Privacy Policy

1. Scope

This policy applies to personal information handled by Dr Marie-Claire Edmunds in connection with the medical practice, website, appointments and communications.

The practice handles personal and health information in line with the Privacy Act 1988 (Cth), the Australian Privacy Principles and the Health Records Act 2001 (Vic), as applicable.

2. Information we collect and hold

The information collected depends on how you deal with the practice and may include:

• your name, date of birth, contact details, emergency contact and identity details;
• appointment, referral, billing and payment information, without storing full card details where a payment provider handles them;
• health information such as your medical history, conditions, medicines, allergies, symptoms and treatment goals;
• consultation notes, consent records, treatment records, clinical photographs, imaging, correspondence and outcomes;
• enquiries, feedback, complaints and other communications with the practice; and
• limited technical information about visits to the website, described below.

3. How information is collected

Information is usually collected directly from you during enquiries, booking, registration, consultations, treatment and follow-up. It may be collected in person, by telephone, email, secure form or through a booking, payment or practice-management provider.

Where authorised or permitted by law, information may also come from a parent, guardian, carer, referring practitioner, another health provider, insurer or other person involved in your care.

You may deal with the practice anonymously or using a pseudonym where this is lawful and practical. Medical care usually requires accurate identifying and health information so that safe care and proper clinical records can be provided.

4. How information is used

Personal and health information may be used to:

• assess your needs, provide medical care and maintain clinical records;
• manage appointments, reminders, payments, follow-up and enquiries;
• communicate with you and, with authority, people involved in your care;
• meet professional, clinical, insurance, safety, reporting and legal duties;
• respond to complaints, incidents, access requests and legal claims; and
• improve the safety and administration of the practice using information that is de-identified where appropriate.

Health information will not be used for an unrelated purpose unless you consent or the use is otherwise permitted or required by law.

5. Who information may be shared with

The practice may disclose information when reasonably needed for your care or the operation of the practice, including to:

• health practitioners, diagnostic providers and other people involved in your care;
• booking, practice-management, payment, communications, secure storage and IT providers;
• professional advisers, accountants, insurers and contractors who are required to protect the information;
• government agencies, regulators, courts, emergency services or law enforcement where authorised or required by law; and
• another person or organisation where you have consented to the disclosure.

The practice does not sell or rent patient information.

6. Marketing

Health information is not used for direct marketing without your specific consent. If you choose to receive practice news or reminders, you can withdraw that choice at any time by using the unsubscribe option or contacting the practice.

7. Website, booking and analytics

The website callback form collects your first and last name, mobile number, email address, callback preference, selected concern, brief description and consent to collect these details and contact you. It also records the page and campaign that led to your enquiry. On the laser enquiry form, selecting Save and continue after agreeing to the contact notice saves your contact details, even if you do not complete the next step. The expanded enquiry is saved when you submit it. Other callback forms save details on submission. Typing or autofill alone does not send your details. Please keep your concern description brief and leave detailed medical history, medicines and photographs for your consultation. If online booking is enabled, you may be directed to a third-party booking service. Information entered there is handled under that provider's privacy terms as well as the practice's obligations.

The website uses Fathom Analytics to understand aggregate visits and page use. Fathom is configured without advertising cookies and is not used to build patient profiles. Callback form events record whether a form was started, successfully submitted or encountered an error. Your name, contact details and enquiry text are not sent to Fathom.

The website also uses Dapple visitor tracking to attribute enquiries and bookings to the campaigns that brought visitors to the site. Dapple stores a randomly generated visitor identifier in browser storage and a first-party cookie for up to one year, and retains campaign parameters in browser storage. It receives the page address, referring page, campaign parameters and limited browser, device and platform information. This tracker does not collect medical, booking or payment details from this website.

Submitted callback requests pass through Vercel website hosting to Google Apps Script and a private Google Sheets enquiry tracker. Resend sends an email notification containing the submitted enquiry details to the practice. Dr Marie-Claire and authorised administrative or technical support can use these records to respond and track follow-up. Submitting an enquiry does not subscribe you to marketing.

Website hosting and security services may also process technical information needed to deliver and protect the site.

Email is useful for general enquiries but may not be suitable for urgent or highly sensitive medical information. Please do not use the website or email for emergencies.

8. Storage, security and retention

Records may be held electronically or in hard copy using practice systems and contracted service providers. Reasonable technical, physical and administrative safeguards are used to protect information from loss, misuse, interference and unauthorised access, modification or disclosure.

Access is limited to people who need the information for their work. Information is kept for the periods required by health-record, professional and other applicable laws, then securely deleted or de-identified where lawful and practical.

If a data breach is suspected, the practice will investigate, contain the issue and make notifications required under applicable law.

9. Overseas processing

Google, Vercel and other providers supporting website hosting, email, enquiry storage, analytics or other practice functions may process or store limited information outside Australia. Depending on the provider and service, this may include the United States, Europe or other countries where the provider operates. The practice takes reasonable steps required by law before disclosing personal information overseas.

10. Access and correction

You may ask to access personal or health information held about you, or ask for it to be corrected if it is inaccurate, incomplete, out of date, irrelevant or misleading. Please make the request in writing using the contact details below.

The practice may need to confirm your identity. Access can be refused or limited where the law permits. If that happens, the practice will explain the reason where it is lawful to do so. A reasonable fee may apply for providing access to health records where permitted by law, but there is no fee to make a request.

11. Privacy questions and complaints

If you have a privacy question or believe your information has been mishandled, contact the practice in writing. Please include enough detail to investigate the issue. The practice will acknowledge the concern and aim to respond within a reasonable time, usually within 30 days.

If you are not satisfied with the response, you may contact the Office of the Australian Information Commissioner or the Victorian Health Complaints Commissioner.

12. Changes to this policy

This policy may be updated when the practice's services, systems or legal obligations change. The current version and update date will be published on this page.