This policy explains how the Australian Institute of Pharmacognosy (“the Institute”, “we”, “us”) handles personal information. It covers this website and the ways people contact us.
The Institute is a small not-for-profit organisation. Whether or not the Privacy Act 1988 (Cth) applies to us at our current size, we have chosen to handle personal information in line with the Australian Privacy Principles (APPs) in that Act.
Who we are
Australian Institute of Pharmacognosy, Cardwell, Queensland, Australia. ABN 80 473 856 173. Privacy contact: our contact form (please choose the topic “Privacy request”).
What we collect
We collect only what we need for the purpose you contact us about. That may include:
- When you email us: your name, email address and whatever you choose to tell us.
- When you subscribe to our newsletter. We collect your email address and, if you give them, your first and last name. We also record when you subscribed or unsubscribed, where on the website you signed up, and a one-way code made from your IP address, which we use only to prevent abuse. The code cannot be turned back into your IP address.
- When you use our podcast page. If you join the podcast mailing list, we collect your first and last name, email address, country and your answer to “What brought you here?”, plus which emails you want, when and where you gave consent, and any later changes. If you follow the podcast on a device, we collect the name you give, your email address if you give one, your topic choices, the notification address and security keys your browser creates for that device, and your browser type. When you like an episode, we record a random code created on your device together with a one-way code made from your IP address, so each device can like an episode only once. When a form is misused, we record a one-way code made from your IP address to prevent abuse. When you ask for a sign-in link, we use your email address to send it.
- When you apply to work with us or for a Laboratory Charter (once applications open): your name, contact details, location, qualifications and experience, and, for applicants under 18, a parent or guardian’s name and contact details.
- When you visit the website: technical information that browsers send automatically, such as IP address, browser type, pages viewed and the time of the visit. See “Analytics and cookies” below.
This website has no public comment function and no passwords. The only way to manage your details online is the emailed sign-in link on our podcast page. We do not ask for health information through this website, and we ask you not to send us health information about yourself or anyone else. The Institute does not provide health services or individual health advice.
How we use it
We use personal information to reply to you, to assess and manage applications and working relationships, to keep the records the law or our Constitution requires, and to understand in aggregate how the website is used so we can improve it. We do not sell personal information, and we do not use it for direct marketing without your consent. You can opt out of any communication from us at any time.
We use your newsletter details only to send you the Institute’s newsletter and to keep a record of your consent. Every issue identifies the Australian Institute of Pharmacognosy as the sender and has an unsubscribe link. When you unsubscribe we stop sending to you promptly, and we keep a record that you unsubscribed so we do not email you again by mistake. You can ask us through our contact form to delete your details altogether.
We use your podcast details only to send you the podcast emails and notifications you chose, to let you manage or delete them, and to keep a record of your consent. The podcast mailing list is separate from the newsletter. You can see or change your details, unsubscribe or delete your details at any time through “Manage my subscription” on the podcast page, which emails you a sign-in link that works for 7 days. You can stop notifications on a device from the podcast page or in your browser settings.
Who we share it with
We share personal information only where it is needed for the purposes above, where you agree, or where the law requires or allows it. Service providers who handle information on our behalf include:
- Google (email and, on this website, Google Analytics). Google may store information outside Australia, including in the United States.
- Cloudflare, which carries traffic to this website and may process connection data in data centres outside Australia.
- iNaturalist, whose map widget on our Observations Map page loads from iNaturalist’s servers (United States), which receive your browser’s request when you view that page.
Our newsletter and podcast mailing lists are held securely by the Institute and its service providers, which may store them outside Australia, including in the United States. We do not sell, rent or share your details with anyone else, and we do not use them for advertising.
Podcast notifications are delivered through the push service run by the company that makes your browser (such as Google, Apple, Mozilla or Microsoft). That service receives your device’s notification address and an encrypted message, and may be located outside Australia, including in the United States.
Emails from the Institute, including podcast sign-in links, are sent through an email delivery provider that may process them outside Australia, including in the United States.
The website itself is hosted on a server in Queensland operated for the Institute. Where information is handled overseas, we take reasonable steps under APP 8 by using established providers with published privacy and security commitments.
Analytics and cookies
See our Cookie Notice. In short: on this website we use Google Analytics to count visits and see which pages are read. It uses cookies and collects information such as an online identifier, approximate location derived from IP address, and device and browser details. We use it only in aggregate. You can block these cookies in your browser or use Google’s opt-out browser add-on.
Our podcast page sets no cookies and uses no analytics. It saves some information in your browser’s storage on your own device: where you are up to in each episode, your favourites and likes, a random code used to count likes, whether you follow the podcast or have joined the list, and any notes you write on the “My notes” page. Your notes stay on your device and are never sent to us. You can remove all of this by clearing this site’s data in your browser.
At our premises: security monitoring
If you visit the Institute’s premises in Cardwell, you will be recorded. Cameras and microphones operate at the gate, yard, entrances and laboratory; recorded audio may be transcribed; and in the laboratory and yard we use automated face, voice and appearance recognition to tell staff and expected visitors apart from people the system does not recognise. Recordings are used only for security and are automatically deleted after about four days unless needed for an incident, complaint or legal requirement. Full details are in our Site Security & Surveillance Notice.
Precision Natural Medicine operates from the same premises. If you attend as a patient, the premises security monitoring described here may record you; how the clinic handles your health information is covered by its own privacy policy.
Security and retention
We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. These include access controls, encrypted connections (HTTPS) and keeping software up to date. We keep personal information only as long as we need it for the purpose it was collected for, or as long as the law requires (for example, financial and governance records are generally kept for seven years). After that, we delete it or de-identify it.
Access and correction
You can ask for access to the personal information we hold about you, or ask us to correct it, through our contact form. We will respond within 30 days. We may need to confirm your identity first. If we refuse a request, we will tell you why, as far as the law allows.
Complaints
If you think we have mishandled your personal information, please contact us first through our contact form. We will acknowledge your complaint within 7 days and aim to resolve it within 30 days. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.
Notifiable data breaches
If a data breach involving your personal information is likely to result in serious harm to you, we will notify you and, where required, the OAIC.
Automated decisions
At our Cardwell premises we use automated systems to recognise faces, voices and general appearance for security, to tell staff and expected visitors apart from people the system does not recognise. These systems can be wrong. You can always identify yourself to us, and we act to correct mistaken identifications when they are raised with us. We do not use automated decision-making in any other part of our work.
Changes to this policy
We may update this policy. The current version is always on this page, with the date it was last updated.