Privacy Policy

This Privacy Policy explains how we collect, use, store, and protect your personal information when you become a patient of our practice. We are committed to safeguarding your privacy in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), and relevant Queensland health regulations. 

WHO IS RESPONSIBLE FOR YOUR INFORMATION  

Our practice determines why and how your personal information is used. 

We use Xestro, a secure practice management system, to store and process information. Xestro acts only as a data processor, meaning it uses your information solely under our direction and never for its own purposes. 

Some clinical documentation may be supported by Heidi, a secure AI assisted notetaking tool used to accurately capture consultation details. Heidi is used only with your consent and only to support your care. 

WHAT INFORMATION WE COLLECT 

We may collect the following information: 

Your name, date of birth, contact details, and address Medical history, symptoms, treatments, medications, allergies, and test results, Medicare, private health insurance, and billing information, Payment details where required (securely stored) Details of your appointments, referrals, and communications with us, Clinical photographs taken to document your progress, surgical planning, or outcomes 

Consultation notes, including those captured using Heidi (with your consent) 

Any information you provide during forms, questionnaires, or discussions with your clinician 

HOW WE USE YOUR INFORMATION 

We use your information to: 

• Provide safe, high-quality medical and surgical care Plan, document, and monitor your treatment, including clinical photography 
• Manage appointments, billing, and administrative tasks Communicate with you about your care (e.g., reminders, followup messages)
• Share information with your GP, specialists, hospitals, pathology, and imaging providers when necessary
• Support telehealth and secure digital communication Improve our services through quality assurance, research, and analysis (always deidentified)
• Maintain accurate clinical records, including AI assisted notes captured through Heidi with your consent 
• We will not use your information for any purpose unrelated to your care without your explicit consent. 

CONSENT FOR HEIDI AI NOTE‑TAKING

Our clinicians may use Heidi, a secure AI supported notetaking tool, during consultations to improve accuracy and efficiency. 

By signing this consent form, you agree to: 

• Allow your clinician to use Heidi during your consultation 
• Permit secure processing of consultation notes for clinical documentation 
• Understand that Heidi is used solely to support your healthcare experience 
• You may withdraw this consent at any time. 

CONSENT FOR CLINICAL PROGRESS IMAGES 

As part of your care, we may take clinical photographs to: 

• Document your baseline condition 
• Assist with surgical planning 
• Monitor healing and progress 
• Record outcomes for medical and legal purposes 

Clinical images are stored securely within your medical record and are never used for marketing, education, or publication without your separate written consent. 

You may decline photography unless it is clinically required for safe treatment. 

SHARING YOUR INFORMATION 

We may share your information with: 

• Your GP and other healthcare providers involved in your care 
• Specialists, hospitals, pathology, and imaging providers 
• Government agencies, insurers, or regulators where legally required 
• Secure technical service providers (e.g., Xestro, Heidi) who meet APP‑compliant privacy and security standards 

Most information is stored and processed within Australia. In rare cases, secure technical services may operate overseas, but only where they meet the same privacy protections required under the APPs. 

SECURITY OF YOUR INFORMATION 

We use strong security measures to protect your information, including: 

• Encryption 
• Secure access controls 
• Storage within Xestro’s ISO 27001‑certified systems 
• Restricted staff access 
• Secure handling of clinical photographs and AI generated notes 

YOUR RIGHTS 

You have the right to: 

• Access your information 
• Request corrections or updates 
• Opt. out of nonessential communications 
• Withdraw consent for Heidi notetaking or clinical photography 
• Request deletion of secondary data (where legally permissible) Make a privacy complaint if you are concerned about how your information has been handled 
• To exercise your rights, contact our practice directly. 

DATA BREACHES 

If your information is involved in a data breach that may cause you serious harm, we will: 

• Notify you promptly 
• Take immediate steps to reduce risk 
• Comply with the Notifiable Data Breaches Scheme