The Law That Applies
Manly Foot Clinic is a private sector health service provider. The Privacy Act 1988 (Cth) applies to every organisation that provides a health service and holds health information, regardless of its annual turnover, so the thirteen Australian Privacy Principles bind this clinic in full.
Because the clinic operates in New South Wales, the Health Records and Information Privacy Act 2002 (NSW) and its Health Privacy Principles also apply to the health information we hold.
What We Collect
Health information is treated as sensitive information under the Privacy Act, which means it attracts a higher level of protection than ordinary personal information.
- Your name, date of birth, address, phone number and email address.
- Your Medicare number, private health fund details and any DVA or NDIS identifiers you give us.
- Your medical history, medications, allergies and the details of your presenting problem.
- Clinical notes, assessment findings, measurements and treatment plans.
- Imaging and reports, whether taken here or provided by you or another practitioner.
- Clinical photographs, where these are taken and where you have agreed to them.
- Correspondence with your GP, specialists and other practitioners involved in your care.
- Payment records, and records of appointments made, changed and missed.
How we collect it
Most of it comes from you, in person, over the phone or through the online booking system. Some comes from other people involved in your care, such as a referring GP, a specialist, a radiology practice or, with your consent, a family member or carer. Where we collect information about you from someone else, we will tell you unless it is unreasonable or impracticable to do so.
Why We Collect It, and How We Use It
The primary purpose is to provide you with podiatric care. That covers assessing your problem, planning and delivering treatment, arranging procedures and imaging, and reviewing how you go.
- Providing and managing your care, including follow-up and recall.
- Communicating with other practitioners involved in your care.
- Billing, claiming and payment, including private health fund claims.
- Meeting our legal and professional obligations, including record keeping and reporting required by law.
- Managing the clinic, including quality improvement and, where necessary, responding to a complaint or a legal claim.
Who We Disclose It To
We disclose your health information only where it is directly related to your care, where you would reasonably expect it, where you have consented, or where the law requires or authorises it.
- Your GP and any specialist, physiotherapist or other practitioner involved in your care.
- A hospital or day surgery facility, where a procedure is arranged.
- Your private health fund, Medicare or the Department of Veterans’ Affairs, for the purpose of a claim you have asked us to make.
- Our insurers and professional advisers, where that is necessary.
- Anyone else you have told us to send it to, or where disclosure is required or authorised by law.
Direct marketing
We do not sell your information, and we do not disclose it to anyone for their own marketing. Where we contact you about your own care, such as a recall or a review reminder, you can ask us to stop at any time.
Storage and Security
We take reasonable steps to protect the information we hold against loss, unauthorised access, modification and disclosure. Electronic records are held in the clinic’s practice management system with access limited to staff who need it, and paper records are held securely on the premises.
This section needs the clinic to confirm the detail before publication: which practice management and booking systems hold your records, where those systems store data, and whether any of it is held or accessed outside Australia. Australian Privacy Principle 8 places obligations on us in relation to any overseas disclosure, so this has to be stated accurately rather than generally.
How Long We Keep It
Health records are not deleted when you stop attending. The Health Records and Information Privacy Act 2002 (NSW) requires a private health service provider to keep health information for at least seven years from the last occasion on which a health service was provided to you.
Where the information was collected while you were under the age of 18, it must be kept until you turn 25.
When health information is destroyed, a record is kept of whose information it was, the period it covered and the date it was destroyed.
| Whose record | Minimum retention period |
|---|---|
| An adult patient | Seven years from the last occasion of service |
| Information collected while the patient was under 18 | Until the patient turns 25 |
Getting Access, and Correcting It
You have a right to ask for access to the health information we hold about you, and a right to ask us to correct it if it is wrong, out of date, incomplete or misleading. Put the request in writing to the clinic and we will respond within a reasonable period.
We can only refuse access in the limited circumstances the law allows, and if we do we will tell you why in writing and explain how to complain. A fee may be charged for the reasonable costs of giving access, such as copying, but not for making the request itself.
Data Breaches
The Notifiable Data Breaches scheme applies to this clinic. If personal or health information we hold is lost, or accessed or disclosed without authorisation, and that is likely to result in serious harm to you, we must notify you and the Office of the Australian Information Commissioner as soon as practicable after we become aware of it.
This Website
The website collects less than the clinic does, but it does collect something, and the specific tools in use have to be listed here rather than described in general terms. The clinic uses Google Tag Manager, Google Analytics, Google Ads conversion tracking, a call tracking script that substitutes the displayed phone number so calls can be attributed to a campaign, and a spam filtering service on the contact form.
Between them these place cookies or similar identifiers in your browser and record information such as your IP address, the pages you view and how you arrived at the site. Online bookings are handled by a third party booking system, and information you enter there is held by that provider under its own terms.
The exact list of services, what each one collects and the links to their own privacy policies must be confirmed and set out here before this policy is published.
Complaints
If you think we have mishandled your personal or health information, tell the clinic first, in writing, and we will investigate and respond. Call (02) 9977 0047 or email info@manlyfootclinic.com.au.
If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner, which handles complaints under the Privacy Act 1988 (Cth), or to the NSW Privacy Commissioner at the Information and Privacy Commission NSW, which handles complaints under the Health Records and Information Privacy Act 2002 (NSW).
Changes to This Policy
We may update this policy. The current version is always the one published on this page, and the date it was last updated is shown at the top.