1. About this policy

This practice is committed to protecting the privacy of the personal and health information it collects. This policy explains how we collect, hold, use, disclose and protect that information, and how you can access it, seek corrections, or make a complaint.

As a health service provider, we are bound by:

• the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs); and
• the Health Records Act 2001 (Vic) and the Health Privacy Principles (HPPs), which apply to health information handled in Victoria.

Health information is “sensitive information” and receives a higher level of protection under both regimes.

This policy applies to information collected through this website, including any online forms, as well as information you provide to us by phone, email, fax or in person.

2. What information we collect

We collect personal and health information that is reasonably necessary to provide surgical and medical care and to manage the practice. Depending on how you interact with us, this may include:

• name, date of birth, address, phone number and email address;
• Medicare, health fund, DVA and other identifiers relevant to billing;
• your GP and referring practitioner details;
• clinical information, including your medical history, symptoms, medications (including any GLP-1, peptide or other medications disclosed in pre-operative screening), and relevant assessments; and
• information you submit through forms on this website, such as records or authority requests, pre-operative screening responses, and patient-reported outcome measures.

We collect this information directly from you wherever practicable. In the course of providing care we may also receive information about you from your GP, referring doctors, other treating practitioners, hospitals, pathology and imaging providers, and your health fund or Medicare.

3. Anonymity

You may deal with us anonymously or under a pseudonym for general enquiries where it is lawful and practicable. This is generally not possible where we are providing clinical care, billing services, or where the law requires us to identify you.

4. Why we collect and use your information

We collect, hold and use your information to:

• provide, coordinate and follow up your surgical and medical care;
• communicate with you and with other practitioners involved in your care;
• process billing, Medicare and health fund claims;
• meet our legal, professional and accreditation obligations; and
• manage the practice, including quality and safety activities.

We use and disclose your health information for the primary purpose for which it was collected, or for a directly related secondary purpose you would reasonably expect. Otherwise, we will seek your consent, unless the use or disclosure is authorised or required by law.

5. How we collect information through this website

This website uses Gravity Forms to collect information you choose to submit. When you submit a form:

• the information is transmitted to us and a copy is emailed to the practice;
• the information is entered into the practice’s clinical information system (see section 6); and
• the form entry stored on the website is deleted, generally within 5 days of submission.

Deleting the website copy after 5 days reduces how long your information sits on the web server. It does not delete the copies held by the practice: your information continues to be held in our clinical information system and in practice email in accordance with our retention obligations (see section 7).

6. Where your information is held and stored

Your information is held in several places, each with different protections:

• Clinical information system: Once processed, your health information is stored in the practice’s clinical information system (Genie), hosted on a server located in Victoria, Australia. This is the primary and enduring record of your care.
• Practice email: Form submissions are emailed to the practice inbox, which is hosted in Sydney, Australia.
• Website hosting: This website is hosted by SiteGround on a server located in Sydney, Australia. Form entries are held there temporarily before deletion (see section 5).
• Backups: Our hosting provider replicates server backups to a data centre in Singapore for disaster recovery.
• Content delivery network: This website uses Cloudflare, a content delivery network that may route website traffic through servers located outside Australia.

We take reasonable steps to protect your information from misuse, interference, loss, and unauthorised access, modification or disclosure. These steps include access controls and staff role restrictions, encryption of sensitive form fields, secure transmission, multi-factor authentication on hosting and administrative accounts, and security hardening and monitoring of our websites.

7. Retention

We keep health information for as long as required to provide your care and to meet our legal and professional obligations, including record-retention periods that apply to health records in Victoria. When information is no longer needed and we are permitted to do so, we take reasonable steps to destroy or de-identify it.

8. Storage and handling outside Victoria and Australia

Most of your information is stored in Australia: in our clinical information system in Victoria, and on our website server and email in Sydney. Some limited handling occurs outside Victoria or outside Australia:

• our hosting provider replicates backups of the website server to Singapore for disaster recovery; and
• our content delivery network may route website traffic through servers located outside Australia.

Before information is handled outside Victoria or Australia, we take reasonable steps to ensure our providers handle it in a way consistent with our obligations under the Privacy Act and the Health Records Act. We remain accountable for how your information is handled by these providers.

9. Disclosure to others

We may disclose your information to:

• other practitioners, hospitals and health services involved in your care;
• your GP and referring doctor;
• Medicare, DVA and your health fund, for claiming and billing; and
• others where you have consented, or where we are authorised or required by law.

We do not sell your information, and we do not use it for marketing without your consent.

10. Accuracy

We take reasonable steps to ensure the information we hold is accurate, complete and up to date. Please tell us if any of your details change or if you believe our records are incorrect.

11. Accessing and correcting your information

You have a right to access the health information we hold about you and to request corrections, under the Health Records Act 2001 (Vic) and the Privacy Act 1988 (Cth). To make a request, contact the practice using the details in section 14. We may need to verify your identity, and in limited circumstances permitted by law we may decline access (for example, where access would pose a serious threat to life, health or safety). Where we cannot agree to a correction, you may ask us to note your requested correction on the record.

12. Website cookies and analytics

This website may use cookies and similar technologies for functionality and to understand how the site is used. You can set your browser to refuse cookies, though some parts of the site may not work as intended.

13. Complaints

If you have a concern about how we have handled your information, please contact the practice first (section 14) so we can try to resolve it. If you are not satisfied, you can complain to:

• the Office of the Australian Information Commissioner (OAIC) for matters under the Privacy Act, at www.oaic.gov.au or 1300 363 992; and
• the Health Complaints Commissioner (Victoria) for matters under the Health Records Act, at hcc.vic.gov.au.

14. Contact us

Dr Jill Tomlinson
549 Bridge Road, Richmond VIC 3121
Phone: 03 9427 9596 Fax: 03 8677 9116
Email: info@jilltomlinson.com

15. Changes to this policy

We may update this policy from time to time. The current version is available on this website, and the date it was last updated appears at the top.