About This Policy
The Coastal Clinic Plastic Surgery & Aesthetics (“we”, “us”, “our”) provides surgical, skin cancer, and aesthetics services. As a health service provider, we’re bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) regardless of our annual turnover — the small business exemption that applies to many other businesses does not apply to us. We’re also guided by the Medical Board of Australia’s Good Medical Practice code, AHPRA’s requirements for maintaining patient confidentiality, and Queensland law relevant to how we handle information (including phone recording, addressed below).
This policy explains what personal information we collect, why, how we use and disclose it, how we keep it secure, and how you can access it, correct it, or raise a concern.
The Personal Information We Collect
Depending on how you interact with us, we may collect:
- Contact and identity information — such as your name, date of birth, postal and email address, and phone number.
- Health information — including your medical history, examination findings, consultation notes, treatment and procedure details, clinical photographs and imaging, referrals, and correspondence with your GP or other treating practitioners (hospitals, anaesthetists, specialists). Health information is “sensitive information” under the Privacy Act and receives a higher level of protection.
- Billing and payment information — including Medicare, private health insurance, and payment details.
- Account information — if you create an account on our website, your username and password.
- Records of your communications with us — including phone calls (see below) and, where you attend a consultation, notes generated with the assistance of AI transcription software (see below).
How We Collect Personal Information
We collect personal information directly from you — in person, over the phone, by email, or through our website (for example, when you make an enquiry, book an appointment, complete a form, or participate in a survey). We may also collect information from your GP or referring practitioner, or from other treating providers involved in your care, generally with your consent.
Phone Calls
All incoming and outgoing phone calls to and from The Coastal Clinic may be recorded for staff training and quality assurance purposes. If you’d prefer your call isn’t recorded, please let our team know at the start of the call.
Consultations — AI-Assisted Clinical Documentation (Heidi)
During consultations, your practitioner may use Heidi, a medical transcription software, to help prepare accurate clinical notes. Heidi listens to the consultation in real time and generates a draft summary, which your practitioner reviews, edits, and approves before it’s saved to your medical record. If you’d prefer we don’t use Heidi during your consultation, please let your practitioner know beforehand and notes will be taken in the usual way instead.
Why We Collect, Hold, Use and Disclose Your Information
We use your personal information to:
- Provide clinical care, including consultations, procedures, and follow-up treatment.
- Communicate with you about appointments, your care, invoices, or enquiries.
- Coordinate your care with other treating practitioners (your GP, hospital, anaesthetist, or specialists).
- Process payments, insurance claims, and Medicare rebates.
- Meet our legal and professional obligations, including under AHPRA, Medicare, and health records law.
- Train our staff and maintain the quality of our phone-based patient service.
- Send you relevant information, updates, and marketing about our services, unless you’ve opted out.
- Improve our website and services, and understand how our website is used.
Consent
Where we need your consent to collect or use your information — for example, to collect health information, or to use Heidi during a consultation — we’ll seek that consent before or at the time of collection, and you can withdraw it at any time by telling your practitioner or contacting us. In some circumstances, the Privacy Act permits us to collect health information without express consent where necessary to provide you with a health service (for example, where you’re unable to give consent in an emergency).
Disclosure of Personal Information
We may disclose your personal information to:
- Other treating practitioners involved in your care — your GP, hospital, anaesthetist, or specialist — generally with your consent.
- Service providers who help us operate — including our practice management and payment systems, and Heidi Health (our AI transcription provider).
- Medicare, the ATO, and your private health insurer, where relevant to your treatment or billing.
- AHPRA or other regulators, where required by law.
- A new owner, in the event of a merger, acquisition, or sale of all or part of our business.
We will not sell, trade, or rent your personal information to third parties for marketing purposes without your consent.
Storage and Security of Personal Information
We take reasonable steps to protect your personal information from misuse, interference, loss, unauthorised access, modification, or disclosure — including restricting staff access to patient records on a need-to-know basis, using secure practice management and payment systems, and requiring our service providers (including Heidi Health) to maintain appropriate security standards. No method of electronic storage or transmission is 100% secure, and we can’t guarantee absolute security.
Sending Information Overseas
We use monday.com, a customer relationship management platform hosted in the United States, to manage patient enquiries and bookings. Information stored in monday.com may include your name, contact details, the procedure you’ve enquired about, and email correspondence with us. Some of the other service providers we use to run our practice may also store or process information on servers located outside Australia.
Where your personal information is sent or stored overseas, we take reasonable steps to ensure it’s handled consistently with the Australian Privacy Principles — including reviewing the provider’s security and privacy commitments before we rely on them.
Accessing and Correcting Your Personal Information
You have the right to access the personal information we hold about you and to ask us to correct it if it’s inaccurate, out of date, or incomplete. To request access to or correction of your information, including your medical record, please contact us using the details below. We may need to verify your identity before providing access, and in limited circumstances permitted by law, access to certain health information may be provided through your treating practitioner.
If Something Goes Wrong
If a data breach occurs that is likely to result in serious harm to you, we will act in accordance with the Notifiable Data Breaches scheme — this means notifying the Office of the Australian Information Commissioner (OAIC) and affected individuals as soon as practicable.
Cookies and Tracking Technologies
We use cookies and similar tracking technologies on our website to improve your browsing experience and understand how our site is used. You can manage your cookie preferences through your web browser settings.
Links to Third-Party Websites
Our website may contain links to third-party websites. We’re not responsible for the privacy practices or content of those sites, and we encourage you to review their privacy policies before providing any personal information.
How to Make a Complaint
If you have a concern about how we’ve handled your personal information, please contact us using the details below so we can address it directly. If you’re not satisfied with our response, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or by calling 1300 363 992.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time. Changes take effect once the revised policy is posted on our website. We encourage you to review this policy periodically.
Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal information, please contact us at admin@thecoastalclinic.com.au or by calling 07 5683 0820.
