Information technology and cyber security

Draft for board adoption. This policy will be reviewed and adopted by the board at its first meeting, then reviewed every year. Questions? Use our contact form.

Our systems

The Foundation uses accounts in its own name, separate from School of Sexual Wellness Pty Ltd. Health and referral information is kept only in approved systems hosted in Australia.

Access

Multi-factor authentication on every account.
People get access only to what their role needs.
Access is removed within one business day when someone leaves.
Passwords are kept in a password manager and never shared.

Devices

Devices used for Foundation work are kept up to date, locked when unattended and encrypted. Health information is never stored on personal devices or portable drives.

Scams

Any change to payment details is confirmed by phone with a known contact. Suspected scam emails are reported to the Treasurer.

Backups

Records are backed up weekly. Restoring a backup is tested every quarter.

Artificial intelligence

No personal or health information is entered into public artificial intelligence tools. Content produced with these tools is checked by a person before use.

Breaches

A suspected data breach is reported to the Chair immediately and assessed within 30 days. Eligible breaches are notified to the Office of the Australian Information Commissioner and the people affected, and to funders where a grant requires it.

All policies · Governance