Protecting your privacy is important to us
Protecting your privacy is important to us. We handle your information in accordance with the Privacy Act 1988 (Cth) and our Privacy Policy. This policy also explains how you can access and correct your personal information, or make a complaint about a breach of the Australian Privacy Principles.
Privacy Policy
This Privacy Policy applies to personal information collected by Baker Heart and Diabetes Institute (ABN 98 131 762 948). In this policy, "the Baker Institute", "we", "us" and "our" refer to Baker Heart and Diabetes Institute.
The Baker Institute is Australia's only independent medical research institute dedicated to addressing the major global health challenges of heart attack, heart failure, diabetes and obesity. Our work spans discovery research, clinical trials, patient care and community health education.
We are committed to protecting the privacy and confidentiality of your personal information, and to handling it in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles and other relevant laws.
This policy does not apply to Baker Institute employee records.
What is personal information?
Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable — whether or not the information is true, and whether or not it is recorded in material form.
Sensitive information is a subset of personal information. It includes information or opinion about an individual's racial or ethnic origin, political opinions, religious beliefs or affiliations, philosophical beliefs, membership of a professional or trade association or trade union, sexual preferences or practices, health information and genetic information.
Types of personal information we collect
The personal information we collect may include your name, date of birth, address, gender, contact details, employment information, research interests, goods and services you have received from us, event attendance and payment details (including bank account and credit card information).
We collect personal information from a range of people connected to our activities, including advisory committee members, research study and clinical trial participants, volunteers, suppliers and service providers.
We collect personal information from donors and supporters — including information needed to process your donation, your donation history and activities you have indicated an interest in.
We may collect information from publicly available sources to enable personalised approaches to individuals and organisations about potential partnership opportunities.
We may also collect personal information — including work experience and references — when processing scholarship and award applications, or when recruiting staff, students and volunteers.
We may ask for sensitive information where it is needed to deliver services to you. For example, we may collect health information if you are participating in a health program or research study. We may collect information about racial or ethnic origin as part of our commitment to reducing death, disability and illness from non-communicable and communicable disease among Aboriginal and Torres Strait Islander peoples. We may also collect photos or personal stories if you have attended a Baker Institute event or shared your experience via our website.
We will not collect sensitive information without your consent. We will only collect personal information where it is reasonably necessary for our functions or activities.
How we collect your personal information
Where possible, we collect your personal information directly from you. This may happen when you contact us by phone, in person, by email or online; when you purchase a product or sign up for a service; when you enter a promotion or competition; or when you complete a form or survey.
We may also collect personal information from third parties such as contractors (including fundraising service providers), health professionals or publicly available sources.
Where we collect information about you from a third party, and it is not clear that you have consented to that disclosure, we will take reasonable steps to make you aware of how and why the information was collected, what we may do with it and the existence of this Privacy Policy.
How we use and disclose your personal information
We use your personal information to send you news, research updates and information about our products, services, education programs and events. We may contact you to seek your support for medical research at the Baker Institute, or to invite your involvement in volunteering, community fundraising and advocacy activities.
We may need to disclose your personal information to:
- Contractors and service providers who perform services on our behalf, including mailing houses, IT service providers, database contractors, fundraising agencies and our marketing automation platform.
- Funders, financiers, grant and award providers and research institutions.
- Health professionals involved in your care.
- Charitable or like-minded organisations that may wish to contact you with relevant information.
- Third-party service providers who facilitate information sharing between charitable and like-minded organisations.
If you have received communications from us and no longer wish to do so, please contact us at privacy@baker.edu.au or by calling 1800 838 498.
Baker Specialist Clinics
As a patient at Baker Specialist Clinics, we collect personal and health information to provide you with comprehensive, coordinated care. In addition to your name and contact details, this may include:
- Your medical history, including family medical history where clinically relevant.
- Your Medicare number and private health insurance details.
- Current medications and treatments.
- Details of referring or treating health professionals, copies of referrals and reports.
- Test results and samples.
This information is used to ensure you receive quality care. Your health information may be shared with other members of your treating team as part of the care process — including Alfred Health consultants, dietitians, nurse educators and exercise physiologists — as well as with your referring doctor or other health services where you are referred for further treatment.
AI-assisted transcription
Baker Specialist Clinics may use AI-assisted transcription technologies to help prepare clinical letters, reports and medical records. Where these technologies are used, only the minimum necessary information is involved, and all AI-generated content is reviewed by clinical staff before being included in your medical record. We take reasonable steps at all times to protect your privacy and the security of your information.
Consent for the collection and use of health information at Baker Specialist Clinics is managed through the Baker Specialist Clinics Client Consent Form, which you will be asked to complete when attending the clinic.
Research and clinical trials
To conduct research and clinical trial activities, the Baker Institute may collect personal and health information including:
- Your medical history, including family medical history where clinically relevant.
- Your Medicare number and private health insurance details.
- Current medications and treatments.
- Details of referring or treating health professionals, copies of referrals and reports.
- Test results and samples.
This information is used to record your involvement in research activities, process results and contact you about future studies. We may, from time to time, collate statistical data from information collected; in these cases, data will be de-identified and aggregated before being disclosed to third parties.
All research and clinical trials undertaken at the Baker Institute are approved by the Alfred Human Research Ethics Committee or the Bellbery Human Research Ethics Committee. Participants are provided with detailed information explaining how their health information will be collected, used and protected.
Overseas disclosure
The Baker Institute works with third-party service providers located outside Australia, including in the United Kingdom, the United States of America and China. As a result, personal information (but not payment details) may be transferred to, and stored at, locations outside Australia. These organisations may also engage third-party service providers operating outside Australia.
We take reasonable steps to ensure that overseas service providers are required to protect your information in a manner consistent with this policy and Australian privacy law.
By providing your personal information to the Baker Institute, you consent to its disclosure, transfer, storage or processing outside Australia as described above. You acknowledge that countries outside Australia may not provide the same level of privacy protection as Australia.
If you do not agree to your personal information being transferred outside Australia, please contact us at privacy@baker.edu.au or by calling 1800 838 498.
Security
We take all reasonable steps to protect the personal information we hold from misuse, interference, loss and unauthorised access, modification or disclosure.
Personal information may be stored as hardcopy documents, electronic data, or within the Baker Institute's systems or third-party database storage. We maintain physical and digital security measures, including firewalls, user authentication controls and secure premises. Electronic backups are stored offsite. Paper records are kept in locked, secure areas.
Where personal information is held by a third-party, we require those parties to maintain appropriate security standards. We are not liable for any unauthorised access or use of information held by third parties, but we take reasonable steps to protect against it.
For online donations, we use Secure Socket Layer (SSL) encryption to protect your payment information. All third-party payment gateway providers are PCI DSS (Payment Card Industry Data Security Standard) compliant.
Data retention
We retain your personal information only for as long as it is needed for the purpose for which it was collected, or as required by law.
- Form submissions and marketing activity data are retained for up to 90 days.
- Other personal information, including clinical and research records, may be archived for up to seven years, after which it is securely destroyed.
Where records are archived, this is managed by a third-party provider of secure archiving services.
Anonymity and pseudonymity
Where lawful and practicable, you may deal with us without identifying yourself, or by using a pseudonym — for example, when making a general enquiry about our activities.
Please note that contact details are required to issue a tax-deductible receipt for donations.
We respect the wishes of donors and supporters who prefer to remain anonymous. If you would like to remain unidentified in our publications or at public events, please advise us in writing addressed to the Director of the Baker Heart and Diabetes Institute.
Accessing and correcting your information
You may request access to the personal information we hold about you at any time. Unless an exception applies under relevant privacy laws, we will provide this information within 14 days at no charge.
If we are unable to provide access, we will explain why and advise you of the avenues available to seek review of that decision.
If you believe any information we hold about you is inaccurate, incomplete or out of date, please contact our Privacy Officer and we will take reasonable steps to correct it or, if necessary, discuss alternative action with you.
Our website
When you visit a Baker Institute website (such as baker.edu.au), we may automatically collect the following information:
- Your server address and top-level domain name.
- The pages you access and documents you download.
- Search terms you enter.
- Your browser type.
This information is used to improve our website and does not identify you personally.
If you contact us by email, your email address will only be used for the purpose for which you provided it, unless you have consented to another use. Please be aware that there are inherent risks in transmitting information over the internet.
We may include links to third-party websites. The Baker Institute is not responsible for the content or privacy practices of those websites.
Cookies
The Baker Institute websites use cookies to deliver a more efficient and personalised experience. A cookie is a small file placed on your device that allows a website to remember information about a previous visit.
We use two types of cookies:
- Session cookies
Temporary cookies that expire when you close your browser. - Persistent cookies
Cookies stored on your device for a longer period. These are used to deliver content relevant to your interests and to show you retargeting advertising on other websites based on your previous interactions with ours. Persistent cookies do not store personal information such as your name, email address, postal address or phone number and cannot be used to identify you as an individual.
Managing your cookies
You can configure your browser to accept, reject or notify you when a cookie is received. Instructions for managing cookies can be found in your browser's help or settings menu.
Disabling cookies will not prevent you from receiving online advertising, but ads will no longer be personalised based on your browsing behaviour.
Changes to this policy
This Privacy Policy was last updated in June 2026 and may be amended from time to time. The most current version is always available at baker.edu.au/privacy-policy.
Contact us and making a complaint
If you have a question about how your personal information is collected or used, or wish to make a complaint about a breach of the Australian Privacy Principles, please contact our Privacy Officer:
Privacy Officer
Baker Heart and Diabetes Institute
75 Commercial Road
Melbourne Vic 3004, Australia
E: privacy@baker.edu.au
P: 1800 838 498 (toll-free)
We will respond to your query as soon as possible and aim to resolve any complaint within 10 business days. If this is not possible, we will contact you within that timeframe to advise how long we expect resolution to take.
Notifiable Data Breaches
The Baker Institute has a formalised process for responding to eligible data breaches under the Notifiable Data Breaches scheme (Privacy Act 1988 (Cth)). If we reasonably believe that an eligible data breach has occurred that is likely to result in serious harm to affected individuals, we will notify those individuals and the Office of the Australian Information Commissioner (OAIC) as required by law.
If you are not satisfied with our response to a complaint, you may refer the matter to the Office of the Australian Information Commissioner:
Office of the Australian Information Commissioner
GPO Box 5218, Sydney NSW 2001
oaic.gov.au | 1300 363 992
