Introduction

Tamborine Village Medical (“the Practice”, “we”, “us” or “our”) is a general practice and multidisciplinary medical centre located at 7-15 Leach Rd, Tamborine QLD 4270, providing general practice, chronic disease management, preventative health, travel medicine, skin, vasectomy, IUD and metabolic clinics, onsite pathology, ultrasound diagnostics, psychological counselling and women’s health services to our community.

We are committed to protecting the privacy and confidentiality of the personal and health information we hold about our patients, website visitors and other individuals we deal with. This Privacy Policy explains what information we collect, why we collect it, how we use, store and disclose it, and how you can access or correct your information or make a complaint.

This Policy is prepared to comply with the Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs), the My Health Records Act 2012 (Cth) and associated Rules, and applicable professional obligations of registered health practitioners regulated by the Australian Health Practitioner Regulation Agency (AHPRA) and the Medical Board of Australia, including Good Medical Practice: A Code of Conduct for Doctors in Australia. It also reflects the RACGP Standards for General Practices (5th edition), Criterion C6.3 (Confidentiality and privacy of health information).

What This Policy Covers

This policy applies to all personal information we collect and hold about patients, guardians/carers, and website users. Information handled includes data provided during in-person visits, via our website or patient portal, through phone or email, and via telehealth

The kinds of information we collect and hold

The information we collect depends on your relationship with the Practice (patient, representative of a patient, job applicant, visitor to our website, or other third party). It may include:

Personal information
  • Name, date of birth, gender, address, contact phone numbers and email address;
  • Medicare number, Department of Veterans’ Affairs (DVA) number, private health fund details and pension/concession card details;
  • Emergency contact and next-of-kin details;
  • Billing and payment information; and
  • Employment or referral details relevant to your care (for example, workers’ compensation or third-party insurer details).
Sensitive and health information

As a medical practice, most of the information we collect is “health information”, a special category of “sensitive information” under the Privacy Act that receives a higher level of protection. This includes:

  • Medical history, symptoms, diagnoses, treatment, medications and allergies;
  • Consultation notes, referral letters, specialist and hospital reports;
  • Results of tests, pathology, imaging and ultrasound investigations;
  • Immunisation records;
  • Information about your family, social and medical history relevant to your care;
  • Genetic, reproductive health, mental health and sexual health information where relevant to your treatment; and
  • Any other information a treating practitioner considers relevant to providing you with safe and appropriate care.

We only collect sensitive information with your consent, or where otherwise permitted or required by law (for example, to lessen or prevent a serious threat to life, health or safety).

We use Medicare, DVA and similar government-issued numbers only for the purposes for which they were provided (such as billing and claiming) and do not adopt them as our own identifier for you, such as your patient record number, except where permitted or required by law.

How we collect your information

Wherever reasonable and practicable, we collect personal information directly from you. This may occur:

  • When you register as a new patient, complete patient information or consent forms, or update your details at reception;
  • During consultations, telehealth appointments, phone calls or correspondence with our doctors, nurses and other clinical staff;
  • When you make a booking online (including through our online booking platform), by phone, or in person;
  • When you contact us by phone, email, through our website contact form, or via social media; and
  • When you subscribe to our newsletter or otherwise interact with our website.

We may also collect information from other sources, including:

  • Family members, carers or your authorised representative (particularly for children, or where you are unable to provide information yourself);
  • Other treating practitioners, specialists, hospitals, pathology and diagnostic imaging providers, and allied health professionals involved in your care;
  • Medicare, DVA and private health funds, for billing and claiming purposes;
  • My Health Record, where you have a record and have not restricted our access; and
  • Publicly available sources, where appropriate.

Where practicable, we will notify you of the collection of your personal information, the purposes of collection, and the third parties to whom we usually disclose information of that kind, consistent with APP 5.

Why we collect, hold, use and disclose your information

We collect, hold, use and disclose your personal and health information for the primary purpose of providing you with safe, high-quality medical care, and for related secondary purposes that you would reasonably expect, including to:

  • Assess, diagnose, treat and manage your ongoing healthcare, including referrals to specialists and allied health providers;
  • Communicate with other healthcare providers involved in your care (e.g. specialists, pathology and imaging providers, hospitals, allied health professionals);
  • Send appointment reminders, recalls for follow-up care, immunisation reminders and results notifications, including by SMS, email or phone;
  • Process Medicare, DVA, private health fund and other billing claims, and manage accounts and payments;
  • Conduct clinical audits, quality assurance, accreditation (including against the RACGP Standards for General Practices) and practice improvement activities, generally using de-identified information wherever practicable;
  • Comply with our legal, regulatory and professional obligations, including reporting obligations to public health authorities and AHPRA notification requirements where applicable;
  • Manage and improve our website, respond to enquiries, and communicate practice updates; and
  • Investigate and manage any complaints, incidents or insurance claims.

We will not use or disclose your personal information for a secondary purpose unrelated to the above unless you have consented, or an exception under the Privacy Act applies (for example, the use is required or authorised by law, or is necessary to lessen or prevent a serious threat to the life, health or safety of any individual, or to public health or safety).

Who we may disclose your information to

We may disclose your personal and health information, only as necessary and consistent with the purposes above, to:

  • Doctors, specialists, allied health professionals and other healthcare providers involved in your ongoing care, including by referral letter, e-referral or shared clinical systems;
  • Pathology and diagnostic imaging providers who perform tests and investigations we order;
  • Hospitals and other healthcare facilities, where you are referred or admitted;
  • Medicare, DVA, the National Disability Insurance Agency (NDIA), private health funds, workers’ compensation and other insurers, and Services Australia, for billing, claiming and eligibility purposes;
  • The My Health Record system, in accordance with the My Health Records Act 2012 (Cth) and your My Health Record access controls (see section 6);
  • Our third-party service providers, including our practice management, online booking, appointment reminder (SMS/email), telehealth, accounting, IT support and cloud hosting providers, who assist us to operate the Practice and who are contractually required to protect your information and use it only for the purposes we specify;
  • Family members, carers or other persons responsible for your care, where you have consented, where it is otherwise permitted by law, or where we reasonably believe disclosure is necessary to lessen or prevent a serious threat to your life, health or safety;
  • Regulatory bodies and government agencies where required or authorised by law, including AHPRA, the Office of the Australian Information Commissioner (OAIC), Queensland Health, courts and tribunals (for example, in response to a subpoena or statutory notice), and agencies to which we have a mandatory reporting obligation (such as child protection authorities); and
  • Our professional advisers, medical defence organisation and insurers, where reasonably necessary to obtain advice or manage a claim, complaint or risk.

We do not sell your personal information, and we do not disclose your information to third parties for their own marketing purposes.

Overseas disclosure

Some of our third-party service providers (for example, cloud storage, practice software or IT support providers) may store or process information on servers located outside Australia. Before disclosing personal information overseas, we take reasonable steps to ensure the overseas recipient handles your information consistently with the Australian Privacy Principles, in accordance with APP 8, or we obtain your consent to the disclosure.

PRACTICE ACTION / CONFIRM: List each cloud/software vendor used (practice management system, online booking provider, SMS reminder service, telehealth platform, accounting software) and confirm, for each, whether data is stored in Australia or overseas, so this section and the Practice’s APP 8 records are accurate.

My Health Record

Tamborine Village Medical is a registered participating healthcare provider organisation in the My Health Record system. Where you have a My Health Record and have not set access controls to prevent it, our treating clinicians may upload clinical documents to, and view relevant health information from, your My Health Record to support your care.

We maintain a written security and access policy for My Health Record use, consistent with the My Health Records Rules, covering staff authorisation and training, access logging, incident and breach management, and information security. Access to My Health Record information is restricted to authorised clinical staff involved in your care, and all access is auditable.

You may set access controls on your My Health Record (including restricting or removing our access), obtain a record of who has accessed it, or choose not to have a My Health Record at all, by contacting the My Health Record System Operator (Services Australia) or through the My Health Record website. Declining to have, or restricting access to, a My Health Record will not affect the standard of care we provide to you.

Direct marketing and communications

From time to time, and only with your consent (which may be inferred from our ongoing treating relationship with you, or given expressly, such as by subscribing to our newsletter), we may send you health-related communications, such as recall and reminder notices (e.g. immunisations, cervical screening, chronic disease reviews), practice newsletters, or information about new services.

You may opt out of receiving marketing or newsletter communications at any time, free of charge, by using the unsubscribe function in the communication, or by contacting reception. We will always give you the option to opt out of clinically-related recalls and reminders while remaining a patient of the Practice, although we encourage you to remain enrolled in clinical recall and reminder systems as they support your ongoing health and safety.

Our website and online services

Our website (tamborinevillagemedical.com.au) may use cookies and similar technologies to operate effectively, remember your preferences and understand website usage through analytics tools. You can adjust your browser settings to refuse cookies, although some parts of the website may not function properly if you do so.

If you make a booking through our online booking platform, complete a contact form, or subscribe to our newsletter, the personal information you provide is collected and handled in accordance with this Policy and, where applicable, the privacy policy of the relevant third-party platform provider.

Our website may contain links to third-party websites and social media pages (including Facebook, Instagram and LinkedIn). We are not responsible for the privacy practices of those third parties, and we encourage you to review their privacy policies before providing any personal information to them.

PRACTICE ACTION / CONFIRM: Confirm the name of the online booking platform and any analytics/cookie tools (e.g. Google Analytics, Meta Pixel) actually in use on the live website, and add a cookie consent banner if tracking cookies beyond strictly necessary cookies are used, to meet APP 5 notification requirements.

Data quality

We take reasonable steps to ensure the personal information we collect, use and disclose is accurate, up to date and complete. We encourage you to inform us if your contact details or other personal circumstances change, and we will periodically ask you to confirm your details are current.

How we store and protect your information

We hold personal information in a combination of secure electronic clinical and practice management systems and, where applicable, physical records. We take reasonable steps to protect the personal information we hold from misuse, interference, loss, and unauthorised access, modification or disclosure, including:

  • Password-protected and access-controlled electronic clinical and practice management systems, with individual staff logins and role-based access restricted to information staff need to perform their duties;
  • Secure, access-restricted storage of any physical records, and secure destruction of records no longer required;
  • Firewalls, antivirus software, encryption and regular data backups for our IT systems;
  • Staff confidentiality obligations, privacy training, and policies restricting access to patient information on a need-to-know basis; and
  • Written agreements with third-party service providers requiring them to protect personal information they handle on our behalf.

We retain health records for the period required by law and applicable professional guidelines. The Medical Board of Australia’s guidance recommends retaining adult patient records for at least seven years from the date of the last entry, and, for children, until the patient turns 25 years of age (or for the relevant period required by law), after which records are securely destroyed or de-identified.

While we take reasonable steps to protect your information, no system can guarantee absolute security. If we become aware of a data breach likely to result in serious harm to you (an “eligible data breach”), we will notify you and the OAIC in accordance with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act, and take steps to contain and remediate the breach.

Accessing and correcting your information

You have a right to request access to the personal and health information we hold about you, and to request that it be corrected if it is inaccurate, out of date, incomplete, irrelevant or misleading. To make a request, please contact our Privacy Officer using the details in section 15.

We will respond to access and correction requests within a reasonable period (generally within 30 days), and may charge a reasonable fee to cover the cost of retrieving and providing copies of records. We will verify your identity before releasing information. Where you are seeking access to another person’s records (for example, as a parent, guardian or authorised representative), we will require evidence of your authority to act on that person’s behalf.

There are limited circumstances in which we may refuse a request for access or correction, in accordance with APP 12 and APP 13 — for example, where access would pose a serious threat to the life, health or safety of any individual, would have an unreasonable impact on the privacy of others, or is otherwise permitted to be refused by law. If we refuse a request, we will provide written reasons and information about how you may complain about the refusal.

Children and young people

We collect and handle the health information of children and young people in accordance with their capacity to consent to treatment and information handling. Where a young person has the maturity and capacity to understand the nature and consequences of a decision (sometimes referred to as “Gillick competence”), we will generally deal directly with them regarding their own health information. For younger children, we will generally deal with a parent or guardian, while considering the child’s best interests.

We are mindful of emerging obligations under Australia’s children’s online privacy code and take a privacy-by-design approach to any digital services accessed by minors.

Anonymity and pseudonymity

Where it is lawful and practicable to do so, you may interact with us anonymously or using a pseudonym (for example, for a general enquiry). However, because we provide clinical medical services, it is generally not practicable for us to provide treatment, prescribe medication, process Medicare claims or maintain a clinical record without identifying you.

Our practitioners' professional obligations

In addition to this Policy, doctors and other registered health practitioners at the Practice are individually bound by professional, ethical and legal obligations of confidentiality, including under the Medical Board of Australia’s Good Medical Practice: A Code of Conduct for Doctors in Australia and the codes of conduct administered by the Australian Health Practitioner Regulation Agency (AHPRA). These obligations exist alongside, and are consistent with, our obligations under the Privacy Act and this Policy, and generally permit disclosure of patient information without consent only where required or authorised by law, or necessary to prevent a serious risk to life, health or safety.

How to make a privacy complaint

If you have a concern or complaint about how we have handled your personal information, please contact our Privacy Officer:

Privacy Officer: [insert name/role, e.g. Practice Manager] Tamborine Village Medical 7-15 Leach Rd, Tamborine QLD 4270 Phone: (07) 5619 5599 Email: reception@tamborinevillagemedical.com.au

Please provide as much detail as possible about your concern so we can investigate it properly. We will acknowledge your complaint promptly and aim to resolve it within 30 days. We take all privacy complaints seriously and will not disadvantage you in the care we provide because you have made a complaint.

If you are not satisfied with our response, or wish to raise the matter independently, you may contact the Office of the Australian Information Commissioner (OAIC):

  • Website: www.oaic.gov.au
  • Phone: 1300 363 992
  • Mail: GPO Box 5288, Sydney NSW 2001

Complaints about the clinical care or professional conduct of a registered practitioner may also be made to the Office of the Health Ombudsman (Queensland) or to AHPRA.

Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements or professional guidance. The current version will always be available on our website and at reception. We encourage you to review this Policy periodically.

Contact us

If you have any questions about this Privacy Policy or how we handle your personal information, please contact us:

Tamborine Village Medical 7-15 Leach Rd, Tamborine QLD 4270 Phone: (07) 5619 5599 Email: reception@tamborinevillagemedical.com.au Website: www.tamborinevillagemedical.com.au

Privacy Policy