Privacy Policy

Who we are

Scope Institute Pty Ltd (ABN 49 657 343 363) is a registered training organisation (RTO code 45946). We deliver nationally recognised training (currently HLTAID011 Provide First Aid, HLTAID010 Provide basic emergency life support and HLTAID009 Provide cardiopulmonary resuscitation) and non-accredited professional training in echocardiography. We're a subsidiary of Scope Healthcare Limited and part of the Scope Healthcare group. Our office is at Unit 1, 202 Jells Road, Wheelers Hill VIC 3150.

In this policy, "we", "us" and "our" mean Scope Institute Pty Ltd.

We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles, which apply to us. The Health Records Act 2001 (Vic) and its Health Privacy Principles also cover health information, and the Student Identifiers Act 2014 (Cth) covers your USI.

Contact our Privacy Officer

Our Privacy Officer handles privacy questions, requests and complaints.

• Email admin@scopeinstitute.edu.au with "Privacy" in the subject line.
• Phone 1300 508 809, Monday to Friday, 9am to 5pm (Melbourne time).
• Write to the Privacy Officer, Scope Institute Pty Ltd, PO Box 3533, Wheelers Hill VIC 3150.

The information we collect

We collect only what we need for the course or service you're using. When you contact us, we collect your name, contact details and whatever you tell us in an enquiry, form, booking, email or conversation.

Students in nationally recognised training

• Your date of birth, address and the other details national training data rules require, including your country of birth, the language you speak at home, any disability and your previous education.
• Your USI, and the identity details we need if you ask us to create one.
• Your photo ID, which we check before your practical assessment. We don't copy it or record its details.
• Your online theory progress, assessment records and results, and a record of your Statement of Attainment (the nationally recognised certificate for the units you complete).
• Evidence of earlier training or work experience, if you apply to have it recognised through credit transfer or recognition of prior learning (RPL).
• If you're under 18, your parent's or guardian's name, contact details and consent.

Students in our echocardiography courses

• Your qualifications, and any previous echocardiography training you ask us to consider for entry.
• Your professional registration, if a course requires it.
• Information from your entry consultation or other discussions about entry.
• Your attendance, assessments, progression reviews, logbooks and learning portal activity, and a record of the Scope Institute certificate we issue.
• Your police check and Working with Children Check, which you need for Clinical Rotations (see Health and other sensitive information).

Payments

You pay for first aid courses by card when you enrol in the first aid student portal, and for echocardiography courses by bank transfer. Our payment provider, Stripe, processes the card payments, and we don't keep your card details. We keep records of what you've paid.

Website and portal visitors

When you visit our website or a student portal, your browser sends technical information such as your IP address (see Cookies and website analytics).

Health and other sensitive information

Some of what we collect is sensitive information under the Privacy Act, and the Health Records Act 2001 (Vic) also protects health information. We collect it only with your consent or where the law requires or allows it. We use it only for the reason we collected it, unless you agree or the law allows another use.

• Your first aid practical assessment includes at least 2 minutes of uninterrupted CPR on a manikin on the floor. If an injury, medical condition, disability or pregnancy could make that hard, tell our Student Support team before you book so we can talk through adjustments and keep you safe.
• Before you start Clinical Rotations, you must give us a current police check and a Working with Children Check. We share the results of both with the clinic that hosts you, including a Heartscope clinic, only with your consent, because police check results are criminal record information, which is sensitive information.
• If you're injured or become unwell during training, we record what happened.
• For nationally recognised training, the details we report include whether you have a disability.

The Health Records Act also gives you the right to access your health information and to complain to the Health Complaints Commissioner.

How we collect it

Most of what we hold comes straight from you, through our enquiry form and other website forms, the student portals, email, phone, in person and consultation bookings made through Microsoft Bookings.

We collect information about you from other people only with your consent or where the law allows it. We may collect it from:

• your employer, if they book group training for you
• the Student Identifiers Registrar, when we verify your USI or, with your permission, look at your USI transcript
• the clinic that hosts your Clinical Rotations, about your attendance and progress
• your parent or guardian, if you're under 18.

If you don't give us information

• If you don't give us the details the law requires for nationally recognised training, we may not be able to enrol you.
• We can't issue a Statement of Attainment unless you have a USI or an exemption applies.
• You can't start Clinical Rotations without a current police check and a Working with Children Check.
• If you don't tell us about an injury or health condition that affects your practical session, we may not be able to make adjustments for you.

Why we collect, use and share it

We use your information to:

• answer your enquiries and advise you about courses
• enrol you, check that you meet entry requirements and manage your enrolment
• deliver training and assessment, including through the student portals
• plan reasonable adjustments and keep you safe in practical sessions
• issue your Statement of Attainment or Scope Institute certificate, and keep a record of it
• arrange your clinical training
• manage fees and payments
• support you during your course
• ask for your feedback and improve our courses
• meet our legal obligations, including reporting to government and dealing with our regulator
• send you course information and renewal reminders, if you've agreed.

Laws that require us to collect information

For nationally recognised training, the law requires us to collect certain information, keep records and report training data. The main laws are:

• the National Vocational Education and Training Regulator Act 2011 (Cth), under which we report training data and give our regulator information it asks for
• the Standards for RTOs 2025, which set rules for our records and for USIs
• the National Vocational Education and Training Regulator (Data Provision Requirements) Instrument 2020 and the National VET Data Policy, which set out the data we report
• the Student Identifiers Act 2014 (Cth), which says you must have a USI before we can issue a Statement of Attainment.

Who we share it with

We share personal information only as this policy describes, with your consent, or where the law requires or allows it. That includes:

• NCVER and other government bodies, for nationally recognised training (see the privacy notice below)
• the Australian Skills Quality Authority (ASQA), our regulator for nationally recognised training, which can require student information from us, for example during an audit
• the Student Identifiers Registrar, for your USI
• our parent company, Scope Healthcare Limited, which runs Heartscope (see Heartscope and the Scope Healthcare group)
• other approved clinical sites that host your clinical training
• your employer, only with your written consent
• our service providers, including the companies that run our website and student portals
• a court or other authority, where the law requires it, for example under a court order or subpoena.

Your USI

A Unique Student Identifier (USI) is a reference number from the Australian Government. It links to an online record of the nationally recognised training you've done since 1 January 2015. It's free, and our Student Support team can help you with it. You don't need a USI for our echocardiography courses.

We can't issue your Statement of Attainment unless you have a USI or an exemption applies. We're also required to include your USI in the data we report to NCVER.

If you've done nationally recognised training before, a first aid course for example, you may already have a USI. You shouldn't have more than one, so check before you create a new one. Find your USI or create one on the USI website.

We verify your USI with the Student Identifiers Registrar, and we collect, use and disclose it only as the Student Identifiers Act allows. We don't print your USI on your Statement of Attainment, and we don't use it as your student number.

If you want us to create your USI

If you'd like us to apply for a USI on your behalf, you must authorise us to do so under section 9(2) of the Student Identifiers Act 2014 and declare that you have read the privacy information at https://www.usi.gov.au/about-us/privacy. We'll also ask for the identity details the application needs.

Under section 11 of the Student Identifiers Act 2014, we'll securely destroy personal information we collect from you solely to apply for a USI on your behalf. We'll do this as soon as practicable after we've made the application or the information is no longer needed for that purpose.

USI exemptions

You can ask the Student Identifiers Registrar for an exemption from needing a USI. If you get one, give us a copy of the Registrar's letter. We won't ask you why you're exempt.

If an exemption applies to you, your results will not be accessible through the Commonwealth and will not appear on any authenticated VET transcript. We will tell you this before you enrol or start training, whichever comes first.

Privacy notice for nationally recognised training

Every RTO must give students in nationally recognised training the national privacy notice below, at or before enrolment. It doesn't apply to our echocardiography courses, which aren't nationally recognised training. We've reproduced it word for word, adding our name and contact details where it asks for them.

This version applies until 31 December 2026. A revised national notice applies from 1 January 2027, and we'll update this page then.

Privacy Notice

Why we collect your personal information

As a registered training organisation (RTO), we collect your personal information so we can process and manage your enrolment in a vocational education and training (VET) course with us.

How we use your personal information

We use your personal information to enable us to deliver VET courses to you, and otherwise, as needed, to comply with our obligations as an RTO.

How we disclose your personal information

We are required by law (under the National Vocational Education and Training Regulator Act 2011 (Cth) (NVETR Act)) to disclose the personal information we collect about you to the National VET Data Collection kept by the National Centre for Vocational Education Research Ltd (NCVER). The NCVER is responsible for collecting, managing, analysing and communicating research and statistics about the Australian VET sector.

We are also authorised by law (under the NVETR Act) to disclose your personal information to the relevant state or territory training authority.

How NCVER and other bodies handle your personal information

NCVER will collect, hold, use and disclose your personal information in accordance with the law, including the Privacy Act 1988 (Cth) (Privacy Act) and the NVETR Act. Your personal information may be used and disclosed by NCVER for purposes that include populating authenticated VET transcripts; administration of VET; facilitation of statistics and research relating to education, including surveys and data linkage; and understanding the VET market.

NCVER is authorised to disclose information to the Australian Government Department of Employment and Workplace Relations (DEWR), Commonwealth authorities, state and territory authorities (other than registered training organisations) that deal with matters relating to VET and VET regulators for the purposes of those bodies, including to enable:

• administration of VET, including program administration, regulation, monitoring and evaluation
• facilitation of statistics and research relating to education, including surveys and data linkage
• understanding how the VET market operates, for policy, workforce planning and consumer information.

NCVER may also disclose personal information to persons engaged by NCVER to conduct research on NCVER's behalf.

NCVER does not intend to disclose your personal information to any overseas recipients.

For more information about how NCVER will handle your personal information please refer to the NCVER's Privacy Policy at www.ncver.edu.au/privacy.

If you would like to seek access to or correct your information, in the first instance, please contact your RTO using the contact details listed below.

DEWR is authorised by law, including the Privacy Act and the NVETR Act, to collect, use and disclose your personal information to fulfil specified functions and activities. For more information about how DEWR will handle your personal information, please refer to the DEWR VET Privacy Notice at https://www.dewr.gov.au/national-vet-data/vet-privacy-notice.

Surveys

You may receive a student survey which may be run by a government department or an NCVER employee, agent, third-party contractor or another authorised agency. Please note you may opt out of the survey at the time of being contacted.

Contact information

At any time, you may contact Scope Institute Pty Ltd to:

• request access to your personal information
• correct your personal information
• make a complaint about how your personal information has been handled
• ask a question about this Privacy Notice

Scope Institute Pty Ltd (RTO 45946), attention Privacy Officer: email admin@scopeinstitute.edu.au with "Privacy" in the subject line, phone 1300 508 809, or write to PO Box 3533, Wheelers Hill VIC 3150. Our full privacy policy is at scopeinstitute.edu.au/privacy-policy.

Employers and group bookings

If your employer books group training, we collect information from them to organise it, for example their contact person's details, the training site and dates, and how many people are attending. They may also give us participants' names and email addresses so we can invite them to enrol.

We'll only give your employer information about your training, such as your attendance, your results or a copy of your Statement of Attainment, if you've given us your written consent first. This applies even if your employer paid for your course.

Heartscope and the Scope Healthcare group

Scope Institute Pty Ltd is a subsidiary of Scope Healthcare Limited, which runs the Heartscope cardiology clinics. The Applied Echocardiography clinic lesson takes place at a Heartscope clinic, and Clinical Rotations takes place at Heartscope clinics and approved clinical sites. Industry Based Learning is paid employment with Heartscope.

We share personal information with Scope Healthcare Limited to run our courses, to arrange your clinical training at Heartscope clinics and approved clinical sites, and to consider applicants for Industry Based Learning. Some Scope Healthcare Limited staff help us handle enquiries and student records. When they do, they follow this policy.

When you attend a clinic for your training, we give it the information it needs to host you, including your name, contact details and course. Clinic staff who supervise you may tell us about your attendance and progress.

Your police check and Working with Children Check results are the exception. We share them, including with Scope Healthcare Limited, only with your consent, because police check results are sensitive information.

Heartscope fills Industry Based Learning positions by application and runs the selection itself. If you apply, we share your results and progress in our courses with Heartscope for its selection.

Service providers and overseas disclosure

We use other companies to run our website, forms, student portals, bookings, email and payments. They hold or process personal information for us, and they're bound by contract to protect it.

Some of these providers hold or process data overseas, so we're likely to disclose personal information to recipients outside Australia. Before we do, we take reasonable steps to make sure they handle it in line with the Australian Privacy Principles, and we remain accountable for how they handle it. Webflow, Stripe, Jotform, Google Analytics, Google Fonts and EducateMe (including its hosting on Vercel and Firebase) may store or process your personal information in the United States, and Brevo and Trustindex may do so in the European Union. Cloudflare runs a global network and may process data in many countries. Some providers may also process data in other countries where they operate.

• Webflow hosts our website in the United States.
• Cloudflare runs a security check on our blog page and sets a security cookie. It stores data mainly in the United States and the European Economic Area, and may access it from other countries where it operates.
• Google Fonts supplies the fonts on our website, so your IP address and browser details reach Google when a page loads. Google may process them on servers in the United States and other countries.
• Google Analytics measures visits to our website and may store this information in the United States.
• Trustindex shows our Google rating on our website, so your IP address and browser details reach Trustindex when a page loads. Trustindex is a Hungarian company.
• Microsoft Bookings takes consultation bookings for our echocardiography courses and stores booking details in Australia.
• EducateMe runs the Scope Institute learning portal at learn.scopeinstitute.com.au for our echocardiography courses. It holds your name, email address, course progress and quiz results. EducateMe's servers are in the United States. EducateMe and its providers, such as Vercel (which hosts the portal) and Google's Firebase, may also process data in other countries.
• RTO Pilot, from XMB Technology Pty Ltd, an Australian company, is our first aid student portal for enrolment, USIs, online theory and records. It stores personal information on servers in Australia.
• Stripe processes first aid card payments made through RTO Pilot, and may process data in the United States and other countries.
• Brevo is our email service and stores data in the European Union.
• Jotform runs our enquiry forms and our online complaints and appeals form, and may store what you submit in the United States.

Cookies and website analytics

Our website uses Google Analytics to measure visits, and it sets cookies to do so. We don't use advertising or marketing trackers. Cloudflare sets an essential security cookie, and our Jotform forms may set their own. On our blog page, Cloudflare Turnstile also checks that a person, not a bot, is using it. When a page loads, Webflow, Amazon CloudFront (which delivers some of Webflow's files), Google Fonts and Trustindex receive your IP address and basic browser information.

If we add other analytics or marketing tools, we'll update this policy.

Student portals

The sign-in page of the Scope Institute learning portal, which runs on EducateMe, loads EducateMe's Google Tag Manager container before you log in. It sends visit information to Google's advertising services and sets an advertising cookie.

The sign-in page of our first aid student portal, run on RTO Pilot, uses Cloudflare and Simple Analytics, a website analytics service. Simple Analytics says it doesn't collect IP addresses or other personal information and keeps its data in the Netherlands.

Automated decisions

From 10 December 2026, this policy must tell you if we use a computer program that uses your personal information to make a decision, or to do something substantially and directly related to making one. This applies if the decision could significantly affect your rights or interests.

The online learning in our courses includes quizzes, which the student portals may mark automatically. We don't use computer programs to make decisions that could significantly affect your rights or interests. Automatically marked quizzes help you check your learning, and our staff make the decisions.

Our trainers and assessors decide whether you're competent, and our staff decide whether you can enter or progress through our echocardiography courses. You can appeal an assessment decision under our Complaints and Appeals Policy.

Surveys and feedback

Besides the surveys described in the notice above, ASQA may survey students during an audit. We must give ASQA student details if it asks.

We ask for your feedback at the end of your course, and sometimes during or after it. Your feedback can be anonymous if you prefer.

Direct marketing

We only send you marketing, for example information about courses, if you've agreed to receive it. That includes reminders when your first aid or CPR training is due for renewal.

As the Spam Act 2003 (Cth) requires, every marketing message we send identifies Scope Institute as the sender and has a working unsubscribe link. You can opt out at any time through that link or by emailing us, and we'll stop sending you marketing.

We never sell personal information. We only give your personal information to someone else for their own marketing if you've given your explicit consent.

Photos and video

We sometimes take photos or video during training for our website, social media and printed materials. We'll only use images of you if you've given us your express consent by opting in. Taking part in a course doesn't mean you consent. If you're under 18, we also need your parent's or guardian's consent.

You can withdraw your consent at any time by emailing us. We'll stop using your image in new material and make every reasonable effort to remove it from existing material where practicable.

Children and young people

Students aged 14 to 17 can enrol in our first aid courses. A parent or guardian must consent to the enrolment and accept our terms.

We follow the Victorian Child Safe Standards. If we're concerned about a child's safety, we act immediately, which may include sharing information with police or child protection services. See our Child Safety page.

A Children's Online Privacy Code is due by 10 December 2026. We'll update this section if it applies to us.

How we protect your information

We take reasonable technical and organisational steps to protect personal information from misuse, interference and loss, and from unauthorised access, change or disclosure. These steps include:

• keeping electronic records in secure, password-protected systems
• limiting access to the staff who need it for their work
• using encrypted connections for our website forms and student portals
• keeping paper records in locked cabinets at our office.

We also take reasonable steps to keep your information accurate, up to date and complete. Please tell us when your details change.

Data breaches

If we have a data breach that is likely to result in serious harm to anyone, we'll notify the people affected and the Office of the Australian Information Commissioner (OAIC), as the Notifiable Data Breaches scheme requires. If you think your information has been lost or misused, contact our Privacy Officer straight away.

How long we keep your information

We keep:

• records of the Statements of Attainment we issue for 30 years
• completed assessment items for nationally recognised training for at least 2 years after you complete the unit
• enrolment and financial records for at least 7 years
• complaint and appeal records for 7 years after the matter closes, securely and separately from academic records
• records of the Scope Institute certificates we issue for 30 years, and echocardiography assessments and logbooks for 7 years
• records of child safety concerns for at least 45 years
• police check and Working with Children Check records until the clinical training they were collected for ends, and injury and incident records for 7 years.

We destroy identity details we collect solely to apply for your USI as soon as practicable (see Your USI). We keep other information only while we need it or the law requires it, then securely destroy or de-identify it.

If we ever stop operating as an RTO, we'll give ASQA our records of the Statements of Attainment we've issued, so you can still get proof of your training.

Access and correction

You have the right to ask for the personal information we hold about you, and to ask us to correct it if it's inaccurate, out of date, incomplete, irrelevant or misleading.

1. Email our Privacy Officer at admin@scopeinstitute.edu.au with "Privacy" in the subject line, or write to us. Tell us what you'd like to see or change.
2. We'll check your identity before we give you access or change anything.
3. We'll respond within 30 calendar days. If you're asking to see health information covered by the Health Records Act 2001 (Vic), we'll respond within 45 calendar days.

There's no charge to ask for or access your information.

The law lets us refuse access in limited cases. If we refuse access or a correction, we'll tell you why in writing and how you can complain. If we don't correct your information, you can ask us to attach a statement saying you believe it's wrong.

For a copy of a certificate, contact our Student Support team. Copies are free.

Complaints

If you think we've mishandled your personal or health information, please complain to us first so we can try to put it right.

1. Email our Privacy Officer at admin@scopeinstitute.edu.au with "Privacy" in the subject line, or write to us, and describe what happened.
2. We'll acknowledge your complaint in writing within 5 business days (Monday to Friday, excluding Victorian public holidays).
3. We'll investigate and give you a written response within 30 calendar days.

If you're not satisfied with our response, or we haven't responded within 30 days, you can complain to the Office of the Australian Information Commissioner (OAIC). Complaints to the OAIC must be in writing: lodge a privacy complaint online, email oaicintake@oaic.gov.au or write to GPO Box 5288, Sydney NSW 2001. For questions, phone the OAIC on 1300 363 992. The OAIC also handles complaints about how a USI has been handled.

If your complaint is about health information, you can also complain to the Health Complaints Commissioner (Victoria). Make a complaint online or phone 1300 582 113.

For complaints about anything other than privacy, see our Complaints and Appeals Policy.

Changes to this policy

We'll update this policy when our practices or the law change. The date at the top of this page shows when it last changed. The policy is free. If you'd like it in another form, such as a printed copy, ask us and we'll send you one.