Prepared by: OrthoSport Victoria Institute Pty Ltd trading as Centaur Institute (Ci)
1. Collection Notice
Who is collecting your information
Centaur Institute (Ci), the trading name of OrthoSport Victoria Institute Pty Ltd, whose Australian Business Number (ABN) is listed on centaur.com.au, collects your personal and health information through the Cordi platform.
What we collect
- Identity and contact details (name, email, date of birth)
- Health information including Patient-Reported Outcome Measure (PROM) survey responses and clinician-entered data
- Account activity and consent records
Why we collect it
- To manage your enrolment and participation in a research program approved by a Human Research Ethics Committee (HREC)
- To enable your treating clinicians to monitor your rehabilitation progress
- To meet legal and regulatory record-keeping obligations
Who we share it with
- Your treating clinical team (surgeons, physiotherapists, coaches) within your program
- Authorised Ci platform staff for support and compliance purposes
- AWS cloud infrastructure in Sydney, NSW under binding data processing agreements
Your rights
You have the right to access and request correction of your personal information. To exercise these rights or lodge a complaint, contact Ci at cordi@centaur.com.au or see Section 6 of this Privacy Policy.
2. Overview
Ci operates the Cordi platform. This Privacy Policy describes how Ci collects, uses, stores, and protects personal and health information in accordance with the Privacy Act 1988 (Cth) and the Health Records Act 2001 (Vic).
By using the Cordi platform or participating in an HREC-approved program managed through it, you agree to the collection and use of your information as described in this policy.
3. What We Collect
- Identity and contact details required to create and manage your account
- Health information and PROM responses submitted through the platform
- Clinician-entered data linked to your treatment journey
- Consent records and audit logs of system access and edits
4. Why We Collect It
- To manage your participation in an HREC-approved research program
- To support treating clinicians in reviewing your progress and outcomes
- To maintain consent, audit, and account records required by applicable law
- To meet Ci's obligations under the Privacy Act 1988 (Cth) and the Health Records Act 2001 (Vic)
5. Who Can Access It
- Your treating clinicians and authorised Ci platform staff
- AWS infrastructure hosted in Sydney, NSW under Ci's data processing arrangements
- You may request access to or correction of your personal information at any time (see Section 6)
6. Your Rights
You have the right to:
- Access the personal and health information Ci holds about you
- Request correction of information that is inaccurate, out of date, incomplete, or misleading
- Lodge a complaint if you believe Ci has mishandled your information
To exercise these rights, contact the Privacy Officer:
- Email: cordi@centaur.com.au
- Mail: Privacy Officer, Centaur Institute, 132A Bridge Road, Richmond VIC 3121
Ci will respond to all written requests within 30 days. If you are not satisfied with Ci's response, you may escalate to:
- Office of the Australian Information Commissioner (OAIC): oaic.gov.au / 1300 363 992
- Health Complaints Commissioner (Vic): hcc.vic.gov.au / 1300 582 113
Full details of how Ci handles access and correction requests are set out in the internal Participant Data Rights Process.
7. Data Retention
Ci retains personal and health information for a minimum of 7 years as required by the Health Records Act 2001 (Vic). After the retention period, data is securely destroyed in accordance with the Data Retention & Deletion Policy.
8. Security
Ci uses industry-standard security measures to protect your information, including encrypted storage on AWS infrastructure (Sydney, NSW), role-based access controls, and audit logging of all access and edits. Further detail is set out in the Vulnerability Management Policy and Secure Software Development Lifecycle (SDLC) Policy.
9. Contact
For all privacy enquiries, contact Ci at:
- Email: cordi@centaur.com.au
- Website: centaur.com.au