Your health information, handled with care.

Three commitments shape everything we do with your information. They sit above the legal mechanics below — and where they conflict with anything else on this page, the principles win.

Beyond these principles, Rosedale Medical Practice operates under the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), the My Health Records Act 2012, the NSW Health Records and Information Privacy Act 2002, and the RACGP Standards for general practices. This page explains how those obligations translate into the day-to-day care of your information.

The information we collect depends on the care you receive and the systems you interact with. In broad terms, we collect three categories of information.

Personal & demographic information

• Your full name, date of birth, gender, residential address, and contact details
• Medicare number, DVA number, private health insurance details, and pension or concession card details where relevant
• Emergency contact and next-of-kin information you choose to provide
• Cultural or language preferences relevant to your care, including Aboriginal or Torres Strait Islander status (only collected when you choose to share it, used to support culturally appropriate care)

Health & clinical information

• Your medical history, current medications, allergies, immunisations, and family medical history
• Clinical notes, examination findings, diagnoses, and treatment plans from each consultation
• Pathology results, imaging results, specialist correspondence, and discharge summaries received about you
• Mental health and substance use history, where clinically relevant to your care
• Documentation from third-party clinicians involved in your care (e.g. psychiatrists, paediatricians, allied health practitioners)

Administrative & operational information

• Records of appointments, including bookings, cancellations, and attendance
• Billing and payment information, including Medicare claims and account history
• Records of communications with you — phone calls, SMS, secure messages, and emails
• Practice CCTV footage (recorded for safety and security; not routinely accessed; retained for limited periods)

Online enquiries & screening tools

Some pages on this website let you make an enquiry or complete a short screening questionnaire, such as our ADHD Fit Check. Your result is shown to you on screen immediately. Your name and contact details, and the general pathway your answers point to, are sent by email to our reception team so they can follow up with you. Your individual answers and any score from the Fit Check are not stored by us and are not sent to any third party; they are used only to calculate the result you see on screen. Other forms on this website, such as guide and newsletter sign-ups, do retain what you submit in the website's own records. These tools are not a diagnosis and completing one does not create a medical record. If you go on to attend the practice, your doctor will take a proper history at that consultation. If you would prefer not to submit an enquiry online, please telephone the practice on 02 9680 9644. Enquiry emails are kept by the practice for 12 months and are then deleted.

If you are not a patient

We also hold information about people who are not patients: job applicants, specialists enquiring about consulting rooms, employers who use our occupational health services, other health professionals, and suppliers. This information is personal information but it is not health information, and we handle it separately from any patient record. If you attend the practice for a medical examination arranged by your employer, you are our patient for that purpose, and the information from that examination is handled as health information under the rest of this policy.

Your information is used primarily for your clinical care. Secondary uses are limited, specific, and either based on your consent or permitted by law.

Primary uses — clinical care

• Consulting with you, diagnosing, prescribing, referring, and coordinating your care over time
• Sharing relevant clinical information with other practitioners involved in your care (specialists, allied health, hospitals, pharmacies) — typically by your request or with your consent
• Following up on test results, recalls, reminders for screening, vaccinations, and chronic disease management
• Discussing your care internally where another Rosedale GP needs context to provide safe continuity

Secondary uses — limited and specific

• Billing & Medicare claims — submitting claims to Medicare, DVA, private health funds, and processing payments on your behalf
• Quality & safety activities — de-identified clinical audit, accreditation reviews under the RACGP Standards, and continuous improvement of our care
• Practice administration — appointment management, account follow-up, reception communications
• Mandatory reporting — communicable disease notification, child protection concerns, and other reporting obligations imposed by Australian law
• Insurance, legal, or workers' compensation matters — only with your written consent or court order

What we never do

• We do not sell your personal or health information to any third party — under any circumstance
• We do not use your health information for marketing or advertising purposes
• We do not share your information with insurers, employers, or family members without your specific, documented consent (with the exception of urgent clinical situations involving incapacity)

Rosedale Medical Practice maintains physical, technical, and procedural safeguards aligned with the RACGP Standards and the Australian Privacy Principles. These are reviewed annually and audited under our AGPAL accreditation.

Technical safeguards

• Clinical records are stored in Best Practice (BP Premier), an Australian-hosted clinical software platform certified to the Royal Australian College of General Practitioners' (RACGP) Standards for general practices
• All data is encrypted in transit (TLS 1.2+) and at rest
• Access requires individual user accounts, role-based permissions, and strong password requirements; multi-factor authentication is enabled for remote access
• Clinical records, including all information held in Best Practice, are stored and backed up in Australia and are subject to regular security patching
• Our website is hosted on the WordPress.com platform, which does not offer an Australian hosting location. Information submitted through a form on this website therefore passes through, and may briefly be stored on, servers outside Australia. We do not keep clinical information on this website
• Network access is firewalled and monitored; unauthorised access attempts are logged

Physical safeguards

• Premises are alarm-monitored outside of operating hours
• Workstations are positioned to prevent inadvertent disclosure of information to other patients
• Paper records (where retained) are stored in locked cabinets in restricted-access areas
• CCTV is installed in public areas of the practice for security purposes only

Procedural safeguards

• All staff sign a confidentiality agreement at commencement and receive privacy training annually
• Access to clinical records is on a strict need-to-know basis — administrative staff do not access clinical records beyond what their role requires
• Audit logs record every access to your record; logs are reviewed periodically
• De-identified data may be used for clinical audit and quality improvement; identifiable data is never shared for these purposes outside the practice

To deliver modern care we rely on a small number of trusted third-party platforms. Most of these are Australian and hold your information in Australia. Where a provider holds information overseas, we say so explicitly below.

HotDoc — online booking & patient communication

When you book online or receive SMS reminders, we use HotDoc, an Australian-owned and Australian-hosted patient engagement platform used by more than 23,000 doctors nationally. HotDoc receives your name, contact details, and appointment details — but does not have access to your clinical record. HotDoc's privacy practices are governed by Australian privacy law and their own privacy policy at hotdoc.com.au/privacy.

Best Practice (BP Premier) — clinical software

Your clinical record is held within Best Practice, the most widely used clinical software in Australian general practice. BP Premier is hosted on Australian servers and accessed only by authorised Rosedale clinicians and authorised administrative staff (within their role permissions).

My Health Record

If you have a My Health Record, Rosedale clinicians may upload clinical documents (such as shared health summaries or event summaries) and view documents uploaded by other practitioners — with your knowledge. You can control what is uploaded, what is viewable, and who can view it via your My Health Record settings at myhealthrecord.gov.au. You may opt out of My Health Record entirely without any impact on the care you receive at Rosedale.

Pathology & imaging providers

When we order pathology or imaging, your request is sent to the provider of your choice (or your nominated default). These providers have their own privacy policies and are bound by Australian privacy law. Results are returned electronically and stored in your Rosedale clinical record.

Pharmacies

Prescriptions are issued either as paper scripts or electronic scripts (eScripts) sent to a pharmacy of your choice. We do not retain a copy of your dispensing history; that is held by the pharmacy and (if relevant) by SafeScript or PBS records.

Practice website & analytics

Our website (rosedalemedicalpractice.com.au) uses cookies and basic analytics tools to understand traffic patterns and improve content. We also use Microsoft Clarity, a website analytics tool that records how visitors move through pages, including mouse movements, clicks and scrolling, so that we can find and fix problems with the site. Microsoft Corporation is a United States company and this information is processed overseas. It is used to improve the website, not to identify you. We do not run retargeting or behavioural advertising, and we do not sell any information about your use of this site. You can disable cookies in your browser settings at any time.

Heidi — artificial intelligence scribe

Some of our doctors use an artificial intelligence scribe called Heidi, provided by Heidi Health Trading Pty Ltd (ABN 84 649 783 871), an Australian company based in Melbourne. It listens during your consultation and produces a draft written note, which your doctor reviews, corrects and approves before it goes into your record. We will always tell you before an AI scribe is used, and we will ask for your consent. We do this in three ways: signage in our waiting room, a question in your pre-consultation questionnaire, and your doctor asking you directly at the start of the consultation. You are free to say no, and you can change your mind at any point during the consultation. If you would prefer your doctor to take notes the usual way, please say so; it will not affect your care. Heidi states that no audio recording is kept, that your words are transcribed as you speak and the audio is not saved, and that patient information is not used to train its artificial intelligence models. Heidi hosts its data in Australia; Heidi also states that some parts of its service rely on third parties whose servers may be located overseas. The draft note is held by Heidi for 30 days and is then deleted. The note your doctor approves is kept in your medical record in Best Practice, in Australia, in the usual way. Heidi may also suggest billing items for your consultation; your doctor reviews and decides these. The scribe drafts; your doctor remains responsible for the accuracy of your record and for what is billed.

Heidi Evidence — clinical reference tool

Our doctors may also use Heidi Evidence, a clinical reference tool from the same provider, to look up medical literature and guidelines. It is not designed to hold patient information and our doctors do not enter details that identify you. The provider states that queries may be used in de-identified form to improve that tool.

BetterConsult — pre-consultation questionnaire

Before some appointments you may receive a link to a short questionnaire from BetterConsult, operated by HealthShare Pty Ltd (ACN 147 153 526), an Australian company based in Bondi Junction. It asks about your symptoms, medicines and the reason for your visit, and turns your answers into a summary your doctor reads at the start of the consultation. Completing it is optional. HealthShare states that this information is stored on servers located in Australia and is not disclosed to anyone outside Australia. It states that information identifying you is deleted from its systems shortly after your consultation. You should know that when you agree to BetterConsult's own terms at the start of the questionnaire, you also agree that HealthShare may keep and use a de-identified version of your answers indefinitely, including combining it with other people's answers to produce analysis and insights that HealthShare owns and may share with others. This is set out in BetterConsult's Terms of Use and Privacy Policy, which we encourage you to read before you begin. If you would prefer not to complete the questionnaire, simply do not fill it in and tell your doctor at your appointment instead. It will not affect your care.

HighLevel — practice communication system

If you have consented to receive practice updates from us, or if you have contacted us about employment, consulting rooms or our services for employers, HighLevel receives your name and contact details so we can respond to you and keep in touch. It does not receive your screening answers, it does not receive information about your medical conditions or care, and it has no access to your clinical record. HighLevel LLC is a United States company, where this information may be stored.

FluentCRM — email subscriber list

If you have subscribed to receive health information or practice updates from us, your name, email address and subscription history are held in our website's own records. As set out under "Where your information is stored", the website is hosted outside Australia. You can unsubscribe from any message we send you.

Amazon Web Services — email delivery

Email that we send you is delivered through Amazon Web Services in its Sydney region, so that messages are processed in Australia. AWS handles the message in order to deliver it and does not use it for any other purpose.

Information held outside Australia or outside New South Wales

Australian privacy law requires us to tell you when your information may be held or handled outside Australia. As a New South Wales health service provider we are also required to tell you when it may be transferred outside New South Wales. Your clinical records are not transferred outside Australia. The following may be held outside Australia: this website and anything submitted through it; practice updates, if you have asked for them, which are held by HighLevel in the United States; our newsletter subscriber list, held by FluentCRM as part of this website's records; the analytics information collected by Microsoft Clarity, as described above; enquiries from people who are not patients; and some parts of the Heidi service, as described above. Where we ask for your consent to any of this, we will tell you clearly beforehand what it means, and you are free to say no. If you would rather none of your details were held outside Australia, please telephone the practice on 02 9680 9644 and we will take your enquiry by phone instead.

Telehealth consultations and electronic messaging extend the convenience of care, but they introduce additional considerations worth understanding.

Telehealth consultations

• Video and phone consultations are conducted using secure platforms that meet Australian healthcare standards
• You should attend telehealth consultations from a private environment where you can speak freely
• Clinical notes from telehealth consultations are documented in your Rosedale record exactly as for in-person care
• Recording of telehealth consultations (by either party) is not permitted without explicit, documented mutual consent

SMS, email & secure messaging

• We use SMS for appointment reminders and brief administrative messages — never for clinical content
• Email is used for sending non-urgent administrative information; we recommend it not be used for clinical questions, which should come via a consultation
• If you contact us by email or SMS, please understand that these are not encrypted end-to-end and we cannot guarantee absolute confidentiality of message contents
• For urgent matters, please call the practice on 02 9680 9644 or, if life-threatening, call 000

You have the right to access the personal and health information we hold about you, and to correct anything that is inaccurate. We will respond to your request in the timeframes set out by Australian privacy law.

Requesting access

• Submit a written request to our Privacy Officer (contact details below) — by post, email, or by completing a request form available at reception
• We will verify your identity before releasing any records
• We aim to respond within 30 days of receiving a complete request
• We may charge a reasonable administrative fee for the time required to compile and provide copies; this fee will be advised in advance

Transferring records to another practice

• If you are moving to a new GP, you can request a copy of your record (or a clinical summary) to be transferred
• Requests should be made by you, in writing, with verification of identity and the receiving practice's details
• We do not release records directly to a new practice without your request
• A reasonable fee may apply for record transfers — this is standard general practice across Australia and is consistent with RACGP guidance

Correcting your record

• If you believe information held in your record is incorrect, please raise it with reception or your GP
• Demographic information (address, contact details) can typically be corrected immediately
• Clinical information will be reviewed by your GP; corrections are documented in your record with a note explaining the change and its source

When access may be limited

In limited circumstances, Australian privacy law allows a practice to decline a request for access — for example, where release would pose a serious risk to your health or safety, or to the safety of others, or where the information relates to ongoing legal proceedings. If we ever need to decline a request, we will explain why in writing, and provide information about how to seek review of the decision.

If you believe your privacy has not been respected, or that any aspect of your care or interaction with our practice has fallen short of what you expected, we want to know.

Talk to us first

The fastest resolution is almost always a direct conversation. Speak with our Practice Manager, Jennifer Williams, or write to our Privacy Officer (details in Section 9). We will acknowledge your concern within 5 business days and aim to resolve it within 30 days. Where the matter is complex, we will keep you updated on progress.

If you'd like to escalate

If you remain dissatisfied with our response, or prefer to raise your concern with an independent body, the following are available to you:

• Office of the Australian Information Commissioner (OAIC) — for federal privacy matters and the My Health Record. oaic.gov.au · 1300 363 992
• NSW Information and Privacy Commission (IPC) — for NSW health information privacy matters. ipc.nsw.gov.au · 1800 472 679
• Health Care Complaints Commission (HCCC) — for complaints about clinical care. hccc.nsw.gov.au · 1800 043 159
• Australian Health Practitioner Regulation Agency (AHPRA) — for complaints about individual practitioners. ahpra.gov.au · 1300 419 495