Medical Topics

1. PURPOSE OF OUR POLICY

1.1. This Privacy Policy deals with how we handle “personal information” as it is defined in the Privacy Act 1988 (Cth), including health information and “health information” as it is defined in the Health Records Act 2001 (Vic) (Personal Information).
1.2. Pop Up GP Pty Ltd (ACN 643­­–943­­­­–604) (we, us or our) operates a medical practice known as Pop Up GP.
1.3. We have adopted this Privacy Policy to ensure that we have standards in place to protect the Personal Information that we collect about individuals that is necessary and incidental to:
(a) conducting a medical practice;
(b) the operation of our website; and
(c) the normal day-to-day operations of our business.
1.4. We ensure that we comply with the Australian Privacy Principles set by the Australian Government for the handling of Personal Information under the Privacy Act 1988 (Cth) (Privacy Act) and the Health Privacy Principles set by the Victorian Government for the handling of Health Information established by the Health Records Act 2001 (Vic) as well as the Health Privacy Principles set by the New South Wales government pursuant to the Health Records and Information Privacy Act 2002 (NSW), and other equivalent principles set by other Australian State and Territory governments (each a Health Records Act) (together the Privacy Act and the Health Records Acts are referred to herein as the Acts).

2. WHO AND WHAT THIS POLICY APPLIES TO

2.1. We collect Personal Information on our own behalf, and our health care practitioners and practice staff may also collect Personal Information on our behalf.
2.2. This Privacy Policy applies to all forms of information, physical and digital, whether collected or stored electronically or in hardcopy.
2.3. If, at any time, an individual provides Personal Information or other information about someone other than himself or herself, the individual warrants that they have that person’s consent to provide such information for the purpose specified.

3. THE INFORMATION WE COLLECT

3.1. In the course of business, and when you become a patient of our medical practice, it is necessary for us to collect Personal Information. This information allows us to identify who an individual is for the purposes of our business, share Personal Information when asked of us, contact the individual in the ordinary course of business and transact with the individual. We will only collect information that is necessary and relevant to provide you with optimal medical care and treatment, and to manage our practice. Without limitation, the type of information we may collect is:
(a) Personal and Contact Information. When you contact Pop Up GP through our
website, we may collect your first name, last name, email address and your
phone number, as well as your telephone and fax number, third-party usernames,
residential, business and postal address and other information that allows us to
contact you;
(b) Health information. In the course of consultation or preliminary discussion with
us or our medical professionals or staff, it may be necessary to disclose, and for
us to record, the information including, but not limited to the information following
related to your health and medical history:
(i) your date of birth;
(ii) your Medicare number
(iii) healthcare identifiers;
(iv) medical information including medical history, medications, allergies,
adverse events, immunisations, social history, family history and risk
factors;
(v) your family medical background (subject to the provisions of the relevant
Health Records Act);
(vi) your health fund details;
(vii) your ethnicity; and
(viii) an emergency contact or your next of kin.
(c) Statistical Information. When you use our website we may make a record and
log some or all of the following information for statistical or maintenance
purposes:
(i) duration of use;
(ii) data level and bandwidth used;
(iii) data level uploaded and downloaded;
(iv) the type of software used.
(d) Information an individual sends us. We may collect any personal
correspondence that an individual sends us.
3.2. We may collect other Personal Information about an individual, which we will maintain in accordance with this Privacy Policy.
3.3. We may also collect information regarding an individual’s location at the time of access to our website including through the use of Application Programming Interfaces (APIs) or by reference to your IP Address.

4. HOW INFORMATION IS COLLECTED

4.1. Information will be collected from you by our healthcare practitioners and staff during the course of providing medical services, through the use of our website or generally dealing with us. We may also receive Personal Information from sources such as staff, recruitment agencies and our business partners. In particular, information is likely to be collected as follows:
(a) Appointments/Treatment: Individuals will provide Personal Information details
when they make a medical appointment with us and when they receive medical treatment from our healthcare professionals;
(b) Supply: When an individual supplies us with goods or services;
(c) Contact: When an individual contacts us in any way; and/or
(d) Access: When an individual accesses our website we may collect information
using cookies (if relevant – an individual can adjust their browser’s setting to
accept or reject cookies), APIs or analytical services;
4.2. We may also need to collect information from other sources such as treating specialists, radiologists, pathologists, hospitals and other healthcare providers. In emergency situations we may also need to collect information from your relatives or friends.
4.3. As there are many circumstances in which we may collect information both electronically and physically, we will endeavour to ensure that an individual is always aware of when their Personal Information is being collected.
4.4. Where we obtain Personal Information without an individual’s knowledge (such as by accidental acquisition or accidental disclosure) we will either delete/destroy the information, or inform the individual that we hold such information, in accordance with the Australian Privacy Principles and Health Privacy Principles.

5. WHEN PERSONAL INFORMATION IS USED AND DISCLOSED

5.1. In general, the primary principle is that we will not use any Personal Information other
than for the purpose for which it was collected other than with the individual’s
permission. The purpose of collection is determined by the circumstances in which the information was collected and/or submitted.
5.2. We may use or disclose your Personal Information in ways which are directly related to your care and treatment, or that you would reasonably expect that we may use it for your ongoing care and treatment, including:
(a) with third parties who work with our practice for business purposes, such as
accreditation agencies or information technology providers – these third parties are required to comply with the Australian Privacy Principles and Health Privacy Principles and with this policy;
(b) with other healthcare providers;
(c) when it is necessary to lessen or prevent a serious threat to a patient’s life, health or safety or public health or safety, or if it is impractical to obtain the patient’s consent;
(d) to assist in locating a missing person;
(e) to establish, exercise or defend an equitable claim;
(f) for the purpose of confidential dispute resolution process;
(g) when there is a statutory requirement to share certain medical, for example in relation to certain diseases which require mandatory notification;
(h) during the course of providing medical services through the Australian
Government My Health Record Shared Health Summaries and Event
Summaries;
(i) in providing medical records to a new health practitioner in the event of a closure of Pop Up GP subject to Principle 10 of the Victorian Health Records Act (and equivalent provisions in each other Health Records Act); and
(j) de-identified data may be used for education and research purposes, or for the collection of health statistics.
5.3. We will retain Personal Information for the period necessary to fulfil the purposes outlined in this Privacy Policy unless a longer retention period is required or permitted by law.
5.4. We may disclose personal information to affiliated companies, government agencies and other third parties in accordance with this policy and the Australian Privacy Principles and Health Privacy Principles.
5.5. We will not disclose or sell an individual’s Personal Information to unrelated third parties under any circumstances.
5.6. Information is used to enable us to operate our business, especially as it relates to an individual. This may include:
(a) the provision of access to our services;
(b) verifying an individual’s identity;
(c) communicating with an individual about:
(i) their relationship with us;
(ii) our own marketing and promotions to customers and prospects;
(iii) surveys and questionnaires;
(d) investigating any complaints about or made by an individual, or if we have reason to suspect that an individual is in breach of any of our terms and conditions or that an individual is or has been otherwise engaged in any unlawful activity; and/or
(e) as required or permitted by any law (including the Acts).
5.7. There are some circumstances in which we must disclose an individual’s information:
(a) where we reasonably believe that an individual may be engaged in fraudulent, deceptive or unlawful activity that a governmental authority should be made aware of; and
(b) as required by any law (including the Acts).

6. CHOOSING TO BE CONTACTED

6.1. An individual may opt to not have us collect their Personal Information. This may prevent us from offering them some or all of our services as a medical practice. They will be aware of this when:
(a) Opt In: where relevant, the individual will have the right to choose to have information collected and/or receive information from us; or
(b) Opt Out: where relevant, the individual will have the right to choose to exclude himself or herself from some or all collection of information and/or
receiving information from us.
6.2. If you believe that you have received information from us that you did not opt in to receive or that you opted not to receive, you should contact us using the details below.

7. SECURING YOUR PERSONAL INFORMATION

7.1. We may appoint a Privacy Officer to oversee the management of this Privacy Policy and compliance with the Australian Privacy Principles and Health Privacy Principles and the Acts. This officer may have other duties within our practice and also be assisted by internal and external professionals and advisors.
7.2. We will not disclose an individual’s Personal Information to any entity outside of the State in which the health information is collected. We will take reasonable steps to ensure that any disclosure to an entity outside of the State in which the health information is collected will not be made unless authorised by the Acts and until that entity has agreed in writing with us to safeguard Personal Information as we do.
7.3. We will take all reasonable precautions to protect an individual’s Personal Information from unauthorised access. This includes appropriately securing our physical facilities and electronic networks.
7.4. Pop Up GP uses encryption to store and transfer Personal Information. Despite this, the security of communications sent by electronic means or by post cannot be guaranteed. Each individual that provides information to us via the internet or by post does so at their own risk. We cannot accept responsibility for misuse or loss of, or unauthorised access to, Personal Information where the security of information is not within our control.
7.5. We are not responsible for the privacy or security practices of any third party (including third parties that we are permitted to disclose an individual’s Personal Information to in accordance with this policy or any applicable laws). The collection and use of an individual’s information by such third parties may be subject to separate privacy and security policies.
7.6. If an individual suspects any misuse or loss of, or unauthorised access to, their Personal Information, they should let us know immediately.
7.7. We are not liable for any loss, damage or claim arising out of another person’s use of the Personal Information where we were authorised to provide that person with the Personal Information.

8. HOW TO ACCESS AND/OR UPDATE INFORMATION

8.1. Subject to the Australian Privacy Principles and Health Privacy Principles, an individual has the right to request from us the Personal Information that we have about them, and we have an obligation to provide them with such information within 30 calendar days (or such shorter period provided for by the Acts) of receiving their written request.
8.2. If an individual cannot update their own information, we will correct any errors in the Personal Information we hold about an individual within 7 days of receiving written notice from them about those errors.
8.3. It is an individual’s responsibility to provide us with accurate and truthful Personal Information. We cannot be liable for any information that is provided to us that is incorrect.
8.4. We may charge an individual a reasonable fee for our costs incurred in meeting any of their requests to disclose the Personal Information we hold about them in accordance with Schedules 1 and 2 of the Health Records Regulations 2012 (Vic) (as amended or superseded from time to time).

9. YOUR RIGHT TO BE FORGOTTEN

9.1. If you request, we will delete or anonymise your personal data so that it no longer identifies you, unless, we are legally allowed or required to maintain certain personal data (including under the Health Records Acts), including situations such as the following:
(a) if there is an unresolved issue relating to your account, such as an unresolved claim or dispute we will retain the necessary personal data until the issue is resolved;
(b) where we are required to retain the personal data for our legal, tax, audit, and accounting obligations, we will retain the necessary personal data for the period required by applicable law; and/or,
(c) where necessary for our legitimate business interests such as fraud prevention or to maintain the security of users of our website and our patients.
9.2. Please note that if you request that we delete or anonymise your personal data, you may not be able to access our website until such time as that personal data is provided to us again or the anonymisation has been reversed.

10. COMPLAINTS AND DISPUTES

10.1. If an individual has a complaint about our handling of their Personal Information, they should address their complaint in writing to the details below.
10.2. If we have a dispute regarding an individual’s Personal Information, we both must first attempt to resolve the issue directly between us.
10.3. If we become aware of any unauthorised access to an individual’s Personal Information we will inform them at the earliest practical opportunity once we have established what was accessed and how it was accessed.

11. CONTACTING INDIVIDUALS

11.1. From time to time, we may send an individual important notices, such as changes to our terms, conditions and policies. Because this information is important to the individual’s interaction with us, they may not opt out of receiving these communications.

12. CONTACTING US

12.1. All correspondence with regards to privacy should be addressed to:
The Privacy Officer – service@popupgp.com

13. ADDITIONS TO THIS POLICY

13.1. If we decide to change this Privacy Policy, we will post the changes on our webpage at www.popupgp.com. Please refer back to this Privacy Policy to review any amendments.
13.2. We may do things in addition to what is stated in this Privacy Policy to comply with the Australian Privacy Principles and Health Privacy Principles, and nothing in this Privacy Policy shall deem us to have not complied with the Australian Privacy Principles and Health Privacy Principles.