Aloura Family Practice Privacy Policy

Name: Aloura Family Practice
Address: Unit 1, 133 Nicholson Road, Canning Vale, Western Australia, 6155, AU
Telephone: (08) 6147 6528

Introduction QW Associates Pty Ltd ACN 688 703 148 trading as Aloura Family Practice of 133 Nicholson Road, Canning Vale WA 6155 (Aloura, us, we, our) are committed to providing quality services to our patients.

This Privacy Policy (Policy) outlines our ongoing obligations to you regarding how we collect, use, disclose, store, secure, and dispose of personally identifiable information.

This Policy is available free of charge and in such form as is reasonably appropriate.

Aloura is bound by the Privacy Act 1988 (Cth) (Privacy Act) and will handle personal information in compliance with the Australian Privacy Principles (APPs) contained in the Privacy Act.

If you have any questions, comments, requests or concerns, please contact us at:
1. by telephone: 08 6147 6528
2. by email: healthcareadmin@alourfamilypractice.com.
3. by post 133 Nicholson Road, Canning Vale WA 6155
Your consent If you do not provide us with your personal information, we may not be able to provide you with our services, communicate with you or respond to your enquiries.

If you do provide us with your personal information, you consent to us collecting, holding, using and disclosing (and otherwise handling) your personal information in accordance with this Policy.
What is personal information? Personal information is any information or an opinion about an identified individual or an individual who can be reasonably identified from the information or opinion. Information or an opinion may be personal information regardless of whether it is true. Personal information includes:
1. Sensitive information: Information or an opinion about an individual’s health or genetic information (and aspects of biometric information), racial or ethnic origin, political opinions or associations, religious or philosophical beliefs, trade union membership or associations, sexual orientation or practices and criminal record. The Privacy Act affords sensitive information a higher level of privacy protection than other personal information.
2. Credit information: Information (other than sensitive information) relating to an individual’s credit.
References to personal information in this Policy include sensitive information and credit information, unless specified otherwise.

Personal information relating to the employment of staff as defined under the Privacy Act as employee records is generally exempt from the Privacy Act and this Policy does not apply to such information. If you are a current or former employee, employee records relate to your employment with us and include associated personal information. Please refer to your contract of employment for more information.
What personal information do we collect? In the ordinary course of business, we may collect information from:
1. patients and potential-patients (including patients and potential patients of Aloura licensees) and their representatives, guarantors or related persons;
2. staff, contractors and suppliers; and
3. other people who come into contact with us in the ordinary course of business.
The types of personal information we collect will depend on the nature and purpose of our interaction with each person, and includes (without limitation):
1. contact details, including address, phone numbers or email address
2. personal details, including name, date of birth and gender / pronoun preference;
3. identification details, including driver’s licence or other identification details;
4. medical information including medical history, medicines, allergies, and adverse reactions immunisations, social history, family history and risk factors
5. Medicare number (where available) for identification and claiming purposes
6. healthcare identifier numbers;
7. health fund details;
8. financial details, including payment and billing information;
9. credit reporting details, including, credit eligibility or credit worthiness data, serious credit infringement, repayment history information, information derived from credit reporting information;
10. transactional details, including the date you contracted with us and transaction history;
11. demographic details, including household size, type of dwelling (e.g. house, apartment), ownership status (e.g. owner or renter);
12. technical details, including IP address, the types of devices you are using to access the website, device attributes, browser type, operating system and the other pages you have visited;
13. related party details, including details of other authorised contacts who may interact with us on your behalf; and
14. for contractors – business and work-related information.
We may also collect sensitive information that you provide to us, with your consent. For example for safety and security purposes including to ensure the safety and wellbeing of the general public, our patient s, staff and any individuals working on site (including to record details of any health or safety incidents or accidents).

If you provide us with personal information about another person (e.g. your authorised representative or other people residing at your premises), please make sure that you tell them about this Policy, and obtain their consent before providing us with their information.
How do we collect your personal information? Generally, we will collect your personal information directly from you: when you make your first appointment, the practice team will collect your personal and demographic information via your registration.

This ensures that you know the information is being collected about you and you have some control over what information is collected.

However, we also collect your personal information from other sources in circumstances where:
1. you have consented to such collection;
2. it is unreasonable or impractical to collect the information directly from you;
3. you would reasonably expect your personal information to be collected from another source;
4. where the collection is authorised by law.
Examples of the ways we may indirectly collect personal information are:
1. Your guardian or responsible person;
2. Other involved healthcare providers, such as specialists, allied health professionals, hospitals, community health services, and pathology and diagnostic imaging services;
3. Your health fund, Medicare, or the Department of Veterans’ Affairs (if relevant);
4. While providing medical services, further personal information may be collected via electronic prescribing, My Health Record and / or online appointments;
5. when we engage with government agencies and regulatory bodies for the purpose of regulatory reporting and compliance;
6. when we engage with third parties to undertake our normal business activities (e.g. your authorised representatives, our agents, service providers and business partners and credit reporting bodies);
7. when we use publicly available sources (e.g. websites).
Various types of images may be collected and used, including:
1. CCTV footage: Collected from our premises for security and safety purpose; and
2. Photos and medical images: These can be taken using personal devices for medical purposes, following the guidelines outlined in our guide on using personal devices for medical images.
We may also collect information about how you access, use and interact with our website or social media platforms in order to create a better user experience and optimise patient engagement and feedback. We do this by using a range of tools such as Google Analytics. This information may include technical data, which may include IP address, the types of devices you are using to access the website, device attributes, browser type, operating system and the other pages you have visited.

We use cookies on the website. A cookie is a small text file that the website may place on your device to store information. We may use persistent cookies (which remain on your computer even after you close your browser) to store information that may speed up your use of our website for any of your future visits to the website. We may also use session cookies (which no longer remain after you end your browsing session) to help manage the display and presentation of information on the website. You may refuse to use cookies by selecting the appropriate settings on your browser. However, please note that if you do this, you may not be able to use the full functionality of the website.

We also use third-party websites to connect with you and for information sharing purposes, such as Facebook, Instagram and LinkedIn. Please read any terms and conditions and privacy policies that apply to those third-party websites to ensure you understand and agree to the way your personal information will be when using those social media platforms to interact with us. We are not responsible for the collection and use of personal information of the relevant third parties. Please refer to our Website Terms and Conditions for more information.
Why do we collect, hold and use your personal information? We will use or disclose personal information (including sensitive information) for the purposes for which it was collected, and for secondary purposes if:
1. you (or your authorised representative) consented; or
2. we are required or authorised under law or court/tribunal order.
We may also use and disclose personal information in circumstances where a person would reasonably expect us to use it for a secondary purpose (e.g. service management, administration, billing, audit and quality assurance, accreditation, incident monitoring). This can be either directly related to the primary purpose (for sensitive information) or related to the primary purpose (for other personal information).

We will only collect personal information that it is reasonably necessary for the performance of one or more of our functions and activities. Aloura’s primary functions and activities include (without limitation):
1. managing your health safely and effectively. This includes providing healthcare services, managing medical records, and ensuring accurate billing and payments. Additionally, we may utilise your information for internal quality and safety improvement processes such as practice audits, accreditation purposes, and staff training to maintain high-quality service standards.
2. offering or providing patients with healthcare, products and services;
3. communicating, responding and dealing with enquiries, concerns and complaints, and recording and analysing patient feedback;
4. developing healthcare, product and service improvements;
5. protecting against unauthorised access and fraud and ensuring the security of patient information and systems (e.g. monitoring for suspicious activities and potential threats);
6. managing and maintaining business and administrative operations (e.g. recruitment, account management, billing and record keeping functions;
7. assisting patients with their health and safety (including support for mental capacity, health-related appliance, financial hardship, domestic violence);
8. delivering on our legal and regulatory obligations and assisting government bodies and law enforcement agencies; and
9. developing marketing and community engagement opportunities and other patient relationship purposes.
We will never commercialise or sell your personal information. However, if ownership or control of all or part of our business changes, we may transfer your personal information to the new owner.
Do we use Artificial Intelligence (AI)? The practice uses an AI scribe tool to support GPs take notes during their consultations with you. The AI scribe uses an audio recording of your consultation to generate a clinical note for your health record. The practice AI scribe service is Heidi and MBS Pro. Heidi and MBS Pro:
1. does not share information outside of Australia;
2. destroys the audio file once the transcription is complete; and
3. removes sensitive, personal identifying information as part of the transcription.
The practice will only use data from our digital scribe service to provide healthcare to you.
Do we collect unsolicited personal information? If we receive personal information which we did not request, we will determine whether it is appropriate for us to collect the information for the purpose of providing you with our products and services (or another reason as listed in Item 6 (above)).

If we determine that it is not appropriate (or we are not lawfully permitted) to collect that personal information, we will, as soon as practicable, destroy the information or ensure that it is permanently de-identified.

If we determine that it is appropriate for us to collect the personal information, we will ensure that the information is handled with in a manner that complies with this Policy.
Who do we disclose your personal information to, and why? We may disclose your personal information to others where you have expressly consented to the disclosure or your consent may be reasonably inferred from the circumstances. Your consent may be inferred for disclosures made in the ordinary conduct of our business.

We may transfer or disclose your personal information to third parties that we engage, or we are engaged by, in the conduct of our business. These third parties include (without limitation):
1. with third parties for business purposes, such as accreditation agencies or information technology providers – these third parties are required to comply with APPs and this policy;
2. with other healthcare providers (e.g. In referral letters);
3. when it is required or authorised by law (e.g. court subpoenas);
4. when it is necessary to lessen or prevent a serious threat to a patient’s life, health or safety or public health or safety, or it is impractical to obtain the patient’s consent
5. to assist in locating a missing person;
6. to establish, exercise or defend an equitable claim;
7. for the purpose of confidential dispute resolution process;
8. When it is a statutory requirement to share certain personal information (e.g. some diseases require mandatory notification);
9. When it is provision of medical services, through electronic prescribing, My Health Record (e.g. via Shared Health Summary, Event Summary);
10. software and IT service providers to support data management needs;
11. third-party licencees and service providers to facilitate the delivery of healthcare;
12. consultants and contractors who deliver healthcare services and recommendations;
13. patient service platforms to handle inquiries;
14. marketing and advertising agencies;
15. billing, mailing and logistics providers;
16. professional advisors (e.g. lawyers, business adviser and auditors);
17. other businesses with whom we have commercial relationships or who are involved in providing or administering our products and services;
18. financial institutions;
19. third parties to whom we assign your debt or that you or we ask to act as guarantor of any credit provided to you;
20. firms that analyse patient feedback and usage patterns to improve service delivery;
21. nominated persons where a dispute arises;
22. government and/or regulatory authorities (where required or authorised by law); and
23. Aloura’s related bodies corporate.
We may also disclose your personal information to others if we are required or authorised by law to do so.
Do we disclose personal information to overseas recipients? We may transfer personal information to service providers located overseas. In such circumstances, we will take reasonable steps in the circumstances to ensure the overseas recipient is contractually bound to comply with the APPs unless the recipient is subject to privacy related legal obligations which are substantially similar to the Privacy Act.

We may also disclose personal information to an overseas recipient, if:
1. you have provided your consent to such disclosure; or
2. we are required or authorised to make such disclosure by law.
Do we use your personal information for marketing? We may use or disclose personal information (excluding sensitive information and credit-related information) for marketing or promotional information in relation to the products and services we offer, if:
1. we collected the information directly from you;
2. you have consented to, or would reasonably expect us to, use or disclose the information for that purpose; and
3. you have not opted-out in receiving fundraising or marketing communications from us by following the opt-out instructions provided in the communication. This may take the form of email, SMS, mail or other forms of communication, and will comply with our obligations under the Law.
If you previously consented to receive marketing communications from us, you can change your mind at any time by contacting us on the contact details set out under Item 1 (above).
How do we store and hold personal information? At all times we will take reasonable steps to ensure that personal information we hold is protected from misuse, interference and loss and from unauthorised access, modification or disclosure.

We store most information about you in computer systems and databases operated by either us or our external service providers. Some information about you is recorded in paper files that we store securely. Our current security processes and measures include:
1. storing electronic information on a server based in Australia;
2. storing hardcopy information on secure premises only accessible by authorised staff and contractors;
3. requiring all staff and contractors to comply with internal information security policies and keep information secure;
4. limiting access to systems on which information is processed and stored and segregate user access as required to carry out their role;
5. ensuring all external email communications sent from Aloura are encrypted;
6. require all staff ad contractors to periodically reset passwords;
7. use multi-factor authentication for access to business systems;
8. use anti-virus protections and ensure operating systems, browsers and plugins are up-to-date with patches and fixes;
9. monitoring and regularly reviewing our third party providers (including cloud computing) to ensure compliance with the APPs;
10. ensuring our staff and contractors are bound by non-disclosure agreements regarding the protection of personal information;
11. monitoring and regularly reviewing our practise against our own policies and against industry best practice.
When do we delete records containing personal information? Generally, we retain our records:
1. until no longer required for the purposes for which it was collected (or for any secondary purpose permitted or authorised by law);
2. for a minimum of 7 years; or
3. as required by law (noting that some laws require us to retain some records indefinitely).
As appropriate we will take all reasonable steps to destroy, delete or permanently de-identify it in line with our Retention and Destruction Policy which comply with applicable law.
What happens if the personal information is subject to a data breach? In the event personal information held by us has been accessed, disclosed without authorisation, or is lost, we will take immediate action to contain, assess and remediate the incident in accordance with our Data Breach Response Plan.

Should we determine that a data breach is likely to cause serious harm to an individual to whom the relevant information relates, we will promptly notify the individual and any relevant regulators about the breach (unless the law requires or authorises otherwise).
How do we maintain the quality of personal information? As a matter of practice, when we receive personal information, we will ask reasonable questions to verify the accuracy of the information.

If, having regard to the purpose for which it is held, we are satisfied that personal information we hold is inaccurate, out-of-date, incomplete, irrelevant or misleading, or if the individual about whom the information relates makes a request, we will take reasonable steps to correct the information. The reasonable steps that we may take include:
1. ensuring that updated and new personal information is promptly added to relevant existing records; and
2. reminding individuals to update their personal information when we engage with them. Where we have identified that we have disclosed credit-related information to a credit reporting body, which is not accurate, up-to-date and complete, we will soon as practicable notify the credit reporting body.
How can you access the personal information we hold about you? Any records created by us are owned by us and / or our licensees. However, you have the right to access the records we hold to the extent it reasonably identifies you.

Such requests should be made in writing and submitted via the contact details set out under Item 1 (above). Your written request to access personal information should include:
1. your contact details;
2. whether the personal information relates to you or another person (with authority);
3. what information you are seeking access to (including dates, location, subject matter or any other information that will help identify the information you seek);
4. outline the reason you wish to access this information;
5. your preferred method and form of the information (including any accessibility requirements);
6. any other information that will assist us in reviewing and responding to the request.
Prior to responding to the request, we are required by law to verify your identity. We will only progress the request if we are satisfied that the request is made by the person to whom the information relates, or by another person who is authorised to make a request on their behalf.

Within a reasonable period (usually 30 days from the date the request was made), we will provide you with access to the information in the manner requested, providing such access is reasonable and practicable. We are permitted to refuse a request to access personal information in certain circumstances. If we refuse to give access to requested information, we will either:
1. consult with you to seek more information and/or take such steps (if any) that are reasonable in the circumstances; or
2. provide you with a written notice setting out our reasons for refusing access (unless it is inappropriate or unreasonable to provide the reasons) and the external dispute resolution options available to you.
We may charge reasonable fees to cover our costs to respond to your request for personal information, including third party costs such as postage costs. The fees will be determined on a case-by-case basis and we will inform you of the likely fees before they are incurred.
How can you access or correct the personal information we hold about you?< Any records created by us are owned by us. However, you have the right to request us to correct the personal information within our records that identifies you. Such requests should be made in writing and submitted via the contact details set out under Item 1 (above).

Please note, in order for us to deal with a request to correct or update personal information, we will need to verify your identity. We will endeavour to deal with correction requests within 30 days.

We will only refuse to correct personal information in accordance with our obligations under the Privacy Act. Where we refuse a request to correct personal information we will provide a written notice to the requestor setting out:
1. the reasons for the refusal (except where it would be unreasonable to provide the reasons);
2. the mechanisms available to complain about the refusal;
3. any other matter prescribed by the regulations; and
4. offer to insert a statement into the relevant record identifying the requestor’s statement that the information is inaccurate, out-of-date, incomplete, irrelevant or misleading.
If we agree to correct the relevant personal information, we will take reasonable steps to notify any third party to whom we had previously disclosed the information, if the individual about whom the information relates requests it and it is not unlawful or impracticable for us to do so. We will not charge fees for requests for the correction of personal information or for associating the statement with the personal information.
How can you make a complaint?If you have a complaint about the way in which we have handled your personal information in compliance with applicable law, dealt with a privacy issue (including a request for access or correction of your personal information) you should contact us on the contact details set out under Item 1 (above).

The following information should be included in your written compliant:
1. your name;
2. your preferred contact details;
3. a clear description of your complaint/concerns; and
4. any supporting materials.
Once we have received your complaint, we will take steps to investigate the issues raised and endeavour to respond to you within a reasonable period of time (usually 30 days).

In response to your complaint, our Privacy Officer (or other relevant officer) will contact you by telephone or in writing to:
1. ask for more information about your complaint;
2. notify you of the outcome of our investigation; or
3. arrange to meet with you to discuss the complaint.
If you are unsatisfied with the way we have handled a privacy issue or your complaint, the following steps may be available to you:
1. approach an independent advisor for guidance on alternative courses of action which may be available; and/or
2. lodge a formal complaint with the Office of the Australian Information Commissioner, via: Post: GPO Box 5218 Sydney NSW 2001
  Phone: 1300 363 992
  Email: enquiries@oaic.gov.au
  Web: https://www.oaic.gov.au/privacy/privacy-complaints/
Changes to this Policy From time to time, we may change this Policy on how we handle personal information or the types of personal information which we hold. Any changes to this Policy will be published on our website.

You may obtain a copy of our current Policy from our website or by contacting us on the contact details set out under Item 1 (above).