Privacy Policy

Last updated: 30 October 2026

Who we are

In this policy, “we”, “us” and “our” means Chimera Legacy Foundation Ltd (ABN 32 635 475 722), a registered charity with the Australian Charities and Not-for-profits Commission (ACNC) and endorsed as a Deductible Gift Recipient (DGR). We are based in Brisbane, Queensland.

This policy applies to personal information we collect through our website chimeralegacyfoundation.org.au, our forms, our emails and our programs, including Holiday from Hospital.

What information we collect

Depending on how you deal with us, we may collect:

• Contact details, such as your name, email address and phone number.
• Holiday request details: when someone requests a Holiday from Hospital, we may collect the patient’s name, the hospital and ward or unit, and health-related information about the patient’s condition or circumstances, as well as the details of the person making the request.
• Donor and payment details, such as your name, email, the amount and date of your gift or boarding pass purchase, and information needed to issue receipts. Card details are handled by our payment provider, not by us (see below).
• Stories, photos and videos that patients, families or supporters choose to share with us.
• Website usage information collected through cookies and analytics tools, such as pages visited, the device and browser used and general location (for example, city or country).

You can browse our website without telling us who you are. If you choose not to give us certain information, we may not be able to provide a service, process a gift or respond to a request.

How we collect it

• Website forms: when you request a holiday, apply to take part, sign up for updates or contact us.
• Payments through Square: donations and boarding pass purchases are processed by Square. Square collects and processes your card details on its secure platform. We do not see or store your full card number. We receive the transaction details we need, such as your name, email, amount and date.
• Email through Brevo: we use Brevo to send confirmations, receipts and updates, and to manage our mailing list.
• Directly from you: when you email us, talk to us or take part in our programs and events.
• From others, with consent: for example, a family member, carer or hospital staff member may submit a holiday request for a patient. We ask that they have the patient’s permission (or the permission of the patient’s parent or guardian) before sharing the patient’s information with us.
• Cookies and analytics: our website and service providers (such as Google) use cookies and similar technologies to help the site work and to understand how it is used. You can block or delete cookies in your browser settings, although some parts of the site may not work as intended.

Why we use it

We use personal information to:

• deliver our Holiday from Hospital virtual reality (VR) experiences, including assessing and arranging requests and communicating with patients, families and hospitals;
• process donations and boarding pass purchases, and issue receipts (including tax-deductible receipts where applicable);
• fundraise and tell supporters about the impact of their gifts;
• send updates and news about our work, where you have agreed to receive them;
• respond to enquiries and manage our relationship with you;
• improve our website and programs; and
• meet our legal, accounting and charity reporting obligations.

We do not sell your personal information.

Health information

Patient stories, photos and videos

Sharing patient stories can help others understand the difference a Holiday from Hospital makes. We only publish or share a patient’s name, image, video or story with their consent (or the consent of their parent or guardian). You can ask us to stop using your story or images at any time by emailing us, and we will remove them from our website and channels that we control as soon as practicable. Content that has already been shared by others may be outside our control.

Who we share it with

We only share personal information where needed for the purposes above, with your consent, or where required or permitted by law. This includes trusted service providers that help us run our charity, such as:

• Square: payment processing;
• Brevo: email delivery and mailing list management;
• Google: services such as email, document and data storage, video hosting and website analytics; and
• our website hosting provider, which stores our website and the information submitted through it.

Where needed to deliver a holiday, we may also share relevant details with the hospital or care team involved. We expect our service providers to protect personal information and use it only to provide their services to us.

Overseas storage

Some of our service providers store or process information outside Australia, for example in the United States, the European Union or other countries where they or their data centres are located. When this happens, we take reasonable steps to make sure the information is handled consistently with the Australian Privacy Principles.

Marketing and opting out

We will only send you updates and fundraising emails where you have agreed or where the law otherwise allows. Every marketing email includes an unsubscribe link, and you can also opt out at any time by emailing us. Even if you opt out of marketing, we may still send you messages about a gift, purchase or request you have made, such as receipts and confirmations.

Keeping your information secure

We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, change or disclosure. These include using reputable service providers, secure (HTTPS) connections, password-protected accounts and limiting access to the people who need it. No method of transmission or storage is completely secure, so please contact us straight away if you think your information has been put at risk.

How long we keep it

We keep personal information only for as long as we need it for the purposes described in this policy, or as required by law (for example, financial and tax records). When it is no longer needed, we take reasonable steps to securely delete or de-identify it.

Accessing and correcting your information

You can ask to see the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date, incomplete or misleading. Please email us; we will respond within a reasonable time (usually within 30 days). We may need to confirm your identity first. If we cannot give you access or make a correction, we will tell you why, unless it would be unreasonable to do so.

Questions and complaints

If you have a question or a concern about how we have handled your personal information, please email us first so we can try to fix it. We take every complaint seriously and aim to respond within 30 days.

If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

Changes to this policy

We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated.