Privacy Policy

About This Privacy Policy

Botanic Ridge Doctors (“the Practice”, “we”, “us” or “our”) is committed to protecting the privacy, confidentiality and security of personal information collected from our patients, visitors and website users.

This Privacy Policy explains how we collect, use, disclose, store and protect personal information, including health information, in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), and applicable healthcare privacy obligations.

This policy applies to all personal information collected by the Practice, including information collected during consultations, appointments, treatment, enquiries, website interactions and through third-party services used by the Practice.

Privacy Contact

If you have any questions regarding this Privacy Policy, wish to access or correct your personal information, or have a privacy concern, please contact:

The Practice Manager
Botanic Ridge Doctors
Email: info@botanicridgedoctors.com.au
Phone: (03) 5902 8223
Address: T17 & 18, 10 Hummingbird Dr
Botanic Ridge VIC 3977

Why and when your consent is necessary

When you register as a patient of our practice, you provide consent for our GPs and practice staff to access and use your personal information so they can provide you with the best possible healthcare. Only staff that need to see your personal information will have access to it. If we need to use your information for anything else, we will seek additional consent from you to do this.

Botanic Ridge Doctors recognises the importance of protecting the privacy and the rights of individuals and patients in relation to their personal information and health. This document is Botanic Ridge Doctors privacy policy and it tells you how we collect and manage your personal information.

Our Practice is governed by a number of state specific privacy laws. We respect your right to privacy and have a legal obligation to abide by the Privacy Act 1988. The rules and regulations under the Privacy Act are known as the Australian Privacy Principles or the APP.

What is a patient health record?

Medical records, whether electronic or not, are a collection of information about a patient’s healthcare that are essential for his or her present and future care (WHO 2001) and are covered by s.3 of the Health Records Act 2001 (AustLII 2012).

As such, the medical record must contain sufficient information to identify the patient to whom it relates, as well as information relevant to the patient’s treatment during current and future episodes of care, for example:

• The patient’s medical history
• The orders and results of any physical examination or tests
• Information relating to allergies
• Other factors that may need special consideration

Secure and guaranteed access to complete information collected in the medical record is essential to ensure that healthcare professionals have the right information available when and where they need it. This maximises the quality and efficiency of the treatments they can provide to their patients at the point of care.

What is personal information?

Your personal information is any information that we can use to personally identify you. This includes but is not limited to your name, date of birth, address, telephone number, email address and profession or occupation. If you are reasonably identified from the information collected by us, the information is considered personal information. Our privacy policy covers all patients and anyone who uses our services.

What is sensitive information?

Sensitive information is any information that is necessary for us to collect in regards to your healthcare. This information may include family, social or medical history, genetic information and emergency contact. In this policy both personal and sensitive information are referred to as “personal information”.

What Information Do We Collect?

The Practice collects personal information that is necessary to provide healthcare services, manage our operations and communicate with patients. The types of information we may collect include:

Personal Information

• Name, date of birth and contact details
• Address and emergency contact details
• Medicare details and healthcare identifiers
• Private health insurance information
• Billing and payment information
• Appointment details

Health Information

Health information is considered sensitive information under Australian privacy law. We may collect information including:

• Medical history
• Dental history and treatment records
• Current and previous medications
• Allergies and adverse reactions
• Diagnoses and treatment plans
• Clinical notes
• Pathology and imaging results
• Dental X-rays, scans, photographs and treatment records
• Specialist and healthcare provider correspondence

Clinical Images, Dental Records and Treatment Documentation

During the course of providing healthcare services, the Practice may collect clinical records including photographs, dental images, scans, X-rays, radiographs, treatment records and other documentation required for diagnosis, treatment planning, monitoring and ongoing care.

These records form part of your healthcare record and will only be used and disclosed for purposes relating to your healthcare, unless otherwise permitted by law or where additional consent has been obtained.

The Practice will not use identifiable patient photographs, treatment outcomes, testimonials or clinical images for marketing, education or promotional purposes without obtaining specific written consent from the patient.

Other Information

We may also collect information relating to:

• Website enquiries
• Feedback or complaints
• Communications with the Practice
• Information required to provide safe and appropriate healthcare services

How do we collect your personal information?

We collect your personal information directly from you unless it is unreasonable or impracticable to do so. When collecting personal information from you, we may collect it in ways including:

• By you completing one of our patient registration forms
• Disclosed by you during a consultation with your GP, one of our Registered Nurses or Allied Health Professionals

In some circumstances personal information may also be collected from other sources. Often this is because it is not practical or reasonable to collect it from you directly. This may include information from:

• Your guardian or responsible person
• Other involved healthcare providers, such as specialists, allied health professionals, hospitals, community health services and pathology and diagnostic imaging services
• Your health fund, Medicare, or the Department of Veterans’ Affairs (as necessary)

We may also collect your personal information when you telephone us or make an online appointment.

What happens if we can’t collect your personal information?

If you do not provide us with the personal information required:

• We may not be able to provide the requested services to you, either to the same standard or at all
• Your diagnosis and treatment may be inaccurate or incomplete
• There may be risks to your health outcome

Dealing with us anonymously

You have the right to deal with us anonymously or under a pseudonym unless it is impracticable for us to do so or unless we are required or authorised by law to only deal with identified individuals.

Why Do We Collect Personal Information?

The Practice collects, uses and stores personal information for purposes including:

• Providing medical and dental healthcare services
• Assessing, diagnosing and treating patients
• Maintaining accurate healthcare records
• Coordinating care with other healthcare providers
• Processing payments and managing billing
• Managing appointments and recalls
• Contacting patients regarding healthcare matters
• Meeting legal, regulatory and professional obligations
• Improving our services and patient experience
• Managing enquiries, feedback and complaints

We only collect information that is reasonably necessary for these purposes.

Telehealth Services

Where telehealth services are provided, personal and health information collected during the consultation will be recorded within your healthcare record.

The Practice will take reasonable steps to ensure telehealth consultations are conducted securely and confidentially.

Patients will be informed of any requirements relating to telehealth services and appropriate consent will be obtained where required.

How do we store and protect your personal information?

Your personal information is stored electronically. Our practice is considered paperless and has systems in place to protect the privacy, security, quality and integrity of the personal health information held electronically. Appropriate staff members are trained in computer security policies and procedures. All personal information including patient health records, visual records (X-rays, CT scans, videos and photos), and audio recordings are stored electronically.

Our practice ensures that our practice computers and servers comply with the RACGP computer security checklist and that:

• Computers are only accessible via individual password access to those in the practice team who have appropriate levels of authorisation
• Computers have screensavers or other automated privacy protection devices enabled to prevent unauthorised access
• Servers are backed up and checked at frequent intervals, consistent with a documented business continuity plan
• Back up information is stored in a secure off-site environment
• Computers are protected by antivirus software that is installed and updated regularly
• Computers connected to the internet are protected by appropriate hardware/software firewalls
• We have a business continuity plan that has been developed, tested and documented

All staff and contractors must sign confidentiality agreements prior to commencing work with our practice. It is most important that we have up to date personal information on your file. Please ensure that any changes to your personal information are updated promptly with our reception staff. Out of date or incorrect information could lead to adverse health outcomes.

When, why and with whom do we share your personal information?

Sometimes we are required to share your personal information:

• With third parties who work with our practice for business purposes, such as accreditation agencies or information technology providers — these third parties are required to comply with APPs and this policy
• With other healthcare providers
• When it is required or authorised by law (e.g. court subpoenas)
• When it is necessary to lessen or prevent a serious threat to a patient’s life, health or safety or public health or safety, or it is impractical to obtain the patient’s consent
• To assist in locating a missing person
• To establish, exercise or defend an equitable claim
• For the purpose of confidential dispute resolution process
• When there is a statutory requirement to share certain personal information (e.g. some diseases require mandatory notification)
• During the course of providing medical services, through eTP, My Health Record (e.g. via Shared Health Summary, Event Summary)

Only people who need to access your information will be able to do so. All referral templates, including those that utilise document automation technology, are regularly reviewed to ensure only relevant medical information is included and released to a third party. Other than in the course of providing medical services or as otherwise described in this policy, our practice will not share personal information with any third party without your consent.

Website Privacy and Online Data Collection

When you visit our website, we may collect information including:

• IP address
• Browser type
• Device information
• Website interactions
• Pages visited
• Date and time of access

This information may be collected through cookies, analytics tools and other website technologies. We use this information to:

• Improve website performance
• Understand website usage
• Improve patient experience
• Monitor website security
• Support online services

Where you submit information through website forms, online booking requests or enquiries, we collect this information to respond to your request and provide healthcare services.

Marketing and Health Communications

The Practice may contact patients with information relating to their healthcare, including:

• Appointment reminders
• Health assessments and recalls
• Preventative health reminders
• Treatment follow-ups
• Health education information
• Service updates relating to your care

Where permitted by law, we may also send information about Practice services, promotions, events or updates that may be relevant to you.

You may choose not to receive marketing communications from us at any time by contacting the Practice or using the unsubscribe option included in electronic communications.

Choosing not to receive marketing communications will not prevent the Practice from contacting you regarding your healthcare, appointments, treatment, recalls, billing or other matters directly relating to your care.

How can you access and correct your personal information at our practice?

You have the right to request access to, and correction of, your personal information. Our practice acknowledges patients may request access to their medical records. We require you to put this request in writing to: Office Manager, Botanic Ridge Doctors.

Our practice will respond to your request for access within 30 days. There may be a fee for access to information; this fee covers any administrative costs associated with access.

There may be instances where we cannot grant you access to the personal information we hold; however, we will only do so in accordance with our rights and obligations under the Act. For example, we may need to refuse access if granting access would interfere with the privacy of others or if it would result in a breach of confidentiality. If that happens, we will give you written reasons for any refusal.

Our practice will take reasonable steps to correct your personal information where the information is not accurate or up to date. From time to time, we will ask you to verify that your personal information held by our practice is correct and current. You may also request that we correct or update your information; such requests should be made in writing to: The Office Manager, Botanic Ridge Doctors.

Our practice will respond to your request within 30 days.

How can you lodge a privacy-related complaint, and how will it be handled?

We take complaints and concerns regarding privacy seriously. You should express any privacy concerns you may have in writing. We will then attempt to resolve it in accordance with our resolution procedure. Such requests should be made in writing and addressed to: Office Manager, Botanic Ridge Doctors.

Our practice will respond to your request within 30 days. You may also contact the OAIC. Generally, the OAIC will require you to give them time to respond before they will investigate. For further information visit www.oaic.gov.au or call the OAIC on 1300 363 992.

If you believe that your privacy has been breached, please contact us in accordance with the arrangements set out below and provide details of the incident so that we can investigate it.

Data Breaches

The Practice takes reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification or disclosure.

If we become aware of a privacy breach involving personal information, we will assess and manage the incident in accordance with the Notifiable Data Breaches Scheme under the Privacy Act 1988 (Cth).

Where a breach is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by law.

Disclosure of Personal Information

The Practice may disclose personal information where required or permitted by law, or where necessary to provide healthcare services. This may include disclosure to:

• Healthcare providers involved in your care, including specialists, allied health professionals, dentists and other practitioners
• Pathology providers and diagnostic imaging providers
• Hospitals and healthcare facilities
• Medicare and private health insurers where required for billing purposes
• Government agencies where required by law
• Third-party service providers supporting Practice operations

The Practice only discloses information necessary for the relevant purpose and takes reasonable steps to ensure third-party providers handle personal information appropriately.

Third-Party Service Providers

The Practice uses third-party providers to support healthcare delivery, administration and business operations. These providers may include:

• Practice management systems
• Appointment booking platforms
• Patient communication systems
• Payment providers
• Website hosting providers
• Information technology providers
• Cloud storage providers
• Digital communication platforms

Where third-party providers handle personal information on behalf of the Practice, we take reasonable steps to ensure they manage information securely and appropriately.

Some providers may store or process information outside Australia. Where this occurs, the Practice takes reasonable steps to ensure appropriate privacy protections are maintained.

Security

We take all reasonable steps to ensure your personal information is protected from misuse and loss and from unauthorised access, modification or disclosure. We hold your information electronically. Personal information is destroyed or de-identified when no longer needed.

Contacting us

If you have any questions about this privacy policy, any concerns or a complaint regarding the treatment of your privacy or a possible breach of your privacy, please contact Botanic Ridge Doctors, in writing at the details below.

We will treat your requests or complaints confidentially. We will aim to ensure that your concern is resolved in a timely and appropriate manner.

The Office Manager
Botanic Ridge Doctors

Privacy Policy Updates

The Practice may update this Privacy Policy from time to time to reflect changes in legislation, technology, healthcare services or operational practices.

The current version of this Privacy Policy will always be available on our website.

Policy Version: 2.0
Effective Date: 1/11/2021
Last Reviewed: 20/07/2026