Skip to main content
Veterans First Consulting exists to help current and former members of the Australian Defence Force with claims for compensation from the Department of Veterans' Affairs (DVA) and the Commonwealth Superannuation Corporation (CSC). Our work requires the collection of personal and sensitive information which could include service history, medical records, financial information and personal statements.
This policy explains what personal information we collect and why, how we hold and protect it, who we share it with (including overseas), how you can access or correct it and how you can make a complaint.
We comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where they apply to the health information we hold, we also comply with:
As a matter of practice, we apply the retention and access requirements of these laws to all client health information, regardless of where the client lives.
This policy applies to Veterans First Consulting Pty Ltd (ACN 660 011 263) (“we”, “us”, “our”). It covers personal information we collect through:
Veterans First Legal Pty Ltd (ACN 686 265092) is a separate legal entity with its own privacy policy. We explain when and how we share your information with Veterans First Legal under the heading "Who we share your information with".
This policy does not cover the personal information of our current and former employees, which we handle under our internal policies and the employee records exemption in the Privacy Act. It does cover recruitment applications and contractors.
Our Privacy Officer handles privacy questions, access requests and complaints.
The personal information we collect may include:
Some of what we collect is "sensitive information" under the Privacy Act. The law gives it extra protection, including tighter limits on how it can be collected, used and disclosed. It could include:
We collect sensitive information only if you consent and it is reasonably necessary for our services, or where the law requires or authorises it. You have the right to withdraw your consent at any time, although this may limit or extinguish our ability to provide our services.
Medicare, DVA and service numbers are “government-related identifiers”. They are not "sensitive information" under the Privacy Act, but they are personal information and we protect them carefully. We use them only for the purpose they were issued, such as completing DVA forms, and we never use them as our own client identifier.
From you. Most of the information we hold about you was collected from you directly: when you call or email us, fill in a form on our website, sign an engagement with us, meet with us or attend an event.
From others, with your written authority. To run your claim we usually need records from other organisations. With your authority, we obtain information from the Department of Defence and DVA (service records, medical records and claim files). We also obtain information from your treating doctors, psychologists and other health providers, and from independent medical examiners. We obtain information from the Commonwealth Superannuation Corporation and Services Australia, and from any lawyer, financial adviser or family member you have instructed to communicate with us.
From people who refer you. Sometimes an ex-service organisation, a health professional or someone who knows you passes on your details so we can contact you. When we first contact you, we will tell you how we obtained your details and confirm that you want to hear from us.
From your use of our website and emails. See "Our website, cookies and advertising".
We record calls on our business phone lines for training, quality and record keeping. When you call us, a recorded message informs you before we continue that the call will be recorded and gives you the opportunity to refuse consent. When we call you, our staff will tell you before the conversation starts that it will be recorded. If you stay on the line after the announcement, or continue the call after our staff member tells you, we take that as your agreement to the recording. If you would prefer not to be recorded, we will turn recording off for that call and you will still receive our services.
You can ask general questions without telling us who you are, or use a name that is not your own. Once we act for you, we need to know who you are, because DVA and other bodies require it and because we cannot run a claim for someone we cannot identify.
You have the right to refuse to provide personal information but we may not be able to take on your matter, lodge or pursue your claim, or give you the service you are looking for. We will tell you which information is essential.
If you give us personal information about someone else, such as a family member, a witness or a treating practitioner, please only share information relevant to your matter. Whilst we handle all personal information in accordance with the law, we ask you to inform them you have provided their information to us.
You can withdraw a consent or authority you have given us at any time by contacting us. We will confirm in writing that we have received your request. Once you withdraw, we will stop the collection, use or disclosure that the consent or authority covered, except where the law requires or authorises us to continue (for example, to keep records we are legally obliged to retain). Withdrawing consent does not affect anything we did while the consent was in place, and it may mean we cannot continue with part of your matter. We will tell you if that is the case.
If we receive personal information we did not ask for, such as details which go beyond what we need or were provided to us in error. When this happens, we check whether we could have collected it in the ordinary way for our services. If we could have collected it, we will handle it in accordance with this policy. If not, we will destroy orde-identify it as soon as practicable, unless the law requires us to keep it.
Our main purpose is to provide claims advocacy. With your authority, that means:
We also collect, use and disclose your information to:
We also use information to understand how our services are used and to produce reports such as the Veteran Wellness Index. For this work we remove names and other identifying details, and we take reasonable steps to make sure no one can be identified from the results. We do not publish or share anything that could reasonably identify you, and we do not use this work to build a profile of you as an individual.
We use and disclose your information for the purposes above. We will use or disclose it for another purpose only if:
Decisions about your claim are made by DVA and the review bodies. The decisions we make, including whether we can act for you, what claims to pursue and what advice to give you, are made by our staff. We use software, including some AI-assisted tools, to organise records, draft documents, check calculations and estimate possible entitlements. These tools use the information in your file, including your service and health information, and the details you give us when you first enquire. They do not make decisions about you, and no decision that significantly affects you is made by a computer program alone or on a computer program's recommendation without a qualified staff member independently assessing it. If that changes, we will update this policy first and tell you what information the program uses and what decisions it makes.
We share your information only when we need to, and usually only under a written authority from you.
Government bodies involved in your claim. DVA, the Department of Defence, the Commonwealth Superannuation Corporation and Services Australia. We also share with the Veterans' Review Board, the Administrative Review Tribunal, the Defence Force Ombudsman and any other body that decides or reviews your claim.
Health professionals. Your treating practitioners and specialists, and independent medical examiners, so we can obtain reports and opinions. We ask for your specific authority for each request.
People you have authorised. A family member, carer, representative, lawyer or financial adviser you have asked us to deal with.
Veterans First Legal. Veterans First Legal Pty Ltd is a separate legal entity. We do not share your information with Veterans First Legal unless you sign a referral authority, and then we share only what that authority covers. We keep an information barrier between the two businesses for everything else.
Service providers who help us run our business. We use carefully chosen providers for:
Each provider is bound by contract to protect your information and to use it only to provide its service to us. We only give the provider necessary information.
Advertising and analytics platforms. Google and Meta receive limited information from our website, which is described under "Our website, cookies and advertising". Where you have given us your express consent, they also receive a scrambled version of your contact details. We explain both of these under "Our website, cookies and advertising" and "Marketing and your choices".
When the law requires or permits it. We will disclose information where a law, court order, subpoena or warrant requires it. We will also disclose it where we reasonably believe this is needed to prevent a serious threat to someone's life, health or safety. We may disclose it where we need to establish or defend a legal claim. We disclose only where there is a legal compulsion or another ground the Privacy Act allows.
If our business changes hands. If we sell or restructure our business, your information may be transferred to the new owner, who must handle it under this policy. Before a sale is complete, a prospective buyer sees only de-identified or aggregated information unless you agree otherwise, and anyone who sees your information is bound by confidentiality.
We do not sell, rent or trade your personal information. We do not share client information with ex-service organisations, other agencies or anyone else outside this list without your specific written consent.
Your core client records are stored in our Australian-based client and case management system. Some of the providers we use are based overseas or store information overseas, including the email and documents we hold in Google Workspace. Based on each provider's published hosting information as at the date of this policy, those locations are:
Before we adopt a system that stores information outside Australia, our Privacy Officer assesses it and we put contractual protections in place. We remain responsible for how those providers handle your information. If you have concerns about an overseas provider, contact us and we will talk through the options with you.
We may tell you about our services, events, resources and news by email, SMS, phone or post. We do this when you have agreed to hear from us, or when you are a client and would reasonably expect it. Before we call you about our services, we check the Do Not Call Register unless you are a current client or have asked us to call.
You can opt out at any time. Every marketing email has an unsubscribe link, or you can contact us. We action opt-outs within five business days. Opting out never affects the service you receive.
Advertising on other platforms. If you have agreed to it, we may give Google or Meta a scrambled (hashed) version of your email address or phone number. We do this so that our ads reach you on their platforms, or so that they stop showing you ads once you are a client. We only do this with your express consent. We ask for that consent separately, and you can withdraw it at any time by contacting us. The platforms use the scrambled details only to match them against their own records. They are barred by contract from using them for anything else. We never build advertising audiences from health information, the type of claim you have made, or your entitlements.
Testimonials and your story. We publish testimonials, photos and client stories only with your written consent. You can withdraw that consent at any time and we will remove the content from anything we control.
Photos and video at events. We ask for a separate yes or no when you register. If you say no, we will not feature you.
Our website uses cookies and similar technologies. Some are essential, some help us understand how the site is used and some support our advertising. The main tools are:
We do not use pages about specific medical conditions to build advertising audiences.
How to control this. Most browsers let you block or delete cookies, though parts of our site may not work as well. You can also manage advertising directly: Google offers ad settings and an opt-out tool for Google Analytics, and Meta lets you control how your activity on other websites is used in its ad preferences.
Website enquiry forms. When you use a form on our site, we collect your name, email, phone number, whether you are still serving, your discharge date, your message and the page you were on. Webflow stores the submission and passes it to ActiveCampaign so we can respond to you and keep track of our conversation.
Server logs. Like most websites, our hosting providers record technical details such as your IP address, browser type and the pages you request, for security and to keep the site running.
Links to other websites. Our site links to other websites, including DVA and other government sites. We are not responsible for their privacy practices, so please read their policies separately.
We hold your information electronically in our approved systems and, occasionally, on paper. Our safeguards include:
No system is completely secure. Email in particular can be intercepted or misdirected. We will offer you secure ways to send us sensitive documents, and we encourage you to use them.
We are covered by the Notifiable Data Breaches scheme. If we suspect that personal information has been lost, accessed or disclosed without authority, we act immediately to contain it and assess the risk. We assess any suspected breach within 30 days, and sooner wherever we can. If the breach is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner as the law requires. Where a state health privacy regulator also needs to be told, we notify them at the same time. We will tell you what happened, what information was involved and what you can do to protect yourself.
We keep your information for as long as we need it to serve you and to meet our legal obligations, then we destroy it securely or de-identify it. Our standard retention periods are:
We may keep information longer where a law, a dispute or a legal claim requires it.
You can ask us for a copy of the personal information we hold about you, or ask us to correct it, at any time. Contact our Privacy Officer using the details above. We will need to confirm your identity first. That is usually a phone call and a check against details already on your file.
We usually respond within 30 days. Because we adhere to state health records legislation, some health information can take up to 45 days. We will give you the information in the form you ask for where reasonably possible, for example a secure download or a paper copy. We do not charge for making a request or for correcting information. If you ask for a large volume of records, we may ask you to cover the reasonable cost of copying. We will tell you the cost before we proceed.
If a client has died, we will deal with their executor or administrator, or another person with legal authority, and we treat their information with the same care as before.
We take reasonable steps to keep your information accurate, up to date and complete. This matters most for the medical evidence that supports your claim, so please tell us when something changes.
In limited situations, the law allows us to refuse access. Examples are where access would unreasonably affect someone else's privacy, would be unlawful, would prejudice legal proceedings or law enforcement, or where the request is frivolous or vexatious. If we refuse access or decline to correct something, we will tell you why in writing. You can ask us to attach a statement to the record saying you believe it is inaccurate. If we have given the information to someone else, you can ask us to tell them about the correction.
If you think we have mishandled your information or breached the Privacy Act, please tell us. We take every complaint seriously and handle it in confidence.
1. Contact our Privacy Officer using the details above. Tell us what happened and what outcome you are looking for.
2. We acknowledge your complaint within five business days and investigate it promptly and impartially.
3. We give you a written response within 30 days, setting out what we found, what we have done to fix it and how you can take the matter further if you are not satisfied.
If you are not happy with our response, you can complain to the Office of the Australian Information Commissioner (OAIC):
Most of our clients are adults. We sometimes hold information about children and young people. Examples are a claim involving a veteran's family, a serving member under 18 who asks us to act for them, Eligible Young Person Payments and a young person who attends one of our events. Where a young person can understand what they are agreeing to, we deal with them directly and respect their choices about who else is involved. Otherwise, we deal with a parent or guardian. In every case, we collect only what the matter or event needs and we keep the records until the young person turns 25 (client files) or 21 (event waivers).
We review this policy at least once a year and whenever our practices or the law changes. The latest version is always on our website, with the date it was updated. If we make a significant change to how we handle client information, we will tell current clients directly.
Join more than 10,000 veterans in getting the support they deserve. Leave us a note and our experts will be in touch shortly.
Zero upfront fees – only pay for successful claims
10,000+ veterans served – we know what we're doing
Australia's largest DVA advocacy group
