Privacy and sensitive information
Pilot Privacy Notice
Pilot version · Updated 11 September 2026
Important: This notice applies to the small, invitation-only Recovery Connect technical pilot. Recovery conversations may contain sensitive health information. Recovery Connect Pty Ltd will obtain qualified Australian privacy and legal review before inviting general members or presenting the platform as a health service.
Who is responsible
Recovery Connect Pty Ltd operates the pilot and is responsible for deciding why and how pilot information is handled. Privacy questions and requests can be sent to recoveryconnect.org@outlook.com.
Information we collect
- A stable account identifier supplied by the sign-in service. The service also supplies an email address and may supply a name so sign-in and authorised administrator access can work.
- Your chosen display name, confirmation that you are at least 18 and located in Australia, the policy version you accepted, account role, creation date and any suspension status.
- Community messages, report details, blocks, message safety flags, moderation decisions and unused invitation records.
- If you use the public concern form, the concern and any contact information you choose to provide.
- Limited technical, security and access information produced by the hosting and sign-in services when the website is used.
Recovery Connect does not ask pilot members for legal names, home addresses, medical records, diagnoses or detailed treatment histories. Please do not put that information into a message or report.
How we collect it
Most information comes directly from you when you sign in, create a profile, post, report, block or contact Recovery Connect. Account and technical information is also received automatically from the sign-in, security and hosting services needed to run the website.
Why we collect and use it
We use pilot information to provide protected profiles and community messaging, control invitations, show messages to approved members, enforce the Community Guidelines, investigate reports, prevent misuse, operate moderation and improve the safety of the pilot. Recovery Connect does not sell member information or use recovery conversations for targeted advertising.
Health and sensitive information
Anything you voluntarily write about addiction, medication, treatment, disability, mental health or recovery may be sensitive health information. By completing the pilot joining steps, you consent to Recovery Connect collecting, holding and using the information you choose to submit for the pilot purposes described in this notice. You can reduce what is collected by using a non-identifying display name and sharing only what is necessary.
Who can see or receive information
- Approved pilot members can see your active messages and display name. Your sign-in email and legal name are not shown in the community.
- Authorised moderators can access active, hidden and held messages, reports, account status and moderation records where needed for safety and administration.
- OpenAI Sites, Cloudflare and related service providers process information to provide hosting, sign-in, security and technical support.
- Information may be disclosed where you consent, where required or authorised by law, or where reasonably necessary to respond to a serious threat to life, health or safety and the law permits it.
We do not promise that a report is anonymous. Recovery Connect does not show the reporter's identity to the reported member, but another person may sometimes infer who made a report from the circumstances.
Overseas processing
The website uses global hosting and security providers. Information may be processed in Australia, the United States and other countries in which those providers or their approved service providers operate. Data protection laws can differ between countries. Recovery Connect will review provider arrangements and likely processing locations before any wider launch.
Security
Current safeguards include encrypted web connections, sign-in controls, server-side administrator checks, restricted moderation tools, display names, single-use invitations, report and block controls, activity records, and no direct messages, public member lists, links or uploads. Access is limited to what is needed for the pilot. No online service can guarantee absolute security.
Retention and deletion
The current pilot does not promise that every conversation will be kept for two years. Different records have different purposes and legal requirements. See the Pilot Data Retention & Deletion Policy for what happens now, what account deletion removes, and what must be legally confirmed before wider launch.
Access, correction and deletion requests
You can ask what information Recovery Connect holds about you, request access or correction, or ask for deletion by emailing recoveryconnect.org@outlook.com. We may need to verify that the request relates to your account. We aim to acknowledge a request within seven days and provide a substantive response within 30 calendar days where reasonably possible. Some information may need to be withheld or retained where the law permits or requires it; if so, we will explain the reason where lawful.
You can permanently delete one of your own community messages from its message controls. This also removes reports linked to that message from the live pilot database. The in-pilot Delete my pilot profile control removes your profile, messages, blocks and linked member reports from the live pilot database. Hosting backups and security records may remain for a limited provider-controlled period before rotation, and information subject to a legal preservation requirement may need separate handling.
Privacy complaints
Email recoveryconnect.org@outlook.com with what happened, the outcome you would like and a safe way to contact you. We aim to acknowledge a complaint within seven days and respond within 30 calendar days. If you are not satisfied, you may contact the Office of the Australian Information Commissioner. For Victorian health-information concerns, you may also contact the Victorian Health Complaints Commissioner.
Data incidents
Recovery Connect will contain, assess and respond to suspected data breaches. Where the Notifiable Data Breaches scheme applies, we will take reasonable steps to complete an eligible-breach assessment within 30 days and notify affected people and the OAIC when legally required.
Changes to this notice
We will show the updated date and explain material changes. Pilot members may be asked to read and accept an updated notice before posting again.
This operational pilot notice is not a substitute for professional legal advice. It is deliberately conservative while Recovery Connect confirms which federal and Victorian health-privacy obligations apply.