Privacy and YOUR Rights

Privacy Policy

Curalo Medical Clinic is committed to providing quality health care for its patients. As a

fundamental part of this commitment, principals and staff of this practice recognise the

importance of ensuring patient privacy. Curalo Medical Clinic, as a health care provider in

the private sector, is bound by the Australian Privacy Principles (APPs). These principles set

the standard by which we handle personal information collected from our patients.

Curalo Medical Clinic is committed to protecting the privacy of patient information and to

handling your personal information in a responsible manner in accordance with the Privacy

Act 1988, Australian Privacy Principles and relevant State and Territory privacy legislation.

This privacy policy explains how we collect, use and disclose your personal information, how

you may access that information and how you may seek the correction of any information.

It also explains how you may make a complaint about a breach of privacy legislation.

This policy will be reviewed regularly to ensure it remains applicable to current practice

procedure and legal requirements.

All staff members are trained in the application of this policy.

This Privacy Policy is current as of the 10th of December 2024.

If you would like a copy of this policy, please ask our reception staff.

Your Consent

When you register as a patient of our practice, you provide consent for our GPs and practice

staff to access and use your personal information and establish a patient health record, so

they can provide you with the best possible healthcare. Only staff who need to see your

personal information will have access to it. If we need to use your information for anything

else, we will seek additional consent from you to do this.

Collection of your personal information

Our practice may collect your personal information in several different ways.

When you make your first appointment our practice staff will collect your personal and

demographic information via:

 your registration.

 your guardian or responsible person

 other involved healthcare providers, such as specialists, allied health professionals,

hospitals, community health services and pathology and diagnostic imaging services

 Medicare, or the Department of Veterans’ Affairs (as necessary).

 Our practice also participates in My Health Record where a shared health summary

or an event summary may be accessed to collect health information such as a

previous immunisation record.

 We may also collect your personal information when you visit our website, send us

an email or SMS, telephone us or make an online appointment. Our practice does

not have a social media presence and therefore does not communicate via any of

the social medial platforms.

Dealing with us anonymously

You have the right to deal with us anonymously or under a pseudonym unless it is

impracticable for us to do so or unless we are required or authorised by law to only deal

with identified individuals. If you wish to not disclose your personal details to us when

requested, this may limit our ability to provide you with a comprehensive health service in a

timely and appropriate manner. We encourage you to discuss your concerns with our

practice staff prior to your first consultation or with your doctor.

Use of your personal information

Our practice will need to collect your personal information to provide healthcare services to

you. Our main purpose for collecting, using, holding and sharing your personal information

is to manage your health. We also use it for directly related business activities, such as

financial claims and payments, practice audits and accreditation, and business processes

(e.g. staff training).

The information we will collect about you includes your:

 names, date of birth, addresses, contact details

 medical information including medical history, medications, allergies, adverse

events, immunisations, social history, family history and risk factors

 Medicare number (where available) for identification and claiming purposes

 healthcare identifiers

Sharing your personal information

We sometimes share your personal information:

 with third parties who work with our practice for business purposes, such as

accreditation agencies or information technology providers – these third parties are

required to comply with APPs and this policy

 with other healthcare providers

 when it is required or authorised by law (e.g. court subpoenas)

 when it is necessary to lessen or prevent a serious threat to a patient’s life, health

or safety or public health or safety, or it is impractical to obtain the patient’s consent

 to assist in locating a missing person

 to establish, exercise or defend an equitable claim

 for the purpose of confidential dispute resolution process

 when there is a statutory requirement to share certain personal information (e.g.

some diseases require mandatory notification)

 during the course of providing medical services through the My Health Record

system which our clinic participates in.

Only people who need to access your information will be able to do so. Other than in the

course of providing medical services or as otherwise described in this policy, our practice

will not share personal information with any third party without your consent.

We will not share your personal information with anyone outside Australia (unless under

exceptional circumstances that are permitted by law) without your consent.

Our practice will not use your personal information for marketing any of our goods or

services directly to you without your express consent. If you do consent, you may opt out of

direct marketing at any time by notifying our practice in writing.

Our practice may use your personal information to improve the quality of the services we

offer to our patients through research and analysis of our patient data.

We may use your health information for quality improvement, education and continuing

professional development. Our practice uses a software tool that assists us in finding health

issues and trends among patients. This is part of a quality improvement initiative where

your information is de-identified (so you cannot be identified) and grouped together and

securely passed on to our local Primary Health Network to assist with improving population

health outcomes. All data is securely stored within Australia. If you would like not to have

your de-identified health information shared, then please tell our practice manager and

they will arrange for your de-identified health information to be removed from the grouped

data.

Document automation technologies that can access your personal information

We use automation technologies that can access your personal information, including:

1. Referral templates. When a doctor writes a referral for you to visit another medical

specialist, some of your personal medical information is automatically extracted

from your records and added to the referral documents. Different templates are

used for different referral types and circumstances, extracting the specific medical

information appropriate to the addressed specialist.

2. Automated reminders. Our medical software searches our database of medical

records for important upcoming events (such as specific, important appointments)

and sends automated SMS messages.

3. E-report delivery software. Blood analysis, medical imaging, medical practices and

other medical institutions that a patient visits for tests or procedures will send us

medical reports about the patients. These are automatically assigned to our doctors

for review or manually flagged for administrative intervention if any personal details

are incorrect or dubious (e.g. misspellings in patient names or birthdate).

4. De-identified and anonymised study scripts as mentioned above.

Storage and protection of your personal information

We are required by law to retain medical records for certain periods of time, depending on

your age at the time we provide services.

Your personal information may be stored at our practice in various forms including some

paper records such as payment receipts, imaging films etc. The majority of your personal

information is held in electronic format. Our practice stores all personal information

securely and this is done by:

 Securing our premises

 Placing passwords and varying access levels on databases to limit access and

protect electronic information from unauthorised interference, access, modification

and disclosure; and

 providing locked cabinets and rooms for the storage of physical records.

Accessing and correcting your personal information at our practice

You are entitled to request access to your medical records.

We request that you put your request in writing as per the above address and we will

respond within a reasonable time.

There may be a fee for the administrative costs of retrieving and providing you with copies

of your medical records.

We may deny access to your medical records in certain circumstances permitted by law,

for example, if disclosure may cause a serious threat to your or someone else’s health and

safety.

If we deny access, we will always inform you of our reasons for denying access and the

options you have, to respond to our decision.

Our practice will take reasonable steps to correct your personal information where the

information is not accurate or up to date. From time to time, we will ask you to verify that

your personal information held by our practice is correct and current. You may also request

that we correct or update your information, and you should make such requests in writing

to our practice manager.

Privacy and our website

We collect no personal information about you when you visit our website. however, certain

information about site visitors is automatically collected and stored. Our practice website

also contains links to other third-party websites that are not owned or controlled by us.

These links are provided for your convenience only. Please be aware that Curalo Medical

Clinic is not responsible for the privacy practices of any linked sites.

Lodging a privacy-related complaint

We take complaints and concerns regarding privacy seriously. You have the option of

making the initial contact by phoning our practice on 02 6496 3322 and asking to speak to

our practice manager. You may also express your privacy concerns in writing which you can

direct to our Practice Manager, Curalo Medical Clinic, 60 Princes Highway, Eden NSW 2551.

You may also contact the:

 Office of the Australian Information Commissioner (OAIC). Generally, the OAIC will

require you to give them time to respond before they will investigate. For further

information visit www.oaic.gov.au or call the OAIC on 1300 363 992.

 Health Care Complaints Commission. For further information visit

https://www.hccc.nsw.gov.au or call 1800 043 159