Privacy and Health Information Policy
Privacy is fundamental to quality healthcare
At Kotara Specialist Suites (“the Practice”), we recognise that patients entrust us with some of their most sensitive personal information. Protecting that information is fundamental to the safe, respectful and effective delivery of healthcare.The Practice is committed to maintaining the confidentiality, integrity and security of all personal and health information entrusted to us. We collect only the information reasonably necessary to provide high-quality healthcare, operate the Practice efficiently and comply with our legal and professional obligations. Privacy is not simply a legal requirement; it is an essential component of the relationship of trust between patients and their healthcare practitioners.To support this commitment, the Practice:complies with applicable Australian privacy and health records legislation, maintains secure clinical and administrative information systems, regularly reviews its privacy, cybersecurity and information governance practices, carefully assesses new technologies before they are introduced into clinical practice; prefers Australian-hosted technology providers wherever reasonably practicable, and uses artificial intelligence only to assist healthcare practitioners and not to replace professional clinical judgement. Every person working within the Practice, including employees, contractors and participating medical practitioners, shares responsibility for protecting patient information.
Purpose of this Policy
This Privacy Policy explains how the Practice collects, uses, stores, protects and discloses personal information. It also explains the rights patients have regarding their personal information, how information may be shared within the Practice, how modern technologies, including artificial intelligence, are used, how patients may access or correct their information; and how privacy concerns or complaints may be raised. The Practice aims to present this information in clear, easy to read form, so that patients understand how their information is managed.
Legislative Framework
The Practice manages personal information in accordance with applicable Australian legislation, including:Privacy Act 1988 (Cth); Australian Privacy Principles; Privacy and Other Legislation Amendment Act 2024 (including the automated decision-making transparency requirements commencing 10 December 2026); Health Records and Information Privacy Act 2002 (NSW); Health Privacy Principles (NSW); applicable Medicare legislation; and other Commonwealth and State legislation relating to health records and confidentiality.Where legislative requirements change, this Policy will be reviewed and updated accordingly.
About Kotara Specialist Suites
Kotara Specialist Suites is operated by The Endocrine Centre Pty Ltd (ABN 65 689 903 658). The Practice provides consulting facilities, reception services, administrative support, information technology, electronic health records, clinical software, approved AI-assisted clinical documentation systems and related practice infrastructure for specialist medical practitioners.The Practice is committed to maintaining an environment that supports safe, coordinated and high-quality patient care while protecting the privacy and security of personal information.
Independent Medical Practitioners
The medical practitioners consulting from the Practice are independent practitioners. Each practitioner provides healthcare services in their own professional capacity; practises using their own Medicare provider number; is not an employee of the Practice; is not a partner of the Practice; and remains independently responsible for their professional, ethical and clinical obligations. Although practitioners operate independently, they utilise the Practice’s shared clinical infrastructure, including electronic health record systems, reception services and approved information technology systems.This model enables coordinated patient care while maintaining each practitioner’s professional independence.
Responsibilities of the Practice
The Practice is responsible for managing the shared administrative and technology infrastructure used by participating practitioners.This includes, where applicable reception services, appointment management, patient communications, electronic health record infrastructure, clinical software administration, approved AI-assisted clinical documentation systems, cybersecurity, information technology, secure data storage; backups, audit logging, access controls, privacy governance, and responding to privacy enquiries relating to Practice-managed systems. The Practice continually reviews these systems to ensure they remain secure, appropriate and consistent with Australian privacy legislation.
Responsibilities of Participating Practitioners
Each participating practitioner remains responsible for collecting clinical information, determining what information is recorded; reviewing and approving clinical records, diagnoses, treatment decisions, referrals, prescribing, obtaining informed consent where required, professional confidentiality, and compliance with their professional regulatory obligations. Nothing in this Privacy Policy alters or limits a practitioner’s professional responsibilities to their patients.
Shared Electronic Health Records
The Practice provides and administers a shared electronic health record (“EHR”) environment using MedicalDirector Clinical and Bluechip.The shared EHR enables authorised practitioners and Practice staff to support the delivery of safe and coordinated healthcare.The Practice is responsible for:maintaining the security of the shared systems;user account administration;access controls;audit logging;backups;software maintenance; andinformation governance.Participating practitioners remain responsible for the clinical content they create within the system.Access to patient records is restricted according to each person’s clinical or administrative responsibilities.The existence of a shared electronic record does not permit unrestricted access to patient information. Information may only be accessed where reasonably necessary for patient care, Practice administration or another purpose authorised by law.
Our Technology Principles
The Practice recognises that modern healthcare depends upon secure and reliable technology. Technology should enhance patient care, not compromise privacy. Before implementing new technology, the Practice considers patient privacy, cybersecurity, Australian data residency, legal compliance, clinical governance, information security, reliability, vendor reputation, interoperability with existing clinical systems; andthe impact on patient care.The Practice prefers technology providers that support Australian data residency for patient information wherever reasonably practicable.
Artificial Intelligence
The Practice recognises that artificial intelligence has the potential to improve healthcare by reducing administrative workload and allowing practitioners to spend more time with patients. Artificial intelligence is used only where it supports safe clinical practice. The Practice’s principles are that AI should assist healthcare practitioners, never replace professional clinical judgement, operate transparently, respect patient privacy, protect confidential information, comply with Australian privacy legislation, and be subject to ongoing governance and review. The Practice does not permit AI systems to make independent clinical decisions on behalf of practitioners. All diagnoses, treatment recommendations, prescribing decisions and clinical judgments remain the responsibility of the treating practitioner.
Continuous Review
Healthcare technology continues to evolve rapidly. The Practice periodically reviews its technology providers, privacy safeguards, cybersecurity controls and governance processes to ensure they remain appropriate. Where significant technological or legislative changes occur, this Privacy Policy will be updated to reflect those changes.
Definitions
Unless the context indicates otherwise:
Personal Information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information is true or not and whether it is recorded in a material form or not.
Health Information has the meaning given by the Privacy Act 1988 (Cth) and the Health Records and Information Privacy Act 2002 (NSW). It includes information about an individual’s physical or mental health, medical history, treatment, diagnosis, medications, pathology, imaging, genetic information and other information collected while providing healthcare.Health information is recognised under Australian privacy law as particularly sensitive information and receives additional legal protection.
Practitioner means an independent medical practitioner consulting from Kotara Specialist Suites.
Practice means Kotara Specialist Suites, operated by The Endocrine Centre Pty Ltd (ABN 65 689 903 658).
Electronic Health Record (EHR) means the Practice’s electronic clinical record systems, including MedicalDirector Clinical, Bluechip and associated clinical software used to support patient care.
AI-assisted Clinical Documentation System means the Practice’s approved artificial intelligence platform used to assist practitioners in preparing clinical documentation. At the date of this Policy, the Practice’s approved provider is Heidi Health.
Patient includes current, former and prospective patients.
We, our and us refer to the Practice and, where appropriate to the particular activity being described, the participating practitioner.
Information We Collect
The Practice collects only the information reasonably necessary to provide safe, effective healthcare, administer the Practice and comply with legal, professional and regulatory obligations.The information collected will vary depending on the healthcare services provided. Information collected may include:
Identification Information
Full name; preferred name, date of birth, gender, residential and postal addresses, email address, telephone numbers, emergency contact details.
Government Identifiers
Where relevant, we may collect - Medicare number, Individual Healthcare Identifier (IHI), Department of Veterans’ Affairs details, private health insurance information, workers compensation or compulsory third-party insurance details, other identifiers required to administer healthcare. These identifiers are collected only where authorised or required by law or reasonably necessary to provide healthcare.
Health Information
Health information may include, medical history, family history, allergies, medications, immunisations, previous illnesses, previous surgery, pathology and imaging results, referral letters, specialist correspondence, consultation notes, diagnoses, treatment plans, prescriptions, progress notes, clinical photographs, measurements and observations, risk factors relevant to healthcare.This information allows practitioners to provide safe and appropriate medical care.
Administrative Information
We may also collect information necessary to administer the Practice, including:appointment history, attendance records, billing information, payment history, Medicare claiming information, private health insurance claims, correspondence, consent forms, complaint records, access requests, privacy enquiries.
Technical Information
When patients interact with the Practice electronically, additional information may be collected, including IP address, browser type, operating system, device information, website usage information, cookies, website analytics. Further information is provided in the Website Privacy section of this Policy.
What this means for you
We collect only the information reasonably necessary to provide your healthcare, operate the Practice and meet our legal obligations. We do not collect information that is unrelated to your care or the operation of the Practice.
How We Collect Information
Most personal information is collected directly from patients.Information may be collected through consultations, telephone calls, telehealth consultations, appointment bookings, online appointment requests, website contact forms, email correspondence, SMS communications, written forms, consent forms, Medicare claims;, payment transactions and AI-assisted clinical documentation used during consultations. Where appropriate, information may also be collected from another person authorised to act on the patient’s behalf, including: parents, legal guardians; substitute decision-makers, carers, attorneys, executors and authorised representatives. Information may also be received from other healthcare providers including general practitioners, specialists, hospitals, pathology providers, imaging providers, pharmacists, allied health practitioners. This information assists practitioners to provide safe, coordinated healthcare.
AI-assisted Clinical Documentation
Where a practitioner uses the Practice’s approved AI-assisted clinical documentation system, information spoken during the consultation may be processed to produce a written transcript and draft clinical documentation.Further information regarding the use of AI is contained in Part 10 of this Policy.
Information Collected Automatically
Certain technical information may be collected automatically when patients visit the Practice’s website.This includes information generated through cookies, website analytics and security monitoring.No information collected through website analytics is linked to a patient’s clinical record.
What this means for you
Most information comes directly from you or from other healthcare providers involved in your care. We also collect limited technical information when you use our website to improve its performance and security.
Why We Collect and Use Personal Information
The Practice collects and uses personal information to support the delivery of safe, high-quality healthcare and to operate the Practice efficiently.Personal information may be used for the following purposes.
Providing Healthcare
The primary purpose for collecting personal information is to enable practitioners to provide healthcare.This includes:assessing health conditions;making diagnoses;developing treatment plans;prescribing medicines;requesting investigations;reviewing results;monitoring progress;coordinating care;maintaining accurate clinical records.
Practice Administration
Personal information is also used to:manage appointments;communicate with patients;issue reminders;process payments;manage accounts;respond to enquiries;manage complaints;maintain business records;improve Practice operations.
Communication with Other Healthcare Providers
Where appropriate, information may be shared with healthcare providers involved in a patient’s care, including:general practitioners;specialists;hospitals;pathology providers;radiology providers;pharmacists;allied health practitioners.Information is shared only where reasonably necessary for the patient’s healthcare or otherwise authorised by law.
Legal and Regulatory Requirements
Information may be used or disclosed where required or authorised by law, including:Medicare and Department of Health requirements;mandatory disease notification;court orders;subpoenas;law enforcement requests where legally authorised;professional regulatory requirements;accreditation activities.
Quality Improvement
The Practice may use de-identified information for:clinical audit;quality assurance;accreditation;risk management;staff education;service improvement.Wherever reasonably practicable, information used for these purposes is de-identified.
Research
The Practice does not ordinarily use identifiable patient information for research without appropriate approval and consent, unless otherwise authorised by law.
What this means for you
Your information is used primarily to provide your healthcare. It may also be used to operate the Practice, meet legal obligations and improve the quality and safety of our services. Wherever possible, information used for quality improvement is de-identified.
Disclosure of Personal Information
The Practice treats all personal information as confidential and will only use or disclose it where reasonably necessary to provide healthcare, operate the Practice or where otherwise required or authorised by law.Personal information is not sold, rented or disclosed for unrelated commercial purposes.
Disclosure for Healthcare
To support safe and coordinated healthcare, the Practice may disclose relevant personal information to healthcare providers involved in your care, including:your general practitioner;medical specialists;hospitals;pathology providers;diagnostic imaging providers;pharmacists;allied health practitioners;community healthcare providers;other healthcare practitioners involved in your treatment.Only information reasonably necessary for your care will be disclosed.
Disclosure for Practice Operations
The Practice may disclose personal information to carefully selected service providers that assist us to operate the Practice.These may include providers of:electronic health records;clinical software;secure cloud hosting;information technology support;cybersecurity services;AI-assisted clinical documentation;telephone systems;appointment reminder services;payment processing;Medicare claiming;accreditation services;secure destruction of records.These providers are engaged only where reasonably necessary to support the Practice and are expected to comply with strict confidentiality, privacy and security obligations.
Disclosure Required by Law
The Practice may disclose information where required or authorised by law, including:mandatory public health notifications;Medicare compliance;subpoenas;court orders;law enforcement requests;professional regulatory investigations;other legal obligations.Where appropriate and lawful, patients will be informed before information is disclosed.
Overseas Disclosure
The Practice seeks, wherever reasonably practicable, to avoid transferring identifiable patient information outside Australia.However, limited overseas processing may occur where required for:operation of the Practice website;technical support;disaster recovery;cybersecurity monitoring;cloud infrastructure;technology providers whose infrastructure changes over time.Where overseas disclosure occurs, the Practice will take reasonable steps to ensure that information is protected by contractual obligations or privacy protections substantially equivalent to Australian privacy law.
What this means for you
Your information is shared only where necessary for your healthcare, to operate the Practice or where required by law. We do not sell your information or disclose it for unrelated commercial purposes.
Artificial Intelligence (AI)-Assisted Clinical Documentation
The Practice is committed to adopting technology that improves patient care while protecting privacy.The Practice currently uses Heidi Health as its approved AI-assisted clinical documentation provider.The approved AI-assisted clinical documentation system assists participating practitioners by preparing draft consultation notes, referral letters and other clinical correspondence.The system is designed to reduce administrative workload and allow practitioners to spend more time focusing on patient care.AI is used only as a documentation tool.It is not used to replace professional clinical judgement.
How the System Works
During a consultation, the system listens to the conversation between the practitioner and the patient.As the consultation proceeds, spoken words are transcribed into text in real time.The transcript is then used to prepare draft clinical documentation for review by the treating practitioner.
Audio Recordings
The Practice understands that patients may have concerns about recordings of consultations. Accordingly, consultation audio is processed only to generate a written transcript; audio recordings are not retained or stored; there are no hidden recordings available for later playback; only the written transcript and resulting draft documentation are retained within the approved system.
Practitioner Review
Every AI-generated document is reviewed by the treating practitioner before it becomes part of the patient’s medical record.The practitioner may:edit;amend;expand;shorten; orcompletely replacethe AI-generated draft.The practitioner remains entirely responsible for:the accuracy of the medical record;diagnoses;treatment recommendations;prescribing;referrals;all clinical decisions.The AI system does not make clinical decisions.
Patient Choice
Patients may decline the use of AI-assisted clinical documentation.Where this occurs, the practitioner will prepare clinical documentation using another appropriate method.A patient’s decision not to use AI-assisted documentation will not affect the care they receive.
Privacy and Security
The Practice has selected an AI provider that supports Australian data residency for Practice data.Based on information published by the provider at the date of this Policy:transcripts and clinical notes are stored;audio recordings are not retained after transcription;identifiable patient information is not used to train public artificial intelligence models; andappropriate privacy and security controls are maintained to protect health information.The Practice periodically reviews these arrangements as part of its technology governance programme.Further information regarding the provider’s privacy and security framework is available from: https://www.heidihealth.com/safety
What this means for you
If your practitioner uses AI-assisted clinical documentation, the system converts speech into text to prepare a draft medical note. Audio recordings are not retained. Your practitioner reviews every note before it becomes part of your medical record, and you may decline the use of AI at any time.
Automated Decision-Making
The Privacy Act requires organisations to explain when personal information is used in automated decision-making that may significantly affect an individual’s rights or interests.The Practice supports transparency in the use of artificial intelligence and automated technologies.
Current Use of Automated Technology
At the date of this Policy, the Practice does not use computer programs to make decisions that could reasonably be expected to significantly affect a patient’s rights or interests.The Practice’s approved AI-assisted clinical documentation system is used solely to assist practitioners in preparing draft clinical documentation.The system is not authorised to:diagnose medical conditions; recommend treatment; prescribe medication; determine patient eligibility for services; prioritise patients for treatment; determine Medicare eligibility; make billing decisions; make insurance decisions; make any other significant decision affecting a patient’s rights or interests.
Human Oversight
All significant decisions concerning patient care are made by appropriately qualified healthcare practitioners.The Practice believes that artificial intelligence should support, rather than replace, professional judgement.Accordingly:practitioners review all AI-generated documentation;practitioners exercise independent clinical judgement;practitioners remain responsible for every clinical decision; andpatients continue to receive care from qualified healthcare professionals rather than automated systems.
Future Technologies
Healthcare technology continues to evolve.If the Practice introduces AI systems that perform functions substantially and directly related to significant decision-making, this Privacy Policy will be updated to explain:the types of personal information used;the kinds of automated decisions made; andthe safeguards implemented to protect patients.The Practice will continue to assess emerging technologies against applicable legislation, clinical governance requirements, cybersecurity standards and patient privacy expectations before introducing them into clinical practice.
What this means for you
Artificial intelligence currently assists with preparing clinical documentation only. It does not make decisions about your healthcare, diagnosis, treatment or eligibility for services. Your healthcare is always directed by your treating practitioner. Excellent. This completes the document. I have kept the language concise, removed unnecessary legal jargon, and maintained a professional governance style.
Australian Data Residency
The Practice is committed to protecting patient information by storing and processing personal information within Australia wherever reasonably practicable.When selecting technology providers, the Practice gives preference to organisations that support Australian data residency and demonstrate strong privacy, security and clinical governance practices.At the date of this Policy:the Practice’s electronic health record systems (MedicalDirector Clinical and Bluechip) store patient information within Australia;the approved AI-assisted clinical documentation platform stores transcripts and clinical documentation within Australia;the Practice’s Microsoft 365 environment is configured to maintain patient information within Australian data centres where available;telephone recordings are retained on the Practice’s on-premises telephone system with secure cloud backup; andPractice data backups are maintained using Wasabi cloud storage on infrastructure hosted within Australia where available.Before engaging technology providers, the Practice undertakes reasonable due diligence regarding:privacy compliance;cybersecurity;information security;Australian data residency;contractual protections;business continuity; andclinical governance.Technology providers are reviewed periodically to ensure they continue to meet the Practice’s privacy and security expectations.
What this means for you
The Practice actively prefers Australian-hosted systems and seeks to minimise overseas storage of patient information wherever reasonably practicable.
Website Privacy, Cookies and Analytics
The Practice maintains the website www.kotarasuites.com.au to provide general information about the Practice and facilitate communication with patients.
Information Collected Through the Website
Patients may choose to provide information through:appointment request forms;contact forms;general enquiries.The Practice requests that patients do not submit detailed or sensitive medical information through website forms unless specifically requested.Where clinical information needs to be exchanged, the Practice may recommend a more secure communication method.
Website Hosting
The Practice website is hosted on infrastructure located outside Australia.Accordingly, information submitted through the website may be transmitted, processed or temporarily stored outside Australia before being securely transmitted to the Practice.The Practice seeks to minimise the amount of personal information collected through its website and limits website forms to information reasonably necessary to respond to enquiries or appointment requests.
Cookies
The Practice website may use cookies and similar technologies to:improve website performance;remember user preferences;improve security;analyse website usage;assist with website administration.Users may disable cookies through their web browser, although some website functions may not operate as intended.
Google Analytics
The Practice may use Google Analytics or similar website analytics services to understand how visitors use the website. Information collected may include:browser type;operating system;device type;pages visited;time spent on pages;referring websites;approximate geographic location;general website usage information.This information is collected in aggregated or de-identified form wherever reasonably practicable and is used solely to improve the Practice’s website.Website analytics do not provide access to patient medical records or information stored within the Practice’s clinical systems.
What this means for you
The website helps patients contact the Practice but is not intended to receive sensitive medical information.
Communications
Patients may communicate with the Practice using:reception@declinic.com.aureception@kotarasuites.com.auEmail is convenient but cannot always be guaranteed to be completely secure during transmission over the internet.Patients should avoid sending highly sensitive medical information by ordinary email unless requested by the Practice.
SMS Reminders
The Practice uses MessageNet to provide appointment reminders and other administrative communications.SMS reminders generally include only the minimum information necessary to identify an appointment.Patients may opt out of SMS reminders by notifying the Practice, although this may increase the likelihood of missed appointments.
Telephone Calls
For quality assurance, staff training, patient safety and administrative purposes, telephone calls to and from the Practice may be recorded.Telephone recordings are stored securely on the Practice’s telephone system with secure cloud backup and are accessible only to authorised personnel.Recordings are retained only for as long as reasonably necessary.
Payment Processing
The Practice uses secure payment and healthcare claiming systems including:TyroMedicare OnlineEclipseInformation disclosed to these providers is limited to that reasonably necessary to process healthcare claims and payments.Financial information is handled in accordance with applicable banking, Medicare and privacy requirements.
CCTV
The Practice uses CCTV within common areas of the premises for:staff safety;patient safety;security;protection of Practice property;incident investigation.CCTV cameras are not installed in consulting rooms or clinical examination areas.CCTV recordings are stored securely on Practice premises and are accessible only to authorised personnel.
Security of Information
Protecting patient information is a core responsibility of the Practice. The Practice maintains administrative, technical and physical safeguards appropriate to the sensitivity of health information. These include role-based access controls; secure authentication; password management; multi-factor authentication where available; encryption; firewall protection; cybersecurity monitoring; audit logging; regular software updates; staff education; confidentiality agreements; secure destruction of records; business continuity planning; periodic security reviews. No information system can guarantee absolute security.If the Practice becomes aware of a data breach that is likely to result in serious harm, it will respond in accordance with applicable legislation, including the Notifiable Data Breaches Scheme where required.
What this means for you
The Practice uses multiple layers of security to protect your information and continually reviews its cybersecurity arrangements.
Access and Correction
Patients may request access to their personal information by contacting the Practice Manager.Requests should preferably be made in writing.Where appropriate, the Practice may consult the treating practitioner before responding.Patients may also request correction of information they believe is inaccurate, incomplete or out of date.Where the Practice agrees that information should be corrected, reasonable steps will be taken to do so.Where a practitioner considers that a clinical opinion should not be altered, an additional statement or notation may be added to the record rather than changing the original clinical entry.
Retention of Records
The Practice retains health records in accordance with applicable legal and professional requirements.When records are no longer required to be retained, they are securely destroyed or permanently de-identified.Electronic records are removed using appropriate secure deletion processes.Paper records are destroyed using secure confidential destruction services.
Privacy Complaints
The Practice encourages patients to raise privacy concerns promptly. Privacy enquiries or complaints should be directed to: Privacy Officer / Practice Manager Email: reception@kotarasuites.com.au or reception@declinic.com.au The Practice will acknowledge receipt; investigate the matter; respond within a reasonable time; seek to resolve concerns fairly and respectfully. If a patient is not satisfied with the Practice’s response, they may contact: Office of the Australian Information Commissioner (OAIC) Information and Privacy Commission NSW
Review of this Policy
The Practice reviews this Privacy Policy regularly to ensure it remains consistent with Australian privacy legislation, technological developments, cybersecurity risks, clinical governance, professional standards and practice operations. The Policy may be amended from time to time without prior notice.The most current version will always be available from the Practice and on the Practice website.
Legislative Framework
This Policy has been prepared having regard to:Privacy Act 1988 (Cth)Australian Privacy PrinciplesPrivacy and Other Legislation Amendment Act 2024 (Cth), including the automated decision-making transparency requirements commencing 10 December 2026Health Records and Information Privacy Act 2002 (NSW)NSW Health Privacy PrinciplesNotifiable Data Breaches SchemeRelevant guidance published by the Office of the Australian Information Commissioner (OAIC)Relevant guidance published by the Information and Privacy Commission NSWRelevant guidance published by the Australian Health Practitioner Regulation Agency (AHPRA) relating to the use of artificial intelligence in healthcare