Privacy and confidentiality · Care Outside the Box®
Your health information, handled with care.
We hold information that can be deeply personal. This policy explains what we collect, why we need it, who may receive it, where it may be processed, and how you can access or correct it.
This policy applies to Salubris Health Pty Ltd, ABN 64 633 299 886, trading as Rosedale Medical Practice. We have cared for West Pennant Hills families since 1997.
The short version
What matters most.
This summary helps you find the main points quickly. The detailed policy below explains the limits and exceptions.
Collect
We ask for what care requires.
That includes identity, contact, health, appointment and billing information needed to care for you and run the practice lawfully.Use and share
Care is the main purpose.
We use and disclose relevant information for your care, billing, safety, practice administration and legal obligations, with consent or another lawful basis.
Protect
Access is limited by role.
We use reasonable technical, physical and administrative safeguards and train our team to respect confidentiality.
Website
Tracking is disclosed.
The site currently uses Google advertising measurement, Meta Pixel and Microsoft Clarity. These tools receive website-use information, not access to your clinical record.
Your rights
You can ask, access and correct.
You can request access to your information, ask us to correct it, change communication preferences or raise a privacy concern.
No sale
We do not sell patient information.
We do not sell or rent personal or health information, and we do not use clinical record content to target advertising.
Who this policy covers.
Rosedale Medical Practice is responsible for the personal and health information it holds and controls.
Who we are
Salubris Health Pty Ltd, trading as Rosedale Medical Practice, is a private health service provider at Ground Floor, 70 Castle Hill Road, West Pennant Hills NSW 2125. Dr Jaspreet Saini is the document owner. Jennifer Williams is our Privacy Officer.
Who it applies to
This policy covers patients, parents and carers, authorised representatives, visitors, website users, job applicants, contractors, suppliers and health practitioners who deal with us.
Specific forms or services may show a shorter collection notice explaining a particular data flow. Read that notice with this policy. A provider such as HotDoc, My Health Record or a pathology service also has its own privacy obligations and policy.
The rules we work under
We handle information under applicable laws and standards, including the Privacy Act 1988 and Australian Privacy Principles, the Health Records and Information Privacy Act 2002 (NSW) and Health Privacy Principles, the My Health Records Act 2012, health-practitioner record-keeping requirements and the RACGP Standards for general practices. Applicable law prevails if a statement in this policy becomes inconsistent with a legal requirement.
What we collect.
The information depends on the care or service you use. Health information is sensitive information under Australian privacy law.
Identity and contact
- Name, date of birth, sex or gender where relevant
- Address, phone, email and preferred contact method
- Emergency contact, next of kin, parent, guardian or representative details
- Language, cultural or accessibility information you choose to share
Health and clinical
- History, symptoms, medicines, allergies, immunisations and family history
- Consultation notes, observations, diagnoses and management plans
- Pathology, imaging, referrals, correspondence and discharge information
- Mental health, substance-use and other sensitive information when relevant
Administrative and digital
- Appointments, cancellations, recalls and communications
- Medicare, DVA, concession, insurance, billing and payment information
- Website forms, subscription preferences and complaint details
- Device, browser, cookie, page-view and interaction data
- CCTV images from common areas used for safety and security
How we collect it
- Directly from you in person, by phone, email, SMS, forms or telehealth
- From a parent, guardian, carer or authorised representative
- From referring practitioners, hospitals, pathology, imaging, pharmacies and other care providers
- From Medicare, DVA, My Health Record, the Australian Immunisation Register and other authorised systems
- From an employer, insurer, lawyer or agency where you authorise it or law permits
If you do not provide it
You can decline to provide information. Depending on what is missing, we may be unable to identify you safely, provide particular care, prescribe, arrange tests, claim a rebate, contact you about results or complete an administrative request. We will explain when information is optional and when it is needed to provide the service.
How we use and share information.
We use information for the reason it was collected, for a related purpose you would reasonably expect, with consent, or when law otherwise permits or requires it.
How we use it
- Assessing, treating, prescribing, referring and coordinating care
- Following up results, recalls, screening and preventive care
- Booking, billing, Medicare and DVA claims, accounts and payments
- Responding to enquiries, requests, feedback and complaints
- Clinical supervision, accreditation, audit, safety and quality improvement
- Meeting public health, child safety, court, regulatory and other legal obligations
- Operating, securing and improving the practice and website
Who may receive it
- Clinicians and authorised team members involved in your care or request
- Specialists, allied health practitioners, hospitals and other treating services
- Pathology, imaging, pharmacy, secure messaging and telehealth providers
- Medicare, DVA, health funds and payment providers
- IT, booking, forms, communications, records and professional advisers under appropriate arrangements
- Regulators, courts, law enforcement or government bodies where authorised or required
- A parent, guardian, representative or carer where you authorise it or law permits
When consent is not required
Privacy law allows or requires some uses and disclosures without consent. Examples can include reducing or preventing a serious threat, mandatory reporting, public health notifications, responding to a lawful court order, managing a legal claim or another situation expressly authorised by law. We limit any disclosure to what is relevant.
Practice updates and direct marketing
We may use contact details to send practice news, health information or information about available services where permitted. You can opt out of promotional messages by using the unsubscribe option or contacting us. Essential appointment messages, recalls and clinically important communications are managed separately. We do not use diagnoses, consultation notes, medicines or test results to select advertising audiences.
Digital services involved in your care.
We use external systems to provide bookings, records, communications and clinical support. The information each one receives depends on the feature you use.
Clinical record, secure messaging and My Health Record
Your main Rosedale clinical record is maintained in our practice clinical system in Australia. Relevant documents may be sent or received through secure clinical messaging. If you have a My Health Record, an authorised clinician may view or upload information as permitted by that system, your settings and law. You can manage access through My Health Record privacy and access controls.
HotDoc bookings, reminders, forms and payments
HotDoc may receive identity, contact, appointment, reminder, form, request and payment-related information when you use those features. The exact data depends on the action you take. HotDoc does not have general access to the complete clinical record merely because you book an appointment. Read HotDoc's privacy policy for its own handling practices.
Pathology, imaging, pharmacies and other care providers
Requests and relevant clinical information are sent to the provider you or your clinician selects. Results and correspondence are returned to Rosedale and added to your record. Electronic prescriptions involve the national ePrescribing system and your chosen pharmacy. Each receiving provider has its own legal duties and privacy policy.
Heidi AI scribe
Some clinicians use Heidi to turn a consultation transcript into a draft note. We tell you before it is used and seek your consent. You can decline or change your mind without affecting your care. The clinician reviews and edits the draft before deciding what enters your record. The tool does not replace clinical judgement and does not make the final diagnosis, treatment, prescribing or billing decision. The service temporarily processes consultation content to create the draft. We use Australian-region settings and seek to minimise retention. Heidi may use approved subprocessors as described in its privacy information. Ask your clinician if you want to know the current settings before consenting.
BetterConsult pre-consultation questionnaires
Before some appointments, HealthShare's BetterConsult may invite you to answer questions about symptoms, medicines and the reason for your visit. It creates a summary for your clinician. Completing it is optional, and you can tell the clinician the same information during your appointment instead. HealthShare states that identifying information is held in Australia. Its terms may allow separate use of de-identified information. Read the notice shown before you begin and the HealthShare privacy policy.
Telehealth, email, SMS and phone
Telehealth consultations are documented in your clinical record in the same way as in-person care. We do not record a consultation unless we have told you and obtained consent. If you want to record, ask everyone involved first. Email and ordinary SMS are useful for brief, non-urgent communication but are not always end-to-end encrypted. Avoid sending more health information than needed. Do not use them for emergencies or urgent clinical advice. You can ask us to record communication preferences on your file.
Website forms, newsletters and communication systems
Website enquiries may collect your name, contact details, selected service or pathway and message. A form-specific notice should explain what is sent. Some screening tools calculate an on-screen result, while contact details or a general pathway may be sent for follow-up. These tools are not a diagnosis and do not create a complete clinical record. Website and newsletter data may be held through WordPress.com, FluentCRM or related website services. Enquiries and permitted practice communications may also be managed through HighLevel. These services may process information outside Australia, including in the United States. If you do not want to use a website form, call 02 9680 9644.
Human judgement stays in charge.
AI scribes, questionnaires and pathway tools can organise or summarise information. A clinician remains responsible for diagnosis, treatment, prescribing and the approved clinical record. Our current tools do not make final clinical decisions about you without human review.
Screening is not a gate.
An online fit check may suggest a service or next step. It does not diagnose you and does not decide that you may or may not receive healthcare. Contact reception if a digital pathway does not fit your circumstances.
Website analytics and advertising.
Our website currently loads analytics and advertising technologies. This section names them and explains the privacy-sensitive part clearly.
These services may receive the page URL, referrer, approximate location derived from an IP address, device and browser information, cookie or pseudonymous identifiers, and interactions such as clicks, scrolling and time on page. We use this information to understand site performance, find usability problems and measure advertising. A page URL can reveal an interest in a health topic. For example, visiting an ADHD or menopause page does not prove you have that condition, but it can still be privacy-sensitive. These tools are not intended to receive clinical records or the contents of health forms.
WordPress.com and Jetpack
These services support hosting, security, performance and website features. They can receive technical logs, IP address, device, browser and page-use information. Data may be processed outside Australia.
Read Automattic's privacy notice →Google tag and Google Ads
Google technology measures visits, calls and other advertising conversions. Depending on settings and cookies, it may also support audience and advertising features. Google may process information in the United States and other countries.
Read Google's privacy policy →Meta Pixel
Meta technology records page visits and advertising events and may help measure or refine advertising audiences. Meta may process information in the United States and other countries.
Read Meta's privacy policy →Microsoft Clarity
Clarity uses cookies and interaction data to provide heatmaps and session replay, including clicks, scrolling and page movement. Microsoft describes its identifiers as pseudonymous and may process information overseas.
Read Microsoft's Clarity disclosure →Where information is held and how long.
We take reasonable steps to protect information from misuse, interference, loss and unauthorised access, modification or disclosure.
Security safeguards
- Individual accounts and access limited by role
- Passwords, multi-factor authentication where supported and secure remote access controls
- Encryption and secure transmission where supported by the system
- Backups, updates, monitoring and incident-response processes
- Confidentiality obligations, privacy training and appropriate supervision
- Restricted physical access, screen positioning, locked storage and secure disposal
- CCTV in common areas for safety and security, not routine clinical monitoring
Australia and overseas
Our core clinical record is maintained in Australia. Australian-region services are used for core clinical and health workflows where available. Website hosting, website forms, CRM, analytics, advertising and some supplier subprocessors may process personal information outside Australia. The principal known overseas location is the United States. Some global providers may use other countries listed in their privacy or subprocessor documents. Before an optional service processes consultation content, we explain the service and seek consent where required.
Adult health records
For at least seven years from the last occasion a health service was provided, subject to any reason or legal duty to keep them longer.
Records collected under 18
Health information collected while a patient is under 18 is retained until the patient turns, or would have turned, 25.
Other information
Administrative, website, communications and CCTV information is retained only as long as needed for its purpose, supplier settings and legal obligations.
Some records are kept longer where needed for ongoing care, a complaint, insurance or legal matter, a preservation requirement or another lawful purpose. When information is no longer required, we securely destroy or de-identify it and keep any disposal record required by law. If a record is transferred to another practice, we retain the transfer information and any copy required by law.
Access, correction and your choices.
You can ask what information we hold, request access, correct an error, change communication preferences or withdraw an optional consent.
Make the request
Contact Jennifer by email, phone, post or in person. You do not have to use a special form, although a written request can help us understand exactly what you need.
Confirm identity
We verify identity and, where relevant, a representative's authority before giving access. Tell us the records, date range or correction involved.
Receive our response
We aim to respond to a complete access request within 30 days. We explain any reasonable access or transfer cost before proceeding.
Access and correction
There is no charge to make a request. A reasonable fee may apply to providing copies or transferring a record. If clinical information is inaccurate, a clinician reviews it. We do not erase the original clinical entry improperly. We correct, annotate or attach a statement as appropriate so the record remains safe and accountable. Privacy law allows access to be limited in specific circumstances. If we refuse or limit access or correction, we explain the reason where permitted and tell you how to complain.
Children and representatives
A parent, guardian, carer, lawyer or other representative may request information where they have authority. We consider identity, authority, the young person's age and maturity, confidentiality, safety, best interests and applicable law before releasing it.
Adults with decision-making capacity control who receives their information. Family relationship alone does not create automatic access.
Deletion and withdrawal of consent
You may ask us to delete information or withdraw consent for an optional use. We will act where lawful and practical, but we cannot delete a clinical record that must be retained or information needed for a legal obligation. Withdrawing consent does not undo handling that was lawful before withdrawal.
Communication choices
Tell reception if you do not want routine SMS or email communication. You can unsubscribe from promotional messages. We may still need to contact you about appointments, accounts, safety, results, recalls or another clinically important matter using an appropriate channel.
Questions and privacy complaints.
Start with Jennifer if you can. She coordinates privacy requests and complaints and can explain the information flow involved.
Jennifer Williams
Practice Manager and Privacy Officer
Email: feedback@rosedalemedicalpractice.com.au
Phone: 02 9680 9644
Post:
Privacy Officer
Rosedale Medical Practice
Ground Floor, 70 Castle Hill Road
West Pennant Hills NSW 2125
Mark written correspondence or the email subject Privacy enquiry. We aim to acknowledge a complaint within 5 business days and resolve straightforward matters within 30 days. Complex matters may take longer, and we will keep you informed.
Privacy questions patients ask.
Can I get a copy of my medical record?
Yes. Contact our Privacy Officer and tell us what you need. We verify identity first and aim to respond to a complete request within 30 days. There is no fee to make a request, although a reasonable fee may apply to providing copies or transferring a record, and we will tell you first.
Can I ask Rosedale to delete my record?
You can ask, but clinical records cannot be deleted when law requires us to retain them or they are needed for ongoing care or another lawful purpose. In NSW, adult health records are generally retained for at least seven years from the last health service, and records collected while a patient is under 18 are kept until age 25.
Does Rosedale use website advertising trackers?
Yes. The website currently uses Google advertising measurement, Meta Pixel and Microsoft Clarity. They may receive page, device, cookie and interaction information. They do not have access to Rosedale's clinical record. Page visits can still reveal an interest in a health topic, so we treat this data flow as privacy-sensitive.
Does an AI system decide my care?
No. An AI scribe may create a draft note when you have been told and consented, and an online tool may suggest a pathway. A clinician remains responsible for diagnosis, treatment, prescribing and the approved clinical record. Contact reception if a digital pathway does not fit your circumstances.
Can a parent or family member access my information?
Only where they have authority or privacy law otherwise permits it. We consider identity, consent, the young person's age and maturity, confidentiality, safety and best interests. Family relationship by itself does not give automatic access to an adult's record.
Who do I contact about a privacy concern?
Contact Jennifer Williams, Practice Manager and Privacy Officer, at feedback@rosedalemedicalpractice.com.au or call 02 9680 9644. You can also contact the OAIC, IPC NSW or HCCC where appropriate.
Document owner: Dr Jaspreet Saini, Practice Principal. Last updated 15 September 2026. Next formal review May 2027, or earlier if our services, suppliers or legal obligations change.
Ask us directly about your information.
Jennifer can help with access, correction, communication preferences or a privacy concern.