Privacy policy

1. Introduction

This privacy policy explains how ClinicLane Pty Ltd (ACN 701 049 425), trading as Doccio ("Doccio", "we", "us", "our"), handles the personal information, including health information, of the patients and visitors who use our website and telehealth services. It describes how your information is collected and used within our practice, and the circumstances in which we may share it with third parties.

We are bound by the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs) and applicable state and territory health records legislation.

2. Why and when your consent is necessary

When you register as a patient of Doccio, you provide consent for our doctors, practice staff and, where relevant, your chosen pharmacy or pathology and imaging providers to access and use your personal information so they can provide you with the best possible healthcare. Only people who need to see your personal information will have access to it. If we need to use your information for anything else, we will seek additional consent from you.

3. Why do we collect, use, hold and share your personal information?

We need to collect your personal information to provide healthcare services to you. Our main purpose for collecting, using, holding and sharing your personal information is to manage your health. We also use it for directly related business activities, such as payments, practice audits and accreditation, clinical governance and staff training.

4. What personal information do we collect?

The information we collect about you may include your:

• name, date of birth, address and contact details;
• medical information, including medical history, medications, allergies, adverse events, immunisations, social history, family history and risk factors;
• Medicare number (where available) for identification purposes;
• healthcare identifiers, such as your Individual Healthcare Identifier (IHI);
• information you provide in an online request, such as the reason for a consultation, the dates a medical certificate should cover, or the medication you are asking to have re-prescribed;
• payment details (processed by our payment provider; we do not store full card numbers);
• employer or educational institution name, where you ask us to record it on a certificate.

5. Dealing with us anonymously

You have the right to deal with us anonymously or under a pseudonym unless it is impracticable for us to do so, or unless we are required or authorised by law to deal only with identified individuals. Because a doctor must confirm your identity before issuing a prescription, certificate or referral, our clinical services cannot be provided anonymously.

6. How do we collect your personal information?

We may collect your personal information in several ways:

• when you first make a request or booking, you provide your personal and demographic information;
• during the course of providing medical services, we may collect further personal information;
• when you visit our website, send us an email or SMS, telephone us, complete an online form or communicate with us using social media;
• in some circumstances, from other sources where it is not practical or reasonable to collect it from you directly, including your guardian or responsible person, other involved healthcare providers (such as specialists, allied health professionals, hospitals, pathology and diagnostic imaging services), or Medicare and the Department of Veterans' Affairs as necessary.

7. When, why and with whom do we share your personal information?

We sometimes share your personal information:

• with third parties who work with our practice for business purposes, such as accreditation agencies, payment processors or information technology providers. These third parties are required to comply with the APPs and this policy;
• with other healthcare providers involved in your care;
• when it is required or authorised by law (for example, a court subpoena);
• when it is necessary to lessen or prevent a serious threat to a patient's life, health or safety, or to public health or safety, and it is impractical to obtain the patient's consent;
• to assist in locating a missing person;
• to establish, exercise or defend an equitable claim;
• for the purpose of a confidential dispute resolution process;
• when there is a statutory requirement to share certain personal information (for example, some diseases require mandatory notification);
• during the course of providing medical services, through electronic prescribing (an eScript token sent to you, which you can present at a pharmacy of your choice), My Health Record (for example, a Shared Health Summary or Event Summary), or secure messaging to a pathology, imaging or specialist provider you nominate;
• when required by a regulatory body, such as the Therapeutic Goods Administration (TGA) or Ahpra.

Medical certificates. We do not send your certificate to your employer or educational institution. You choose who to share it with. If an employer uses our certificate verification tool, it confirms only that a certificate ID is genuine, the dates it covers and the issuing clinic. No diagnosis, symptoms or clinical notes are ever shown.

Only people who need to access your information will be able to do so. Other than in the course of providing medical services or as otherwise described in this policy, we will not share personal information with any third party without your consent.

We will not share your personal information with anyone outside Australia (unless under exceptional circumstances permitted by law) without your consent. Our systems are hosted in Australia wherever practicable.

We may use your personal information to improve the quality of the services we offer through research and analysis of de-identified patient data. Where we provide de-identified data to other organisations to improve population health outcomes, patients cannot be identified and the information is stored within Australia. You can let us know if you do not want your information included.

8. How we use your contact details, and opting out

We may use your name, email address and phone number to:

1. communicate for service-related purposes, such as consultation confirmations, eScript tokens, certificate and referral delivery, and important notices about your care or account;
2. send promotional communications about new services or updates relevant to your health, but only where you have provided consent;
3. request feedback, such as inviting you to a survey or to leave a review to help us improve.

You may opt out of promotional communications at any time. Every promotional email includes an "Unsubscribe" link, and every promotional SMS includes instructions (such as replying "STOP"). Once you opt out you will no longer receive promotional messages; essential communications about your care will continue.

9. How do we store and protect your personal information?

Your personal information may be held in various forms, including electronic clinical records, consultation notes, documents you upload, and, where you are informed at the start of a call, audio or video recordings kept for quality and safety purposes.

We store all personal information securely in protected electronic systems with access controls, encryption in transit and at rest, audit logging and staff confidentiality obligations. We retain health records for the period required by law, which is generally at least seven years from the last entry, or until a patient turns 25 if they were under 18 at the time.

10. How can you access and correct your personal information?

You have the right to request access to, and correction of, your personal information.

To request a copy of your records, please email us at privacy@doccio.com.au. We will verify your identity and respond within a reasonable period (usually within 30 days). We do not charge a fee for reasonable access requests.

We will take reasonable steps to correct your personal information where it is not accurate or up to date. From time to time we may ask you to confirm that the details we hold are current. You may also ask us to correct or update your information at any time by emailing privacy@doccio.com.au.

11. How can you lodge a privacy complaint, and how will it be handled?

We take privacy complaints and concerns seriously. If you are concerned that we have not complied with your legal rights or applicable privacy laws, you may lodge a complaint through our internal process or make a formal complaint to the Office of the Australian Information Commissioner (OAIC), the regulator responsible for privacy in Australia.

Step 1: Tell us in writing

Send your complaint to our Privacy Officer at privacy@doccio.com.au.

Step 2: Investigation

Your complaint will be investigated by our Privacy Officer and a written response provided within a reasonable period (usually within 30 days). If we can resolve the matter together, or are in the process of doing so, the complaint need go no further. If we agree there is no immediate resolution, you may take the complaint to the OAIC.

Step 3: Contact the OAIC

If you remain dissatisfied, you can contact the OAIC at www.oaic.gov.au or on 1300 363 992. The OAIC will generally ask that you give us time to respond before they investigate.

12. Privacy and our website

When you interact with our website, social media or email, we may collect additional information, including:

• Website analytics: with your consent, we use analytics tools to understand how visitors use our site so we can improve it. Data may include your IP address, browser type, pages visited and time on site. Analytics never receives your health information.
• Cookies: our website uses strictly necessary cookies to run, and optional analytics cookies only if you accept them. See our Cookie policy for the full list and how to change your choice.
• Social media: if you interact with us on social platforms, we may collect information from your profile, such as your name and any other information you choose to share.
• Email: when you email us, we collect your email address and the information in your message.

13. Policy review and updates

This policy is reviewed regularly, and at least every 12 months, to ensure it reflects our practices and any changes in the law. We may update it from time to time; the current version will always be published on this page, and we will notify patients of material changes by email or a notice on our website.

14. Contact us

Any questions, requests or complaints in relation to this policy should be sent to our Privacy Officer:

ClinicLane Pty Ltd (trading as Doccio)
Privacy Officer: privacy@doccio.com.au
General enquiries: hello@doccio.com.au
New South Wales, Australia 2000

We will endeavour to respond to all correspondence promptly.