Mindora Health ABN 35 669 694 277 (“Mindora Health”, “we”, “us”, “our”) is committed to protecting your privacy and keeping your personal and health information safe. As a Nurse Practitioner-led mental health service, we handle sensitive health information, and we take that responsibility seriously.
This policy explains what information we collect, why we collect it, how we use and store it, who we may share it with, and how you can access or correct it. It applies to information collected through our website (mindorahealth.com.au), our online booking and intake forms, our telehealth and in-person consultations, and any other dealings you have with us.
We handle your information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and — because we are a health service based in New South Wales — the Health Records and Information Privacy Act 2002 (NSW) and its Health Privacy Principles (HPPs). We also follow the privacy and confidentiality obligations that apply to registered health practitioners under the Health Practitioner Regulation National Law and AHPRA.
What is personal and health information?
Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable — for example your name, date of birth, address, email and phone number.
Health information (also called sensitive information) is a special category of personal information that receives extra protection under the law. It includes information about your physical or mental health, your symptoms and diagnoses, the treatment or medications you receive, and other sensitive details such as your Aboriginal or Torres Strait Islander status. Because we are a mental health service, most of the information we collect is health information.
What information we collect
Depending on how you interact with us, we may collect:
Identity and contact details — first and last name, date of birth, gender, residential address, phone number and email address.
Health and clinical information — the reason you are seeking support and your primary mental health concerns; your mental health and medical history; current and past treatments, therapies and medications; allergies; diagnostic and assessment information; treatment plans; investigation and pathology results; and clinical notes made during your care. This is the information we need to assess, diagnose and treat you safely.
Medicare and billing information — your Medicare number and reference number, concession or health care card details where relevant, and the payment card details you provide to secure and pay for your appointment. Card payments are processed by our secure third-party payment provider; we do not store your full card number on our own systems.
Information for reports and letters — where you ask us to prepare an NDIS support letter or access request, a DCJ Housing medical assessment or support letter, or a Centrelink/Disability Support Pension letter, we collect and record the information needed to complete that document.
Information about your care team — your regular GP and any other treating practitioners, so we can coordinate your care with your consent.
Website and technical information — when you visit our website we may collect limited technical data such as your IP address, browser type, pages viewed and the date and time of your visit, through cookies and analytics tools (see Cookies and website analytics below).
We collect this information because it is reasonably necessary for us to provide you with safe, high-quality clinical care and to meet our legal and administrative obligations. If you choose not to provide certain information, we may not be able to assess or treat you appropriately, or to complete a report or claim on your behalf.
How we collect your information
Wherever possible, we collect personal and health information directly from you — through our online intake and booking form, during your consultations (in person or by telehealth), and in your communications with us by phone or email.
Sometimes we may collect information about you from others, for example from your GP or other treating practitioners (with your consent), from a referral letter, from a family member or carer where appropriate, or from Medicare or Services Australia in connection with a claim. We will only do this where it is reasonable and necessary for your care, or where the law permits or requires it.
Consent and sensitive information
Because health information is sensitive, we generally collect, use and disclose it with your consent. You provide consent when you complete our intake form and agree to receive care, and through the specific consents you give during your treatment — for example, consent to assign your Medicare benefit to us, or consent for us to share a report or your results with your GP.
You can withdraw your consent at any time by contacting us. Withdrawing consent may affect our ability to continue providing certain aspects of your care, and we will explain this to you if it applies.
How we use and share your information
We use your information to:
- assess, diagnose, plan and provide your mental health care;
- prescribe and manage your medications, and monitor your treatment;
- prepare reports, letters and forms you have asked us to complete (NDIS, DCJ, Centrelink and similar);
- process appointments, billing, and Medicare claims; and
- manage our practice, meet our legal and professional obligations, and improve our services.
We may disclose your information to:
- Your GP and other treating practitioners — to coordinate your care, with your consent.
- Third parties you have asked us to send reports or letters to — such as the NDIS/NDIA, DCJ Housing, or Services Australia/Centrelink — with your consent.
- Medicare / Services Australia — to process rebates and claims you have authorised.
- Pharmacies — to send your electronic prescriptions.
- Our service providers — including our practice management and clinical records software, our secure telehealth platform, our online booking provider, our payment processor, and our IT and hosting providers. These providers are only permitted to use your information to provide services to us, and are bound by confidentiality and privacy obligations.
- Others where required or authorised by law — for example where disclosure is necessary to lessen or prevent a serious threat to the life, health or safety of you or another person, to comply with a court order or subpoena, or to meet a mandatory reporting or regulatory obligation.
We do not sell your personal or health information, and we do not disclose it for any purpose unrelated to your care unless the law requires or permits it, or you have consented.
My Health Record
Where you have a My Health Record, we may — with your consent — access it to view relevant clinical information, and upload documents such as prescriptions or clinical summaries, in accordance with the My Health Records Act 2012 (Cth). You control what is in your My Health Record and can set your own access controls. [Confirm whether the clinic participates in My Health Record; remove this section if not.]
Direct marketing
We may occasionally contact you with appointment reminders, health information, or updates about our services. We keep any such communications relevant and minimal. You can opt out of non-essential communications at any time by contacting us or using the unsubscribe option in the message. Appointment reminders and communications that are part of your clinical care are not marketing and will continue while you are our client.
How we store and protect your information
We store your health records electronically in secure, access-controlled clinical software, and any paper records securely on our premises. We take reasonable steps to protect your information from misuse, interference, loss, and unauthorised access, modification or disclosure — including access controls, staff confidentiality obligations, secure logins, and encrypted connections for telehealth and data transfer.
If we ever experience a data breach that is likely to result in serious harm, we will respond in line with the Notifiable Data Breaches scheme under the Privacy Act 1988, including notifying affected individuals and the Office of the Australian Information Commissioner (OAIC) where required.
Storage location and overseas disclosure
We take reasonable steps to ensure your information is stored securely. Some of our service providers — for example cloud hosting, telehealth or software providers — may store or process data on servers located outside Australia, or may be owned by companies based overseas. Where this occurs, we take reasonable steps to ensure those providers handle your information consistently with Australian privacy law. [Confirm your providers and whether any store data overseas; if all data is stored onshore in Australia, state that here instead.]
How long we keep your information
We are required to keep health records for minimum periods set by law. In New South Wales, health information about an adult must generally be kept for at least 7 years from the date of the last occasion on which we provided a service to you. For a person who was under 18 when the record was made, the record must be kept until that person turns 25. After these periods, we securely destroy or de-identify records that are no longer required. [Confirm retention practice with the practitioner/legal adviser.]
Cookies and website analytics
Our website uses cookies and similar technologies to help the site function and to understand how visitors use it, so we can improve it. Cookies are small files stored on your device; most browsers let you disable or delete them, though some site features may not work as well if you do. We may use analytics tools (such as [Google Analytics / your chosen tool]) that collect de-identified information about site usage. Our website may contain links to third-party websites; we are not responsible for the privacy practices of those sites, and we encourage you to read their privacy policies.
Accessing and correcting your information
You have the right to ask for access to the personal and health information we hold about you, and to ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading. To make a request, contact us using the details below. We will respond within a reasonable time. There may be limited circumstances where we are unable to provide full access — for example where doing so would pose a serious threat to someone’s life, health or safety, or where the law allows us to refuse — and if so we will explain why and offer alternatives where possible. A reasonable fee may apply to cover the cost of retrieving and copying records. [Confirm whether an access fee applies.]
How to make a privacy complaint
If you have a concern about how we have handled your personal or health information, please contact us first — most issues can be resolved quickly and directly. Contact our Privacy Officer using the details below. We will acknowledge your complaint and aim to respond within [30] days.
If you are not satisfied with our response, you can contact:
- The Office of the Australian Information Commissioner (OAIC) — 1300 363 992, www.oaic.gov.au;
- The NSW Information and Privacy Commission (IPC) — 1800 472 679, www.ipc.nsw.gov.au, for matters under the NSW health privacy laws.
Changes to this policy
We may update this policy from time to time to reflect changes in our practices or in the law. The current version is always available on our website, and the “Last reviewed” date at the top shows when it was last updated.
Contact us
Privacy Officer — Mindora Health Phone: 0425 576 017 Email: [info@mindorahealth.com.au — confirm the correct address] Post: [registered postal / clinic address, Wollongong NSW POSTCODE] Website: mindorahealth.com.au/contact/
If you are in immediate danger, call 000. For 24-hour mental health support, Lifeline is on 13 11 14 and the NSW Mental Health Line on 1800 011 511.