PRIVACY POLICY

We recognise that your privacy is very important to you and we are committed to protecting your personal information in accordance with the Australian Privacy Principles under the Privacy Act 1988 (Cth) and in accordance with other applicable privacy laws. This Policy applies to personal information we collect and handle about individuals including patients who visit our clinics, visitors to our websites, users of services we may from time to time provide and members of the public. It provides information about the personal information we collect and the ways in which we use and disclose that personal information, our policies for managing personal information as well as how you can access and seek correction of it.

Please read this Policy carefully. Your use of any part of our websites or services will constitute your consent to the collection, use, transfer, processing, storage, disclosure and other uses of your personal information in accordance with the Policy. If you do not agree with the terms and conditions of this Policy, please do not use our websites and services.

About MedCentres
MedCentres is an owner and operator of high-quality general practice medical clinics on the Gold Coast.
Everything we do at MedCentres aims to make your appointments with your GP a more positive experience.

GPs consulting from our clinics are committed to providing you with personalised healthcare and offer comprehensive health services for your whole family.

What information does MedCentres collect about you?

Patients and prospective patients
When you become a patient of MedCentres, a record is made which includes personal information such as your name, address, date of birth, contact details and emergency contact details. Personal information collected about you to provide, or in providing, healthcare services is considered health information and is treated as sensitive information. MedCentres may also collect other personal information about you which is considered sensitive information (such as information about your racial / ethnic origin) where this is relevant to the services we provide or to the services a GP provides to you.

Generally, health information we collect about you includes:
• your previous and current medical history (including, where clinically relevant, a family medical history) and details of treatment and health services you have received;
• medical practitioner consultation notes;
• medications you take;
• information about other healthcare professionals and health service providers who are involved in your care;
• information about your healthcare preferences and wishes;
• family contact information; and
• your attorney, guardian or other person responsible for your healthcare decisions.

MedCentres may also collect information relevant to administering your payment arrangements such as your banking details, your pension entitlements and any other relevant information. Where it is relevant to administering your payment arrangements, we will collect information such as your Medicare number, private health care provider, Department of Veterans' Affairs (DVA), pension, student or health care card number and your entitlement to benefits. Where we have collected a government related identifier (such as your Medicare number), we will not adopt that identifier as our own identifier and we will only use or disclose that identifier as required or permitted by law.

Your health information will be stored in a “patient health record” which is stored securely in our practice management system. The patient health record is a collection of your health information that is essential for your present and future care. Your patient health record contains sufficient information to identify you, as well as information relevant to your treatment including, for example:
• your medical history;
• any orders and results of any physical examinations or tests;
• information relating to allergies; and
• any other factors that may need special consideration.

MedCentres, and GP consulting from our clinics, do not conduct recorded telehealth (audio or visual) consultations. In the unlikely event your GP would like to record a consultation, the Doctor will obtain your consent before doing so.

How do we collect your personal information?

MedCentres will, where practicable, collect information from you when:
• you register as a patient of a GP consulting from our practice and complete and submit documentation;
• you communicate with us via email, telephone, SMS, our websites or social media or make an online appointment;
• you interact with our websites;
• you communicate with staff or representatives during the course of us providing services to you (including information collected through electronic transfer of prescriptions (eTP) and
• you otherwise deal with us in the course of our business.

However, we may also need to collect information from other sources such as GPs, treating specialists, radiologists, pathologists, hospitals, other health care providers, and the MedCentres record system and other third parties including:
• other healthcare professionals and health service providers involved in your care;
• government agencies responsible for administering relevant entitlements and benefits (such as Centrelink, Medicare, Department of Social Services, National Disability Insurance Agency, Department of Veterans Affairs, and other government agencies responsible for home care services); and
• credit reporting agencies.

We may also collect information about you from your family members, a carer, an attorney, a guardian or a person responsible for your healthcare decisions. If the personal information you provide to us is incomplete or inaccurate, we may be unable to provide you with the services you are seeking.

Prospective employees/applicants

We collect personal information when recruiting personnel, such as your name, contact details, qualifications and work history. Generally, we will collect this information directly from you. We may also collect personal information from third parties in ways which you would expect (for example, from recruitment agencies or referees you have nominated). Before offering you a position, we may collect additional details such as your tax file number, superannuation information and other information necessary to conduct pre-employment checks.
This Policy does not apply to MedCentres’ employee records.

Other individuals

MedCentres may collect personal information about other individuals who are not patients of a GP consulting from one of our clinics. This includes
• people who engage MedCentres to provide services to them (including GPs);
• individual service providers and contractors to MedCentres;
• other individuals who interact with MedCentres on a commercial basis;
• healthcare professionals who have referred patients to us or who are providing services to our patients; and
• visitors to our websites.

The kind of personal information we collect will depend on the capacity in which you are dealing with MedCentres. Generally, it would include your name, contact details, professional details and information regarding our interactions and transactions with you.

How does MedCentres hold and protect your personal information?

MedCentres primarily collects and holds your personal information in electronic form / paper / visual records (x-rays, CT scans, videos and photos) and audio recording. Information held in electronic form is held securely on servers and computer systems. Certain information is collected and held in paper-based documents (such as administrative forms), which may be converted to electronic form and the original paper-based documents securely destroyed. Information which is retained in paper-based, visual and audio form is held securely at our premises or in archive facilities in Australia.

We maintain physical security over our paper, visual, audio and electronic data stores, such as locks and security systems onsite and offsite. We also maintain computer and network security; for example, we use firewalls (security measures for the Internet) and other security systems such as user identifiers and passwords to control access to our computer systems.

Confidentiality obligations are included in our employment contracts for our staff members and agreements with our contractors.

We take reasonable steps to:
• ensure that personal information we collect is accurate, up-to-date, complete and relevant, other than where it is only collected to provide advice in respect of a particular point in time, in which case we will seek to ensure it is accurate, complete and relevant as at that particular point in time;
• ensure that personal information we use or disclose is accurate, up-to-date, complete and relevant, having regard to the purposes for which personal information is used or disclosed;
• protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure; and
• destroy or de-identify personal information which we no longer need for the purposes for which it was collected, except where it is necessary under law or to retain it in order to maintain ongoing medical records for patients of our GPs.

We cannot ensure the security of personal information which is left with you in your home or transmitted via the internet. However, we will work with you to minimise the opportunity for other individuals to access your personal information.

MedCentres sometimes uses document automation technology which streamlines the process for a doctor to prepare certain documents (eg, referral letters). The templates created that use that technology are regularly reviewed to ensure only relevant personal information and health information is included and released to a third party (e.g., specialists, pathology providers, etc.).

Why does MedCentres collect, hold and use your personal information?

MedCentres collects personal information about patients in order to assess and manage your needs when we are providing our services to you. We also collect your personal information to enable your GP to provide health care, treatment and associated services to you. For example, we collect information about your health to ensure that our services respond to your healthcare needs; to ensure that our services are consistent with other healthcare services you receive; and to minimise the need for you to provide the same information on multiple occasions.

Further information about the way in which MedCentres uses and discloses your personal information is set out in the next section.

Providing accurate and complete information is important for the safety, quality and effectiveness of the services we provide. It is also important to ensure you receive the correct entitlements to benefits and funding for the services we provide. If you provide incomplete or inaccurate information, we may not be able to provide you with the services and treatment you seek. If you have any concerns about personal information we have asked you to provide, please let us know.

When you check in at your appointments, we may ask you to identify yourself using your name, email, address and/or date of birth. This is required to ensure we have your correct file as some patients share the same names and birthdays.

You have the option of not identifying yourself, or using a pseudonym, when dealing with MedCentres (for example, when making a general enquiry). However, it is usually not practicable for MedCentres to deal with you anonymously or pseudonymously on an ongoing basis (for example, as a patient of a GP consulting from a MedCentres clinic).

How does MedCentres use and disclose your personal information?

We use and disclose personal information about you so that we can perform our business activities and functions and to provide the best possible quality of service to you. We use and disclose your personal information for the following purposes:
• to provide you with requested services (including contacting you regarding appointments, issue reminders or arrange referrals);
• to provide medical services and treatment to you, and to enable you to be attended by medical practitioners or other allied health professionals at our clinics; and
• assist medical practitioners at our clinics to provide you with appropriate health care, treatment and services.

There are circumstances where we may be permitted or required by law to disclose your personal information to third parties. For example, to Medicare, Police, insurers, solicitors, government regulatory bodies, tribunals, courts of law, hospitals, debt collection agents, the electronic transfer of prescriptions service or to the MedCentres record system.

It may also be shared with other healthcare professionals involved in your care and other persons involved in your care.

Generally, this will only happen in ways you would reasonably expect or otherwise with your consent. For example, MedCentres may disclose your personal information to your GP or to a medical specialist involved in your care; to a hospital or aged care facility if you are referred for respite or higher levels of care; or to other healthcare professionals who are involved in your care such as nurses, occupational therapists, pharmacists, physiotherapists, podiatrists, dentists and the ambulance service.

In certain situations, and as permitted by law, we may provide collect, use or disclose personal information without your consent. These situations include:
• lessening or preventing a serious threat to the life, health or safety of an individual, or to public health and safety;
• taking appropriate action in relation to suspected unlawful activity or serious misconduct;
• assisting in locating a missing person;
• establishing, exercising or defending an equitable claim;
• for the purpose of a confidential dispute resolution process;
• when there is a statutory requirement to do so; or
• during the course of providing medical services through electronic transfer of prescriptions.

Contractors and other service providers

MedCentres sometimes engages third parties to perform services on our behalf and we may use and disclose personal information to facilitate these arrangements. This may include specialist care services, allied health services, and general domestic and personal care services. We may also contract other organisations to perform services on our behalf, for example, to undertake customer satisfaction surveys, IT and practice supplier services.
Third parties to whom we have disclosed your personal information may contact you directly to let you know they have collected your personal information and to give you information about their privacy policies.

Administration and management

MedCentres will also use and disclose your personal information in the ordinary course of our business including for a range of administrative, management and operational purposes.
This includes:
• administering billing, payments and debt recovery;
• liaising with, and reporting to, government agencies in the administration of particular funding programs;
• disclosure of certain de-identified personal information to local primary health networks (PHNs) for the purpose of quality improvement;
• administering subsidies and benefits to which you may be entitled from government agencies and other third-party payers (such as Centrelink, Medicare, Department of Social Services, Department of Veterans Affairs, and other government agencies responsible for primary care services);
• planning, managing, measuring and monitoring and evaluating our services;
• safety and quality assurance and improvement activities;
• statistical analysis and reporting;
• training staff, contractors and other workers;
• risk management and management of legal liabilities and claims (for example, liaising with insurers and legal representatives);
• meeting our obligations of notification to our medical defence organisations or insurers;
• responding to your enquiries and complaints;
• updating our records and keeping your contact details up to date;
• obtaining advice from consultants and other professional advisers;
• responding to subpoenas and other legal orders and obligations; And
• otherwise complying with applicable laws.

Does MedCentres use or disclose your personal information for direct marketing?

If you are a patient of a GP consulting from a MedCentres clinic, we require your updated contact details as a safety measure for important appointment reminders and recalls. No private healthcare information regarding your individual circumstances or test results will be disclosed in these communications.

From time to time, we may also contact you regarding important healthcare news and announcements, or to notify you of changes at your clinic, such as opening hours, or doctors and healthcare services. This is only done with your consent. If you do not want to receive direct marketing communications or wish to change your preferences, please contact your local clinic directly.

MedCentres does not provide your personal information to other organisations for their direct marketing.

Does MedCentres disclose your personal information overseas?

MedCentres does not typically or routinely disclose personal information to overseas recipients.
Unless we have your consent, or an exception under the Australian Privacy Principles applies, we will only disclose your personal information to overseas recipients where we have taken reasonable steps to ensure that the overseas recipient does not breach the Australian Privacy Principles in relation to your personal information.

How can you access or seek correction of your personal information?

Generally, if you would like further information about the care or services you have received from MedCentres, you may ask your doctor or call our reception team. Please do not use our websites or social media pages to request personal information or seek changes to your personal information. However, you have the right to request access to personal information MedCentres holds about you at any time.
To request access to your personal information, please contact your local clinic directly.
There are no charges for requesting access (or correction) of your personal information except where the volume of information we hold is excessively large when we may charge a reasonable administration fee (including fees for photocopying).

Where the person requesting access is an authorised representative of the person about whom the information relates (such as an attorney or guardian), we will ask the representative to provide evidence of their authority (such as a copy of an Enduring Power of Attorney) where we do not already hold that information.
In certain circumstances, your request to access your personal information may be declined in accordance with privacy laws (for example, where giving access would put you or another person at risk of harm).
MedCentres will respond to your request to access within a reasonable period however, prior to disclosing any such information it will be necessary for you to satisfactorily verify your identify. If we decline your request for access, we will tell you the reasons for declining your request and inform you of your right to make a complaint. We may recover reasonable charges to provide you with access.
There are exceptional circumstances where access to or correction of your personal information may be refused by us such as where access would be unlawful. We will advise you of such circumstances should a circumstance arise.

We take reasonable steps to ensure that your personal information is accurate, up-to-date and complete. You can help us do this by letting us know if you notice errors or discrepancies in information we hold about you and also letting us know if any of your personal details change.
If you consider personal information we hold about you is inaccurate, out-of-date, incomplete or irrelevant, you have a right to request we correct the information. It is sometimes not possible for us to make changes to personal information we hold about you (such as your healthcare records). In that circumstance, you may be entitled to request that we associate a statement with your information and you may have a right to make a complaint.

How long will MedCentres hold your personal information?

MedCentres will hold your personal information until it is no longer needed. Generally, if you are a patient, your personal information will be held for a minimum of 7 years from the date of last entry in your record (in the case of children, the record is kept until the patient attains or would have attained 25 years of age). This complies with MedCentres’s legal requirements to maintain such records.
You may request your medical records be transferred to an alternate GP. A fee may apply. Please contact your local clinic directly for details.
Information that is no longer needed, or required to be held by law, will be securely destroyed or de-identified.

How is your personal information handled on our websites?

You may visit our websites (such as www.medcentres.com.au) without identifying yourself. If you identify yourself (for example, by providing your contact details in an enquiry), any personal information you provide to MedCentres will be managed in accordance with this Policy.

MedCentres websites use cookies.
A ‘cookie’ is a small file stored on your computer’s browser, which assists in managing customised settings of the website and delivering content. We collect certain information such as your device type, browser type, IP address, pages you accessed on our website and on third-party websites. You are not identifiable from such information. MedCentres uses third-party services (such as Google Analytics) to undertake demographic analysis of visitors to our website. From time to time we may contact you for feedback and also for the purpose of reminding you of required appointments e.g. annual check-ups.
You may refuse to accept cookies by selecting the appropriate setting on your internet browser but if you do this you may not be able to use the full functionality of our websites.

Users of our websites and social media pages are encouraged against sending personal information via the internet.
For your convenience and to improve the usage of the websites and services we may insert links to third-party websites, applications or resources, for which this Policy does not apply.
MedCentres is not responsible for those third party websites, applications or resources. If you access such websites, applications or resources, you do so at your own risk and we make no representations or warranties regarding third parties’ privacy practices. We encourage you to read the privacy statements/policies of every website, application or resource you use.
When we do link to a third party website, application or resource, this does not automatically imply that MedCentres endorses that website, application, resource and their contents.
Our Policy does not cover the use of cookies by any third parties.

How can you make a complaint about the handling of your personal information?

You may contact MedCentres at any time if you have any questions or concerns about this Policy or about the way in which your personal information has been handled including the collection, use, disposal or destruction of your personal information. If you have a complaint about the privacy of your personal information (including complaints about our use of the MedCentres record system), we request that you contact us in writing.

We will first consider your complaint to determine whether there are simple or immediate steps which can be taken to resolve the complaint. We will generally respond to your complaint within 14 days. If your complaint requires more detailed consideration or investigation, we will acknowledge receipt of your complaint within a week and endeavour to complete our investigation into your complaint promptly.
We may ask you to provide further information about your complaint and the outcome you are seeking. We will then typically gather relevant facts, locate and review relevant documents and speak with individuals involved.

In most cases, we will investigate and respond to a complaint within 30 days. If the matter is more complex or our investigation may take longer, we will let you know.

If you are not satisfied with our response to your complaint, you are entitled to make a complaint to the Office of the Australian Information Commissioner. The Office of the Australian Information Commissioner can be contacted by telephone on 1300 363 992. Full contact details for the Office of the Australian Information Commissioner can be found online at www.oaic.gov.au.

How are changes to this Policy made?

This Policy may be reviewed or amended from time to time. The latest version will apply to your personal information held by us at that time. You can access the most up to date copy of this policy by visiting our website (www.medcentres.com.au).

How can you contact MedCentres?
The contact details for MedCentres are:
Mail and Street Address:
2A 8 Laver Drive, Robina, QLD, 4226
Email: manager@medcentres.com.au

Definitions:
In this document, the following terms have these meanings:
• MedCentres, we, us or our means MedCentres (PTY) Ltd and its related bodies corporate;
• GP means a general medical practitioner;
• personal information has the meaning given to it in the Privacy Act which, in general terms, means any information that can be used to identify you;
• Policy means this privacy policy as amended from time to time; and
• you or your means any individual about whom we collect personal information or anyone acting on their behalf or with their implied authority.

This Policy was last updated on 19th May 2025. Any information we hold about you will be governed by our current policy. We recommend that you periodically review this policy for any changes.