Privacy Policy

Why we do things

The purpose of this Privacy Policy is to set out how personal information is managed by the Healthia Group.

Who this Policy applies to

This Privacy Policy applies to all personal information that the Healthia Group collects (whether directly or indirectly) from Healthia team members and those external to Healthia. That is, from:

• Current and past patients, clients and customers.
• Current and past team members.
• Individuals who otherwise interact with the Healthia Group and the products and services it offers (including prospective patients, clients, customers, team members and third party service providers).

This Privacy Policy is relevant to all Healthia Group sites, products and services.

Internal and external application of this Policy

• For team members, this policy outlines how employment-related personal information is collected, used and protected.
• For patients, and other external individuals, it explains how we manage personal information in connection with healthcare and related products and services.
• Where a team member is also a patient, their information will be handled in accordance with both employment and patient privacy obligations.

Please note that any reference made to “you” or “your” in this policy refers to each person whose personal information is held by Healthia.

Our Policy

1. Our commitment to privacy

Healthia Pty Limited (ABN 85 626 087 223) and its subsidiaries take pride in delivering a personalised and friendly experience to each patient, customer and employee. In doing so, we respect a person’s privacy and are committed to complying with the Privacy Act 1988 and its Australian Privacy Principles (APPs), as well as other applicable laws including the Health Records Act 2001 (VIC), the Health Records (Privacy and Access) Act 1997 (ACT), the Health Records and Information Privacy Act 2002 (NSW) and the Health Information Privacy Code 1994 in New Zealand.

This privacy policy applies to Healthia Limited and each of its subsidiaries. Please note that any reference made to “we”, “our” or “us” refers to each relevant member or members of the Healthia Group.

2. Content of our privacy policy

This Privacy Policy explains:

• What kinds of personal information we collect and hold
• How we collect personal information
• The purposes for which we collect, hold, use and disclose personal information
• How we hold personal information and keep it safe
• Your rights

2.1 What kinds of personal information we collect and hold about you

We collect and hold a range of personal information (including sensitive information) in connection with carrying out our business and functions as a network of allied healthcare service providers.

This may include the following:

• Name, date of birth, mailing and street address, email address, contact numbers
• Information about a patient or customer’s family or relatives or key contact people
• Health fund details
• Government identifiers such as Medicare number, DVA number
• Health information such as a record of symptoms, relevant medical history, the diagnosis made and the treatment decisions made
• Other health information such as:
  • Doctor’s and/or specialist’s reports
  • Test results
  • Prescriptions
  • Healthcare identifiers
  • Other information for the purpose of providing care
  • Occupation and employer
  • Lifestyle and hobbies
  • Details of products purchased online and/or in person, from our clinics or stores
• Payment details
• Any other information that an individual provides to us through our website, by email, written letters and phone conversations
• Information in connection with our recruitment processes, such as educational details, skills and background checks, and references from past employers and referees

2.2 How we collect personal information

We typically collect personal information directly from you when you access our services or purchase our products, such as when you make an enquiry, complete a new patient/client form or make an online purchase.

We may collect your personal information from a person responsible for you, or from other third parties including government agencies (such as the Department of Health, Disability and Ageing through Medicare), private health insurers, medical professionals (such as general practitioners, specialists and allied health professionals), as well as legal representatives and workers’ compensation companies.

2.3 The purposes for which we collect, hold, use and disclose personal information

We collect, hold, use and disclose personal information to provide the best possible healthcare, to communicate with others involved in care in relation to those services, and to maintain a high level of quality customer service.

We collect, hold, use and disclose personal information for various purposes including:

• Providing services and products to our patients, clients, customers and team members
• Administrative aspects of running our clinics, including billing and maintaining our records
• To consult with other health professionals involved in a person’s health care, including healthcare providers outside the Healthia Group
• To obtain test results from diagnostic and pathology services
• If a person has a My Health Record, to upload and download (to a person’s patient records in connection with providing healthcare services) personal information
• To interact with insurers, including to make insurance claims and to discharge professional indemnity insurance notification requirements
• To communicate with a person’s health fund, and with government and other regulatory bodies such as Medicare
• Where the parent or guardian of a child or other person under care has requested access to, or use of, the personal information that relates to that child or other person under care
• Where an individual has given consent for another person to have access to, or use or disclosure of, personal information that relates to that individual
• Marketing our services and products, including mail and email reminders
• Research and statistical analysis (only de-identified information is used unless otherwise specified)
• Advising if a clinic will be closing down, merging or relocating
• To lessen or prevent a serious threat to a patient’s/customer’s/team member’s life, health or safety or a serious threat to public health or safety
• Contracting out some of our functions to external service providers and suppliers (for example, we outsource the conduct of our patient reminders to a third-party provider)
• Accreditation and quality assurance activities to improve individual and community healthcare and practice management
• To comply with our legal and regulatory obligations (such as mandatory reporting and responding to court orders)
• To otherwise carry out our functions as a network of allied health care service providers

We are exploring ways in which we can use AI in carrying out our business and functions as a network of allied healthcare service providers. We will only use personal information in connection with AI products in accordance with applicable laws and this privacy policy.

Direct marketing purposes, mail and email reminders

From time to time, we may collect and use personal information so that we can promote and market our products and services and keep our patients/customers/team members informed of special offers from the Healthia Group. We may contact our patients/customers/team members in relation to these promotions and offers by direct mail, SMS and MMS messages, targeted marketing on social media platforms, by phone and email.

If you do not want to be contacted in this way or want to change the way in which we communicate with you, please let us know by using the “unsubscribe” function in our emails and messages or by contacting us. If you have signed up to receive marketing from us via different email addresses, please tell us all email addresses you wish to opt out of receiving marketing in order to stop receiving marketing from us or on our behalf to those email addresses.

2.4 How we hold personal information and keep it safe

We hold personal information in hardcopy files and in electronic form. We store hardcopy files on our premises and take certain steps to ensure that access to those hardcopy files is appropriately limited. We store electronic records within our own secure network and through third party data storage providers. Our third-party data storage providers are required to protect personal information in accordance with applicable laws and take appropriate technical and organisational measures to protect our electronic records.

We take reasonable steps to keep personal information protected from misuse, interference and loss and from unauthorised access, modification and disclosure. We also take reasonable steps to destroy personal information when no longer required. In terms of confidentiality requirements, a confidentiality agreement is entered into by all Healthia Group team members, contractors and agents at the time of their employment or engagement with us which supports the protection of personal information.

Where we outsource our services, we look to ensure that those third parties are contractually required to comply with all applicable privacy and data protection laws.

Importantly, the Healthia Group ensures that Australian patients’ personal information is not stored, or accessible from, outside of Australia, except in certain limited circumstances (which are set out in the Healthia Group’s Health Records Policy).

Cookies

When a patient/customer/team member visits a Healthia Group website, the server/s may attach a ‘cookie’ to their computer’s memory. A ‘cookie’ assists us to store information on how visitors to the website use it and the pages that may be of most interest. This information may be used to provide users of computers with information that we think may interest them. This feature can be disabled by updating the computers web browser preferences, however some features on our website may be dismantled by such action.

2.5 Your rights

Your right to seek access to and if required correction of the records we hold about you

Patients/customers/team members can request access to their personal information. Such requests can be for clinical notes, images, reports and other personal information which we hold by contacting one of our centres to obtain a Release of Personal Information Consent Form. Personal information will not be released unless a consent form has been signed, received and processed by our team. In most circumstances, we will be able to release that personal information on request by a patient/customer/team member or their nominated third party.

Keeping your records up to date

We endeavour to keep personal information relevant, accurate, complete and up to date. When arriving for an appointment, the receptionist at the relevant clinic may request confirmation that the personal details held have not changed. If updates to personal information are required, please contact the clinic. If information held is not correct, let us know in writing. We will take reasonable steps to correct personal information where the information is not accurate, complete, up-to-date, relevant or is misleading.

Your right to receive treatment from us anonymously (or by using a pseudonym)

Where it is it lawful and practicable for us to do so, patients/customers/team members can be treated anonymously or through use of a pseudonym (a name other than their own).

Your right to make a complaint

If a patient/customer/team member has concerns about how we have handled their privacy, let us know in writing and such complaint will be investigated, and a written response will be received to the complaint within a reasonable period of time (which is usually around 30 days).

Healthia’s Privacy Officer
Phone: 07 3180 4900
Email: privacy@healthia.com.au

If a patient/customer/team member is not satisfied with the response, they may lodge a privacy complaint with the Office of the Australian Information Commissioner.
Phone: 1300 363 992
Email: enquiries@oaic.gov.au
Post: GPO Box 5218 Sydney New South Wales 2001
Website: https://www.oaic.gov.au/privacy/privacy-complaints/

Related Policies

Policies related to this procedure include:

•  Code of Conduct and Behaviour Policy
• Health Records Policy
• NDIS Code of Conduct

Related Documents

Other relevant resources in relation to this procedure are:

• Ahpra and National Boards Code of Conduct June 2022
• Australian Privacy Principles (APPs) in the Privacy Act 1988
• Code of Ethics Speech Pathology Australia 2022
• ESSA Professional Code of Conduct and Ethical Practice 2021
• Good Medical Practice: A Code of Conduct for Doctors in Australia

Internal Controls