Introduction & Scope
This privacy policy is to provide information to you, our patient, on how your personal information (which includes your health information) is collected and used within our practice, and the circumstances in which we may share it with third parties.
We respect your privacy and are committed to handling your personal and health information in compliance with the Privacy Act 1988 and Australian Privacy Principles (APPs). This policy explains how we collect, use, disclose, store, and manage your information. A copy of the Australian Privacy Principles may be obtained from the website of The Office of the Australian Information Commissioner at https://www.oaic.gov.au.
When you register as a patient of our practice, you provide consent for our doctors and practice staff to access and use your personal information so they can provide you with the best possible healthcare. Only staff who need to see your personal information will have access to it. If we need to use your information for anything else, we will seek additional consent from you to do this.
Our practice will need to collect your personal information to provide healthcare to you. Our main purpose for collecting, using, holding, and sharing your personal information is to manage your health. We also use it for directly related business activities, such as financial claims and payments, practice audits and accreditation, and business processes (i.e. staff training).
Information We Collect
Personal Information: Names, date of birth, addresses, contact details, emergency contacts, Medicare number, healthcare identifiers, and private health fund details.
Sensitive Health Information: Medical, social, and familial history, diagnoses, medications, treatments, images, test results, immunisations, allergies etc.
How We Collect your Personal Information
We primarily collect your personal information direct from you in consultations, intake forms, and any phone calls, SMS, or emails you make to us.
We sometimes collect personal information from third parties (e.g., your carer/power of attorney, other medical providers, hospitals, pathology and diagnostic imaging services, My Health Record, Medicare, private health funds, Department of Veterans’ Affairs etc).
Purpose of Collection & Use
We use your info to:
- Provide medical care;
- Communicate with you and your care teams;
- Administer billing and insurance;
- Comply with legal and regulatory requirements;
- Support complaints or medico-legal processes.
Disclosure of Information
We may share your personal information:
- With other healthcare providers, hospitals, pathology, and diagnostic imaging services;
- With your insurer when required;
- With third-party service providers (e.g. accreditation agencies, information technology (IT) providers, artificial intelligence (AI) tools etc. all of whom are required to comply with APPs and this policy);
- When required by law (e.g. court subpoenas) or to prevent serious threat to a patient’s life, health or safety, or public health or safety, or it is impractical to obtain the patient’s consent.
- When there is a statutory requirement or share certain personal information (e.g., some diseases require mandatory notification).
Only people who need access to your information will be able to do so. Other than in the course of providing medical services or as otherwise described in this policy, our practice will not share personal information with any third party without your consent.
Our practice may use your personal information to improve the quality of the services we offer to our patients through research and analysis of our patient data, such as condition audits.
How We Store and Protect your Personal Information
Your personal information may be stored at our practice in various forms. We predominantly work with electronic records, but do rarely work with paper records or visual records.
We take steps to secure your data physically and digitally via passwords, encryption, multifactor authentication (MFA), limited access, a secured environment etc.
Your data is retained only as long as necessary, then securely disposed of or de-identified.
Use of AI Tools & Transcription
When using AI in a consultation (e.g., Heidi Health), we obtain your informed consent ahead of time. On the consent form provided to you we disclose where data is stored and how to withdraw consent.
Cross-Border Disclosure
We will not share your personal information with anyone outside Australia (unless under exceptional circumstances that are permitted by law) without your consent. We comply with APP 8, ensuring adequate safeguards and informing you accordingly.
Access & Correction Rights
You have the right to request access to, and correction of, your personal information (under APP 12).
Our practice acknowledges patients may request access to their medical records. We require you to put this in writing via email at admin@crclinic.net.au and our practice will respond within a reasonable time.
Our practice will take reasonable steps to correct your personal information where the information is not accurate or up to date. From time to time, we will ask you to verify that your personal information held by our practice is correct and current. You may also request that we update your personal information, and you can make such requests in person or via phone on 03 9509 9462 or via email at admin@crclinic.net.au.
We will not charge any fee for your access request, but may charge an administrative fee for providing a copy of your personal information.
Notifiable Data Breaches
In case of a data breach causing serious harm, we will notify you and the Office of the Australian Information Commissioner (OAIC) per the Notifiable Data Breach scheme.
Training & Governance
All staff receive ongoing training in privacy, cyber‑security, breach prevention, and AI usage.
Privacy and our Website
Our website, https://www.crclinic.net.au collects website analytics and cookies.
Complaints
We take complaints and concerns regarding privacy seriously. You should express any privacy concerns you may have in writing via our practice manager at our email admin@crclinic.net.au or post via Central Rheumatology, Suite 34 Cabrini Malvern, 183 Wattletree Road, Malvern VIC 3144. We will then attempt to resolve it in a timely manner.
If unresolved, you have the right to contact the OAIC on 1300 363 992 or the National Privacy Commissioner GPO Box 5218 Sydney NSW 2001 or the AHPRA GPO Box 9958 Melbourne VIC 3001 or the Office of the National Health Practitioners Ombudsman Address: Suite 2310, L23, 40 City Rd, Southbank, 3006.
Updates to This Policy
We may update this policy; any changes will be posted here with the date of last revision.
Last revised: 9/10/2025
Next revision: 9/10/2026