Privacy policy

1. Scope and commitment

Dr Constant van Schalkwyk’s practice respects your privacy and recognises that health information is sensitive. This policy explains how the practice manages personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles, the Health Records and Information Privacy Act 2002 (NSW) and the NSW Health Privacy Principles, as applicable.

In this policy, “the practice”, “we”, “us” and “our” refer to the private medical practice of Dr Constant van Schalkwyk and the people and service providers who support its operation.

2. Personal information we may collect

The information collected depends on your relationship with the practice and may include:

• your name, date of birth, gender, contact details and emergency contact;
• Medicare, Department of Veterans’ Affairs, private health insurance and other billing or claim information;
• medical history, current health, medications, allergies, examination findings, diagnoses, treatment plans, operative records and clinical correspondence;
• referrals, pathology, medical imaging, reports and records from other health practitioners or facilities;
• clinical photographs and other images, where appropriate and with the relevant authority or consent;
• appointment, communication, consent, billing, payment and administrative records;
• information needed to respond to an enquiry, complaint, access request or employment application; and
• technical information recorded in standard website security or server logs, such as an IP address, browser type and date or time of access.

We aim to collect only information that is reasonably necessary for the practice’s functions or required or authorised by law.

3. How information is collected

We usually collect information directly from you during enquiries, registration, consultations, treatment and correspondence. With your consent, where you would reasonably expect it, or where otherwise permitted by law, we may also receive information from:

• your referring practitioner and other treating health practitioners;
• hospitals, day surgeries, pathology, radiology and allied health providers;
• a parent, guardian, authorised representative, carer or family member;
• Medicare, health insurers and other funding or claims bodies; and
• other organisations involved in your care or the administration of the practice.

If information is collected about you from someone else, we will take reasonable steps to make you aware of the relevant circumstances unless an exception applies.

4. Why we collect information

We collect and handle information to:

• assess, advise, diagnose, treat and provide follow-up care;
• manage appointments, referrals, clinical records and communications;
• coordinate care with hospitals and other treating practitioners;
• obtain pathology, imaging, devices or other services required for care;
• process accounts, Medicare or insurance claims and recover payments;
• meet professional, legal, insurance, accreditation, audit and regulatory obligations;
• manage safety, complaints, quality improvement and practice administration; and
• respond to enquiries and requests.

If you do not provide information that is reasonably required, we may be unable to safely assess or treat you, arrange a service, communicate with other providers or process a claim.

5. Use and disclosure

We use and disclose information for the purpose for which it was collected, for a directly related purpose you would reasonably expect, with your consent, or as otherwise required or permitted by law. Recipients may include:

• practice staff and contracted providers who support clinical, administrative, information-technology, records, accounting or professional services;
• your GP, referring practitioner and other treating health professionals;
• hospitals, day surgeries, pathology and imaging providers, laboratories and medical-device suppliers involved in your care;
• Medicare, health insurers, compensation schemes and billing or debt-recovery providers;
• professional advisers, medical indemnity insurers, auditors and accreditation bodies; and
• courts, tribunals, regulators, law-enforcement bodies or other persons where disclosure is required or authorised by law or is necessary to address a serious threat.

Health information is not used for direct marketing unless you have expressly consented and the use is permitted by law. You may withdraw marketing consent at any time. Appointment reminders and information directly connected with your care are not treated as marketing.

6. Data quality, security and retention

We take reasonable steps to keep information accurate, complete and current, and to protect it from loss, misuse, interference and unauthorised access, modification or disclosure. Safeguards may include access controls, secure clinical and administrative systems, staff confidentiality obligations, physical security, backups and secure destruction.

Medical records are retained for at least the periods required in NSW: generally seven years from the last entry for an adult, and for a person who was under 18 at the last entry, until that person reaches or would have reached 25 years of age. Some records may be kept longer where clinically appropriate or required by law, insurance or professional obligations. Information no longer required is securely destroyed or de-identified where lawful and practicable.

If a data breach is likely to result in serious harm, we will assess and respond to it in accordance with the Notifiable Data Breaches scheme and any other applicable requirements.

7. Access and correction

You may ask for access to personal or health information we hold about you, or ask us to correct information you believe is inaccurate, incomplete, out of date, irrelevant or misleading. Please contact the practice in writing and describe the information concerned.

We may need to verify your identity or authority. Access may be provided in a reasonable form and a reasonable fee may apply for retrieval, copying or professional review where permitted by law. If access or correction is refused, we will explain the reasons and available complaint options unless it would be unlawful to do so.

8. Consent, anonymity and representatives

Where lawful and practicable, you may make a general enquiry without identifying yourself or by using a pseudonym. It is usually not practicable to provide medical assessment or treatment without accurate identifying and health information, and doing so may affect continuity of care, Medicare or insurance claims.

You may authorise another person to act for you. We will take reasonable steps to confirm that person’s identity and authority before releasing information.

9. Website, email and telephone

This website currently does not use a patient enquiry form, advertising pixels or analytics scripts. The website host may process standard technical logs needed to deliver, protect and maintain the site. If the site’s technology changes materially, this policy will be updated.

Email and ordinary internet communications may not be fully secure. Please do not send urgent or highly sensitive clinical information by ordinary email. Contact the practice by telephone to ask about an appropriate secure pathway. Email is not monitored continuously and must not be used for medical emergencies.

10. Overseas disclosure

The practice does not routinely disclose patient health records to overseas recipients. Some contracted technology or cloud-service providers may use infrastructure outside Australia. Where handling involves an overseas disclosure, we will take the steps required by applicable privacy law. The locations involved depend on the providers in use; you may contact the practice for current information relevant to your records.

11. Questions and privacy complaints

Please contact the practice first if you have a privacy question or concern. We will acknowledge and investigate a complaint, seek any further information needed and aim to respond within a reasonable period.

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner or, for NSW health information, the Information and Privacy Commission NSW.

OAIC privacy complaintsIPC NSW health privacy

12. Changes to this policy

We may update this policy when our practices, technology or legal obligations change. The current version will be published on this page with its date of update.