Privacy Policy

This Privacy Policy explains how Rape Insure Pty Ltd (ABN 62 148 903 771, AFSL 512 884) collects, holds, uses and discloses personal information, and how you can access and correct it or make a complaint. In this policy, we, us and our mean Rape Insure Pty Ltd, and you means anyone whose personal information we handle, including customers, people covered under a policy, claimants, representatives, providers and visitors to our website.

We are bound by the Privacy Act 1988 (Cth) and the thirteen Australian Privacy Principles (APPs) in Schedule 1 of that Act. We are also bound by the Insurance Contracts Act 1984, the Corporations Act 2001, the Spam Act 2003, the Do Not Call Register Act 2006 and the General Insurance Code of Practice, each of which affects how we handle your information.

Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether or not it is true and whether or not it is recorded in a material form.

Sensitive information is a category of personal information that the law protects more strictly. It includes health information, information about a person's criminal record, racial or ethnic origin, religious beliefs, sexual orientation or practices, and membership of associations. Because of the nature of Victim Support Cover, we may need to collect health information and information about a criminal offence committed against you when you make a claim.

This policy applies to information we collect through our website, by phone, email, post and in person, and through third parties acting for us. It does not apply to the practices of other organisations we link to, such as AFCA, state Victims Services schemes or support services, each of which has its own privacy policy.

The types of personal information we collect depend on how you deal with us. Someone who only asks for a quote gives us far less than someone who makes a claim. The table below sets out the categories of information we may collect, with examples, and when we collect them.

Information about other people

If you give us personal information about someone else, for example a partner or dependant covered under a couple or family policy, an emergency contact, a nominated representative, or a treating practitioner, you should make sure that person knows you have done so and is aware of this policy. Where you name a family member as a carer under the income and carer benefit, we will collect their identity and employment details directly from them.

Where an offender or alleged offender is a family member or someone otherwise known to you, information about that person may be unavoidable in a police report or court document. We treat that information as sensitive, do not record it in any structured field, and never use it for any purpose other than assessing your claim.

Anonymity and pseudonymity

You can ask about our products, use our website and quote tool, and contact our sales team without identifying yourself. You can also contact the claims line anonymously to ask how a claim would work. We need to identify you to issue a policy, make changes, or pay a claim, because the Insurance Contracts Act 1984 and our AFSL obligations require us to know who we are dealing with.

Wherever it is practical, we collect personal information directly from you. That happens when you:

• request a quote or apply for cover on our website or by phone;
• call, email, write to or message us;
• make a claim, provide supporting documents or nominate a provider;
• make a complaint or respond to a survey;
• update your details or change your cover; or
• browse our website, where some information is collected automatically (see section 10).

We may also collect information from other people, but only in these situations:

• People you authorise. Your nominated representative, support worker, lawyer, psychologist or medical practitioner may give us information on your behalf, within the limits of the authority you have given.
• Police and Victims Services schemes. With your consent, we may confirm that a police event number or Victims Services application reference is genuine. We do not obtain the contents of a police report or statement, and we do not need them to accept a claim.
• Providers who bill us directly. When a psychologist, lawyer, removalist or landlord invoices us directly, they send us the invoice and the minimum information needed to match it to your claim.
• Other insurers. Where you tell us another insurer, workers compensation scheme or Medicare has also paid for a cost, we may confirm the amount with them to avoid double payment, with your consent.
• Publicly available sources. Court lists and published judgments, only where they relate to a matter in which you are a victim or witness and only where relevant to the legal advocacy benefit.
• Identity verification services. To confirm your identity when you apply, using the details you give us.

Unsolicited information

If we receive personal information we did not ask for and would not have been permitted to collect, we will destroy or de-identify it as soon as practicable, as APP 4 requires. If you send us more than we need, for example a full police statement when we asked only for an event number, we will retain only the reference and securely destroy the rest, and we will tell you we have done so.

Call recording

Calls to our sales, service and claims lines are recorded for training, quality and dispute resolution purposes. We tell you at the start of the call. If you would prefer not to be recorded, tell the person you are speaking with and they will pause the recording, or you can contact us by email or through our website instead.

We collect, hold and use personal information for the following purposes:

• to give you a quote, assess your application, issue and renew your policy, and calculate and collect premiums;
• to verify your identity and confirm that a person contacting us about a policy is entitled to do so;
• to assess, manage and pay claims, including confirming a claim trigger, paying providers directly and coordinating support;
• to communicate with you about your policy, claims, changes to our products or documents, and matters you have raised with us;
• to handle complaints and disputes, including at AFCA;
• to meet our legal and regulatory obligations, including under the Corporations Act 2001, the Insurance Contracts Act 1984, the Privacy Act 1988, our AFSL conditions, APRA prudential standards and the General Insurance Code of Practice;
• to detect, investigate and prevent fraud and other unlawful activity;
• to design, price and improve our products and services, and to prepare our Target Market Determination;
• to train our staff and monitor the quality of our service; and
• to tell you about products and services we think may interest you, where you have agreed to this (see section 9).

We will only use or disclose your personal information for the purpose for which we collected it, a directly related purpose you would reasonably expect, a purpose you have consented to, or a purpose permitted or required by law. We do not sell personal information, and we do not provide it to third parties for their own marketing.

Decisions about claims are made by people

We use technology to route work, check for duplicate invoices and flag claims that need urgent attention. We do not use automated decision-making, profiling or artificial intelligence to decline, reduce or delay a claim. Every decision to decline a claim, in whole or in part, is made and reviewed by a trained person and explained to you in writing.

Research and de-identified data

We may use de-identified and aggregated claims data to understand how crime affects our customers and to improve the product. We share aggregated statistics with victim support partners and researchers under written agreements. Information that could identify you, or that describes an individual incident, is never included.

We share personal information only where it is necessary for one of the purposes in section 4, and only with the organisations described below. Each is bound by the Privacy Act or by contractual obligations at least as strict.

We may also disclose personal information where the law requires or authorises it, for example in response to a subpoena, a notice from ASIC or APRA, or a request under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 where it applies. Where we are permitted to, we will tell you about any compulsory disclosure.

We do not disclose personal information to recipients outside Australia, with one exception described below. Our customer records, claims files, call recordings and backups are stored in data centres located in Australia. Our staff, including the claims and complaints teams, are located in Australia, and we do not use offshore contact centres.

The one exception

Our reinsurer, Tasman Re (Australia) Limited, performs portfolio analytics through a team based in New Zealand. For this purpose we provide pseudonymised claims data, in which your name, address, date of birth and contact details are replaced with a code, and any free-text description of an incident is removed. The data allows the reinsurer to model how often benefits are claimed and how much they cost, which is necessary to keep our premiums stable.

Before disclosing information for this purpose, we have taken the following steps as required by APP 8:

• the reinsurance agreement requires the recipient to handle the data in accordance with the Australian Privacy Principles and not to attempt to re-identify any individual;
• New Zealand's Privacy Act 2020 provides protections substantially similar to the APPs, and New Zealand has an independent Privacy Commissioner you can complain to;
• the data is transferred and stored encrypted, and access is limited to named analysts; and
• we audit the recipient's compliance annually.

We do not disclose health information, criminal record information or any information that identifies you overseas for this or any other purpose. If this changes, we will update this policy and tell you before any disclosure takes place.

We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification and disclosure, as APP 11 requires. Given who our customers are, we treat all claims information and safety instructions as high-risk data and protect them accordingly.

How we protect your information

• All data is encrypted in transit and at rest, and backups are encrypted separately.
• Access to claims files is restricted to the case team assigned to you. Sales and marketing staff cannot see claims information.
• Safety flags restrict who can see your address and contact details and require a second person to authorise any change of address.
• All staff use multi-factor authentication and are required to complete privacy and family violence training when they start and each year after.
• We commission independent penetration testing of our systems at least annually and after any significant change.
• Paper documents are stored in locked facilities and shredded once scanned.
• Contracts with technology providers include security standards, audit rights and data breach notification obligations.

How long we keep it

We keep personal information only as long as we need it for the purposes described in this policy and to meet our legal obligations. In general:

• policy records are kept for 7 years after the policy ends, as the Corporations Act 2001 and our AFSL require;
• claim files are kept for 7 years after the claim is finalised, or longer if a dispute or legal proceeding is on foot;
• call recordings are kept for 12 months, unless they form part of a claim or complaint file;
• quote information you do not proceed with is deleted after 90 days; and
• website analytics data is aggregated after 30 days and never retained in identifiable form.

When we no longer need personal information, we destroy it securely or permanently de-identify it. You can ask us to delete information earlier, and we will do so unless the law requires us to keep it, in which case we will tell you why and when it will be destroyed.

Under APP 12 and APP 13 you have the right to ask for access to the personal information we hold about you, and to ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading. You do not need to give a reason.

How to ask

Contact our Privacy Officer using the details in section 13. We will need to confirm your identity before we release information. You can ask for a copy of a specific document, such as a claim decision letter or a call recording, or for everything we hold. Tell us the format you prefer, for example a secure download, email or post, and we will accommodate it where we can.

What to expect

• We acknowledge your request within 1 business day.
• We respond within 30 calendar days, and usually much sooner for simple requests. If we need longer, we will tell you why and when to expect a response.
• There is no charge for making a request, for the first copy of any document, or for correcting your information.
• If we correct information we have previously shared with a third party, we will tell them about the correction if you ask us to.

When we may refuse

In limited circumstances the Privacy Act allows us to refuse access, for example where giving access would unreasonably affect the privacy of another person, would reveal information subject to legal professional privilege, or would prejudice an investigation of unlawful activity. If we refuse access to any information, we will tell you in writing, explain the reasons unless it would be unreasonable to do so, and tell you how to complain. Where possible, we will give you access to the rest of the information or through a mutually agreed intermediary.

If we decline to correct information, you can ask us to attach a statement to the record noting that you believe it is inaccurate, and we will do so.

We may tell you about our products, changes to your cover, and services from partners we think may help you, such as free counselling or legal information services. We only do this where you have agreed, or where you would reasonably expect it because you are already a customer.

We comply with the Spam Act 2003 and the Do Not Call Register Act 2006. Every marketing email and SMS includes a way to unsubscribe, and we will action a request within 5 business days. You can also opt out at any time by contacting us using the details in section 13. Opting out of marketing does not stop service messages we are required or entitled to send, such as renewal notices, changes to your PDS, or claim updates.

We do not use health information, criminal record information, claims information or safety instructions for marketing, and we do not disclose your information to any third party for their marketing. We do not use data brokers, and we do not use information about your browsing to target advertising to you on other websites.

If you have told us it is not safe to leave messages, we will never send unsolicited SMS or leave voicemails, regardless of your marketing preferences.

Our website uses a small number of cookies and similar technologies. A cookie is a small text file stored in your browser. We use them for the following purposes only:

• Essential cookies. To keep your session working, remember a quote in progress, and protect the site from abuse. These cannot be switched off without breaking the site.
• Preference cookies. To remember choices you have made, such as a preferred state for pricing or that you have dismissed a notice.
• Analytics. We use a first-party, privacy-preserving analytics tool hosted in Australia to understand which pages are used and where the site could be clearer. It truncates your IP address before storage, does not set cross-site tracking cookies, and does not share data with any advertising network.

We do not use advertising cookies, social media pixels or third-party tracking on any page. We honour the Global Privacy Control signal and the Do Not Track setting where your browser sends them, and treat them as a request to disable analytics.

Quote information you enter is kept in your browser until you choose to save it or submit an application. If you close the page without saving, it is discarded. You can clear cookies at any time through your browser settings; instructions are available from the browser maker.

The website may contain links to other sites, including AFCA, state Victims Services schemes and support services. We are not responsible for their privacy practices, and we encourage you to read their policies.

We are subject to the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act 1988. An eligible data breach occurs where there is unauthorised access to or disclosure of personal information, or personal information is lost, and a reasonable person would conclude that this is likely to result in serious harm to any individual.

If we suspect a data breach has occurred, we will:

• contain the breach immediately and preserve evidence;
• complete an assessment within 30 days, and usually within days, of whether it is an eligible data breach;
• notify the Office of the Australian Information Commissioner (OAIC) and each affected individual as soon as practicable if it is; and
• tell you what happened, what information was involved, what we are doing, and what you can do to protect yourself.

Our contracts with technology and service providers require them to tell us of any suspected breach affecting our data within 24 hours so that we can meet these obligations.

If you believe we have breached the Australian Privacy Principles or mishandled your personal information, please tell us. Complaints about privacy are handled by our Privacy Officer under the same process as any other complaint, described on our complaints and disputes page.

• We acknowledge your complaint within 1 business day.
• We investigate and give you a written response within 30 calendar days, explaining what we found and what we will do about it.
• If you are not satisfied, you can ask for the matter to be escalated to our Customer Advocate.

If you are still not satisfied, or you would rather go directly to an external body, you can complain to:

Office of the Australian Information Commissioner
Phone: 1300 363 992
Website: www.oaic.gov.au
Post: GPO Box 5288, Sydney NSW 2001

The OAIC will usually expect you to have complained to us first and to have given us 30 days to respond. Because we hold an Australian financial services licence, you can also take a privacy complaint that relates to our financial services to the Australian Financial Complaints Authority on 1800 931 678 or at www.afca.org.au. Both services are free.

Our Privacy Officer is responsible for this policy, for handling access, correction and deletion requests, and for investigating privacy complaints. You can contact them in any of the following ways:

Privacy Officer, Rape Insure Pty Ltd
Email: privacy@rape.insure
Phone: 1300 727 346, Monday to Friday, 8am to 8pm AEST
Post: Privacy Officer, GPO Box 4471, Melbourne VIC 3001
In person: Level 14, 120 Collins Street, Melbourne VIC 3000, by appointment

If you need an interpreter, call the Translating and Interpreting Service on 131 450 and ask to be connected to us. If you are deaf, hard of hearing or have a speech impairment, contact us through the National Relay Service on 133 677.

We review this policy at least once a year, and whenever our practices, our systems or the law change. The current version is always published on our website, and you can ask us for a printed copy or a copy of any earlier version at no charge.

If we make a material change, for example a new category of recipient, a new overseas disclosure or a new purpose for using sensitive information, we will tell you by email or with your next renewal notice at least 30 days before the change takes effect. Minor changes, such as updated contact details or clearer wording, take effect when published.

This policy was last updated on 1 July 2026 and is version RI-PP 2.3. It replaces all earlier versions. Questions about it should be directed to our Privacy Officer using the details in section 13.