BrainVox is committed to protecting the privacy and personal information of its users. We recognise our responsibility to handle user data with the utmost care and in compliance with all applicable laws and regulations, including the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth). This policy outlines BrainVox's procedures for responding to legally binding requests for user data from public authorities (including law enforcement agencies and government bodies). Our primary goal is to balance our legal obligations with our commitment to user privacy, ensuring that any disclosure of data is lawful, necessary, and proportionate.
This policy applies to all BrainVox employees, contractors, and agents who may receive or process requests for user data from public authorities. It covers all user data held by BrainVox, including data (for example, Platform Data) obtained from partners (for example, Meta) and any other personal information collected or processed in connection with the services provided to our clients.
When responding to requests from public authorities, BrainVox will adhere to the following principles:
Legality: We will only disclose user data in response to a valid and legally binding request issued by a public authority with appropriate jurisdiction. This includes ensuring the request is made under proper legal authority (e.g., valid warrant, court order, subpoena, or other legally recognised process).
Necessity and Proportionality (Data Minimisation): We will strive to disclose only the minimum amount of information necessary to comply with the specific, legitimate request. We will not provide data that is overly broad or irrelevant to the stated purpose of the request.
Transparency (where permissible): Unless legally prohibited (e.g., by a gag order or where there is an imminent risk of harm), we will endeavor to notify the affected user(s) of the request before disclosing their data, allowing them an opportunity to seek legal remedies. If prior notification is not possible, we will provide notice as soon as legally permissible.
Challenging Unlawful Requests: We reserve the right to challenge requests that we believe are unlawful, overly broad, unclear, or improperly served.
Accountability and Documentation: All requests and our responses will be thoroughly documented, including the legal basis for disclosure, the data disclosed, and the reasoning behind our actions.
Public Authority: Any law enforcement agency, government body, or other entity with legal authority to request user data.
User Data: Any information held by BrainVox that relates to an identified or identifiable user, including personal information and Platform Data obtained from (for example) Meta or other partners.
Legal Process: A valid and legally binding document such as a subpoena, court order, search warrant, or other equivalent legal instrument.
All requests from public authorities for user data must be submitted in writing and addressed to [Designated Contact Person/Department, e.g., Legal Department or Data Protection Officer].
Requests received via informal channels (e.g., phone calls, unofficial emails) will not be processed until a formal, written request is received.
Upon receipt, the request will be immediately forwarded to the [Designated Contact Person/Department] for review.
The [Designated Contact Person/Department] will conduct an initial review to determine the validity and legality of the request, ensuring:
If the initial review confirms the request's apparent validity, a more detailed legal assessment will be conducted by [Designated Contact Person/Department, or external legal counsel if necessary].
This assessment will determine:
BrainVox will consult with external legal counsel as needed, particularly for complex or unusual requests, or those involving international jurisdictions.
If, during the legal review, it is determined that a request is unlawful, overly broad, or otherwise invalid, BrainVox will take appropriate steps to challenge the request. This may include:
Before disclosing any user data, BrainVox will, unless legally prohibited (e.g., by a gag order or where there is an imminent risk of death or serious physical injury), attempt to notify the affected user(s) of the request.
The notification will inform the user about the request and provide them with an opportunity to seek their own legal advice or challenge the request.
If a gag order or other legal prohibition prevents prior notification, BrainVox will provide notice to the user as soon as the prohibition is lifted.
If BrainVox determines that it is legally obligated to disclose data, only the specific data explicitly required by the valid legal process will be provided.
Data will be provided in a secure manner, consistent with industry best practices.
A comprehensive record of each request and BrainVox's response will be maintained. This record will include:
These records will be retained for a period consistent with legal and regulatory requirements.
All relevant BrainVox personnel will receive regular training on this policy and associated procedures to ensure they understand their responsibilities in handling requests from public authorities and protecting user data.
This policy will be reviewed annually, or more frequently as required, to ensure its continued effectiveness and compliance with evolving legal and regulatory requirements.
If you would like to request your data be deleted please contact us at the email in the footer below.