Privacy Policy | Clinoraa

Clinoraa (ABN 20 698 451 197) operates an Australian telehealth service ("Clinoraa", "we", "us", "our"). Our registered address is Suite 394, Level 2, 66 Victor Crescent, Narre Warren VIC 3805, Australia. You can reach us at [email protected].

This policy explains what we collect, why we collect it, who we share it with, how long we keep it, and the choices you have. It applies to our website, our booking system and every consultation we provide.

We handle your information under:

the Privacy Act 1988 (Cth) and the Australian Privacy Principles;
the Health Records Act 2001 (Vic) and its Health Privacy Principles;
the Healthcare Identifiers Act 2010 (Cth);
the Spam Act 2003 (Cth), for any electronic messages we send you;
other state and territory health records law that applies to where you receive care.

Dealing with us anonymously

Due to the nature of the health services we provide, it is generally impracticable for us to deal with individuals who have not identified themselves. Accurate identification is required to ensure the safety and continuity of clinical care, to comply with our legal and professional obligations under applicable health legislation, and to meet the requirements of Medicare and private health insurance billing.

You can still browse our website without telling us who you are. You can also ask a general question about how the service works without giving us your health information.

The information we collect

What we collect depends on how you use the service. It falls into four groups.

Personal information

your name, date of birth, gender and address;
your phone number and email address;
the name and contact details of an emergency contact, if you give us one;
your Medicare number, Individual Healthcare Identifier, concession card details or private health fund membership number, where these apply.

Health information

Health information is "sensitive information" under the Privacy Act. It carries a higher level of protection. For us it includes:

the reason you are consulting and the symptoms you describe;
your medical history, family history, allergies and immunisations;
your current and past medicines;
any diagnosis, clinical impression or assessment the treating doctor records;
the consultation notes the doctor writes;
prescriptions issued, and the pharmacy you ask us to send them to;
referrals to another doctor or health service;
pathology and radiology requests, and the results returned to us;
medical certificates issued;
care plans and follow-up instructions;
consultation metadata, meaning the date, time, length and phone number of each consultation, and which doctor you spoke with;
answers you give in any pre-consultation form or health questionnaire.

Billing and claims information

the fee you paid, the date and the payment method;
membership status, where you hold one;
any Medicare or private health fund claim we make or support on your behalf, including the item numbers and amounts involved.

Our payment provider handles card payments. We receive a record of the transaction, not your full card number.

Technical information

your IP address, device type, browser and operating system;
the pages you visit on our site and how you arrived;
information from cookies and similar technologies.

How we collect your information

We collect most information directly from you. That happens when you book, fill in a form, speak with the doctor, email us or use the website.

Sometimes we collect information about you from someone else. That may be a parent or guardian booking for a child, a family member managing an account, a pathology or imaging provider returning a result, a pharmacy, another treating doctor, or a hospital. Where the law allows and it is reasonable to do so, we will tell you when we have collected information about you from someone else.

Unsolicited information

From time to time, we may receive personal or health information that we did not solicit. Where we receive unsolicited personal information, we will promptly assess whether that information is of a kind we could have collected under our standard collection practices. If it is not, and the law permits us to do so, we will destroy the information or de-identify it. If it is the kind of information we could have collected, we treat it under this policy like any other information we hold.

Why we use your information

We use your personal and health information to:

verify your identity before a consultation;
check that we can provide the service to you;
provide your consultation and any outcome that is clinically appropriate, such as advice, a certificate, a prescription, a referral or a test request;
keep your clinical record and support continuity of your care;
contact you about a booking, a result, a follow-up or your account;
take payment, manage memberships and handle refunds;
meet our legal and professional obligations, including record-keeping, mandatory reporting and responding to a lawful request;
review the quality and safety of our service, using de-identified information wherever that is workable;
improve how the website works.

We use your health information only for your care, or for a directly related purpose you would reasonably expect, or where the law requires it. We do not use it for advertising.

Consent

By booking a consultation you consent to us collecting, using and disclosing your personal and health information as set out in this policy. Where the law requires express consent, we ask for it at the point of collection, by a tick box or a clear statement you agree to.

You can withdraw your consent at any time by emailing us. This may limit or stop our ability to provide care to you. Withdrawing consent does not affect anything we have already done, and it does not override a record we are legally required to keep.

Managing information for your family

You can manage consultations and records for partners, children and parents from one account. Anyone who books for another person confirms they have authority to do so.

A person's health information belongs to them. A young person who is able to make their own healthcare decisions may ask us to keep their information private from a parent or guardian, and we will follow the law and our professional obligations in deciding that. An adult can ask us to remove another person's access to their records at any time.

Who we share your information with

We share your information only where it is needed for your care, or where the law requires or allows it. That may include:

the pharmacy you choose, so a prescription issued in your consultation can be filled;
pathology and radiology providers, to carry out a test you were referred for, and to return the result;
another doctor, hospital, allied health provider or your usual GP, with your consent;
a parent, guardian, carer or person you have authorised to act for you;
our service providers, such as secure hosting, booking, telephony, electronic prescribing, email and payment providers, under contract and confidentiality obligations;
our insurers and professional advisers, where needed and on a confidential basis;
Services Australia, for Medicare or claims purposes, where that applies to you;
a court, tribunal, regulator or government agency, where the law requires or authorises it.

We may also disclose information to lessen or prevent a serious threat to someone's life, health or safety, where the Privacy Act allows it.

We do not sell your personal or health information. We do not share it so another business can market to you.

Storing and sharing information overseas

We aim to hold your information in Australia. Some of the software we rely on may store or process information overseas. That can apply to categories such as cloud hosting, email, customer support tools, website analytics and payment processing.

Before we disclose your information to an overseas recipient, we take reasonable steps to make sure they handle it in a way consistent with the Australian Privacy Principles. Where APP 8 requires your consent first, we will ask for it and explain what it means.

We do not send your clinical records overseas for the purpose of providing care.

Direct marketing

We send marketing messages only to people who have agreed to receive them. Agreeing is a separate step from booking a consultation. We do not bundle it into another consent.

Every marketing message includes a clear way to opt out. You can also email us at any time to stop them, and we will action it promptly. Opting out of marketing does not stop the messages we must send you about a booking, a result or your account.

We do not use your health information to target marketing. We do not disclose your information to any other organisation for their marketing. If you ever ask us where we got your details, we will tell you, unless it is unreasonable or impracticable to do so.

Cookies and website tracking

Our website uses cookies and similar technologies. Some are needed for the site and the booking process to work. Others help us understand how the site is used so we can improve it.

Browsing a health website can reveal something about your health interests. We treat that seriously. We keep tracking to what is reasonably necessary, we do not use it to build a health profile of you, and we do not use it for health-based advertising.

You can block or delete cookies in your browser settings. If you do, parts of the site may not work as expected.

Government-related identifiers

We collect government identifiers such as your Medicare number, Individual Healthcare Identifier (IHI), Department of Veterans' Affairs number or concession card number only where we need them to provide your care, to bill or claim correctly, or to meet a legal requirement.

We do not use a government identifier as our own way of identifying you in our systems. We use and disclose these identifiers only as the Privacy Act and the Healthcare Identifiers Act 2010 (Cth) permit. Giving us your Medicare number is your choice, though some services may not be available without it.

Software and automated tools

We use software to support booking, scheduling, note-taking, record-keeping, billing and administration. Some of these tools use artificial intelligence or other automated processing.

These tools support the doctor. They do not replace clinical judgement. No prescription, medical certificate, referral or test request is issued without the treating doctor reviewing it and making the decision. No automated system decides your care.

If we ever introduce a tool that transcribes or summarises a consultation, we will tell you before it is used and ask for your consent.

Privacy during your consultation

Consultations happen by phone. Before your consultation the doctor confirms who you are, usually by checking your name, date of birth and address against your record.

Please take the call somewhere you can speak freely. The doctor will ask whether anyone else is with you and whether you are happy for them to stay. You can ask that person to leave at any point. You can also ask for someone to be present as support, or for an interpreter.

We will not record a consultation without telling you first and getting your consent. Please do not record a consultation without letting the doctor know, as recording laws differ between states.

If the doctor decides that a phone consultation is not suitable for your concern, they will tell you and recommend what to do instead. That may be an in-person assessment, urgent care, a review with your usual GP, a referral to another doctor, further investigation or no treatment. Your information is handled the same way whatever the outcome.

My Health Record

We do not upload information to your My Health Record unless you ask us to and the legal requirements for doing so are met. If we ever view your My Health Record, it would be for your care and with your consent, except where the law allows access in an emergency.

You control your My Health Record through myGov. You can set access controls, view the access history, or cancel the record entirely.

How we protect your information

We take reasonable steps to protect your information from misuse, interference and loss, and from unauthorised access, modification or disclosure. Those steps include:

encrypting information in transit and at rest;
restricting access to the people who need it for their role;
individual logins, strong passwords and multi-factor authentication;
audit logging on clinical records;
confidentiality obligations in every staff and contractor agreement;
privacy training for anyone who works with us;
secure destruction of records once we are allowed to dispose of them.

No system can be completely secure. If something goes wrong, we act on it under our data breach response plan.

How long we keep your information

We keep clinical records for at least as long as the law requires. Under the Health Records Act 2001 (Vic), health information must be kept for at least seven years from the date of the last entry in your record. Where the person was under 18 when the information was collected, it must be kept until they turn 25.

The clock runs from the last entry in the record, not from your first consultation. Other state and territory laws may set a longer period, and where one applies to you we follow the longer period. Tax, payment and business records are kept for the period required by other laws.

Once we no longer need information and no law requires us to keep it, we destroy it securely or de-identify it.

Data breaches

We maintain a data breach response plan. If we suspect a data breach, we assess it quickly and complete that assessment within 30 days, as the Privacy Act requires.

If a breach is likely to result in serious harm to you, it is an "eligible data breach" under the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act 1988 (Cth) (sections 26WA to 26WR). In that case we will notify the Office of the Australian Information Commissioner (OAIC) and we will notify you as soon as practicable. Our notice will explain what happened, what information was involved and what you can do about it. We will also take steps to contain the breach and reduce the harm.

Accessing and correcting your information

You can ask for a copy of the personal and health information we hold about you. You can also ask us to correct anything that is wrong, out of date or incomplete.

Email your request to [email protected]. We will verify your identity first. We aim to respond within 30 days. A reasonable fee may apply to the cost of copying or sending a large record, and we will tell you the amount before we do the work.

In limited cases the law allows us to refuse access or a correction. One example is where giving access would pose a serious threat to someone's life, health or safety. If we refuse, we will tell you why in writing and explain how to complain. If we do not agree to a correction, you can ask us to attach a statement to the record noting your view.

Complaints

If you are unhappy with how we have handled your information, please tell us first so we can put it right. Write to:

Clinoraa, Privacy Officer
Suite 394, Level 2, 66 Victor Crescent, Narre Warren VIC 3805
[email protected]

We will acknowledge your complaint, investigate it and respond in writing. We aim to respond within 30 days.

If you are not satisfied with our response, you can take it further at no cost:

Office of the Australian Information Commissioner (OAIC), on 1300 363 992 or at www.oaic.gov.au;
Health Complaints Commissioner (Victoria), on 1300 582 113 or at hcc.vic.gov.au;
the health complaints body in your own state or territory, if you live outside Victoria.

A complaint about a doctor's conduct or registration can be made to the Australian Health Practitioner Regulation Agency (AHPRA) at www.ahpra.gov.au.

Changes to this policy

We may update this policy as our service or the law changes. The current version sits on this page, with the date it was last updated shown near the title. If a change materially affects how we handle your information, we will tell you.

Contact us

For any question about this policy or your information, email [email protected] or write to Clinoraa, Suite 394, Level 2, 66 Victor Crescent, Narre Warren VIC 3805, Australia.