Privacy Policy

This privacy policy provides information to you, our patient, on how your personal information (which includes your health information) is collected and used within our practice, and the circumstances in which we may share it with third parties.

In accordance with the Australian Privacy Principles, your medical record is a confidential document. It is the policy of this practice to maintain the security of personal health information at all times and to ensure it is only available to authorised members of staff.

When you register as a patient of our practice, you provide consent for our GPs and practice staff to access and use your personal information so they can provide you with the best possible healthcare. Only staff who need to see your personal information will have access to it.

If we need to use your information for anything else, we will seek additional consent from you before doing so.

Our practice collects your personal information to provide healthcare services to you. Our main purpose for collecting, using, holding and sharing your personal information is to manage your health.

We also use it for directly related business activities, such as financial claims and payments, practice audits and accreditation, and business processes (e.g. staff training).

The information we collect about you includes:

• Name, date of birth, address and contact details
• Medical information including medical history, medications, allergies, adverse events, immunisations, social history, family history and risk factors
• Medicare, DVA, Pension or Healthcare card number (where available) for identification and claiming purposes
• Healthcare identifiers
• Private health fund details

Our practice may collect your personal information in several ways:

• When you make your first appointment — practice staff collect your personal and demographic information via your registration form
• During the course of providing medical services
• When you visit our website, send us an email or SMS, call us, or make an online appointment

In some circumstances, personal information may also be collected from other sources where it is not practical or reasonable to collect it from you directly. This may include information from:

• Your guardian or responsible person
• Other involved healthcare providers — specialists, allied health professionals, hospitals, community health services, pathology and diagnostic imaging services
• Your health fund, Medicare, or the Department of Veterans' Affairs
• Your employer or prospective employer
• Third party bodies such as law enforcement or other government entities

We may sometimes share your personal information:

• With third parties who work with our practice for business purposes (e.g. accreditation agencies, IT providers) — these parties are required to comply with Australian Privacy Principles
• With other healthcare providers involved in your care
• When required or authorised by law (e.g. court subpoenas)
• When necessary to lessen or prevent a serious threat to a patient's life, health or safety, or public health or safety
• To assist in locating a missing person
• To establish, exercise or defend an equitable claim
• For the purpose of a confidential dispute resolution process
• When there is a statutory requirement to share certain personal information (e.g. mandatory reporting of notifiable diseases or family/domestic violence)
• During the course of providing medical services through Electronic Transfer of Prescriptions (eTP), My Health Record, eReferrals and Smart Referrals
• With your consent — to your employer, prospective employer, their authorised representative or insurer in work-related consultations

Our practice may use de-identified data to improve population health outcomes. Patients cannot be identified from this data and it is stored within Australia. Please let reception know if you do not want your information included.

Our practice stores all personal information securely using a combination of the following measures: passwords and access controls, secure cabinets for physical records, and confidentiality agreements for staff and contractors.

A patient's personal information may be held at the practice in various forms:

• Electronic records (protected information systems)
• Visual records — X-rays, CT scans, videos and photos
• Audio recordings
• Hard copy records in a secured environment

You have the right to request access to, and correction of, your personal information. Our practice requires you to put this request in writing — at the front desk, via signed email, or by post. We will respond within a reasonable time, usually within 30 days.

There may be fees associated with providing copies of records, though these will not be excessive. Patients are not charged for making the request itself.

Our practice will take reasonable steps to correct your personal information where it is not accurate or up to date. You may also request corrections in writing to:

We take complaints and concerns regarding privacy seriously. Feedback forms are available at reception. Alternatively, please contact the Practice Manager:

We will attempt to resolve issues within 30 days. If you feel your concerns are not being addressed, you may contact:

• Queensland Health Ombudsman — 133 646
• Office of the Australian Information Commissioner (OAIC) — 1300 363 992 or oaic.gov.au. Note: the OAIC will generally require you to allow the practice time to respond before they investigate.

This privacy policy is reviewed regularly to ensure it remains in accordance with OAIC legislation and any changes that may occur. When we amend this policy, patients will be notified by a notice displayed at our practice reception highlighting the changes.