Privacy Policy

1. About this Privacy Policy

[PRACTICE COMPANY NAME] ACN [ACN] / ABN [ABN] ("we", "us" or "the Practice") is a private medical practice based in New South Wales, Australia.

We respect the privacy of our patients, families, carers, referrers and other people who interact with the Practice.

This Privacy Policy explains how we collect, hold, use and disclose personal information and health information in connection with:

• the medical and administrative services provided by the Practice;
• communications with patients, parents, carers, referrers and other healthcare providers;
• our website at [WEBSITE URL] ("Website");
• our patient information and downloadable resources; and
• our internal administration and website management systems.

Our handling of personal information is intended to comply with applicable Australian privacy laws, including the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). As a private health service provider operating in New South Wales, our handling of health information is also subject to the Health Records and Information Privacy Act 2002 (NSW) and the Health Privacy Principles (HPPs).

This Policy should be read together with any specific collection notice provided to you when we collect information for a particular purpose.

2. What information we may collect

The information we collect depends on your relationship with the Practice and the care or service being provided.

We may collect personal information such as:

• your name, date of birth and contact details;
• your address and other identifying information;
• details of a parent, guardian, carer, next of kin or authorised representative;
• referral details and information about your referring practitioner;
• appointment and administrative information;
• Medicare, private health insurance and billing information where relevant;
• correspondence and other communications with the Practice;
• information contained in enquiries, feedback or complaints; and
• other information reasonably necessary to provide or administer our services.

Because we provide health services, we may also collect health information and other sensitive information, including:

• medical history;
• symptoms and presenting concerns;
• diagnoses and clinical findings;
• medications, allergies and relevant risk information;
• imaging, pathology and other investigation results;
• treatment, procedure and surgical information;
• clinical notes and correspondence;
• hospital, anaesthetic and post-operative information; and
• other information reasonably necessary for your care.

We only seek to collect information that is reasonably necessary for the relevant purpose.

3. How we collect information

Where practical, we collect personal and health information directly from you or from a parent, guardian, carer or authorised representative.

Depending on your care, we may also receive information from people or organisations involved in your treatment or administration, such as:

• your referring GP or specialist;
• hospitals and day surgery facilities where Dr Michael Taplin consults or operates;
• anaesthetists and other healthcare professionals involved in your care;
• pathology, imaging or other diagnostic providers;
• Medicare, private health insurers or other funding bodies where relevant; and
• other persons or organisations where you have authorised the disclosure, or where collection is otherwise permitted or required by law.

If you contact us by phone, post or email, we may collect the information you choose to provide as part of that communication.

4. The Website and information collection

The public Website is primarily an information and resource website.

At the date of this Policy:

• there is no patient login or patient portal;
• there is no online patient account;
• there is no online appointment booking form;
• there is no general patient enquiry form;
• there is no public referral upload function; and
• we do not use Google Analytics, Meta Pixel, advertising cookies or similar behavioural tracking technologies.

Appointments remain arranged through the Practice's approved contact channels.

If we introduce an enquiry form, appointment request form, referral upload function or another feature that collects personal or health information through the Website, we will provide an appropriate collection notice and update this Privacy Policy before that feature is made available.

Technical information

Like most websites, limited technical information may be processed automatically by the systems used to host, secure and operate the Website. This may include:

• IP address;
• browser and device information;
• date and time of a request;
• pages or files requested;
• basic diagnostic information; and
• security or error information.

This information may be processed by our website hosting and security providers, including Cloudflare, where used in the production environment.

We do not intend to use this technical information to build marketing profiles about Website visitors.

Cookies

The public Website is not intended to use analytics or advertising cookies.

Strictly necessary cookies or similar technologies may be used where required for security or for protected staff administration functions.

Third-party content such as Google Maps may use cookies or similar technologies controlled by that third party.

5. Google Maps and external services

The Website may include or link to Google Maps to help visitors find consulting rooms, hospitals or day surgery locations.

When you view or interact with Google Maps, information such as your IP address, device or browser information, and information about the page you are viewing may be transmitted directly to Google. Google's handling of that information is governed by Google's own privacy practices and terms.

We do not intentionally provide patient health information to Google Maps through the Website.

You can review Google's privacy information at: policies.google.com/privacy

The Website may also identify or link to hospitals, day surgery facilities or other healthcare providers involved in Dr Michael Taplin's practice. Those organisations operate independently and may have their own privacy policies and information-handling practices.

6. Why we collect, hold, use and disclose information

We may collect, hold, use and disclose personal and health information for purposes including:

• providing medical care and related health services;
• assessing and managing referrals;
• arranging appointments and follow-up;
• communicating with you, your authorised representative and relevant healthcare providers;
• coordinating care with hospitals, day surgery facilities, anaesthetists and other treating professionals;
• maintaining clinical and administrative records;
• processing Medicare, private health insurance, billing or payment matters where relevant;
• managing post-operative care and communications;
• responding to questions, complaints or requests;
• maintaining patient safety, clinical quality and service administration;
• operating, securing and maintaining our Website and internal systems;
• complying with legal, regulatory, insurance and professional obligations; and
• other purposes authorised or required by law.

We will not use health information for unrelated marketing purposes without an appropriate legal basis and, where required, consent.

7. When we may disclose information

We may disclose personal or health information where reasonably necessary for your care or the administration of the Practice, including to:

• Dr Michael Taplin and authorised Practice staff;
• healthcare professionals involved in your care;
• hospitals and day surgery facilities involved in your treatment;
• your referring practitioner or other treating practitioners;
• Medicare, private health insurers or other funding bodies where relevant;
• professional advisers, insurers, auditors or service providers where reasonably necessary;
• technology providers that support the secure operation of Practice systems;
• regulators, courts, law enforcement bodies or other authorities where required or authorised by law; and
• another person or organisation with your consent or authority.

We take reasonable steps to limit disclosures to what is appropriate for the relevant purpose.

8. Overseas processing and disclosure

We do not intend to routinely disclose patient clinical information overseas through the public Website.

Some global technology providers used to operate or support the Website, including Google and Cloudflare, may process limited technical information using infrastructure located in Australia or overseas.

Before publication, the Practice will confirm its final production providers and complete the required overseas-disclosure review.

[OVERSEAS DISCLOSURE DETAILS / COUNTRIES IF REQUIRED]

9. Educational resources, cartoons and scenarios

The Practice may publish educational resources for patients, parents and carers, including cartoons, illustrated scenarios or "social story" style materials.

Some educational scenarios may be informed by:

• de-identified real-world patient experiences;
• broader experience within the Practice; or
• clinical research, investigation and professional experience.

These materials are created for educational purposes. They are not intended to identify a particular patient or family.

Where real-world experience informs a scenario, identifying details may be removed, changed, combined or generalised so that the material is presented as an educational scenario rather than as an identifiable patient story or testimonial.

We do not intend to publish identifiable patient information in these materials without an appropriate legal basis and any consent required by law.

10. Information about children

The Website is not directed to children and is not intended to collect personal information directly from children through public Website functions.

Some resources concern paediatric care. Those resources are intended for parents and carers, who may choose to use appropriate parts of the material when preparing or supporting a child.

The Website does not require an "18+" age restriction merely to access general information.

Clinical information about a child that is held by the Practice as part of the child's care is handled in accordance with applicable privacy, health-record and consent requirements.

11. Security

We take reasonable steps to protect personal and health information from misuse, interference, loss, unauthorised access, modification and disclosure.

Depending on the system and information involved, safeguards may include:

• restricted staff access;
• individual authentication and access controls;
• secure hosting and storage;
• encryption and secure communications where appropriate;
• system monitoring and security controls;
• staff confidentiality obligations;
• controlled document and record handling; and
• appropriate backup, recovery and incident-response processes.

No electronic system can be guaranteed to be completely secure. If we become aware of a data breach, we will assess and respond to it in accordance with applicable legal obligations, including the Notifiable Data Breaches scheme where it applies.

12. Retention and disposal

We retain personal and health information for the periods required by applicable law and for as long as it is reasonably required for the purpose for which it is held.

When information is no longer required to be retained, we take reasonable steps to securely destroy it or de-identify it where appropriate.

Different retention requirements may apply to clinical records, administrative records, billing records and website/security records.

13. Accessing or correcting your information

You may request access to personal or health information that we hold about you, or ask us to correct information that you believe is inaccurate, out of date, incomplete, irrelevant or misleading.

Requests can be made by contacting the Practice using the details below.

We may need to verify your identity or authority before providing access or making a correction.

In some circumstances, access may be limited or refused where permitted or required by law. If this occurs, we will explain the reason where we are legally able to do so.

14. Privacy complaints

If you have a concern about how the Practice has handled your personal or health information, please contact us so that we can review the matter.

A complaint can be made:

• by phone: [PRACTICE PHONE NUMBER]; or
• in writing by post: [PRACTICE COMPANY NAME], [PRACTICE POSTAL ADDRESS].

Please provide enough information for us to understand the concern and how you would like us to respond.

We will handle privacy complaints in a reasonable manner and may contact you for further information.

If you are not satisfied with our response, you may also have the right to contact:

• the Office of the Australian Information Commissioner (OAIC) regarding matters under the Privacy Act 1988 (Cth): oaic.gov.au; and/or
• the Information and Privacy Commission NSW / NSW Privacy Commissioner regarding matters under the Health Records and Information Privacy Act 2002 (NSW): ipc.nsw.gov.au.

External complaint processes have their own requirements and time limits.

15. Third-party websites and links

Our Website may contain links to third-party websites, including hospitals, day surgery facilities, Google Maps or other healthcare-related services.

We are not responsible for the privacy practices of those external websites. You should consider the privacy information provided by the relevant third party when using its service.

16. Changes to this Privacy Policy

We may update this Privacy Policy when our services, Website features, technology providers or legal obligations change.

The current version will be published on the Website with its effective or review date.

Material changes to the way we collect or use information may also require an updated collection notice or other communication.

17. Contact us

[PRACTICE COMPANY NAME]
ACN: [ACN]
ABN: [ABN]
Postal address: [PRACTICE POSTAL ADDRESS]
Phone: [PRACTICE PHONE NUMBER]
Privacy contact: [PRIVACY CONTACT / PRACTICE MANAGER]

For privacy requests or complaints, please contact us by phone or in writing using the details above.