PRIVACY POLICY
[INSERT APP NAME] is a health platform intended to assist patients in the self-management of their health (“Platform”). The Platform is comprised of a patient-facing Patient App and a clinician-facing Clinical Portal.
[Organisation name] Pty Ltd (ACN XXX XXX XXX) (“we”, “us” or “our”) and our operation of the Platform is committed to respecting your privacy. This privacy policy sets outs out how we collect, use, process, store, share and disclose your Personal Information on our Platform (“Privacy Policy”). You can view our terms and conditions [Insert Web Link] and contact us at [Insert Email Address].
In this Privacy Policy, “User”, “you” or “your” means:
• an employee, contractor, director, or agent, who uses the Platform to manage patients (“Clinician”);
• a patient who uses the Platform (“Patient”).
We are committed to protecting your privacy and respecting and upholding your rights under the Australian Privacy Principles (“APPs”) contained in the Privacy Act 1988 (Cth) (collectively, “Privacy Laws”). We are a data controller for the purposes of the GDPR. We ensure that we will take all necessary and reasonable steps to comply with the relevant Privacy Laws and to deal with inquiries or complaints from individuals about compliance with the relevant Privacy Laws.
By accessing and using our Platform, products and services, you freely and expressly consent to the collection, use, processing, storage and disclosure of Personal Information by us as set out in this Privacy Policy.
1. Your Information
We will collect Personal Information only by lawful and fair means and not in an unreasonably intrusive way. Generally, we will collect Personal Information directly from you, and only to the extent necessary to provide the Platform and our services to you and to carry out our administrative functions or as required by a relevant Privacy Law.
We will not collect sensitive personal information (as defined under the relevant Privacy Laws) from you. We ask that you do not send us, or do not disclose, any sensitive personally identifiable information (such as information related to racial or ethnic origin, religion or other beliefs, health, criminal background or trade union membership) on or through the Platform or otherwise. If, contrary to this request, you do provide any sensitive personal information, in doing so you consent to us collecting and handling that information in accordance with this Privacy Policy.
If you use a pseudonym when dealing with us or you do not provide identifiable information to us, we may not be able to provide you with any or all of our services as requested. If you wish to remain anonymous when you use our Platform, do not sign into it or provide any information that might identify you.
We require individuals to provide accurate, up to date and complete Personal Information at the time it is collected.
2. Personal information
We collect personal information from Clinicians and Patients who use the Platform.
“Personal information” is information or an opinion about an individual whose identity is apparent, or can be reasonably ascertained, from that information or opinion (whether true or not, and whether recorded in a material form or not).
The type of personal information we collect may include, but is not limited to, the following:
• full name
• email address
• telephone number
• address
• details of any specialist practice, qualifications and industry body memberships
• Medicare provider number
• AHPRA registration number
• details of the products and services we have provided to you or that you have enquired about, including any additional information necessary to deliver those products and services and respond to your enquiries
• any additional information relating to you that you provide to us directly through our website or indirectly through your use of our website or online presence or through other websites or accounts from which you permit us to collect information
• information you provide to us through surveys
• any other personal information that may be required in order to facilitate your dealings with us.
3. Health Information
We collect the health information of Patients who use the Platform.
“Health information” means:
• information or an opinion about:
• the health, including an illness, disability or injury, (at any time) of an individual
• an individual’s expressed wishes about the future provision of health services to him or her
• a health service provided, or to be provided, to an individual;
• other personal information collected to provide, or in providing a health service to an individual. This may include, but is not limited to, personal details such as a patient’s name, address, admission and discharge dates, and Medicare number, as well as information entered by Patients via the Patient App including that Patient’s mood ratings, sleep records, daily journals, psychological assessment responses and results; and
• genetic information about an individual in a form that is, or could be, predictive of the health of that individual or a genetic relative of the individual.
The types of health information in relation to Patients that we may collect may include, but is not limited to:
• full name
• date of birth
• Medicare number
• health fund details
• medical history and details of any current illness, injury or condition of the Patient
• health services to be provided
• primary and secondary diagnoses
• details of any consultations or referrals
• social and background history
• list of current medications
• Patient-provided information
• other information that the Clinician or Patient deems relevant.
4. Collection
Personal Information
We will collect personal information only by full and fair means and not in an unreasonably intrusive way. Generally, we collect personal information directly from Clinicians and Patients, and only to the extent necessary to provide our products and services, to carry out our administrative functions, and as required by law.
We may also collect personal information from you when you fill in an application form, communicate with us, visit our website, provide us with feedback, complete online surveys or participate in competitions.
Health information
We will collect health information upon the registration of a new Patient via the Platform.
5. How your information is used
Clinicians
We use and disclose the personal information of Clinicians for which the information is collected, or for a directly related purpose, including (but not limited to):
• providing our Platform, products and services to you;
• verifying your identity and place of work
• administering, protecting, improving or optimising our website, products and services law (including performing data analytics, conducting research and for advertising and marketing purposes);
• informing you about our website, products, services, rewards, surveys, contests, or other promotional activities or events sponsored or managed by us or our business partners;
• responding to any inquiries or comments that you submit to us;
• any other purpose you have consented to; and
• any use which is required or authorised by law.
We may disclose the personal information of Clinicians to:
• other Clinicians or other health organisations who are providing or receiving a referral in respect of a Patient;
• the Platform Vendor for the purposes of providing technical support or assistance where required;
• third-parties we ordinarily engage from time to time to perform functions on our behalf for the above purposes;
• any person or entity to whom you have consented to us disclosing your personal information to;
• our external business advisors, auditors, lawyers, insurers and financiers where necessary; and
• any person or entity to whom we are required or authorised to disclose your personal information to in accordance with the law.
We do not sell or share personal information with third party marketers.
Patients
We will disclose the health information of a Patient only as directed by the Clinician providing health services to that Patient, in accordance with the express consent of that Patient, or as required to do so in accordance with the law.
6. Direct Marketing
Clinicians
Where we:
• have your express consent (which you may withdraw at any time by contacting us in writing at [insert email address]);
• have a legal basis; or
• are otherwise permitted by relevant Privacy Laws,
we may use and process your Personal Information to send you information about products and services we believe are suited to you and your interests or we may invite you to attend special events.
At any time, you may opt out of receiving direct marketing communications from us. Unless you opt out, your consent to receive direct marketing communications from us and to the handling of your Personal Information as detailed above will continue. You can opt out by following the unsubscribe instructions included in the relevant marketing communication, or by contacting us in writing at [insert email address].
Patients
No health information will be used to market directly to Patients. As discussed below, all health information is stored securely in an anonymised format, and our staff and service providers will not have access to such information except in very limited, exceptional circumstances.
7. Cookies
We use cookies, web beacons and similar technologies (collectively “Cookies”) on our Website. By accessing or using this Website, you agree that we can store and access Cookies in accordance with this Privacy Policy.
Cookies are small files that can be stored on and accessed from a user’s device when the user accesses a website. They enable authorised web servers to recognise you across different websites, services, devices and browsing sessions.
We may use Cookies to enable users to access and use our Website and Services, including to:
• identify users of our Website and Services;
• process user requests;
• improve user experience;
• remember user preferences on our Site;
• monitor the use of our Site and for analysis of our user base;
• facilitate communication with users;
• control access to certain content on our Site; and
• protect our Site.
The data collected through Cookies will not be kept for longer than is necessary to fulfil the purposes mentioned above.
We will handle any Personal Information collected by Cookies in the same way that we handle all other Personal Information.
You can delete and refuse to accept browser Cookies by activating the appropriate setting on your browser. However, if you select this setting you may be unable to access certain parts of the Website.
Unless you have adjusted your browser setting so that it will refuse Cookies, our system will issue Cookies when you direct your browser to our Website.
8. Our Platform
When transmitting Personal Information via the Platform, you must keep in mind that the transmission of information over the internet is not always completely secure or error-free. Other than liability that cannot lawfully be excluded, we will not be liable in any way in relation to any breach of security or any unintended loss or disclosure of that information.
9. Data Storage
We may hold your personal or health information in either electronic or (in rare circumstances) hard copy. We take reasonable steps to protect all personal and health information from misuse, interference and loss, as well as unauthorised access, modification or disclosure.
We have implemented best practice processes to protect personal information and health information from unintended disclosure, misuse and loss. This includes a number of physical, administrative, personnel and technical measures, including by:
• storing all our cloud information in Australia in HIPAA-complaint and Government endorsed servers;
• storing all health information in an anonymised and encrypted format;
• restricting the external transmission of personal and health information;
• adopting measures to protect our computer systems and networks for storing, processing and transmitting personal and health information;
• adopting procedural and personnel measures for limiting access to personal information by our staff and contractors;
• restricting our staff and service providers from accessing health information, except in exceptional circumstances;
• regularly reviewing and updating our information collection, storage and usage practices;
• using password protection, multifactor authentication procedures and physical access restrictions to limit unauthorised access;
• complying with laws applicable to the collection, use, transmission and storage of personal and health information; and
• regularly testing our systems and networks and assessing security risks.
Further, in accordance with our obligations under the Health Records and Information Privacy Act 2002 (NSW), Health Practitioner Regulation (NSW), Health Records Act 2001 (Vic), Health Records (Privacy and Access) Act 1997 (ACT) and the Privacy Act 1988 (Cth), we are obliged to retain health information in Australia for a period of:
• for adults – seven years from the date of last entry
• for children – until they reach the age of 25 years
However, we cannot guarantee the security of any personal or health information transmitted over the internet and therefore you disclose information to us at your own risk. To the maximum extent permitted under law, we are not liable for any unauthorised access, modification or disclosure, or misuse of personal or health information.
10. Access to information
Subject to some exceptions provided by the relevant Privacy Laws, you may request access to your Personal Information in our customer account database, or seek correction of it, by contacting us. See section 13: Contact information. Should we decline you access to your Personal Information, we will provide a written explanation setting out our reasons for doing so.
If you believe that we hold Personal Information about you that is not accurate, complete or up-to-date then you may request that your Personal Information be amended. We will respond to your request to correct your Personal Information within a reasonable timeframe and you will not be charged a fee for correcting your Personal Information.
If we no longer need your Personal Information for any of the purposes set out in this Privacy Policy, or as otherwise required by the relevant Privacy Laws, we will take such steps as are reasonable in the circumstances to destroy your Personal Information or to de-identify it.
11. Clinician obligations
This clause applies to Clinicians who use our services.
In providing or receiving the health information of a Patient via the Platform, you warrant that you have sought all required consents from the Patient to do so and that you have otherwise fully complied with the Privacy Act and all other relevant legislation and regulations pertaining to the collection, storage, use and disclosure of health information.
You agree to indemnify us for any liability, costs and expenses (including our reasonable legal costs) which we incur as a result of a breach by you of your privacy obligations.
We disclaim any liability whatsoever for information collected or shared outside the Platform.
12. Mandatory data breach notifications
In the circumstances where the Platform suffers a data breach that contains personal or health information, we will take all necessary steps to comply with the Notifiable Data Breach Scheme outlined under the Privacy Act and any other laws that apply to the type of information the subject of the data breach.
This means we will immediately make an objective assessment of whether a breach of personal information is likely to result in serious harm to individuals, and if this is the case, endeavour to notify the affected individual(s) and the Australian Information Commissioner.
You will be notified of any data breach affecting your health information.
13. Contact information
If youPRIVACY POLICY
[INSERT APP NAME] is a health platform intended to assist patients in the self-management of their health (“Platform”). The Platform is comprised of a patient-facing Patient App and a clinician-facing Clinical Portal.
[Organisation name] Pty Ltd (ACN XXX XXX XXX) (“we”, “us” or “our”) and our operation of the Platform is committed to respecting your privacy. This privacy policy sets outs out how we collect, use, process, store, share and disclose your Personal Information on our Platform (“Privacy Policy”). You can view our terms and conditions [Insert Web Link] and contact us at [Insert Email Address].
In this Privacy Policy, “User”, “you” or “your” means:
• an employee, contractor, director, or agent, who uses the Platform to manage patients (“Clinician”);
• a patient who uses the Platform (“Patient”).
We are committed to protecting your privacy and respecting and upholding your rights under the Australian Privacy Principles (“APPs”) contained in the Privacy Act 1988 (Cth) (collectively, “Privacy Laws”). We are a data controller for the purposes of the GDPR. We ensure that we will take all necessary and reasonable steps to comply with the relevant Privacy Laws and to deal with inquiries or complaints from individuals about compliance with the relevant Privacy Laws.
By accessing and using our Platform, products and services, you freely and expressly consent to the collection, use, processing, storage and disclosure of Personal Information by us as set out in this Privacy Policy.
1. Your Information
We will collect Personal Information only by lawful and fair means and not in an unreasonably intrusive way. Generally, we will collect Personal Information directly from you, and only to the extent necessary to provide the Platform and our services to you and to carry out our administrative functions or as required by a relevant Privacy Law.
We will not collect sensitive personal information (as defined under the relevant Privacy Laws) from you. We ask that you do not send us, or do not disclose, any sensitive personally identifiable information (such as information related to racial or ethnic origin, religion or other beliefs, health, criminal background or trade union membership) on or through the Platform or otherwise. If, contrary to this request, you do provide any sensitive personal information, in doing so you consent to us collecting and handling that information in accordance with this Privacy Policy.
If you use a pseudonym when dealing with us or you do not provide identifiable information to us, we may not be able to provide you with any or all of our services as requested. If you wish to remain anonymous when you use our Platform, do not sign into it or provide any information that might identify you.
We require individuals to provide accurate, up to date and complete Personal Information at the time it is collected.
2. Personal information
We collect personal information from Clinicians and Patients who use the Platform.
“Personal information” is information or an opinion about an individual whose identity is apparent, or can be reasonably ascertained, from that information or opinion (whether true or not, and whether recorded in a material form or not).
The type of personal information we collect may include, but is not limited to, the following:
• full name
• email address
• telephone number
• address
• details of any specialist practice, qualifications and industry body memberships
• Medicare provider number
• AHPRA registration number
• details of the products and services we have provided to you or that you have enquired about, including any additional information necessary to deliver those products and services and respond to your enquiries
• any additional information relating to you that you provide to us directly through our website or indirectly through your use of our website or online presence or through other websites or accounts from which you permit us to collect information
• information you provide to us through surveys
• any other personal information that may be required in order to facilitate your dealings with us.
3. Health Information
We collect the health information of Patients who use the Platform.
“Health information” means:
• information or an opinion about:
• the health, including an illness, disability or injury, (at any time) of an individual
• an individual’s expressed wishes about the future provision of health services to him or her
• a health service provided, or to be provided, to an individual;
• other personal information collected to provide, or in providing a health service to an individual. This may include, but is not limited to, personal details such as a patient’s name, address, admission and discharge dates, and Medicare number, as well as information entered by Patients via the Patient App including that Patient’s mood ratings, sleep records, daily journals, psychological assessment responses and results; and
• genetic information about an individual in a form that is, or could be, predictive of the health of that individual or a genetic relative of the individual.
The types of health information in relation to Patients that we may collect may include, but is not limited to:
• full name
• date of birth
• Medicare number
• health fund details
• medical history and details of any current illness, injury or condition of the Patient
• health services to be provided
• primary and secondary diagnoses
• details of any consultations or referrals
• social and background history
• list of current medications
• Patient-provided information
• other information that the Clinician or Patient deems relevant.
4. Collection
Personal Information
We will collect personal information only by full and fair means and not in an unreasonably intrusive way. Generally, we collect personal information directly from Clinicians and Patients, and only to the extent necessary to provide our products and services, to carry out our administrative functions, and as required by law.
We may also collect personal information from you when you fill in an application form, communicate with us, visit our website, provide us with feedback, complete online surveys or participate in competitions.
Health information
We will collect health information upon the registration of a new Patient via the Platform.
5. How your information is used
Clinicians
We use and disclose the personal information of Clinicians for which the information is collected, or for a directly related purpose, including (but not limited to):
• providing our Platform, products and services to you;
• verifying your identity and place of work
• administering, protecting, improving or optimising our website, products and services law (including performing data analytics, conducting research and for advertising and marketing purposes);
• informing you about our website, products, services, rewards, surveys, contests, or other promotional activities or events sponsored or managed by us or our business partners;
• responding to any inquiries or comments that you submit to us;
• any other purpose you have consented to; and
• any use which is required or authorised by law.
We may disclose the personal information of Clinicians to:
• other Clinicians or other health organisations who are providing or receiving a referral in respect of a Patient;
• the Platform Vendor for the purposes of providing technical support or assistance where required;
• third-parties we ordinarily engage from time to time to perform functions on our behalf for the above purposes;
• any person or entity to whom you have consented to us disclosing your personal information to;
• our external business advisors, auditors, lawyers, insurers and financiers where necessary; and
• any person or entity to whom we are required or authorised to disclose your personal information to in accordance with the law.
We do not sell or share personal information with third party marketers.
Patients
We will disclose the health information of a Patient only as directed by the Clinician providing health services to that Patient, in accordance with the express consent of that Patient, or as required to do so in accordance with the law.
6. Direct Marketing
Clinicians
Where we:
• have your express consent (which you may withdraw at any time by contacting us in writing at [insert email address]);
• have a legal basis; or
• are otherwise permitted by relevant Privacy Laws,
we may use and process your Personal Information to send you information about products and services we believe are suited to you and your interests or we may invite you to attend special events.
At any time, you may opt out of receiving direct marketing communications from us. Unless you opt out, your consent to receive direct marketing communications from us and to the handling of your Personal Information as detailed above will continue. You can opt out by following the unsubscribe instructions included in the relevant marketing communication, or by contacting us in writing at [insert email address].
Patients
No health information will be used to market directly to Patients. As discussed below, all health information is stored securely in an anonymised format, and our staff and service providers will not have access to such information except in very limited, exceptional circumstances.
7. Cookies
We use cookies, web beacons and similar technologies (collectively “Cookies”) on our Website. By accessing or using this Website, you agree that we can store and access Cookies in accordance with this Privacy Policy.
Cookies are small files that can be stored on and accessed from a user’s device when the user accesses a website. They enable authorised web servers to recognise you across different websites, services, devices and browsing sessions.
We may use Cookies to enable users to access and use our Website and Services, including to:
• identify users of our Website and Services;
• process user requests;
• improve user experience;
• remember user preferences on our Site;
• monitor the use of our Site and for analysis of our user base;
• facilitate communication with users;
• control access to certain content on our Site; and
• protect our Site.
The data collected through Cookies will not be kept for longer than is necessary to fulfil the purposes mentioned above.
We will handle any Personal Information collected by Cookies in the same way that we handle all other Personal Information.
You can delete and refuse to accept browser Cookies by activating the appropriate setting on your browser. However, if you select this setting you may be unable to access certain parts of the Website.
Unless you have adjusted your browser setting so that it will refuse Cookies, our system will issue Cookies when you direct your browser to our Website.
8. Our Platform
When transmitting Personal Information via the Platform, you must keep in mind that the transmission of information over the internet is not always completely secure or error-free. Other than liability that cannot lawfully be excluded, we will not be liable in any way in relation to any breach of security or any unintended loss or disclosure of that information.
9. Data Storage
We may hold your personal or health information in either electronic or (in rare circumstances) hard copy. We take reasonable steps to protect all personal and health information from misuse, interference and loss, as well as unauthorised access, modification or disclosure.
We have implemented best practice processes to protect personal information and health information from unintended disclosure, misuse and loss. This includes a number of physical, administrative, personnel and technical measures, including by:
• storing all our cloud information in Australia in HIPAA-complaint and Government endorsed servers;
• storing all health information in an anonymised and encrypted format;
• restricting the external transmission of personal and health information;
• adopting measures to protect our computer systems and networks for storing, processing and transmitting personal and health information;
• adopting procedural and personnel measures for limiting access to personal information by our staff and contractors;
• restricting our staff and service providers from accessing health information, except in exceptional circumstances;
• regularly reviewing and updating our information collection, storage and usage practices;
• using password protection, multifactor authentication procedures and physical access restrictions to limit unauthorised access;
• complying with laws applicable to the collection, use, transmission and storage of personal and health information; and
• regularly testing our systems and networks and assessing security risks.
Further, in accordance with our obligations under the Health Records and Information Privacy Act 2002 (NSW), Health Practitioner Regulation (NSW), Health Records Act 2001 (Vic), Health Records (Privacy and Access) Act 1997 (ACT) and the Privacy Act 1988 (Cth), we are obliged to retain health information in Australia for a period of:
• for adults – seven years from the date of last entry
• for children – until they reach the age of 25 years
However, we cannot guarantee the security of any personal or health information transmitted over the internet and therefore you disclose information to us at your own risk. To the maximum extent permitted under law, we are not liable for any unauthorised access, modification or disclosure, or misuse of personal or health information.
10. Access to information
Subject to some exceptions provided by the relevant Privacy Laws, you may request access to your Personal Information in our customer account database, or seek correction of it, by contacting us. See section 13: Contact information. Should we decline you access to your Personal Information, we will provide a written explanation setting out our reasons for doing so.
If you believe that we hold Personal Information about you that is not accurate, complete or up-to-date then you may request that your Personal Information be amended. We will respond to your request to correct your Personal Information within a reasonable timeframe and you will not be charged a fee for correcting your Personal Information.
If we no longer need your Personal Information for any of the purposes set out in this Privacy Policy, or as otherwise required by the relevant Privacy Laws, we will take such steps as are reasonable in the circumstances to destroy your Personal Information or to de-identify it.
11. Clinician obligations
This clause applies to Clinicians who use our services.
In providing or receiving the health information of a Patient via the Platform, you warrant that you have sought all required consents from the Patient to do so and that you have otherwise fully complied with the Privacy Act and all other relevant legislation and regulations pertaining to the collection, storage, use and disclosure of health information.
You agree to indemnify us for any liability, costs and expenses (including our reasonable legal costs) which we incur as a result of a breach by you of your privacy obligations.
We disclaim any liability whatsoever for information collected or shared outside the Platform.
12. Mandatory data breach notifications
In the circumstances where the Platform suffers a data breach that contains personal or health information, we will take all necessary steps to comply with the Notifiable Data Breach Scheme outlined under the Privacy Act and any other laws that apply to the type of information the subject of the data breach.
This means we will immediately make an objective assessment of whether a breach of personal information is likely to result in serious harm to individuals, and if this is the case, endeavour to notify the affected individual(s) and the Australian Information Commissioner.
You will be notified of any data breach affecting your health information.
13. Contact information
If you require further information regarding our Privacy Policy or wish to make a privacy complaint, please contact us in writing at [insert email address].
14. Notices and Revisions
We reserve the right to modify this Privacy Policy in whole or in part from time to time without notice. Non-material changes and clarifications will take immediate effect, and material changes will take effect immediately after the posting of the amended Privacy Policy on the Platform.
15. Enforcement
We will cooperate with the appropriate regulatory authorities, including local data protection authorities, to resolve any complaints regarding the transfer of personally identifiable information that cannot be resolved between us and the individual.
Dated: [Insert date]
14. Notices and Revisions
We reserve the right to modify this Privacy Policy in whole or in part from time to time without notice. Non-material changes and clarifications will take immediate effect, and material changes will take effect immediately after the posting of the amended Privacy Policy on the Platform.
15. Enforcement
We will cooperate with the appropriate regulatory authorities, including local data protection authorities, to resolve any complaints regarding the transfer of personally identifiable information that cannot be resolved between us and the individual.
Dated: [Insert date]
[INSERT APP NAME] is a health platform intended to assist patients in the self-management of their health (“Platform”). The Platform is comprised of a patient-facing Patient App and a clinician-facing Clinical Portal.
[Organisation name] Pty Ltd (ACN XXX XXX XXX) (“we”, “us” or “our”) and our operation of the Platform is committed to respecting your privacy. This privacy policy sets outs out how we collect, use, process, store, share and disclose your Personal Information on our Platform (“Privacy Policy”). You can view our terms and conditions [Insert Web Link] and contact us at [Insert Email Address].
In this Privacy Policy, “User”, “you” or “your” means:
• an employee, contractor, director, or agent, who uses the Platform to manage patients (“Clinician”);
• a patient who uses the Platform (“Patient”).
We are committed to protecting your privacy and respecting and upholding your rights under the Australian Privacy Principles (“APPs”) contained in the Privacy Act 1988 (Cth) (collectively, “Privacy Laws”). We are a data controller for the purposes of the GDPR. We ensure that we will take all necessary and reasonable steps to comply with the relevant Privacy Laws and to deal with inquiries or complaints from individuals about compliance with the relevant Privacy Laws.
By accessing and using our Platform, products and services, you freely and expressly consent to the collection, use, processing, storage and disclosure of Personal Information by us as set out in this Privacy Policy.
1. Your Information
We will collect Personal Information only by lawful and fair means and not in an unreasonably intrusive way. Generally, we will collect Personal Information directly from you, and only to the extent necessary to provide the Platform and our services to you and to carry out our administrative functions or as required by a relevant Privacy Law.
We will not collect sensitive personal information (as defined under the relevant Privacy Laws) from you. We ask that you do not send us, or do not disclose, any sensitive personally identifiable information (such as information related to racial or ethnic origin, religion or other beliefs, health, criminal background or trade union membership) on or through the Platform or otherwise. If, contrary to this request, you do provide any sensitive personal information, in doing so you consent to us collecting and handling that information in accordance with this Privacy Policy.
If you use a pseudonym when dealing with us or you do not provide identifiable information to us, we may not be able to provide you with any or all of our services as requested. If you wish to remain anonymous when you use our Platform, do not sign into it or provide any information that might identify you.
We require individuals to provide accurate, up to date and complete Personal Information at the time it is collected.
2. Personal information
We collect personal information from Clinicians and Patients who use the Platform.
“Personal information” is information or an opinion about an individual whose identity is apparent, or can be reasonably ascertained, from that information or opinion (whether true or not, and whether recorded in a material form or not).
The type of personal information we collect may include, but is not limited to, the following:
• full name
• email address
• telephone number
• address
• details of any specialist practice, qualifications and industry body memberships
• Medicare provider number
• AHPRA registration number
• details of the products and services we have provided to you or that you have enquired about, including any additional information necessary to deliver those products and services and respond to your enquiries
• any additional information relating to you that you provide to us directly through our website or indirectly through your use of our website or online presence or through other websites or accounts from which you permit us to collect information
• information you provide to us through surveys
• any other personal information that may be required in order to facilitate your dealings with us.
3. Health Information
We collect the health information of Patients who use the Platform.
“Health information” means:
• information or an opinion about:
• the health, including an illness, disability or injury, (at any time) of an individual
• an individual’s expressed wishes about the future provision of health services to him or her
• a health service provided, or to be provided, to an individual;
• other personal information collected to provide, or in providing a health service to an individual. This may include, but is not limited to, personal details such as a patient’s name, address, admission and discharge dates, and Medicare number, as well as information entered by Patients via the Patient App including that Patient’s mood ratings, sleep records, daily journals, psychological assessment responses and results; and
• genetic information about an individual in a form that is, or could be, predictive of the health of that individual or a genetic relative of the individual.
The types of health information in relation to Patients that we may collect may include, but is not limited to:
• full name
• date of birth
• Medicare number
• health fund details
• medical history and details of any current illness, injury or condition of the Patient
• health services to be provided
• primary and secondary diagnoses
• details of any consultations or referrals
• social and background history
• list of current medications
• Patient-provided information
• other information that the Clinician or Patient deems relevant.
4. Collection
Personal Information
We will collect personal information only by full and fair means and not in an unreasonably intrusive way. Generally, we collect personal information directly from Clinicians and Patients, and only to the extent necessary to provide our products and services, to carry out our administrative functions, and as required by law.
We may also collect personal information from you when you fill in an application form, communicate with us, visit our website, provide us with feedback, complete online surveys or participate in competitions.
Health information
We will collect health information upon the registration of a new Patient via the Platform.
5. How your information is used
Clinicians
We use and disclose the personal information of Clinicians for which the information is collected, or for a directly related purpose, including (but not limited to):
• providing our Platform, products and services to you;
• verifying your identity and place of work
• administering, protecting, improving or optimising our website, products and services law (including performing data analytics, conducting research and for advertising and marketing purposes);
• informing you about our website, products, services, rewards, surveys, contests, or other promotional activities or events sponsored or managed by us or our business partners;
• responding to any inquiries or comments that you submit to us;
• any other purpose you have consented to; and
• any use which is required or authorised by law.
We may disclose the personal information of Clinicians to:
• other Clinicians or other health organisations who are providing or receiving a referral in respect of a Patient;
• the Platform Vendor for the purposes of providing technical support or assistance where required;
• third-parties we ordinarily engage from time to time to perform functions on our behalf for the above purposes;
• any person or entity to whom you have consented to us disclosing your personal information to;
• our external business advisors, auditors, lawyers, insurers and financiers where necessary; and
• any person or entity to whom we are required or authorised to disclose your personal information to in accordance with the law.
We do not sell or share personal information with third party marketers.
Patients
We will disclose the health information of a Patient only as directed by the Clinician providing health services to that Patient, in accordance with the express consent of that Patient, or as required to do so in accordance with the law.
6. Direct Marketing
Clinicians
Where we:
• have your express consent (which you may withdraw at any time by contacting us in writing at [insert email address]);
• have a legal basis; or
• are otherwise permitted by relevant Privacy Laws,
we may use and process your Personal Information to send you information about products and services we believe are suited to you and your interests or we may invite you to attend special events.
At any time, you may opt out of receiving direct marketing communications from us. Unless you opt out, your consent to receive direct marketing communications from us and to the handling of your Personal Information as detailed above will continue. You can opt out by following the unsubscribe instructions included in the relevant marketing communication, or by contacting us in writing at [insert email address].
Patients
No health information will be used to market directly to Patients. As discussed below, all health information is stored securely in an anonymised format, and our staff and service providers will not have access to such information except in very limited, exceptional circumstances.
7. Cookies
We use cookies, web beacons and similar technologies (collectively “Cookies”) on our Website. By accessing or using this Website, you agree that we can store and access Cookies in accordance with this Privacy Policy.
Cookies are small files that can be stored on and accessed from a user’s device when the user accesses a website. They enable authorised web servers to recognise you across different websites, services, devices and browsing sessions.
We may use Cookies to enable users to access and use our Website and Services, including to:
• identify users of our Website and Services;
• process user requests;
• improve user experience;
• remember user preferences on our Site;
• monitor the use of our Site and for analysis of our user base;
• facilitate communication with users;
• control access to certain content on our Site; and
• protect our Site.
The data collected through Cookies will not be kept for longer than is necessary to fulfil the purposes mentioned above.
We will handle any Personal Information collected by Cookies in the same way that we handle all other Personal Information.
You can delete and refuse to accept browser Cookies by activating the appropriate setting on your browser. However, if you select this setting you may be unable to access certain parts of the Website.
Unless you have adjusted your browser setting so that it will refuse Cookies, our system will issue Cookies when you direct your browser to our Website.
8. Our Platform
When transmitting Personal Information via the Platform, you must keep in mind that the transmission of information over the internet is not always completely secure or error-free. Other than liability that cannot lawfully be excluded, we will not be liable in any way in relation to any breach of security or any unintended loss or disclosure of that information.
9. Data Storage
We may hold your personal or health information in either electronic or (in rare circumstances) hard copy. We take reasonable steps to protect all personal and health information from misuse, interference and loss, as well as unauthorised access, modification or disclosure.
We have implemented best practice processes to protect personal information and health information from unintended disclosure, misuse and loss. This includes a number of physical, administrative, personnel and technical measures, including by:
• storing all our cloud information in Australia in HIPAA-complaint and Government endorsed servers;
• storing all health information in an anonymised and encrypted format;
• restricting the external transmission of personal and health information;
• adopting measures to protect our computer systems and networks for storing, processing and transmitting personal and health information;
• adopting procedural and personnel measures for limiting access to personal information by our staff and contractors;
• restricting our staff and service providers from accessing health information, except in exceptional circumstances;
• regularly reviewing and updating our information collection, storage and usage practices;
• using password protection, multifactor authentication procedures and physical access restrictions to limit unauthorised access;
• complying with laws applicable to the collection, use, transmission and storage of personal and health information; and
• regularly testing our systems and networks and assessing security risks.
Further, in accordance with our obligations under the Health Records and Information Privacy Act 2002 (NSW), Health Practitioner Regulation (NSW), Health Records Act 2001 (Vic), Health Records (Privacy and Access) Act 1997 (ACT) and the Privacy Act 1988 (Cth), we are obliged to retain health information in Australia for a period of:
• for adults – seven years from the date of last entry
• for children – until they reach the age of 25 years
However, we cannot guarantee the security of any personal or health information transmitted over the internet and therefore you disclose information to us at your own risk. To the maximum extent permitted under law, we are not liable for any unauthorised access, modification or disclosure, or misuse of personal or health information.
10. Access to information
Subject to some exceptions provided by the relevant Privacy Laws, you may request access to your Personal Information in our customer account database, or seek correction of it, by contacting us. See section 13: Contact information. Should we decline you access to your Personal Information, we will provide a written explanation setting out our reasons for doing so.
If you believe that we hold Personal Information about you that is not accurate, complete or up-to-date then you may request that your Personal Information be amended. We will respond to your request to correct your Personal Information within a reasonable timeframe and you will not be charged a fee for correcting your Personal Information.
If we no longer need your Personal Information for any of the purposes set out in this Privacy Policy, or as otherwise required by the relevant Privacy Laws, we will take such steps as are reasonable in the circumstances to destroy your Personal Information or to de-identify it.
11. Clinician obligations
This clause applies to Clinicians who use our services.
In providing or receiving the health information of a Patient via the Platform, you warrant that you have sought all required consents from the Patient to do so and that you have otherwise fully complied with the Privacy Act and all other relevant legislation and regulations pertaining to the collection, storage, use and disclosure of health information.
You agree to indemnify us for any liability, costs and expenses (including our reasonable legal costs) which we incur as a result of a breach by you of your privacy obligations.
We disclaim any liability whatsoever for information collected or shared outside the Platform.
12. Mandatory data breach notifications
In the circumstances where the Platform suffers a data breach that contains personal or health information, we will take all necessary steps to comply with the Notifiable Data Breach Scheme outlined under the Privacy Act and any other laws that apply to the type of information the subject of the data breach.
This means we will immediately make an objective assessment of whether a breach of personal information is likely to result in serious harm to individuals, and if this is the case, endeavour to notify the affected individual(s) and the Australian Information Commissioner.
You will be notified of any data breach affecting your health information.
13. Contact information
If you require further information regarding our Privacy Policy or wish to make a privacy complaint, please contact us in writing at [insert email address].
14. Notices and Revisions
We reserve the right to modify this Privacy Policy in whole or in part from time to time without notice. Non-material changes and clarifications will take immediate effect, and material changes will take effect immediately after the posting of the amended Privacy Policy on the Platform.
15. Enforcement
We will cooperate with the appropriate regulatory authorities, including local data protection authorities, to resolve any complaints regarding the transfer of personally identifiable information that cannot be resolved between us and the individual.
Dated: [Insert date]