Privacy Policy

On Point Family Practice understands the importance to our patients of maintaining privacy in relation to the personal information we collect, use, disclose, hold or otherwise handle in connection with managing our patients. This Privacy Policy sets out how we comply with our obligations under the Privacy Act 1988 and other relevant State and Territory legislation in handling your personal information. By attending our practice, you consent to your personal information being collected, used, disclosed, stored, and otherwise handled in accordance with this Policy and other relevant arrangements between us. We may change our Privacy Policy from time to time by publishing changes to it on our website. You should check our website periodically to ensure you are aware of our current Privacy Policy.

Personal information is information or an opinion about an identified or reasonably identifiable person, whether or not true and whether recorded in a material form or not. Within this Privacy Policy unless indicated otherwise, references to personal information also include sensitive information such as information or an opinion about your health, or health services provided to you. We will only collect personal information from you where reasonably necessary for purposes directly related to our functions or activities. We will only collect as much personal information as we and medical practitioners operating from our medical centre need to provide you with services (including medical services) and to allow us to obtain payment for those services. 

The types of personal information we may collect and hold about you include: 

• Identity Billing and administration Medical
• Name 
• Address 
• Date of Birth
• Medicare Number
• Health insurance membership number
• Medical history 
• Clinical notes 
• Test results
• Gender/Sex 
• Email address 
• Telephone number 
• Healthcare identifiers 
• Details of next of kin
• Credit card number Treatment plan 
• Prescribed medications 
• Referral details 
• Disease statistics 
• Clinical Digital Images

We may also collect personal information from you when you use and access our websites (including any information contained in an online enquiry or a request for an appointment, device type and ID, IP address, pages you visited, time and date of visit and geo-location information). 

If you do not provide us with all the personal information we request, medical practitioners operating from our medical centre may not be able to provide medical services to you. We collect personal information about you in several ways, including from: 

• You directly (including through our websites, when you complete a new patient form, or when you interact with a personnel of our medical centre, e.g. a nurse or receptionist); 
• Someone with responsibility for you (such as your parent, carer or guardian);
• Independent medical practitioners, including as recorded in your patient records; 
• External health providers which are provided to the practice and included in your medical record; 
• National digital health records (such as your My Health Record); 
• Government agencies such as the Department of Veterans Affairs or Medicare, that you may use for assistance to access the medical and dental services at our centre.

When you attend our practice to obtain services from the medical practitioners operating from the practice, we create a unique digital medical record for you. When you visit our websites, a small data file called a “cookie” is stored on your computer or mobile device by our server. We use cookies to maintain user sessions and to generate statistics about the number of people that visit our websites. Generally, this information will not identify you and we do not link it back to your identity or other information that you have provided to us.

We collect, use, disclose and handle personal information about you for the purpose of delivering, or facilitating the delivery of medical and health services, including to:

• Assist medical practitioners at our medical centre to provide you with appropriate health care, treatment and services; 
• Provide you and/or your medical practitioner with information that may assist you in managing and improving your health;  
• Provide a medical history for you that allows your medical practitioner to provide you with better care, as it assists with identifying changes to your health over time; 
• Respond to your online enquiries or process requests for appointments; and 
• Send you appointment reminders (including by SMS or email) in relation to obtaining services from our practice. This enables us to contact you, for example, to make follow-up appointments to discuss test results, or to remind you that you, or a dependent, are due for an immunisation, cervical screening test, annual health assessment or other type of consultation or test.

We use and handle your personal information as is reasonably incidental to our ordinary course operations, including where necessary to manage our administration, store data, conduct systems maintenance and penetration testing, and manage accounts and payment for the services provided to you. Subject to compliance with applicable Australian law, these incidental operations shall include our use and, where necessary, disclosure of your personal information:

• For billings and collection purposes, including to obtain payment from Medicare, your private health insurance fund or from any organisation responsible for payment of any part of your account, such as the Department of Veterans Affairs;  
• To provide you with information and materials about products and services offered by the medical centre which might be of interest to you.

Where you attend the medical centre you will be taken to have consented to the receipt of such materials (including by SMS and email), and to the use and disclosure of your personal information for this purpose. You may opt-out of receiving such materials by contacting the Privacy Officer below or following the unsubscribe process described in the relevant material. 

We may share your information if:

• Circumstances require to our professional advisers or insurers, or those of your medical practitioners in compliance with applicable law and on a confidential basis; 
• To manage and store your personal information in a secure fashion; 
• For data entry and data analytics purposes; 
• To enable an individual to discharge their duties as a director, officer or executive manager of our corporate group under Australian law; and
• To third parties, subject to confidentiality and security conditions, (including, in certain circumstances described below, to offshore third parties): who provide support or maintenance services for medical software, systems or equipment we use (including our practice management system, cloud storage systems and software and hardware); which provide services to local health networks (either on a de-identified basis, or for the purpose of the third party de-identifying such information); or where otherwise reasonably incidental to our ordinary course operations at our practice, including to provide or assist us with the services described above.

We may use de-identified information (derived from your personal information) for internal teaching purposes or to monitor, evaluate, plan and improve the services provided at our practice. We may use your personal information to provide third parties (such as universities, government organisations and pharmaceutical companies) with aggregated, de-identified health information about our patients. These third parties may use the bulk de-identified information they receive from us for their business purposes. Should you, at any time, wish to withdraw your consent for your personal information to be part of a de-identified information database, please notify our Privacy Officer using the contact details below providing your full name, date of birth and address. Withdrawing this consent will not affect the relationship between you and your medical practitioner, nor will it hinder your ability to access services at a Centre. If third parties undertaking research request identified data (ie. personal information) from our medical records, we will only provide such identified data if: 

• It is for medical research purposes; 
• We are satisfied privacy and confidentiality requirements (including any requirements under the Privacy Act 1988 have been satisfied; and
• The research has been approved by a Human Research Ethics Committee, or you have otherwise provided your consent to that information being accessed, used or disclosed for research purposes in accordance with a medical study.

We may also access, use or disclose your personal information: 

• With your consent (or that of your parent, guardian, attorney, authorised representative or other responsible person), including where you consent to receiving direct marketing communications (including by SMS or email) about our products and services or those of our partners. You may opt-out of receiving such communications by contacting the Privacy Officer below or following the unsubscribe process described in the relevant communication; 
• Where required to comply with any Australian law; 
• For the purposes of a permitted general situation or permitted health situation under the Privacy Act 1988; or  
• Where we reasonably believe it necessary to lessen or prevent a serious threat to the life, health or safety of an individual or public health or safety.

We will use best endeavours to ensure your personal information is only stored and accessible from within Australia. However, we may disclose your personal information, or enable it to be accessed by:

• Entities, where required to provide or facilitate the provision of health services to you; 
• Third parties which are based overseas who provide support or maintenance services to us for medical equipment, systems and software, where their access to personal information is incidental to the proper performance of a support or maintenance arrangement. We will take reasonable steps to ensure that these recipients do not breach the requirements of the Privacy Act 1988 and other State and Territory privacy legislation that may be applicable. However, when you provide your personal information to us, you consent to the disclosure of that information outside of Australia in the circumstances described above,  and acknowledge that we are not required to ensure overseas recipients handle that personal information in compliance with Australian privacy law.

We may hold your personal information in either electronic or hard copy form. We take reasonable steps, and implement reasonable safeguards, to protect your personal information that we hold from misuse, interference and loss, as well as unauthorised access, modification and disclosure. We ensure that we and the medical practitioners handle all patient information securely and in accordance with this Privacy Policy and professional duties of confidentiality. We and medical practitioners operating in our practice are subject to a range of obligations relating to the periods for which health information and records must be retained. 

We must generally retain health information about an individual until at least an individual turns 25 – if we collected the information before the individual was 18, or 7 years from the last occasion on which that health information was altered, or a health service was provided to that individual from the practice. Following such retention periods, if we no longer require personal information for a purpose permitted by Australian law, we will take reasonable steps to securely destroy or de-identify such personal information. 

You (or your parent, guardian, attorney, authorised representative or responsible person) may request (i) details of what personal information we hold about you; or (ii) access to, or that corrections be made to, the personal information we hold about you, by contacting the Privacy Officer (details below). Following such retention periods, if we no longer require personal information for a purpose permitted by Australian law, we will take reasonable steps to securely destroy or de-identify such personal information. 

You (or your parent, guardian, attorney, authorised representative or responsible person) may request (i) details of what personal information we hold about you; or (ii) access to, or that corrections be made to, the personal information we hold about you, by contacting the Privacy Officer (details below). Please include your name, email address and/or telephone number and clearly describe your concerns or complaint. We will endeavour to respond to your complaint within a reasonable time after it is made. If you are unhappy with our response, we will provide you with information about further steps you can take.

Privacy Officer – Principal GP
Dr Alexander Baggott