Privacy Policy

1. About this policy

The Privacy Act 1988 (Privacy Act) requires entities bound by the Australian Privacy Principles (APP) to have a privacy policy¹. This privacy policy outlines the personal information handling practices at NHMRC.

References to use and disclosure of personal information include references to NHMRC employees’ and contractors’ handling of personal information. NHMRC will only collect, use or disclose personal information in accordance with the Privacy Act and other legislation that NHMRC administers.

The legal obligations of NHMRC when collecting and handling personal information are outlined in the Privacy Act, in particular the APPs in that Act. Detailed information on the APPs can be found on the website of the Office of the Australian Information Commissioner (OAIC).

NHMRC’s Privacy Policy outlines what kinds of personal and sensitive information we collect, why we collect the information and how we handle it.

A Privacy Impact Assessments table is available underneath the policy.

2. Definitions

In this privacy policy, personal information and sensitive information (a sub-set of personal information), have the same meanings as defined in subsection 6(1) of the Privacy Act, namely:

personal information is as defined in section 6 of the Privacy Act and means information or an opinion about an identified individual, or an individual who is reasonably identifiable:

1. whether the information or opinion is true or not; and
2. whether the information or opinion is recorded in a material form or not.

sensitive information is as defined in section 6 of the Privacy Act and means

1. information or an opinion about an individual's:

   1. racial or ethnic origin
   2. political opinions
   3. membership of a political association
   4. religious beliefs or affiliations
   5. philosophical beliefs
   6. membership of a professional or trade association
   7. membership of a trade union
   8. sexual orientation or practices, or
   9. criminal record

   
   that is also personal information; or

2. health information about an individual
3. genetic information about an individual that is not otherwise health information
4. biometric information that is to be used for the purpose of automated biometric verification or biometric identification, or
5. biometric templates.

3. Dealing with NHMRC anonymously or pseudonymously

You can ask NHMRC to deal with you anonymously or pseudonymously (using a fictitious name) unless NHMRC expressly identifies that it is not practicable to deal with you on that basis. In most cases, NHMRC will require your contact details.

In the case of applications for research grants or licence applications under the Research Involving Human Embryos Act 2002 (RIHE Act), it is not practicable for NHMRC to deal with you on an anonymous or pseudonymous basis. NHMRC will not accept an application or report that is anonymous or not in your real name.

4. Collecting personal information

4.1 Why we collect personal information

NHMRC is Australia's peak body for:

• supporting health and medical research
• developing health advice for the Australian community, health professionals and governments
• providing advice on ethical behaviour in health care and in the conduct of health and medical research.

Governed by the National Health and Medical Research Council Act 1992 (NHMRC Act), NHMRC's functions are to pursue activities designed to:

• raise the standard of individual and public health throughout Australia
• foster the development of consistent health standards between the various States and Territories
• foster medical research and training and public health research and training throughout Australia
• foster consideration of ethical issues relating to health.

NHMRC collects, holds, uses and discloses personal information to carry out these functions or activities. NHMRC also collects, holds, uses and discloses personal information to carry out other responsibilities including those under the:

• NHMRC Act 1992
• Medical Research Future Fund Act 2015
• Research Involving Human Embryos Act 2002 (RIHE Act)
• Prohibition of Human Cloning for Reproduction Act 2002 (PHCR Act)
• Public Governance, Performance and Accountability Act 2013 (PGPA Act)
• Freedom of Information Act 1982 (FOI Act)
• Therapeutic Goods Act 1989, in relation to the registration of Human Research Ethics Committees (HRECs).

4.2. How we collect your personal information

The main way in which NHMRC collects personal information is when you provide it. For example, NHMRC may collect your personal information when you:

• are an employee or prospective employee of NHMRC
• are appointed as the Chair or a member of NHMRC's Council, principal committees or working committees (including as a peer reviewer)
• apply for research grants or are part of an application for research grants, through an NHMRC Administering Institution
• access NHMRC's grant management system, including to update a CV
• participate in grant review processes
• use the Human Research Ethics Application (HREA)
• apply for a licence under the RIHE Act
• respond to a request for tender or quote
• participate in NHMRC meetings, consultations or surveys
• contact NHMRC for information or advice, including Freedom of Information (FOI) requests
• contact Ministers in the health portfolio and related portfolios
• make a complaint to NHMRC or the NHMRC Commissioner of Complaints
• make an allegation about a breach of the Australian Code for the Responsible Conduct of Research including research misconduct, a probity matter, or fraud or corruption, to NHMRC
• request a review by the Australian Research Integrity Committee (ARIC)
• access NHMRC websites, social media or subscription services (see Appendix A)
• make a public interest disclosure
• make a complaint under the Government Procurement (Judicial Review) Act 2018.

NHMRC may also collect your personal information via a third party, such as:

• when an institution or organisation:
  • registers an HREC and provides updates on its activity
  • applies for a licence under the RIHE Act
  • applies for certification under the National Certification Scheme and during any monitoring or assessment activity
  • makes a notification under the NHMRC Research Integrity and Misconduct Policy
  • participates in NHMRC targeted or public consultations or surveys
  • applies to be an Administering Institution
  • applies to be on Research Committee's Approved Research Institutes register
  • registers via the Guidelines in Development Register
  • responds to a request for tender or quote.
• or when an individual or group:
  • makes an allegation about a breach of the Australian Code for the Responsible Conduct of Research including research misconduct, probity matter, or fraud or corruption, to NHMRC
  • participates in NHMRC targeted or public consultations or surveys
  • while completing an ethics application using the HREA
  • contacts NHMRC or Ministers in the Health Portfolio and related portfolios
  • makes a complaint to NHMRC or the NHMRC Commissioner of Complaints
  • requests a review by ARIC
• or when another Government Department or Agency provides the information in the course of that Department/agency and/or NHMRC performing their roles or duties, including where there is a reasonable belief that the disclosure of the personal information is for a purpose directly related to NHMRC performing its roles or duties, or to the enforcement or investigation of a possible breach of a Commonwealth, State or Territory law.

When we collect personal information, we will notify you using a privacy collection notice, if it is reasonable to do so. The notice will include reasons why we are collecting the information, whether the collection is required or authorised by law, and any person or body to whom we usually disclose the information. We will also inform you how you can request access to, or correction of, your personal information, and who to contact if you have a privacy enquiry or wish to make a complaint. There may be some situations where we are not able to notify you using a privacy collection notice. Examples of these situations include:

• notification would be inconsistent with another legal obligation, for example, by breaching a statutory secrecy provision, a client’s legal professional privilege, or a legal obligation of confidence
• notification may pose a serious threat to the life, health or safety of an individual or pose a threat to public health or safety, for example, a law enforcement agency obtaining personal information from a confidential source for the purpose of an investigation.

NHMRC may also collect personal information about you from publicly available sources to enable it to:

• contact stakeholders who may be interested in NHMRC's work, or who may wish to participate in targeted or public consultations
• construct databases of contact details for the purpose of informing relevant parties about relevant grant opportunities, or
• for ensuring compliance with the NHMRC Research Integrity and Misconduct Policy.

We may also collect information about how you use our online services and applications. See Appendix A.

4.3 The types of personal information we collect and hold

In performing our functions, NHMRC may collect and hold the following information: 

• identity and contact details for individuals (e.g. title, name, phone, email and postal address)
• information relating to individuals’ personal circumstances and health (e.g. date of birth/age, gender, and family circumstances including spouses, carers and dependents)
• information relating to individuals’ financial affairs (e.g. payment details, bank account details, superannuation, vehicle insurance details)
• other information relating to identity (e.g. date of birth, signatures, citizenship and visa status),
• information about employment (e.g. employment status and work history, education/training qualifications, referee comments and information, salary, professional registrations and affiliations, disclosures of interests), employer/ employee relationships and activities, employment conditions
• information related to grant applications and administration (where not mentioned elsewhere), including research grant and research publication history, relative to opportunity details, details of a breach of the Australian Code for the Responsible Conduct of Research including research misconduct or a probity matter or fraud or corruption (whether alleged, substantiated or dismissed)
• government identifiers (e.g. Medicare card number, tax file number, Australian Business Number)
• Digital identifiers such as IP address, top-level domain name (see Appendix A).

NHMRC also collects sensitive information (see the definition in section 2 above). For example, NHMRC may need to collect sensitive information for employment or where it is relevant to a grant opportunity.

NHMRC may also hold this information where it has been volunteered by the individual (see section 4.4).

4.4 Receipt of unsolicited personal information

Unsolicited personal information is personal information received where there were no active steps taken by NHMRC to collect the information. NHMRC may receive unsolicited personal information about an individual in correspondence from external parties, including in ministerial correspondence, submissions to public or targeted consultations or surveys, in grant applications, complaints and in correspondence seeking advice.

When handling unsolicited personal information, NHMRC uses APP4, to determine whether or not NHMRC could have solicited the information (refer APP3). If the information provided could have been solicited by NHMRC to do its work, then NHMRC may use or disclose unsolicited personal information that has been provided by an individual.

However, if NHMRC determines that it would not have collected the personal information, and the information is not contained in a Commonwealth record² , NHMRC will, as soon as practicable, but only if it is lawful and reasonable to do so, destroy the information or ensure that the information is de-identified.

If NHMRC determines that it could have collected the personal information under APP3, or the information is contained in a 'Commonwealth record', then APPs 5 to 13 will apply in relation to the information as if NHMRC had solicited the information under APP3.

Where it is determined that the unsolicited personal information cannot be destroyed or de-identified under APP4 (that is, it is part of the Commonwealth record), the information will be treated in accordance with APPs 5 to 13. That is, it will be retained until it can be destroyed in accordance with the Archives Act 1983.

In regard to submissions received during public consultation, NHMRC reserves the right to redact unsolicited personal information from submissions, or to not publish submissions containing unsolicited personal information.

4.5 Collection of information via videoconference

As part of performing its functions, we may record video and audio meetings and obtain auto-generated transcripts of the meeting. The personal information collected via these recordings may include name, email address, phone number, digital images, video and audio recordings, text (in chats), that participation in the meeting occurred and any opinions expressed on the matters discussed.

Recordings and transcripts will be used to:

• allow staff to refer to meetings to confirm points that were discussed, or outcomes agreed upon
• enable staff who missed a meeting to catch-up on what was discussed
• keep a record of the meeting for evidentiary purposes or
• reduce the need for staff to make detailed meeting minutes during the meeting.

Personal information may also be used for other purposes. In the event the personal information will be used for another purpose, the host will discuss this at the beginning of the meeting. Alternatively, the use of personal information for another purpose may be set out in the invitation to the meeting.

NHMRC is unlikely to disclose any personal information collected in this way to any overseas recipients, unless they are also participants in the meeting. If there is an expectation that your personal information will be disclosed to overseas recipients, this will be discussed by the host at the start of the meeting.

If you do not agree to collection of your personal information by way of video or audio recording, you will need to inform the Chair of the meeting, and this may impact your attendance or participation at the meeting.

5. Use or disclosure of personal information

5.1 General provisions

NHMRC can, and usually will, use or disclose personal information where:

• a person has consented to the use or disclosure, or
• the person would reasonably expect that their information will be used or disclosed, or
• the disclosure is authorised or required by or under law, including in accordance with the requirements of the Commonwealth Grants Rules and Principles (see section 7.6).

NHMRC will not be taken to have breached its obligations under this policy or the Privacy Act where:

• a person has consented to the use or disclosure of their personal information
• a purpose for which the personal information is to be used is directly related to the purpose for which it was collected
• a person would reasonably expect, or has been told, that personal information may be published or passed to certain individuals (including the general public), bodies or agencies (for example, if requested by the Australian Research Council (ARC), for the purpose of ARC establishing compliance with its funding rules)
• a grant applicant has explicitly indicated, or made NHMRC generally aware, of a wish for the application to be considered by other funding bodies and research institutions, such as co-funding organisations or the applicant's own institution
• it uses the personal information to comply with obligations, or exercise rights under the NHMRC Act, or NHMRC policies and procedures
• it uses the personal information to enable effective management or auditing of a funding agreement, scheme or NHMRC's grants management solution
• the disclosure of personal information:
  • to overseas entities, Australian state/ territory or local government agencies, organisations or individuals is necessary to assess an application or administer a grant
  • to universities, private medical research bodies, Australian state/ territory or local government agencies is for the purpose of establishing expert advisory panels or working groups
  • is required or permitted by law
  • will prevent or lessen a serious and imminent threat to somebody's life or health
• there is a reasonable belief that the disclosure of the personal information is for a purpose directly related to the enforcement or investigation of a possible breach of a Commonwealth, State or Territory law
• the personal information is in the public domain.

Access to NHMRC records and your personal information is limited to those who have an operational need or who have legislative authority. These include:

• NHMRC CEO and staff
• Ministers and staff in the Health Portfolio and related portfolios
• NHMRC Council, Principal Committee and Working Committee members
• individuals involved with NHMRC grant review processes
• contracted service providers that provide services on behalf of NHMRC in relation to our programs
• contracted service providers that assist in NHMRC’s human resources, communications, information technology, legal or other corporate functions
• review, audit, investigation and intelligence agencies and bodies
• Royal Commissions.

This list is not exhaustive, and we may disclose your personal information to other Australian Government agencies or to other bodies in accordance with the Privacy Act.

5.2 Disclosure of information about grant recipients and peer reviewers

In accordance with the Commonwealth Grants Rules and Principles and in the interests of transparency, NHMRC will publicly disclose the names and titles of all chief investigators for all grants awarded from all NHMRC schemes and all MRFF initiatives administered by NHMRC. This will include the title (Dr, Prof, etc) first name and last name provided in Sapphire profiles. In some cases, it may also include ‘middle name’ or ‘middle initial’. Chief Investigator names and titles will be published on both the NHMRC website and GrantConnect. Each CI’s ORCID ID (where available) will be published on the NHMRC website.

NHMRC also publishes the NHMRC Peer Review Honour Roll each year which lists peer reviewers, chairs, mentors, community observers and external assessors, who have contributed to NHMRC peer review processes. This list includes the title, first and last name and primary institution of these people. Information about peer reviewers may also be disclosed to the institutions for which they work, consistent with the requirements of the NHMRC Funding Agreement for Administering Institutions to make available personnel for peer review.

5.3 Disclosure of sensitive information in grant applications

Researchers applying to some grant schemes may be asked to provide career disruption or relative to opportunity information. Applicants should note that application information may be available to:

• people with preview access to applications, including Chief Investigators and Research Administration Officers related to the application
• NHMRC staff and individuals involved in peer review.

Applicants are asked to consider the level of information they disclose.

5.4 Disclosure of personal information to overseas recipients

NHMRC may disclose certain personal information to overseas recipients with consent, where authorised by or under law, or in accordance with an international treaty or convention.

Disclosure for NHMRC peer review of applications for funding

NHMRC's review processes use the most qualified researchers available to assess grant applications. There may be occasions when personal information (contained in an application) must be sent overseas to an expert reviewer or assessor for review where the assessor or reviewer best suited and available to assess the application is overseas.

NHMRC will prompt applicants with a notice that seeks their express consent to overseas disclosure at the time of making their application. Applicants can elect not to have their information sent overseas for review or assessment.

Disclosure for the assessment of licences under the RIHE Act

When assessing a licence application, the Embryo Research Licensing Committee (ERLC) may request advice from other relevant experts. These experts may be located overseas and where there is a need, they may require access to the personal information of the people identifiable in the application form.

Each person named on a mitochondrial donation licence application will be asked to confirm that they have been given a copy of the Mitochondrial Donation Licensing Scheme Privacy Notice. The nominated embryologist must confirm their consent to being nominated on the application and the Organisation Representative and the Principal Supervisor must also confirm that the information in the application is true and correct.

Disclosure within jointly administered research schemes

NHMRC participates in a number of funding schemes which provide assistance to Australian researchers to participate in collaborative research projects with international researchers. See International Collaborative Health Research Funding for further information regarding these funding schemes and corresponding organisations and countries.

In order for applicant researchers to participate in these schemes, their personal information may need to be disclosed by NHMRC to overseas recipients, generally for the purposes of review of the applications. Applicants are advised of this at the time of making their application.

Australian researchers may also be nominated by NHMRC to participate in joint international peer review panels or collaborations in their area of expertise outside of joint grant opportunities to foster global health and medical research goals. Consent to be nominated for these activities is sought prior to nomination.

Disclosure in public or targeted consultation or surveys

NHMRC undertakes public or targeted consultations and surveys in order to perform its functions. If an expert or consultant engaged to analyse or consider any survey or consultation data is based overseas, NHMRC will ordinarily adopt one of the following approaches:

• redact any personal information that may be contained in the response before forwarding the data overseas
• advise in the collection notice attached to the survey or consultation that any personal information provided in the response will only be forwarded overseas if the respondent expressly gives consent to the information being forwarded overseas.

5.5 Submissions to NHMRC targeted and public consultations

Providing personal information in any consultation or survey response is usually optional.

In general, if you provide NHMRC with permission to publish your public consultation submission on the NHMRC public consultation website, the submission will be published as soon as possible once all administrative and committee processes have concluded. Regardless of your permission, NHMRC reserves the right to not publish any submission, or part of a submission, which contains what NHMRC determines, in its absolute discretion, to be personal information about you and/or personal information about a reasonably identifiable third party.

NHMRC does not usually publicly disclose submissions to targeted consultations. Should the need arise, NHMRC will seek your explicit permission to publish your submission online.

5.6 Use of Artificial Intelligence

NHMRC is embracing the use of Generative AI (GenAI), but in doing so recognises both internal and external risks. NHMRC’s AI Transparency Statement outlines the agency’s approach to AI use within the NHMRC, in accordance with the DTA's policy for responsible AI in government. NHMRC has also developed a Policy on Use of Generative Artificial Intelligence in Grant Applications and Peer Review.

6. Storage and security of personal information

6.1 No sale of personal information

Under no circumstances will NHMRC sell or receive payment for licensing or disclosing your personal information.

6.2 Storage and security of personal information

Under the Public Governance, Performance and Accountability Act 2013, NHMRC is required to implement the Australian Government Protective Security Policy Framework (PSPF). The PSPF provides the appropriate controls for the Australian Government to protect its people, information and assets, at home and overseas. All personal information held by NHMRC is stored in accordance with the PSPF and managed in accordance with the Archives Act 1983. NHMRC takes steps to protect the security of the personal information it holds by:

• regularly assessing the risk of misuse, interference, loss, and unauthorised access, modification or disclosure of that information
• taking appropriate measures to address those risks
• conducting regular reviews to assess whether NHMRC has adequately complied with or implemented these measures.

In addition, NHMRC must comply with the Australian Cyber Security Centre Information Security Manual and with relevant government security standards when storing any information.

In compliance with APP10, NHMRC takes reasonable steps to ensure that the personal information it collects is accurate, up-to-date and complete. In compliance with APP11, NHMRC also takes reasonable steps to protect the personal information it holds from misuse, interference and loss, as well as unauthorised access, modification or disclosure.

Once NHMRC receives information from you, the information is maintained in a secure environment.³ Your personal information will not be released unless the law permits it or your permission is granted.

We take reasonable steps to ensure your personal information is protected from misuse and loss and from unauthorised access, modification or disclosure. We may hold your information in either electronic or hard copy form. Personal information is destroyed or deidentified when no longer needed in accordance with the requirements of the Archives Act 1983.

For further information on the way NHMRC manages security risks in relation to personal information, contact the Agency Security Adviser via email to nhmrc.security@nhmrc.gov.au

7. Accessing and correcting your personal information

7.1 Overview

Under the Privacy Act (APPs 12 and 13), you have the right to ask for access to the personal information that NHMRC holds about you, and to ask that NHMRC corrects that personal information. You can ask for access or correction by contacting NHMRC's Privacy Officer (see contact information below).

You will be asked to verify your identity before NHMRC will give you access to your information or corrects it. If you are uncertain about how to set out your request, or the supporting material required, the Privacy Officer may be able to assist you. 

If you ask, NHMRC must give you access to your personal information unless there is a law that allows or requires NHMRC to refuse access. If your personal information is inaccurate, out-of-date, incomplete, irrelevant or misleading, NHMRC will take reasonable steps to correct your personal information within 30 days of receiving and verifying your request.

If a correction is made and NHMRC has disclosed the incorrect information to certain third parties, you can ask NHMRC to tell them about the correction.

If NHMRC refuses to give you access to, or correct, your personal information, you will be notified in writing of the reasons.

You also have the right under the FOI Act to request access to documents that NHMRC holds and ask for information that NHMRC holds about you to be changed or annotated if it is incomplete, incorrect, out-of-date or misleading. For further information see Freedom of information requests to NHMRC.

7.2 Correcting information yourself

For some systems used by NHMRC, including Sapphire and Aurion, individuals can correct their own information.

8. Making a privacy complaint

8.1 Making a complaint

If you wish to complain that the NHMRC has breached one or more of the APPs you can contact the NHMRC's Privacy Officer (contact details below).

Your privacy complaint should be in writing and set out as much detail as possible and include any supporting documentation. You may make a privacy complaint anonymously, or by using a pseudonym. However, you should realise that if you do so, this may restrict our ability to fully investigate and deal with the complaint.

8.2 How NHMRC will deal with your privacy complaint

The NHMRC will usually respond to your complaint within 30 calendar days and provide you with its response in writing.

If NHMRC takes more than 30 days to respond to your privacy complaint (without your prior agreement), or you are not satisfied with the NHMRC's response, you may then take your privacy complaint to the OAIC.

9. NHMRC Response Plan for data breaches involving personal or sensitive information

We take seriously any unauthorised access to, disclosure of, or loss of personal information (data breach). We are subject to the Notifiable Data Breaches Scheme (NDBS) under the Privacy Act. We will handle any suspected or actual data breach in accordance with the requirements of the NDB Scheme and the Privacy Act – see NHMRC Response Plan for data breaches involving personal or sensitive information.

10. Privacy Impact Assessments 

A Privacy Impact Assessment (PIA) is a systematic assessment of a project that identifies the impact that the project might have on the privacy of individuals, and sets out recommendations for managing, minimising, or eliminating that impact.

NHMRC is required by the Australian Government Agencies Privacy Code to maintain a register of the Privacy Impact Assessments it conducts. A list of Privacy Impact Assessments, and the NHMRC response, is published on the website.

11. Further information

11.1 Resources

• Privacy Act 1988
• Office of the Australian Information Commissioner website
• Response Plan for data breaches involving personal or sensitive information

11.2 Contact

• NHMRC.Privacy@NHMRC.gov.au
• Privacy Officer
  National Health and Medical Research Council
  GPO Box 1421
  Canberra ACT 2601
   

Appendix A - Digital information

NHMRC websites:

NHMRC administers the following websites:

• NHMRC (this site)
• Sapphire
• NHMRC Public Consultations
• NHMRC Committee Centre
• The Human Research Ethics Application (HREA) | NHMRC
• eatforhealth.gov.au
• Water Quality Guidelines

Note the development of Sapphire included a Privacy Impact Assessment (see below) and uses privacy access controls, such as user penetration testing, as part of its data management strategy.  

Any system on these websites that seeks to record personal information about you will include a Privacy collection notice and will include a link to this Policy.

When you visit any of the NHMRC websites, NHMRC makes a record of your visit and logs the following information for statistical or systems administration purposes:

• your client address
• your top-level domain name
• the date and time of access to the site and duration
• pages accessed and documents downloaded
• the previous site visited
• type of browser and operating system used.

Analytic and session tools

NHMRC uses a range of tools provided by third parties, such as Google Analytics, to collect or view website traffic information. These sites have their own privacy policies. NHMRC also uses session tools to improve your experience when accessing our websites.

The information collected by these tools may include the IP address of the device you are using and information about sites that IP address has come from, the pages accessed on our site and the previous site visited. Google Analytics does not identify individual users or associate your IP address with any other data held by Google. NHMRC uses this information to maintain, secure and improve our websites and to enhance your experience when using them. In relation to Google Analytics you can opt out of the collection of this information using the Google Analytics Opt-out Browser Add-on. No attempt will be made to identify anonymous users or their browsing activities unless NHMRC is legally compelled to do so, such as in the event of an investigation, where a law enforcement agency may exercise a warrant to inspect the Internet Service Provider's log files.

Cookies

NHMRC uses 'cookies' for maintaining contact with a user through a website session. A cookie is a small file supplied by us and stored by the web browser software on your computer when you access our site. Cookies allow us to recognise you as an individual as you move from one of our web pages to another.

If you prefer not to receive cookies, you can adjust your browser settings. However, you may not be able to use the full functionality of the website.

This information is only used to help you navigate NHMRC website systems more efficiently, not to track your movements through the internet, or to record personal information about you.

Social networking services

NHMRC uses social networking services such as Facebook, Linked In, Instagram, Youtube and X (formerly Twitter) to communicate with the public about its work. When you communicate with NHMRC using these services NHMRC may collect your personal information, but it is only used to communicate with you and the public. The social networking service will also handle your personal information for its own purposes. These sites have their own privacy policies and data storage which may include cookies. Your use of these services is governed by the individual conditions of each site.

Subscriptions on NHMRC websites

If you subscribe to any of NHMRC's regular electronic publications (for example, Tracker), the personal information you submit through the subscription service form will be secure using SSL protocol used solely by NHMRC and not be disclosed to any other individual or organisation. The records are kept within NHMRC and Campaign Monitor (USA) until the individual asks to be removed from the NHMRC mailing list or fails to respond to a request for confirmation of continued interest.

There are security risks associated with transmission of information via the Internet. NHMRC has taken reasonable steps to safeguard against unauthorised access, use, modification or disclosure of the personal information NHMRC holds electronically. Before deciding whether to use this subscription facility you should make your own assessment of the potential risks to the security of your information.

By clicking on the warning/ disclaimer tick box on the subscription service or our web-based forms, you acknowledge and agree that the Commonwealth will not be liable for any unauthorised access or for any loss or damage that you may incur as a result of any unauthorised access to this site or to the information transmitted by you or any other person.

Collaboration tools

NHMRC uses Microsoft Teams to collaborate with external stakeholders through a secure Business-to-Business (B2B) process. This allows invited individuals to access NHMRC Teams environments using their own organisational credentials. When you accept an invitation to join NHMRC Teams, NHMRC may collect personal information such as your name, email address, organisation and role. This information is used to manage access, support collaboration and maintain the security of NHMRC systems. 

NHMRC applies appropriate security controls, including multi-factor authentication and conditional access to protect personal information collected through this process. Participation in Microsoft Teams is also subject to Microsoft’s privacy and data protection standards.  When you accept an invitation to collaborate with the NHMRC you will be presented with the NHMRC Conditions of use.

Footnotes

_{¹ See clause 1.3 of Australian Privacy Principle 1 (open and transparent management of personal information), in Schedule 1 of the Privacy Act.
² A Commonwealth record is a document (including in electronic form) that is the property of the Commonwealth and that has been kept by reason of its connection with any event, person, circumstance or thing (ss6(1) and ss3(1) of the Archives Act 1983.
³ Some relevant records may also be held by the Department of Health, Disability and Ageing, if those records were generated before NHMRC became a separate agency in the Health Portfolio (that is, before 2006).}

Privacy Impact Assessments

NHMRC is required by the Australian Government Agencies Privacy Code to maintain a register of the Privacy Impact Assessments it conducts. Privacy Impact Assessments, and the NHMRC response, are published in the following table:

The NHMRC Privacy Impact Assessments register is current as at September 2025.

Note

This policy is subject to annual review.

This page was last updated on 3 September 2025.