details including payment method information. The payment processor we use on this website is Stripe for all donations. For regular donations not acquired through our website, they are processed through our Salesforce Payment Gateway - Ezidebit.
Occasionally, we may disclose your contact details to other like-minded charities to update you on their activities that may be of interest to you. These organisations allow us to do the same and this way we can reach more people with vital information. These external organisations are also under the same obligation to protect your personal information under the Australian Privacy Principles.
If you do not wish to receive communications from like-minded organisations opt-out at any time by contacting Supporter Care.
For researchers and collaborators
We may share your professional information with research institutions, universities, funding bodies, ethics committees, and other researchers involved in collaborative projects. This sharing is necessary to facilitate research partnerships, grant applications, and ensure proper oversight of research activities.
For research participants
For research purposes, we may share your de-identified health information with other research institutions, regulatory bodies, ethics committees, data monitoring committees, and researchers involved in your specific study. We may also share aggregated, de-identified research data with the broader scientific community through publications and databases to advance medical knowledge. Any sharing of identifiable health information requires specific consent and appropriate ethical approvals.
Overseas
In some cases, we may transfer de-identified personal information to recipients outside Australia, including:
- When we work with overseas researchers on global childhood cancer research initiatives.
- Some of our technology systems and cloud storage providers may have servers located in other countries.
Before disclosing personal information to overseas recipients, we take reasonable steps to ensure the overseas recipient does not breach the Australian Privacy Principles. This typically includes:
- Contractual arrangements that require the recipient to handle information
- Verifying that the recipient is subject to privacy laws that provide similar protections to Australian law
- Obtaining your specific consent for the overseas disclosure where appropriate
Some of these locations include Europe, Asia and the United States of America.
What are your rights?
In simple terms - You can access your information, correct mistakes, control what communications you receive, and make complaints about our privacy practices.
For all stakeholders
You have the right to access your personal information held by us at any time. To protect personal information, we may require you to answer a number of questions for security purposes before it is made accessible. We will endeavour to meet requests for access as soon as practicable.
If you would like to change, modify, request deletion, or to request access to your information, you can contact our Supporter Care team. You also have the right to request correction of personal information if you believe it is inaccurate, out-of-date, incomplete, irrelevant or misleading.
It is your right, where it is practicable and lawful, not to identify yourself to us when making a complaint. It is also your right to refrain from identifying yourself when any kind of transaction is made, though non-identification of personal details could mean that we may not be able to respond to your complaint or provide certain services.
For donors, supporters, partners and suppliers
You can change your communication preferences at any time, including opting out of marketing communications or stopping communications from partner organisations. Use the ‘unsubscribe’ button at the bottom of any marketing material you receive from us.
For researchers and collaborators
You can request updates to your professional information and control how your expertise and research interests are shared with potential collaborators.
For research participants
You have specific rights regarding your health information used in research, including the right to withdraw from research studies (where this doesn't compromise the scientific integrity of completed research), access information about how your data is being used in research, and receive updates about research findings where appropriate. These rights may be subject to specific conditions outlined in your research consent forms. Research participation rights are carefully explained during the consent process and are overseen by Human Research Ethics Committees.
How can you contact us about privacy matters?
In simple terms -We have staff dedicated to helping with privacy questions and complaints, and you can also contact external agencies if needed.
For access requests and general privacy enquiries:
Supporter Care
Children's Cancer Institute Australia
PO Box 81, Randwick
NSW 2031
1800 685 686
supportercare@ccia.org.au
For privacy complaints or concerns:
Privacy Officer
Children's Cancer Institute Australia
PO Box 81, Randwick
NSW 2031
1800 685 686
privacy@ccia.org.au
If you believe we have breached your privacy or you have concerns about how we handle your personal information, you can:
Contact us - Reach out to our Privacy Officer with details of your concern.
Your complaint should include:
- Your contact details
- A description of the privacy issue or breach
- When it occurred (if known)
- What outcome you are seeking
We will:
- Acknowledge receipt of your complaint
- Investigate the matter thoroughly
- Provide a written response within 30 days (or explain if we need more time)
- Take appropriate remedial action where a breach is confirmed
If your concerns are not resolved by us, or if you would like more information about privacy generally, please contact the Office of the Australian Information Commissioner at www.oaic.gov.au and on 1300 363 992.
Updates to this statement
In simple terms - We'll let you know when we make important changes to how we handle your information.
We may update this Privacy Statement from time to time to reflect changes in our practices, legal requirements, or other factors. When we make changes that significantly affect how we handle your personal information, we will notify you through our website, email communications, or other methods we normally use to contact you. We encourage you to review this Privacy Statement periodically.
This Privacy Statement was last updated on 29th October 2025 and complies with the Australian Privacy Principles and relevant OAIC guidelines.
