Who to contact about privacy
Questions, requests or complaints about privacy may be directed to:
Amanda Cox-Edwards
Upwey Acupuncture
42 Ropley Grange
Upwey VIC 3158
Phone: 0475 866 754
Email: amanda@upweyacupuncture.com.au
Why we collect personal and health information
We collect personal and health information that is reasonably necessary to provide safe, appropriate and effective healthcare and to operate the clinic.
We may collect, hold, use or disclose information to:
- identify you and maintain an accurate patient record;
- assess your health, symptoms, medical history and treatment needs;
- provide acupuncture, Chinese herbal medicine and related services;
- prepare and review treatment plans;
- prescribe, order or supply herbal products where appropriate;
- communicate with you about appointments, treatment and follow-up care;
- communicate with another healthcare provider involved in your care;
- process payments, receipts and private health insurance claims;
- manage referrals, reports, test results and other clinical correspondence;
- respond to enquiries, feedback or complaints;
- meet our legal, regulatory, professional and insurance obligations;
- support clinical governance, safety, record keeping and quality improvement; and
- administer and protect our website, systems and business operations.
Where personal information is requested for clinical care, you are not required to provide it. However, incomplete or inaccurate information may limit our ability to provide suitable or safe treatment.
What information we collect
Depending on your relationship with the clinic, the information we collect may include:
- your name, date of birth, address and contact details;
- your emergency contact and, where relevant, parent, guardian or responsible person;
- appointment and attendance information;
- medical history, symptoms, diagnoses and current health concerns;
- information about medications, supplements, allergies and adverse reactions;
- family, social and lifestyle history relevant to your care;
- information about pregnancy, fertility or reproductive health where relevant to treatment;
- information about previous or current healthcare and healthcare providers;
- clinical observations, treatment notes and treatment outcomes;
- referrals, medical reports, pathology results, imaging or other documents you provide;
- details of acupuncture, herbal medicines and other treatment provided or recommended;
- private health fund, payment and transaction information;
- emails, text messages, telephone notes and other communications;
- photographs or other images where clinically necessary and collected with appropriate consent; and
- technical information generated when you use our website, such as your IP address, browser type, device type, pages visited and referring website.
Personal information collected in the course of providing a health service may form part of your health information and clinical record.
How we collect information
Where practical, we collect personal and health information directly from you.
Information may be collected when you:
- make an appointment;
- complete a patient registration or health-history form;
- attend a consultation or treatment;
- speak with us by telephone;
- send an email or text message;
- use the website contact form;
- use an online appointment system;
- provide a referral, report, image or test result;
- make a payment or private health insurance claim; or
- communicate with us through another channel.
Where permitted by law and reasonably necessary for your care, we may also collect information from:
- a parent, guardian, carer or other responsible person;
- another healthcare practitioner or health service;
- a referring practitioner;
- a hospital, pathology provider or diagnostic service;
- a private health insurer;
- a supplier involved in dispensing or providing prescribed herbal medicine; or
- another person authorised by you.
We will take reasonable steps to ensure you understand why the information is being collected and how it will be handled.
Consent
When you provide personal and health information to Upwey Acupuncture for the purpose of receiving healthcare, you consent to that information being collected, held, used and disclosed as reasonably necessary to provide and manage your care.
Consent may be express or implied, depending on the circumstances. We will seek additional consent where information is to be used or disclosed for a purpose that is not directly related to your care, not reasonably expected or not otherwise permitted by law.
Consent to the handling of personal information is separate from consent to treatment.
You may withdraw consent for a particular use or disclosure by contacting us. Withdrawal will not affect any collection, use or disclosure that has already lawfully occurred and may affect our ability to continue providing particular services.
Children and young people
Upwey Acupuncture provides services to children and young people. Information about a child may be collected from the child and from their parent, guardian or responsible person.
How information is handled will depend on the young person’s age, maturity, capacity, wishes and circumstances, together with our legal and professional responsibilities. Where appropriate, we will explain privacy and consent arrangements to both the young person and their parent or guardian.
Remaining anonymous
You may make a general enquiry anonymously or using a pseudonym where it is lawful and practical to do so.
For clinical care, it will usually be necessary to confirm your identity and collect accurate information so that we can maintain appropriate health records, provide safe treatment, communicate with other providers and process payments or private health insurance claims.
How we use and disclose information
We generally use and disclose personal and health information for the primary purpose for which it was collected: providing and managing your healthcare.
Information may also be used or disclosed for a directly related purpose that you would reasonably expect, or where you have consented.
Depending on the circumstances, information may be disclosed to:
- healthcare practitioners or services involved in your treatment;
- a person you have authorised, such as a parent, guardian, carer or representative;
- private health insurers for claim or payment purposes;
- service providers that support appointments, communications, clinical records, payments, website operation, data storage, cybersecurity or technical support;
- suppliers involved in preparing or providing prescribed herbal medicines;
- professional advisers, auditors and insurers where reasonably necessary;
- the Chinese Medicine Board of Australia, Ahpra or another regulator where required or authorised;
- courts, tribunals, law-enforcement bodies or government agencies where required or authorised by law; or
- another person or organisation where disclosure is necessary to lessen or prevent a serious threat to life, health or safety and the law permits the disclosure.
Only information reasonably necessary for the relevant purpose will be disclosed.
We do not sell patient information or disclose it to third parties for their own direct marketing.
Referrals and continuity of care
With your consent, or where otherwise permitted by law, we may exchange relevant health information with another healthcare provider involved in your care.
You may also request that some or all of your health information be transferred or made available to another health service provider. We will facilitate lawful requests within a reasonable period after verifying your identity and authority.
Photographs, testimonials and social media
Clinical photographs or other images will only be collected where reasonably necessary and with appropriate consent.
We will not publish, post, reproduce or use identifiable patient information, photographs, recordings, treatment stories or testimonials for marketing, social media, education or another public purpose without specific, informed and written consent.
Consent for this kind of use is voluntary and is not a condition of receiving treatment.
Direct marketing
We will only use your personal information to send promotional communications where you have consented or where the communication is otherwise permitted by law.
You may opt out at any time by using the unsubscribe method provided or by contacting the clinic. Administrative communications concerning appointments, treatment, safety, payments or ongoing care are not considered marketing communications.
Website, cookies and analytics
When you visit the Upwey Acupuncture website, certain technical information may be collected automatically. This may include your IP address, browser and device details, pages visited, approximate location, referring website and the date and time of your visit.
The website may use cookies and analytics services to:
- operate website functions;
- understand how visitors use the website;
- identify technical problems;
- maintain website security; and
- improve the content and user experience.
You can restrict or delete cookies through your browser settings, although doing so may affect parts of the website.
Information submitted through the contact form, email or an online booking service may be handled by third-party technology providers. Please avoid including more sensitive health information than is necessary in a general website enquiry. You may telephone the clinic if you would prefer not to send health information electronically.
Links to external websites are provided for convenience. Upwey Acupuncture is not responsible for the privacy practices of external websites.
Overseas processing and disclosure
Some technology providers used for website hosting, email, communications, online appointments, analytics, technical support or data backup may store or process personal information outside Australia.
Depending on the provider and its infrastructure, overseas processing may include the United States and other countries in which the provider or its subcontractors operate. It may not always be practicable to identify every location used by a distributed technology provider.
Where an overseas service is used, we take reasonable steps appropriate to the circumstances to select reputable providers and protect personal information. Clinical information will not otherwise be intentionally disclosed to an overseas recipient without your consent unless the disclosure is required or authorised by law.
You may contact us for current information about the providers used by the clinic and any known overseas processing locations.
How information is stored and protected
Personal and health information may be held in electronic clinical records, appointment systems, emails, correspondence, images, financial records and, where applicable, paper documents.
We take reasonable administrative, physical and technical steps to protect information against misuse, interference, loss, unauthorised access, modification and disclosure. These measures may include:
- password-protected systems and devices;
- individual access controls;
- secure clinical and business software;
- device and account security;
- secure storage of paper records;
- backups and software updates;
- limiting access to people who need the information for an authorised purpose; and
- secure disposal of information when legally permitted.
No electronic transmission or storage system can be guaranteed to be completely secure.
If a suspected data breach occurs, we will assess and respond to it promptly. Where a breach is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.
Retention and secure destruction
Victorian law restricts when a health service provider may delete health records.
Health records will generally be retained:
- for more than seven years after the last occasion on which Upwey Acupuncture provided a health service to an adult patient; and
- where information was collected while the patient was a child, until the patient reaches 25 years of age or for more than seven years after the last health service was provided, whichever is later.
Records may be kept longer where required or authorised by another law, where reasonably necessary for legal or insurance purposes, or where continued retention is otherwise permitted.
When information is no longer required and may lawfully be disposed of, it will be securely destroyed or permanently de-identified. Where required, a record of the destruction or transfer will be retained.
If the clinic closes, relocates or transfers ownership, reasonable steps will be taken to notify affected patients and ensure that health records remain securely stored and accessible in accordance with Victorian law.
Accessing your information
You may request access to the personal or health information we hold about you. Depending on the circumstances, access may be provided through:
- inspection of the record;
- a copy of the record;
- an agreed summary;
- an explanation of the information; or
- transfer to another healthcare provider.
Requests should be made to Amanda Cox-Edwards using the contact details at the beginning of this policy. We may ask you to verify your identity and authority before releasing information.
We will respond within a reasonable period. A reasonable fee may be charged where permitted by law to cover the cost of locating, preparing or providing access to records. We will advise you of any proposed fee before proceeding.
Access may be refused or limited where permitted by law, including where providing access would create a serious threat to health or safety, unreasonably affect another person’s privacy, disclose information connected with legal proceedings or otherwise be unlawful.
If access is refused, we will generally provide written reasons and explain the available complaint options.
Correcting your information
We take reasonable steps to keep personal and health information accurate, complete, up to date and relevant.
You may ask us to correct information you believe is inaccurate, incomplete, misleading or out of date. There is no charge for requesting a correction.
Health records cannot ordinarily be deleted merely because information is disputed. Where we do not agree to make a requested correction, you may provide a written statement explaining the correction you seek, which may be retained with the record as required by law.
Privacy complaints
Please contact Amanda Cox-Edwards if you believe your information has been mishandled or this policy has not been followed.
Please provide:
- your name and contact details;
- an explanation of your concern;
- relevant dates or communications; and
- the outcome you are seeking.
We will acknowledge the complaint, investigate it fairly and aim to provide a response within 30 days. If additional time is required, we will explain why and provide an updated timeframe.
If you are not satisfied with our response, you may contact:
Health Complaints Commissioner — Victoria
For complaints concerning health services or the handling of health information in Victoria.
Phone: 1300 582 113
Website: hcc.vic.gov.au
Office of the Australian Information Commissioner
For complaints concerning the Australian Privacy Principles or the Privacy Act 1988.
Phone: 1300 363 992
Website: oaic.gov.au
Depending on the nature of the concern, you may also be entitled to contact the Chinese Medicine Board of Australia or Ahpra about the professional conduct of a registered practitioner.
Changes to this policy
We review this Privacy Policy periodically to ensure that it reflects our current practices and legal obligations.
Updated versions will be published on the Upwey Acupuncture website with a revised effective date. Where a change materially affects how existing patient information is handled, we will take reasonable steps to notify affected patients where appropriate.
Contact details
Amanda Cox-Edwards
Upwey Acupuncture
42 Ropley Grange
Upwey VIC 3158
Phone: 0475 866 754
Email: amanda@upweyacupuncture.com.au
