1. Who ScienceLifeMedicine is and what this policy covers
ScienceLifeMedicine (ABN 55 177 876 763) handles personal information in Australia. ScienceLifeMedicine develops products and software.
This policy covers one thing: how ScienceLifeMedicine handles personal information in its role as a Document Verification Service (DVS) Gateway Service Provider. It does not cover any other product or service of ScienceLifeMedicine. It explains how ScienceLifeMedicine collects, holds, uses and discloses personal information, including identity information, in that role. It is written to meet the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth).
“Gateway users” are the organisations that use the ScienceLifeMedicine gateway to send DVS checks. “People being verified” are the people whose identity documents are checked. “You” means people being verified, gateway users and their staff, and other people who deal with ScienceLifeMedicine.
ScienceLifeMedicine has applied to be on the OAIC’s Privacy Opt-in Register, to opt in to coverage under the Privacy Act 1988 (Cth) (section 6EA). The application is in process (see section 2).
2. Privacy Act, Australian Privacy Principles and the ScienceLifeMedicine commitment
ScienceLifeMedicine handles personal information in the gateway role under the Privacy Act and the APPs, and the DVS agreements with the Attorney-General’s Department require ScienceLifeMedicine to follow the APPs. ScienceLifeMedicine also has obligations under the Identity Verification Services Act 2023 (Cth) and the agreements with the Attorney-General’s Department.
To remove any doubt, including for the role in the Document Verification Service (see section 3), ScienceLifeMedicine has applied to opt in to coverage under the Privacy Act 1988 (Cth) under section 6EA, and the application is in process. Once the application is accepted, ScienceLifeMedicine will be treated as an organisation bound by the APPs, whatever the small business exemption would otherwise say.
ScienceLifeMedicine will strictly comply with this privacy policy, including as it applies to the DVS Gateway Service. This is in addition to all other legal and contractual obligations of ScienceLifeMedicine (DVS GSP Terms and Conditions cl 16.3; Participation Agreement cl 5.1(c)). Everyone who works for ScienceLifeMedicine, and every service provider ScienceLifeMedicine engages, must follow this policy to the extent it applies to that role.
3. Identity verification and the Document Verification Service (DVS)
What the DVS is
The Document Verification Service (DVS) is run by the Australian Government Attorney-General’s Department under the Identity Verification Services Act 2023 (Cth). It checks whether the details on an identity document match the records held by the agency that issued it, for example Services Australia for Medicare cards. The DVS returns a “match” or “no match” result (or an error). It does not send back any extra document details. More information about the DVS is at www.idmatch.gov.au.
The ScienceLifeMedicine role as a Gateway Service Provider
ScienceLifeMedicine is applying to become a DVS Gateway Service Provider (GSP).
- Gateway Service Provider (applying). ScienceLifeMedicine is in the process of applying to the Attorney-General’s Department to become an approved DVS Gateway Service Provider. If and once ScienceLifeMedicine is approved, ScienceLifeMedicine will provide a gateway service. This lets approved organisations (the “Gateway Users”) send DVS check requests and receive results. Until then, ScienceLifeMedicine will not make DVS checks through the ScienceLifeMedicine gateway.
- As a Gateway Service Provider, ScienceLifeMedicine will have a direct connection to the DVS, called a gateway. ScienceLifeMedicine uses it only to give authorised users access to the DVS, send match requests and return the results. ScienceLifeMedicine does not use the gateway to run checks for ScienceLifeMedicine, or checks for anyone who is not an authorised user.
- ScienceLifeMedicine will not allow anyone else to use the connection to the DVS unless ScienceLifeMedicine has appointed that person as an information match agent, and ScienceLifeMedicine will not give the result of a check to anyone who is not the authorised gateway user that asked for it.
- ScienceLifeMedicine will run the gateway service. This includes sending match requests between gateway users and the DVS, supporting gateway users with compliance reporting, and responding to enquiries.
- ScienceLifeMedicine must not make any public statement concerning the DVS unless the Framework Administrator authorises it (GSP Participation Agreement cl 4.15(i); GSP Terms and Conditions cl 12.8).
Who sends requests and receives results (including intermediaries)
There are no third-party providers that help send DVS requests or receive results.
Business users are the users of the verification service, but ScienceLifeMedicine will be sending and receiving the requests.
ScienceLifeMedicine’s gateway users will be predominantly businesses in the science, life sciences and medical fields. The people verified through the gateway will be staff, consumers and patients of those businesses.
When a DVS check is made, your identity information may pass through or be handled by these kinds of organisations:
- the gateway user that asked for the check;
- ScienceLifeMedicine as the Gateway Service Provider (if and once approved), which sends the request to the DVS and passes the result back;
- gateway or intermediary service providers. These are third-party technology providers the requesting organisation may use to send requests or receive results, such as hosting and secure network providers. ScienceLifeMedicine does not use any intermediary service providers in its Gateway Service Provider role. Under the DVS rules, each of these is appointed as an “Information Match Agent”. Each must follow the same DVS rules ScienceLifeMedicine follows and must not pass your identity information to anyone else;
- the Attorney-General’s Department, which runs the DVS hub;
- the official record holder, meaning the agency that issued the document, such as Services Australia, the Department of Home Affairs, a state or territory registry of births, deaths and marriages, or (for driver licences) a road agency through Austroads.
Why ScienceLifeMedicine uses government identifiers
ScienceLifeMedicine will only use or disclose a government-related identifier (such as a Medicare card number or driver licence number) for a DVS check if one of these applies:
- it is reasonably necessary to verify your identity for the functions or activities of ScienceLifeMedicine; or
- it is reasonably necessary to meet the obligations of ScienceLifeMedicine to a government agency or authority; or
- it is required or authorised by an Australian law or a court or tribunal order.
This reflects APP 9.2 and Participation Agreement cl 2.1.
What ScienceLifeMedicine handles for a DVS check
The details shown on the identity document you choose to use pass through the ScienceLifeMedicine gateway. This may include your name, date of birth, the document number and other details on the document (such as the card position or expiry date for a Medicare card). The request itself and the result (“match”, “no match” or an error) also pass through.
All DVS document types will be checked.
There is no requirement to check addresses, and ScienceLifeMedicine does not run address checks.
The ScienceLifeMedicine gateway handles checks of all identity documents the DVS supports. The Attorney-General’s Department publishes the list at www.idmatch.gov.au. At the time of writing, the documents are:
- Aviation and Maritime Security Identification Card
- Birth certificate
- Centrelink concession card
- Certificate of registration by descent
- Change of name certificate
- Citizenship certificate
- Death certificate
- Driver licence
- ImmiCard
- Marriage certificate
- Medicare card
- Passport
- Visa
This list may change as the DVS adds documents. ScienceLifeMedicine will keep it up to date.
Your express consent for each check
The ScienceLifeMedicine gateway user terms require each gateway user to get the individual’s consent and give a privacy notice before sending a check.
ScienceLifeMedicine will not pass a DVS check request through the ScienceLifeMedicine gateway unless the gateway user has your express consent for that check first. Before you consent, the gateway user must tell you:
- what information will be checked, and that it will be checked against the official record held by the document issuer;
- why the check is made (to confirm your identity);
- how the gateway user and ScienceLifeMedicine will use the DVS;
- the kinds of organisations that may receive your information (see “Who sends requests and receives results” above);
- the legal obligations, and your rights, in relation to the information;
- what happens if you do not consent (see “If you do not consent, or the DVS is unavailable” below);
- where to find information about complaints, and about how the Attorney-General’s Department runs the DVS.
You will be asked to tick a box like this, on the same screen where you enter your document details:
☐ I confirm that I am authorised to provide the personal details presented, and I consent to my information being checked with the document issuer or official record holder via third-party systems, including ScienceLifeMedicine’s DVS gateway, for the purpose of confirming my identity.
ScienceLifeMedicine will also link to the Attorney-General’s Department’s Identity Verification Services Privacy Statement and use its standard collection notice wording where it applies.
If you lack capacity to consent, for example because of disability, temporary incapacity or limited English, the gateway user should try to support you to consent yourself, such as by arranging an interpreter. Otherwise, a guardian or someone you have nominated in writing may consent for you. ScienceLifeMedicine generally treats people aged 15 or over as able to consent for themselves, unless there is reason to think otherwise. DVS checks through the ScienceLifeMedicine gateway are not available for anyone under 15 (see section 10).
How ScienceLifeMedicine uses DVS information, and limits on use
ScienceLifeMedicine uses DVS information only to send the check to the DVS, return the result to the gateway user, and verify identity for the purpose you consented to. ScienceLifeMedicine will not use identity information collected for a DVS check to build a profile of you, to track you, or for marketing, offering goods or services, or market research (Participation Agreement cl 5.6). ScienceLifeMedicine will not rely on a DVS result as the only evidence of your identity in legal proceedings.
If you do not consent, or the DVS is unavailable
You do not have to consent to a DVS check. If you do not consent, or the DVS cannot give a result, the gateway user should offer another way to confirm your identity where practicable. Some services may be delayed until your identity can be confirmed another way.
Your rights about a DVS check
You can ask ScienceLifeMedicine for access to, or correction of, information ScienceLifeMedicine holds about you from a check, and you can make a complaint (see section 10 and section 14). You can also ask the gateway user that asked for your check. If you ask ScienceLifeMedicine, ScienceLifeMedicine will acknowledge your request within 7 days, check the audit logs for that check, and pass your request to the gateway user that sent it. ScienceLifeMedicine will respond to you within 30 days, whether or not the gateway user has acted.
What ScienceLifeMedicine keeps and deletes
- All match data is deleted automatically. Except for the name, date of birth and address described below, once the purpose of a check has been fulfilled, ScienceLifeMedicine takes reasonable steps to permanently delete or destroy the personal information in the Information Match Data, or to de-identify it, unless the law requires ScienceLifeMedicine to keep it (Participation Agreement cl 4.17).
- ScienceLifeMedicine keeps name, date of birth and (where provided) address from the identity credential, as part of customer records, with no credential numbers. ScienceLifeMedicine never keeps document numbers.
- Images and identity documents pass through the gateway but are never stored.
- Any sensitive information that passes through the gateway, including information about racial or ethnic origin, is removed instantaneously.
- ScienceLifeMedicine keeps audit and compliance records about the gateway service, gateway users’ access to and use of the DVS, and compliance, for at least 7 years, as required (Participation Agreement cl 4.16; T&C cl 14). These records are kept to show that checks were authorised and consented to. They are not used for any other purpose. The 7-year retention period applies only to these records. It does not apply to match data, and ScienceLifeMedicine never stores identity documents or images.
Location of DVS systems
The ScienceLifeMedicine DVS gateway system, and the management and control of the gateway service, will be located and run in Australia (or New Zealand if permitted). Anyone outside Australia or New Zealand may only access the DVS through ScienceLifeMedicine if the Attorney-General’s Department has been told in advance in writing, and that person must comply with the APPs (Participation Agreement cl 4.15).
The Gateway System is hosted on equipment wholly controlled by ScienceLifeMedicine (GSP Participation Agreement cl 4.15(d); GSP Terms and Conditions cl 12.4). Cloud hosting is through Microsoft Azure in Australia East, and is fully and wholly controlled by ScienceLifeMedicine (see section 7).
Audit and oversight
Use of the DVS by ScienceLifeMedicine can be audited by the Attorney-General’s Department at any time. ScienceLifeMedicine completes an annual internal audit and compliance statement, and ScienceLifeMedicine keeps complete records of DVS use so that compliance can be checked.
Consistency with the DVS Privacy Impact Assessment
The Attorney-General’s Department has commissioned a Privacy Impact Assessment (PIA) on standard uses of the DVS. As far as possible, ScienceLifeMedicine will make sure use of the DVS is consistent with its findings and recommendations. If ScienceLifeMedicine finds an inconsistency, ScienceLifeMedicine will tell the Department promptly, commission an independent PIA of that use, and share the findings with the Department (Participation Agreement cl 5.3).
DVS security incidents
If ScienceLifeMedicine knows or suspects a security breach, compromise of access credentials or unauthorised use involving the DVS or the ScienceLifeMedicine gateway, ScienceLifeMedicine will notify the Attorney-General’s Department immediately (Participation Agreement cl 10.3). If the breach is likely to cause you serious harm, ScienceLifeMedicine will take reasonable steps to tell you. This is in addition to the obligations of ScienceLifeMedicine under the Notifiable Data Breaches scheme (see section 6).
4. Personal information ScienceLifeMedicine collects and why
See section 7 for where the information is stored.
What ScienceLifeMedicine collects
- Gateway user details: the name, position, business name, business identifier, email, phone and sign-in details of the people at gateway users who set up and use the ScienceLifeMedicine gateway.
- Details of people being verified: your name, date of birth, the document number and other details on the identity document you choose to use (see section 3), and an address only where one is provided.
- Government identifiers: for example a Medicare card number, driver licence number or passport number, as shown on the document being checked. These pass through the ScienceLifeMedicine gateway and ScienceLifeMedicine never keeps them (see section 3).
- Check results: the result of each DVS check (“match”, “no match” or an error) and the request details.
- Identity document images: only if a gateway user sends them through the ScienceLifeMedicine gateway, and only to carry out the check. They pass through and are never stored (see section 3).
- Gateway records: audit and compliance records of gateway activity, including who sent each request, when, and the result (see section 3).
- Technical information: device, browser, IP address and logs. ScienceLifeMedicine does not envisage using cookies (see section 12).
Sensitive information
ScienceLifeMedicine does not ask for health information or other sensitive information in the gateway role. Any sensitive information that passes through the gateway, including information about racial or ethnic origin, is removed instantaneously (see section 3).
How ScienceLifeMedicine collects it
ScienceLifeMedicine receives information through the gateway connection from gateway users. Gateway users are business users, and they send information to ScienceLifeMedicine using the ScienceLifeMedicine electronic portal forms. ScienceLifeMedicine receives results from the DVS. ScienceLifeMedicine may also collect information directly from you, for example when you contact ScienceLifeMedicine with a question, request or complaint.
ScienceLifeMedicine does not collect information from public sources.
Why ScienceLifeMedicine collects it
ScienceLifeMedicine collects and uses this information to:
- send DVS check requests for gateway users and return the results;
- set up and manage gateway user accounts, and support gateway users;
- verify identity, through the DVS, for the gateway user that asked for the check;
- meet the legal, contractual and record-keeping obligations of ScienceLifeMedicine, including to the Attorney-General’s Department;
- manage complaints and insurance;
- run and secure the ScienceLifeMedicine systems.
If a gateway user does not give ScienceLifeMedicine the information needed for a check, ScienceLifeMedicine cannot send it. Where it is lawful and practicable, you may use a pseudonym or stay anonymous for general enquiries to ScienceLifeMedicine, but not for DVS checks.
Children and people who need support
Where someone cannot make decisions for themselves, a parent, guardian or other authorised representative may act for them, as described in section 10 for access requests.
5. Who ScienceLifeMedicine discloses information to
ScienceLifeMedicine discloses information only for the purposes above, for directly related purposes you would reasonably expect, with your consent, or where the law requires or permits it. Recipients may include:
- the gateway user that asked for the check, which receives the result;
- the DVS participants described in section 3, for identity checks only;
- the hosting provider, Microsoft Azure, which holds gateway data for ScienceLifeMedicine and must protect it (see section 7);
- regulators, insurers, legal advisers, and law enforcement where the law requires or permits it (for example the Attorney-General’s Department, the OAIC or a court order).
ScienceLifeMedicine does not sell personal information.
6. Data security and the Notifiable Data Breaches scheme
ScienceLifeMedicine takes reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, change or disclosure. These steps include access controls, logging and monitoring, and staff training. ScienceLifeMedicine reviews security regularly. Hosting and encryption details are in section 7.
ScienceLifeMedicine is covered by the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act. If ScienceLifeMedicine suspects a data breach, ScienceLifeMedicine will assess it quickly, and within 30 days. If it is an “eligible data breach”, meaning it is likely to cause serious harm, ScienceLifeMedicine will notify affected people and the Office of the Australian Information Commissioner (OAIC) as soon as practicable. For DVS-related breaches, ScienceLifeMedicine will also notify the Attorney-General’s Department as described in section 3.
How ScienceLifeMedicine holds information
ScienceLifeMedicine holds personal information electronically, in the cloud system described in section 7. No records are held on paper. ScienceLifeMedicine does not combine or link personal information across systems or sources.
7. Hosting, encryption and access security
Hosting and data residency
The gateway is hosted on Microsoft Azure in data centres located in Australia (Azure Australia East). All production data and backups are held in Australia.
ScienceLifeMedicine runs the system and holds the data. Access is limited by role, and access to records is logged. Identity document details collected for DVS checks are handled as set out in section 3.
Encryption and access security
- In transit: data sent between your device and the gateway is encrypted using TLS 1.3, which is approved by the Australian Signals Directorate (ASD).
- At rest: data stored in the gateway is encrypted using ASD-approved AES-256 or equivalent encryption.
- Cloud provider: the gateway is hosted on Microsoft Azure. The Azure services ScienceLifeMedicine uses are IRAP assessed (Infosec Registered Assessors Program). All production data is held in Australia.
- Encryption standard: data is encrypted at rest (AES-256 or equivalent) and in transit (TLS 1.3) using algorithms approved by the Australian Signals Directorate (ASD), as required by Services Australia’s Integrated Third Party Security Policy.
- Multi-factor authentication is enforced for all staff.
- Logging and monitoring: ScienceLifeMedicine keeps and reviews access and audit logs, including for all DVS gateway activity.
Backups
ScienceLifeMedicine backs up gateway data daily so it can be recovered after an incident. Backups are encrypted, stored in Microsoft Azure Australia East, and kept on a rolling 35-day cycle, after which they are automatically deleted. Backups are protected to the same standard as live data and are used for disaster recovery only.
Service providers
ScienceLifeMedicine does not use any intermediary service providers in the Gateway Service Provider role. If that changes, they will be appointed as Information Match Agents and bound by the DVS rules (see section 3).
8. Data kept in Australia
All production data for the ScienceLifeMedicine gateway is held in Australia. “Production data” means the live information in the ScienceLifeMedicine gateway system. DVS gateway systems will be located and run in Australia (or New Zealand if permitted).
ScienceLifeMedicine does not require any associated overseas or third-party services, other than the Microsoft Azure hosting described in section 7.
No overseas provider stores or accesses information, and there is no related company overseas.
9. Retention and destruction of records
- Gateway service records: records of the gateway service, gateway users’ access to and use of the DVS, and compliance, are kept for 7 years (see section 3).
- DVS match data and identity documents: handled as set out in section 3. ScienceLifeMedicine keeps only the name, date of birth and (where provided) address from the identity credential, as part of customer records, and never document numbers. Other match data is deleted automatically. Identity documents and images pass through the gateway and are never stored.
When ScienceLifeMedicine no longer needs information and the law does not require ScienceLifeMedicine to keep it, ScienceLifeMedicine securely destroys or de-identifies it.
10. Access and correction
You can ask for access to the personal information ScienceLifeMedicine holds about you, and ask ScienceLifeMedicine to correct it if it is wrong, out of date or incomplete. Contact ScienceLifeMedicine. ScienceLifeMedicine will respond within 30 days.
Access is usually free, but ScienceLifeMedicine may charge a reasonable fee for copying or preparing records. ScienceLifeMedicine may refuse access in limited cases allowed by law, for example where access would pose a serious threat to someone’s life, health or safety. If ScienceLifeMedicine refuses, ScienceLifeMedicine will tell you why in writing and explain how to complain.
How to ask
To ask for access or correction, contact the privacy officer using the details in section 14. Please tell ScienceLifeMedicine what you are asking for and how to reach you. ScienceLifeMedicine will not refuse a request just because it was not made in a particular way.
The steps to follow are: contact the privacy officer with your request, then confirm your identity. ScienceLifeMedicine checks your identity online through image processing before giving access to, or correcting, any information. The image used for that check is not kept.
Access, correction and complaint requests are handled by email, using the contact details on this website.
Access by other people
Sometimes someone other than you asks for your information, such as a parent, guardian, carer or other representative, or a law enforcement agency. ScienceLifeMedicine will only give access if you have agreed, the person is legally authorised to act for you, or the law requires or permits it.
If a parent, guardian, carer or other representative asks for information on your behalf, that person must give ScienceLifeMedicine proof of authority (such as a court order, guardianship order or power of attorney), and ScienceLifeMedicine will check that person’s identity online using image processing. Requests from law enforcement agencies must be made in writing, and ScienceLifeMedicine only acts on them where the law requires or permits it. Identity checks using the Document Verification Service (DVS) through the ScienceLifeMedicine gateway are not available for anyone under 15 years of age; ScienceLifeMedicine does not process DVS checks for people under 15.
Keeping information accurate
ScienceLifeMedicine takes reasonable steps to make sure the information ScienceLifeMedicine holds is accurate, up to date and complete. ScienceLifeMedicine has audit trails and procedures in place to keep information accurate, up to date and complete.
11. Marketing
ScienceLifeMedicine does not use DVS identity information for marketing. ScienceLifeMedicine may send gateway users service messages, such as account notices, support updates and important updates.
If ScienceLifeMedicine sends any general newsletters or promotional messages, ScienceLifeMedicine will only do so where the law allows. Each message will include a simple way to opt out, and you can also opt out at any time by contacting ScienceLifeMedicine.
12. Cookies and analytics
At this stage in development, ScienceLifeMedicine does not envisage the use of cookies or analytic tools. This applies to this website and any gateway portal.
If this changes, ScienceLifeMedicine will update this policy before any cookies or analytic tools are used. ScienceLifeMedicine will never put identity or DVS information into analytic tools.
This website does not set cookies and does not use analytics.
13. Version, review and where to find this policy
- Version: 0.5
- Published at: https://sciencelifemedicine.com.au/privacy/
- Next review: at least annually (see below)
This is the privacy policy referred to in the ScienceLifeMedicine application to the Attorney-General’s Department for DVS access (Addendum 2 – Privacy Act and Policy). ScienceLifeMedicine will review this policy periodically, at least annually, and whenever there is a structural change to the business or the way ScienceLifeMedicine handles personal information changes in an important way. ScienceLifeMedicine will publish any important changes on this website.
When ScienceLifeMedicine changes this policy, ScienceLifeMedicine will publish the new version at the same address with an updated version number. ScienceLifeMedicine will also keep a record of previous versions.
This policy is free to read. ScienceLifeMedicine will give it to you in the form you ask for where ScienceLifeMedicine reasonably can, for example as a printed copy or in an accessible format. When asked, ScienceLifeMedicine can provide this policy in a different format within five business days. Contact ScienceLifeMedicine to ask. You can also print this page from your browser.
14. Complaints and contact
Privacy officer support@sciencelifemedicine.com.au
If the privacy officer contact changes, ScienceLifeMedicine will update these contact details.
If you have a question or a complaint about privacy, including about a DVS identity check, please contact ScienceLifeMedicine first. ScienceLifeMedicine will acknowledge your complaint within 7 days and aim to resolve it within 30 days.
Complaints work in these steps. This includes complaints about how a service provider has handled your information:
- Step 1: contact ScienceLifeMedicine. Contact the privacy officer using the details above. ScienceLifeMedicine will acknowledge your complaint and tell you the outcome in writing.
- Step 2: if you are not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or on 1300 363 992.
Information about the DVS is available at www.idmatch.gov.au.
ScienceLifeMedicine is not a member of a recognised external dispute resolution scheme and is not bound by any registered APP code.