Her Health & Aesthetics privacy policy

When you register as a patient of the practice, you provide consent for doctors and practice staff to access and use your personal information so they can provide healthcare.

Only staff who need to see your personal information will have access to it. If the practice needs to use your information for anything else, it will seek additional consent where required.

The practice collects personal information to provide healthcare services. The main purpose for collecting, using, holding and sharing personal information is to manage your health.

Information may also be used for directly related business activities, such as financial claims and payments, practice audits, accreditation and staff training.

The information collected may include names, dates of birth, addresses, contact details, next-of-kin or emergency contact details, Medicare number where available, pension card details and healthcare identifiers.

Medical information may include medical history, medications, allergies, adverse events, immunisations, social history, family history and risk factors.

You have the right to deal with the practice anonymously or under a pseudonym unless it is impracticable or the practice is required or authorised by law to deal only with identified individuals.

When you make your first appointment, practice staff may collect personal and demographic information through registration.

During the course of providing medical services, further information may be collected through clinical care, electronic transfer of prescriptions, My Health Record where applicable, booking systems, imaging services and referral systems.

Personal information may also be collected when you visit the website, send an email or SMS, telephone the practice, make an online appointment or communicate through social media.

In some circumstances, information may be collected from other sources where it is not practical or reasonable to collect it from you directly. This may include information from a guardian or responsible person, other involved healthcare providers, hospitals, pathology or diagnostic imaging services, health funds, Medicare or the Department of Veterans’ Affairs where necessary.

To help us spend more time focusing on you and less time typing, our clinic may use secure artificial intelligence (AI) scribe technology during your consultation. With your consent, the AI scribe listens to the conversation between you and your doctor and generates a draft clinical note. Your doctor carefully reviews, edits, and approves the note before it becomes part of your medical record. The AI scribe is used solely to assist with documentation and does not make clinical decisions or replace your doctor's judgement. Any information processed is handled in accordance with Australian privacy legislation and applicable healthcare privacy standards. If you would prefer not to have AI scribe technology used during your consultation, simply let your doctor know. Your decision will not affect the care you receive.

Personal information may be shared with third parties who work with the practice for business purposes, such as accreditation agencies or information technology providers, where those third parties are required to comply with privacy obligations and this policy.

Information may also be shared with other healthcare providers, where required or authorised by law, where necessary to lessen or prevent a serious threat to life, health or safety, to assist in locating a missing person, to establish or defend a legal claim, for confidential dispute resolution, or where a statutory requirement applies.

Only people who need to access your information will be able to do so. Other than in the course of providing medical services or as otherwise described in this policy, the practice will not share personal information with a third party without consent.

The practice will not share personal information with anyone outside Australia unless exceptional circumstances permitted by law apply or consent has been given.

The practice will not use personal information for direct marketing without express consent. If you consent, you may opt out of direct marketing at any time by notifying the practice in writing.

The practice may use personal information to improve the quality of services through research and analysis of patient data.

The practice may provide de-identified data to other organisations to improve population health outcomes. The information is secure, patients cannot be identified and the information is stored within Australia. You can let reception staff know if you do not want your information included.

Personal information may be stored in electronic medical records, clinical systems, secure communication systems and paper records where paper remains necessary.

Paper records are minimised and destroyed once digital storage is confirmed. Paper records are kept in locked cupboards. Patient communication data held on practice devices is password protected and deleted periodically where it is no longer required.

The practice stores personal information securely. Staff access is restricted according to service delivery requirements, staff are bound by privacy agreements, and data breaches are reviewed, documented and used to revise systems.

You have the right to request access to, and correction of, personal information held by the practice.

Requests for access to medical records should be made in writing by email, fax or letter. The practice will respond within 30 days. A data handling fee may apply where permitted.

The practice will take reasonable steps to correct personal information where it is not accurate or up to date. From time to time, you may be asked to verify that information held by the practice is correct and current.

The practice takes privacy complaints and concerns seriously. Privacy concerns should be expressed in writing so the practice can attempt to resolve them in accordance with its resolution procedure.

You may also request an appointment to discuss a privacy matter in person. The practice will endeavour to address privacy concerns within 30 days.

You may also contact the Office of the Australian Information Commissioner. Generally, the Office of the Australian Information Commissioner will require you to give the practice time to respond before it will investigate. You may also contact the ACT Human Rights Commission for health service complaints and health records matters in the Australian Capital Territory.

Information may be collected as part of communications with the practice through the website, social media or email. This data may be temporarily held by the web host, email server or clinic communication platform.

Where data is held within practice digital systems and is not essential, it will be periodically deleted.

If you allow analytics, the website uses Google Analytics to understand which public pages and booking pathways are useful. Google Analytics is not loaded until you choose to allow it. If you later decline analytics, the website stops sending the website's custom analytics events and updates Google consent to denied. You can decline analytics or change your choice at any time through the Analytics settings link in the website footer.

Analytics events are limited to public page paths, general button interactions and non-identifying service or article labels. The website is configured not to send names, email addresses, phone numbers, form messages, attachment names, medication information, payment details or health information to analytics. Google may process permitted analytics data in accordance with its privacy terms, including outside Australia.

This policy will be reviewed regularly to ensure it remains in accordance with legislative and compliance changes.

Patients may be notified by email when this policy is amended where that is appropriate and supported by the practice systems.