Privacy Policy
Last updated: 21 August 2026
1. About this Privacy Policy
Our clinic is committed to protecting the privacy, confidentiality and security of personal information and health information.
In this Privacy Policy, “our clinic”, “we”, “us” and “our” mean the legal entity that operates the medical clinic identified on this website. The legal name and Australian Business Number (ABN) of the entity operating our clinic are identified on this website.
This Privacy Policy explains how our clinic collects, holds, uses and discloses personal information, including health information, in connection with:
the provision and administration of healthcare services;
communications with patients and other individuals;
the operation of our clinic; and
the operation of this website.
Our clinic handles personal information in accordance with applicable Australian privacy laws, including the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) and, in New South Wales, the Health Records and Information Privacy Act 2002 (NSW) and the Health Privacy Principles (HPPs).
Additional laws may apply to particular information or services, including legislation relating to My Health Record, healthcare identifiers, Medicare and other healthcare programs.
Where there is any inconsistency between this Privacy Policy and a requirement imposed by law, the applicable law will prevail.
2. What information we may collect and hold
The types of personal information our clinic collects and holds depend on the circumstances and the healthcare or other services being provided.
This may include:
name, address, telephone number, email address and other contact details;
date of birth, age, sex or gender and other demographic information where relevant;
Medicare, Department of Veterans' Affairs, private health insurance and other healthcare or billing information;
Individual Healthcare Identifiers and other government-related identifiers where collection and use are permitted by law;
emergency contact and next-of-kin information;
appointment, attendance and communication records;
payment and billing information;
information about a parent, guardian, carer, authorised representative or other person involved in a patient's care;
referrals and correspondence from or to healthcare providers;
information required to comply with legal, regulatory, accreditation or professional obligations; and
information contained in enquiries, complaints, feedback or other communications with our clinic.
Because our clinic provides medical services, we also collect and hold health information, which is sensitive information under Australian privacy law.
Health information may include, where relevant:
current and past medical conditions;
symptoms and reasons for seeking medical care;
medical and family history;
medications, allergies and adverse reactions;
diagnoses and treatment information;
consultation and clinical notes;
pathology, imaging and other test results;
prescriptions;
referrals and specialist correspondence;
procedures and treatment records;
photographs, images or other clinical material;
information concerning disability, mental or physical health and other sensitive information relevant to care; and
other information reasonably necessary for the provision of healthcare.
We seek to collect only information that is reasonably necessary for our functions and activities or that we are otherwise permitted or required by law to collect.
3. How we collect personal information
Where reasonable and practicable, our clinic collects personal information directly from the individual concerned.
Information may be collected:
when a patient registers with our clinic;
during consultations, examinations, procedures and treatment;
when an appointment is made, changed or cancelled;
through telephone calls, emails and other communications;
through forms completed for our clinic;
through our website;
when an individual makes an enquiry, request, complaint or provides feedback; and
during other dealings with our clinic.
Where it is reasonable, necessary or authorised by law, information may also be collected from other sources, including:
a parent, guardian, carer, family member or authorised representative;
general practitioners, specialists and other healthcare providers;
hospitals and other health services;
pathology and diagnostic imaging providers;
pharmacies;
Medicare, the Department of Veterans' Affairs and other government agencies or programs;
private health insurers;
My Health Record and healthcare identifier services, where our clinic participates in or lawfully uses those services;
appointment and healthcare administration services used by our clinic; and
other persons or organisations where authorised or required by law or with appropriate consent.
If our clinic receives personal information that it did not request, we will handle that information in accordance with applicable privacy law, including deleting, destroying or de-identifying it where required.
4. Website Contact Us form
Our website includes a Contact Us form that may request information such as:
first name;
last name;
email address;
subject; and
message.
Information submitted through the Contact Us form is collected for the purpose of receiving, managing and responding to the enquiry and for related administrative purposes.
Our website is hosted using Squarespace. Information submitted through a Squarespace form is transmitted through Squarespace's systems to the email address nominated by our clinic. Form submitter details and submissions may also be stored within the Squarespace website's contact-management functionality.
Accordingly, information submitted through the Contact Us form should not be treated as a secure clinical messaging service.
Please do not use the Contact Us form to send medical records, test results, Medicare numbers, detailed medical histories or other highly sensitive health information unless our clinic has specifically asked you to do so.
For clinical matters, patients should contact our clinic using the appropriate clinical communication method advised by the clinic.
The Contact Us form is also not suitable for urgent or emergency medical matters.
If health or other sensitive information is nevertheless provided through the form, our clinic will handle information received by it in accordance with this Privacy Policy and applicable privacy law.
Submitting a Contact Us form does not, by itself, constitute consent to receive marketing communications.
5. Information collected when you use this website
When you visit this website, certain technical information may be collected automatically by our website platform or third-party services.
This may include information such as:
IP address;
browser and device information;
operating system;
approximate location derived from technical information;
pages visited;
referring website or URL;
date and time of access;
interactions with website features; and
other technical information ordinarily generated when using a website.
We generally use this information to operate, maintain, secure and understand the use of the website.
6. Squarespace and cookies
This website is hosted by Squarespace.
Squarespace may use cookies and similar technologies that are necessary for the website to operate. Depending on the settings used on this website and a visitor's cookie preferences, Squarespace may also use analytics or performance technologies to provide information about website traffic and use.
Cookies are small pieces of data stored on a visitor's device or browser.
Where available, visitors can use the website's cookie controls and their own browser settings to manage the use of cookies. Disabling certain cookies may affect the operation of some website features.
Our clinic does not use information obtained from this website for targeted advertising unless this Privacy Policy is updated to explain that practice and any required privacy measures are implemented.
7. Google Maps and other Google services
This website may contain an embedded Google Map to help visitors locate our clinic.
When a page containing an embedded Google Map is loaded or the map is used, the visitor's browser may communicate directly with Google. Google may receive information such as the visitor's IP address, browser or device information, referring website, interactions with the map and location-related information depending on the visitor's device, browser and Google account settings.
Google handles information it receives in accordance with its own privacy practices and policies.
Our clinic does not control Google's independent collection or handling of information through Google Maps.
Squarespace forms may also use services such as Google reCAPTCHA for spam and abuse prevention where that functionality is enabled. Information collected directly by Google through such services is subject to Google's applicable privacy practices.
8. External booking services and links
Some clinic websites may provide a link to an external online appointment booking service such as HotDoc.
When a visitor follows an external booking link, they leave our website and interact with that third-party service.
Information provided directly to an external booking provider is handled by that provider in accordance with its own privacy policy and terms.
Where booking or patient information is subsequently provided to our clinic by that service, our clinic will handle the information it receives in accordance with this Privacy Policy and applicable law.
Our website may also contain links to other third-party websites or services. Our clinic is not responsible for the independent privacy practices of third parties, and visitors should review the privacy information provided by those services.
9. Why we collect, hold, use and disclose personal information
Our clinic may collect, hold, use or disclose personal information for purposes reasonably necessary to provide and administer healthcare and operate the clinic.
Depending on the circumstances, these purposes may include:
providing medical assessment, treatment and other healthcare;
maintaining appropriate patient and clinical records;
identifying and communicating with patients;
managing appointments;
providing appropriate appointment, follow-up or clinical communications;
arranging referrals, investigations, pathology, diagnostic imaging, prescriptions or other healthcare services;
communicating and coordinating with other healthcare providers involved in a patient's care;
obtaining or providing relevant medical information;
managing billing, payments, Medicare, Department of Veterans' Affairs or private health insurance matters;
managing patient enquiries, requests, complaints and feedback;
maintaining quality and safety of healthcare services;
accreditation, clinical governance and quality assurance activities;
managing the clinic's administration and operations;
maintaining information technology, records-management and communication systems;
obtaining professional, legal, insurance, accounting, information technology or other support services;
preventing or responding to fraud, misuse, cybersecurity incidents and other risks;
meeting professional, regulatory, insurance and legal obligations;
responding to court orders, subpoenas or other lawful requirements;
responding to emergencies or serious threats to life, health or safety where permitted by law; and
other purposes authorised or required by law.
Where information is to be used for a materially different purpose and no legal exception applies, our clinic will obtain consent where required.
10. Who we may disclose information to
Our clinic does not sell patient health information.
Personal information may be disclosed where reasonably necessary for the purposes described in this Privacy Policy, with appropriate consent, or where authorised or required by law.
Depending on the circumstances, recipients may include:
doctors, nurses and other healthcare practitioners involved in the patient's care;
authorised clinic staff and contractors;
referring practitioners and other healthcare providers;
specialists;
hospitals and health services;
pathology and diagnostic imaging providers;
pharmacies;
Medicare and the Department of Veterans' Affairs;
private health insurers and other healthcare funding bodies;
My Health Record and healthcare identifier services where applicable;
professional advisers, insurers, auditors and accreditation bodies;
information technology, communications, document-storage, practice-management and other service providers used to support our clinic;
government departments, regulators, courts, tribunals, law-enforcement bodies or other persons where disclosure is authorised or required by law; and
other persons with the individual's consent or as otherwise permitted by law.
Access to personal information within our clinic is limited to people who require the information for legitimate clinical, administrative or operational purposes.
Related clinics and group services
Our clinic forms part of a broader group of clinics.
Where our clinic uses administrative, information technology, finance, governance, management or other support services provided by another entity within the clinic group, personal information may be made available to that entity only to the extent reasonably necessary for the relevant function and in accordance with applicable privacy obligations.
Being part of the same clinic group does not, by itself, mean that all patient information is automatically available to every clinic or every person within the group.
Clinical information will only be shared between clinics or group entities where there is an appropriate basis for doing so, such as where it is reasonably necessary for healthcare, the individual has consented, a related administrative service requires access, or sharing is otherwise authorised or required by law.
11. Direct marketing
Health information is subject to strict privacy protections.
Our clinic will not use health information for direct marketing except where the individual has provided the consent required by law or the use is otherwise expressly permitted by law.
Submitting an enquiry through this website does not automatically subscribe an individual to marketing communications.
Where our clinic sends marketing communications based on a valid consent or other lawful basis, individuals will be provided with a reasonable means of opting out of further marketing communications.
Communications relating to a patient's healthcare, appointments, treatment or appropriate clinical follow-up are not necessarily marketing communications.
12. Anonymity and pseudonyms
Where lawful and practicable, individuals may interact with our clinic anonymously or using a pseudonym for general enquiries.
For many healthcare services, however, it may be impracticable for our clinic to provide services without confirming the patient's identity. Identification may also be required by law or for matters such as Medicare claims, prescriptions, referrals, medical records, billing, healthcare identifiers and continuity of care.
13. Children, guardians and representatives
Our clinic may provide services to children and to individuals who have a parent, guardian, carer or other authorised representative involved in their care.
Information concerning a patient will only be provided to another person where our clinic is satisfied that disclosure is appropriately authorised, reasonably necessary or permitted or required by law.
The privacy rights of children and young people are assessed having regard to applicable law, the circumstances and the individual's capacity. A parent or guardian does not necessarily have an unrestricted right to every item of information held about a child or young person.
14. How we hold and protect information
Personal information may be held in electronic and, where applicable, physical form.
Depending on the systems used by the particular clinic, information may be held in:
clinical and practice-management systems;
electronic document and communication systems;
secure physical records;
email systems;
appointment and administration systems;
systems operated by contracted service providers; and
website systems such as Squarespace in relation to website enquiries.
Our clinic takes reasonable steps appropriate to the circumstances to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure.
These measures may include appropriate access controls, authentication, staff confidentiality requirements, physical security, system security, backup and recovery practices, staff procedures and controls applying to third-party service providers.
Access to personal and health information is restricted according to legitimate clinical, administrative and operational requirements.
No electronic storage, email system or internet transmission can be guaranteed to be completely secure. For that reason, patients should use communication methods recommended by our clinic when sending sensitive clinical material.
15. Retention and destruction of records
Our clinic retains personal information for as long as reasonably necessary for the purposes for which it may lawfully be used and for the periods required by applicable laws, professional requirements and legitimate clinical needs.
Under NSW health privacy legislation, private health service providers are generally required to retain:
health information collected while an individual was an adult for at least 7 years from the last occasion on which a health service was provided to that individual; and
health information collected while an individual was under 18 years of age until the individual has reached 25 years of age.
Information may be retained for longer where another legal, professional, insurance or clinical requirement applies.
Website enquiries and other administrative information that do not form part of a clinical record are retained only for as long as reasonably necessary for the purpose for which they were collected and any applicable legal or operational requirements.
When information is no longer required to be retained, our clinic will take reasonable steps to securely destroy or de-identify it where required and appropriate.
16. Access to personal and health information
Individuals may request access to personal information or health information held about them.
Requests should be made to our clinic using the contact details published on this website and should clearly state that the request relates to access to personal or health information.
Before providing access, our clinic may take reasonable steps to verify the identity and authority of the person making the request.
Access may be provided in an appropriate form, which may include providing copies of records, allowing inspection of records or providing information in another manner permitted by law.
There are circumstances in which access may lawfully be refused or limited, including where providing access would create a serious threat to a person's life, health or safety, unreasonably affect another person's privacy, be unlawful, prejudice certain legal proceedings or where another exception permitted by law applies.
Where required, our clinic will provide reasons for refusing or limiting access and information about available complaint mechanisms.
A reasonable charge for providing access may apply where permitted by law. Any charge will not be excessive and will relate to the reasonable costs of providing access.
17. Correction of information
Our clinic takes reasonable steps to ensure that personal information it uses is accurate, complete, relevant and up to date as required by law.
Individuals may ask our clinic to correct personal or health information that they believe is inaccurate, out of date, incomplete, irrelevant or misleading.
Requests should be made using the contact details published on this website.
Where our clinic does not agree to make a requested correction, we will comply with applicable legal requirements concerning notice of the decision and, where required, requests to associate a statement with the relevant record.
18. Overseas storage, processing and disclosure
Our clinic may use technology and service providers that store or process information outside Australia.
In particular, this website is hosted using Squarespace. Information associated with the operation of the website, including information submitted through website forms, may be processed by Squarespace and its service providers outside Australia. Based on Squarespace's current service arrangements, this may include processing in Ireland and the United States of America.
The use of embedded Google services such as Google Maps or reCAPTCHA may also result in technical information being transmitted to and processed by Google internationally in accordance with Google's own privacy practices.
Other systems used in the operation of a particular clinic may involve providers that store or process information outside Australia. The countries involved depend on the service providers used by that clinic from time to time.
Where our clinic makes personal information available to an overseas recipient, we will take the steps required by applicable Australian privacy law, including reasonable steps concerning the protection of that information where required.
Individuals may contact our clinic if they would like further information about overseas processing relevant to information held about them.
19. Data breaches
Our clinic takes privacy and information-security incidents seriously.
If our clinic becomes aware of a suspected data breach involving personal information, we will assess and respond to the incident in accordance with applicable law and our obligations.
Where a breach is an eligible data breach under the Notifiable Data Breaches scheme or another notification requirement applies, our clinic will notify affected individuals and the relevant regulator as required by law.
20. Automated decision-making
This website does not itself make clinical decisions or other decisions about an individual's healthcare or rights through automated decision-making.
If our clinic uses or introduces a computer program that uses personal information to make, or substantially and directly assist in making, a decision that is subject to specific disclosure requirements under Australian privacy law, our clinic will include the information required by law in this Privacy Policy.
21. Privacy enquiries and complaints
Questions, requests or complaints about privacy or the handling of personal or health information should first be directed to our clinic.
Please contact our clinic using the telephone number, email address or postal/contact details published on this website and, where appropriate, mark your communication:
Attention: Privacy Officer
Please provide sufficient information for us to understand and investigate the matter. We may contact you to request additional information where necessary.
Our clinic will take privacy complaints seriously and will investigate and respond within a reasonable period.
If an individual is not satisfied with our response, they may have the right to make a complaint to:
the Office of the Australian Information Commissioner (OAIC); or
the Information and Privacy Commission NSW (IPC NSW) in relation to matters within its jurisdiction under NSW health privacy law.
Different complaint pathways, time limits and remedies may apply. Individuals may wish to obtain information from the relevant regulator before choosing which complaint process to use.
22. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes to our practices, technology, service providers or legal requirements.
The current version will be published on this website and the date of the most recent update will appear at the beginning of the policy.
23. Contacting our clinic
For privacy enquiries, requests for access or correction, or privacy complaints, please contact our clinic using the contact details published on this website.
Please address privacy-related correspondence to:
Privacy Officer
Our clinic
A copy of this Privacy Policy can also be provided in an alternative form on reasonable request.