GP Staff Academy is the registered business name under which The Trustee for Potter Procurement Trust (ABN 72 199 119 851) supplies the Service. In this Privacy Policy, “GP Staff Academy”, “we”, “us” and “our” refer to that supplier. This Privacy Policy explains how we collect, hold, use and disclose personal information through gpstaffacademy.com.au, our courses and related services. It is intended to support our obligations under the Privacy Act 1988 (Cth) and the Australian Privacy Principles where they apply.

What information we collect

Depending on how you use GP Staff Academy, we may collect:

Account and identity information: your name, email address, username, password credentials in protected form and, if supplied, the name of your practice or organisation.
Order and billing information: billing contact details, purchased products, amounts, transaction references, order status, invoices and refund records. Our payment providers process card and other payment credentials; GP Staff Academy does not receive or store your full card number.
Learning records: enrolments, course access, progress, lesson and topic completion, quiz attempts, scores, completion dates, certificates and resource downloads.
Enquiries and communications: contact details, messages, support requests, feedback and communication preferences that you choose to provide.
Optional checklist email delivery and updates: the email address you submit to receive the checklist. If you separately opt in to occasional updates, we also record the page used, the date of consent and the version of the consent wording. The checklist remains available without entering an email address.
Technical and usage information: approximate location, browser and device type, referring page, pages viewed, selected course-interest and contact actions, downloads, quiz or course-completion milestones, cart and checkout steps and completed-purchase events.

Please do not submit patient names, health information, Medicare details or other clinical information through this website or its forms. GP Staff Academy is an education service and does not require patient information to provide its courses. If we receive personal information that we did not request, we will promptly assess whether we could lawfully have collected it. Where the Australian Privacy Principles apply, if we could not have collected the information and it is lawful and reasonable to do so, we will destroy or de-identify it as soon as practicable.

How we collect information

We collect information directly from you when you contact us, create an account, enrol, purchase a course, complete learning activities, request support or subscribe to communications. We also collect limited technical and usage information automatically through WordPress, WooCommerce, LearnDash, security systems, server logs, cookies and Google Analytics 4.

If a practice or employer purchases or arranges training for you, we may receive your name, business email address and enrolment instructions from that organisation. The organisation should ensure it is authorised to provide that information. We will tell you which organisation supplied the information and provide access to this Privacy Policy when we create your account or send your enrolment instructions, unless the law permits otherwise.

Why we use information

We use personal information where reasonably necessary to:

create and secure accounts, process enrolments and provide course access;
record progress, administer assessments and issue completion certificates;
process orders, payments, refunds and accounting records;
respond to enquiries and provide learner or customer support;
operate, secure, troubleshoot and improve the website, courses and learner experience;
understand course interest, resource use and the effectiveness of website content;
send service messages and, where permitted, information about relevant courses or resources;
prevent fraud, misuse and security incidents; and
comply with legal, regulatory, tax, accounting and dispute-resolution obligations.

Marketing communications

We send commercial electronic messages only where we have express consent or another basis permitted by the Spam Act 2003. We keep records of the source, date, method and wording of consent. Each marketing message accurately identifies GP Staff Academy and the supplier of the Service, includes current contact details and provides a functional unsubscribe facility.

We action unsubscribe requests within five working days, do not charge for unsubscribing, do not require a person to log in or provide additional personal information, and keep the unsubscribe facility working for at least 30 days after the message was sent. We do not add someone to marketing merely because they made a one-off purchase, requested a resource or submitted an enquiry. Essential account, purchase and course-administration messages are not marketing communications.

Internal learning reports

We also use existing account, enrolment, course-completion and paid-order records to calculate aggregate totals for free-course participation, completion and subsequent purchases. These administrator reports show no learner names, email addresses, individual answers or payment details. This internal reporting does not add advertising pixels, cookies or external analytics and is separate from the browser analytics choices described below.

Google Analytics and behavioural measurement

We use one Google Analytics 4 implementation (measurement ID G-JFPL0MYVRF) to understand website use and the purchase journey. WooCommerce is the sole source of standard page-view and ecommerce events. A separate consent layer sends only selected, sanitised course-interest, contact, file-download and learning-milestone events; it does not duplicate standard page views, product views, checkout starts or purchases. In Australia and other locations outside the prior-consent regions listed below, privacy-restricted measurement is enabled by default unless the visitor turns it off.

For visitors in the European Economic Area, United Kingdom and Switzerland who have not already saved a choice, analytics storage is denied by default. We use Google’s advanced consent mode: before a visitor allows analytics, the Google tag may send cookieless consent and measurement pings with limited functional and aggregate information, but it does not set Analytics cookies or send full cookie-based measurement. Full Analytics storage is enabled only after the visitor selects Allow analytics. Advertising storage and personalisation remain denied in every region, and granular location and device collection is disabled in these prior-consent regions.

Google Analytics uses first-party identifiers such as the _ga and _ga_JFPL0MYVRF cookies to distinguish browsers and sessions. Google states that these cookies may remain for up to two years under its default settings. Google Analytics also receives general device, browser, session and approximate location information. IP addresses may be used during collection to derive approximate location before Google discards them from logged Analytics data.

Our implementation is configured to reduce privacy risk:

advertising storage, advertising user data and advertising personalisation are denied;
Google Signals and advertising-personalisation signals are disabled;
custom events use limited labels and path-only URLs, while standard ecommerce events are generated once by WooCommerce;
arbitrary visible link and button text is not transmitted;
we do not send form-field contents, site-search terms, names, email addresses, phone numbers, patient or clinical information, free-text responses, fine location or a GP Staff Academy user ID to Google Analytics; and
payment card details are not available to Analytics.

You can change your choice at any time using Privacy choices in the website footer. Selecting Turn analytics off stores that preference in your browser, keeps Analytics storage denied, suppresses future Analytics events from that browser and removes accessible Google Analytics cookies. The Google tag may still load in consent mode without permission to use Analytics storage. Selecting Allow analytics records permission for that browser. If you clear browser storage or use another browser or device, you may need to repeat your choice. You can also use the Google Analytics Opt-out Browser Add-on.

For more information, see Google’s information about safeguarding Analytics data, how Google uses information from sites that use its services and the Google Privacy Policy.

Other cookies and local storage

The website also uses essential cookies or browser storage to support security, sign-in, account sessions, course access, shopping-cart and checkout functions and to remember privacy preferences. Essential technologies are required for requested website and account functions. Disabling them may prevent login, checkout, saved progress or other features from working correctly.

Who we disclose information to

We may disclose relevant information to service providers that help us operate GP Staff Academy, including website hosting and security providers, WordPress/WooCommerce and LearnDash technology providers, payment processors, email and communication providers, professional advisers, accounting systems and Google Analytics. Providers receive only the information reasonably required for their role and may process information under their own privacy terms.

If a practice or employer purchases or administers your enrolment, we may disclose to an authorised contact at that organisation your name, assigned courses, completion status and completion dates for training-administration purposes. We do not disclose detailed quiz answers or support communications unless you consent or we are otherwise permitted or required by law. We will tell you when organisation reporting applies.

We do not sell or rent personal information. We may disclose information where required or authorised by law, to prevent or investigate suspected fraud or security incidents, or to establish, exercise or defend legal claims.

Overseas processing and disclosure

Some service providers operate global cloud infrastructure and may store or process information outside Australia. Likely overseas locations include the United States and countries in which our technology, payment, email and analytics providers or their subcontractors maintain facilities. Because distributed cloud infrastructure and provider locations change, it is not practicable to identify every country in advance.

Where the Australian Privacy Principles apply, we take reasonable steps appropriate to the circumstances before disclosing personal information to an overseas recipient. Overseas recipients may be subject to different privacy laws and regulatory requirements.

How long we keep information

We retain information only for as long as reasonably necessary for the purpose for which it was collected, to maintain learning and certificate records, provide support, resolve disputes and meet legal, tax, accounting, fraud-prevention and security obligations. Retention periods vary by record type and service-provider settings. Google Analytics event-level and user-level data associated with cookies, user identifiers or advertising identifiers is configured for 14-month retention, with reset on new activity. Aggregated reporting may be retained under Google’s standard reporting settings. When information is no longer required, we take reasonable steps to delete or de-identify it, subject to lawful backup and record-retention requirements.

Data security

We use reasonable administrative and technical safeguards intended to protect information against misuse, interference, loss and unauthorised access, modification or disclosure. These include access controls, encrypted connections, protected account credentials, software and hosting security controls and restricted administrative access. No internet service can guarantee absolute security.

You are responsible for keeping your account password confidential. Please contact us promptly if you believe your account or personal information has been compromised.

Access and correction

You may request access to personal information we hold about you or ask us to correct inaccurate, out-of-date, incomplete, irrelevant or misleading information. Contact us using the details below and describe your request. We may need to verify your identity. If an applicable legal exception prevents access or correction, we will explain the reason where the law permits.

Privacy complaints

If you believe we have mishandled your personal information, contact our Privacy Officer with details of the concern. We will acknowledge the complaint, investigate it and generally provide a substantive response within 30 calendar days. If we need more time, we will explain why and tell you when we expect to respond. We may ask for further information needed to investigate.

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner. Depending on your location, other privacy rights or complaint avenues may also apply.

External links

Our website may link to third-party websites. Their privacy practices are governed by their own policies, and we are not responsible for external websites.

Changes to this policy

We may update this policy when our services, technology or legal obligations change. The current version will remain available on this page. Material changes may also be communicated through the website or another appropriate channel.

Contact

Privacy Officer
For privacy questions, access or correction requests, or complaints, email hello@gpstaffacademy.com.au.