Healthengine Limited (ACN 138 767 021) and its related bodies corporate (Healthengine, we or us) is committed to protecting the privacy of your personal information. We take our responsibility for handling sensitive personal information seriously and we have put measures in place to maintain the integrity of personal information and provide full transparency on conduct. We are bound by the Australian Privacy Principles under the Privacy Act 1988 (Cth) (Privacy Act) about how we handle your personal information.
Healthengine provides a range of services that are primarily offered through our website and associated bookings mobile applications (Healthengine Network) or through our customers' websites and mobile applications (Health Professional Network) and include:
- a booking system for appointments with health professionals, including but not limited to general practitioners, dentists, allied health professionals, telehealth providers and pharmacies (health professionals);
- digital forms to assist with the registration of patients booking appointments with health professionals and/or provision of health-related services;
- a secure video conferencing solution to facilitate telehealth consultations between you and health professionals;
- a pre-vaccination screening service to facilitate the administration of vaccinations;
- an online prescription service, to request repeat prescriptions from health professionals;
- form based and form assisted digital medical consultations to request medical certificates and prescriptions from health professionals;
- a prescription fulfilment and medication delivery service delivered in partnership with Chemist2U Australia Pty Ltd (Chemist2U);
- a place for patients to store and access relevant health details and records;
- a task manager whereby patients can store, access and manage to do list activity;
- an online directory of health professionals and practices; and
- referral services to assist you in connecting with providers of other products and services which may be of interest to you
Healthengine also offers a range of services through related entities, including website design and online resources.
We are constantly evolving our services, and new services may be offered from time to time.
What information does Healthengine collect?
The personal information we collect depends on which of our services you use and the information you choose to provide.
When you use our services, you may choose to provide to Healthengine, and we may collect personal information such as:
- your name;
- your date of birth;
- your contact details (e.g. address, email address, phone number);
- your gender and/or birth sex;
- your marital status;
- cultural background;
- your emergency contact details;
- your next of kin details;
- advance health directive;
- the type of appointment you are requesting;
- the reason you are seeking that type of appointment;
- health information as defined under the Privacy Act which includes but is not limited to information about your health, illness or disability, a health service you have had or will receive, your medical records and your medications;
- billing information including MBS item numbers and rebates;
- additional information requested by your Health Professional including information they consider necessary to facilitate the provision of health appointments or health-related services;
- records of any interactions or communications you have with a Health Professional through the Healthengine Network;
- notes, records and images you provide relating to your health appointments;
- to do list activity;
- health interests;
- information about your private health insurance fund, including your
- membership number;
- your Medicare, Pension, Health Care Card and Veteran Affairs number and details;
- your photograph or image;
- financial information;
- transaction information;
- de-identified technical data such as internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access the Healthengine Network; and
- web analytics data which we may collect directly or use third party analytics tools, to help us measure traffic and usage trends for our products and services. These tools collect information sent by your browser or mobile device, including the pages you visit and other information that assists us in improving our products and services. We collect and use this analytics information in aggregate form such that it cannot reasonably be manipulated to identify any particular individual user.
If you choose to use our booking system for appointments with medical specialists, we may collect information from you as provided by your referring health professional regarding your treatment such as copies of referral letters which may include relevant medical history, symptoms, investigation results, medication and management, and other health information.
If you choose to use our digital forms or online pre-vaccination screening service, we may collect information about your health, billing information (including MBS item numbers and rebates), and other information you may provide when using these services for the purposes of facilitating your health appointment or the administration of your health appointment or vaccination, as appropriate.
If you choose to use our online prescription service, we may collect information about your prescriptions, symptoms, treating health professional and other information you may provide when using the service.
If you request the services of a third party service provider through the Healthengine Network, we may collect your personal information for the purpose of facilitating the provision of the third party services you have requested.
If you are applying for employment with us, we will collect information about you for recruitment purposes (including possible future recruitment opportunities) and human resources activities. Information collected may include but not be limited to your occupation, qualifications, citizenship, information contained in your resume, medical or health related information, employee records and other human resources personal information. We may also conduct and collect psychometric, technical skills or behavioural analysis type assessments.
If you are a health professional using our online directory, we will collect information about you and your practice (for the online directory).
If you are a referring health practitioner, we may collect information about you and your practice such as name, contact details, provider number and information relevant to providing services to referred patients.
Usually we collect your personal information directly from you. Healthengine may collect your personal information from you in various ways, including via the Healthengine Network, telephone and email.
We may also collect information from third parties, such as:
- family members, legal guardian/s and/or a person you have authorised to provide your personal information to us;
- health professionals and their practices (often via their practice management software systems), in relation to the management of appointments you have made, your requested health services, and the associated fees (including MBS item numbers and rebates); and
- platforms such as Facebook, Google and Apple with your consent for the purposes of logging in or creating a Healthengine account, and to enable this, we will collect your name and e-mail from these services for this purpose..
You do not have to use our services, and you may choose which of our services you wish to use. Some of our services, such as our online directory of health professionals and practices, do not require you to provide us with personal information. However the majority of our services do, and when you use such services we require you to provide accurate details and do not permit you to use a pseudonym or remain anonymous. For some services, certain information is designated as mandatory (which is required to use the service) and some is optional (which you may choose not to provide, but your failure to provide that information may limit your use of the service). If you do not provide personal information to Healthengine that is designated as mandatory, we will be unable to provide you with that service.
Healthengine uses social networking services such as Facebook, Twitter and Instagram to communicate with the public about its activities. Healthengine may collect your personal information when you communicate with us by using these social networking services, and the social networking services will also handle your personal information for their own activities. These social networking sites have their own privacy policies.
Why does Healthengine collect and use your personal information?
The primary reason Healthengine uses your personal information is to provide the services you have elected to receive.
Health Professional Networks: Healthengine may also collect and use your personal information and sensitive information if you interact with Health Professional Networks that have incorporated Healthengine technology in the course of the health professional providing health services to you.
Where Healthengine has collected personal and sensitive information through the Health Professional Network that incorporate Healthengine's technology, it will:
- handle your personal information in accordance with Healthengine's privacy commitments outlined in our agreements with such health professionals (Health Professional Agreement);
- disclose your personal information and sensitive information to the relevant health professional (or their affiliates and service providers), and will not otherwise have effective control or use your personal and sensitive information as detailed below unless permitted under the Health Professional Agreement;
- seek assurances from health professionals that use our services that they will handle information in accordance with applicable laws, but we have no control over and are not responsible for any health professional's use of information (including information used by their affiliates and service providers) for which it has effective control.
Subject to the above in relation to Health Professional Networks that utilise Healthengine's technology, Healthengine may use your personal information:
- to contact you about your use of the Healthengine Network;
- to facilitate communications between you and health professionals and their practices such as to remind you of an upcoming appointment, to confirm a booking, to request feedback, to complete a digital form or participate in a survey or questionnaire;
- if you decide to create a personal profile on the Network, we will store that information securely on the Network for the purpose of making your future interactions with Healthengine more convenient;
- on a de-identified basis for analysis, research and quality assurance purposes;
- for referral services, to facilitate communications between you and certain service providers (e.g., for private health insurance comparison services, providers of audiology services, and providers of cosmetic or major dental services);
- when you have provided prior agreement, for communicating with you about our products and services and those of third parties or about general or health information which you have indicated or we believe may be of interest to you. You will be able to stop receiving these communications at any time by:
- clicking on the "Unsubscribe" link on email correspondence;
- replying "Stop" to SMS correspondence; or
- emailing firstname.lastname@example.org;
- to promote and drive engagement with our products and services, including the use of targeted online advertising;
- to send push notifications to your mobile device. You can use the settings on your mobile device to enable or turn off mobile push notifications from Healthengine;
- to pre-fill forms;
- for human resources activities including but not limited to recruitment purposes and possible future recruitment opportunities;
- to report to health professionals and their practices about the use and functionality of our services, including associated financial benefits;
- for de-identified data analytics to help us improve our service and products, and our users' experience, including by monitoring aggregate metrics such as total number of visitors, traffic, and demographic patterns;
- for payment processing; and
- for other purposes that are notified to you at the time we collect your information, which you give your consent to, or which are authorised or required by law.
Who does Healthengine disclose personal information to?
Healthengine may also disclose your personal information to other persons, such as:
- third party service providers (such as IT and software service providers such as practice management software vendors, First Focus IT and MedAdvisor International, providers of research services, payment processing service providers, and our professional advisers such as lawyers and auditors), but only for the purpose of providing goods or services to us. Some of these software services allow us to advise you of certain services and benefits available to you, facilitate the provision of products and services to you or provide you with functionality associated with the Healthengine Network. We require our third party service providers to agree to appropriate privacy restrictions, and only permit them to access personal information to the extent needed to provide goods or services to us;
- upon your request, to your representatives and/or providers of other services and products which may be of interest to you, such as private health insurance companies and comparison services, providers of finance credit for cosmetic, medical and dental procedures (including major dental and cosmetic dental service providers), providers of audiology services, and providers of prescription fulfilment and medication delivery services;
- courts, tribunals, regulatory authorities and law enforcement officers, as required by law, in connection with any actual or prospective legal proceedings, or in order to establish, exercise or defend our legal rights; and
- other persons notified to you at the time we collect your personal information, who you give your consent to, or to whom we are authorised or required by law to make such disclosure.
We may also disclose de-identified information of our users to third parties that collect and process data for analysis, research and quality assurance purposes, such as:
- third parties who provide data analytics (such as Google Analytics and Hotjar) to help us improve our service and products, and our users’ experience, including by monitoring aggregate metrics such as total number of visitors, traffic, and demographic patterns;
- third party security entities to prevent various types of data processing abuse attempts and block suspicious behaviour (such as Google reCAPTCHA);
Some third party service providers used by Healthengine may store your personal information on servers located overseas. However, they must also meet our requirements for privacy and data security.
Data quality and security
Healthengine will take reasonable steps to ensure that your personal information which we may collect, use or disclose is accurate, complete and up-to-date. However, we rely on the accuracy of the personal information as entered by you or provided to us by third parties.
Healthengine will take reasonable steps to protect your personal information from misuse, interference and loss and from unauthorised access, modification or disclosure. Healthengine implements security measures including:
- physical security such as security procedures for access to our business premises; and
- IT security procedures including password protection, network firewalls, encryption, intrusion detection and site monitoring.
We store your personal information on secure servers located in Australia in an encrypted, electronic format.
Before disclosing personal information to an entity or person located overseas, Healthengine takes steps to ensure that the recipients of such information do not breach the APPs in relation to the information, by including relevant contractual provisions.
We will only retain your personal information for as long as reasonably necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal information for a longer period in the event of a complaint or for legal purposes.
To determine the appropriate retention period for personal information, we consider the amount, nature and sensitivity of the personal information, the potential risk of harm from unauthorised use or disclosure of your personal information, the purposes for which we handle your personal information and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.
Access to, deletion of and correction of your personal information
You have a right to request:
- access to your personal information;
- that your personal information be deleted or de-identified; or
- that we correct inaccuracies relating to your information.
In some circumstances, we may not be able to comply with a request that you make in respect of your personal information. For example, we may be required to retain certain information that you ask us to delete for various reasons, such as where there is a legal requirement to do so. Where these reasons to refuse a request in respect of your personal information exist, we will advise you of those reasons at the time you make your request.
If we do agree to your request for the deletion or de-identification of your personal information, we will delete or de-identify your data but will generally assume that you would prefer us to keep a note of your phone number on a register of individuals who would prefer not to be contacted. That way, we will minimise the chances of you being contacted in the future where your data is collect in unconnected circumstances. If you would prefer us not to do this, you are free to say so.
If you request that your personal information is changed, and if Healthengine does not agree to change your personal information, we will enclose your statement of the requested changes with your personal information.
If you would like to obtain access to, delete or request changes to your personal information you can ask our Privacy Officer (details below).
Healthengine can charge a reasonable fee for the time and cost of collating, preparing, and photocopying material for you if you request access to your personal information.
Where we have obtained your consent to handle your personal information, or consent to send you information, you may withdraw your consent at any time and we will cease to carry out the particular activity that you previously consented to, unless we consider that there is an alternative reason to justify our continued handling of your personal information for this purpose, in which case we will inform you of this condition.
Where Healthengine provides services directly to health professionals, this may involve Healthengine receiving and handling information separately on behalf of the health professional, for the purpose of providing those services. In these circumstances, Healthengine will return, retain or destroy any personal information that we have collected in delivering our services to a health professional in accordance with our end user terms and conditions that we agree with that health professional and/or the Health Professional Agreement.
In particular, if you wish to make a complaint about how we have handled your personal information, you should forward a written complaint to our Privacy Officer.
We will respond in writing within 30 days of receipt of a complaint. If you are not satisfied with our decision, you can contact us to discuss your concerns.
If the complaint remains unresolved, you have the option of notifying the Office of the Australian Information Commissioner (OAIC). Contact details can be found at OAIC's website: www.oaic.gov.au
How to contact us
By letter: Privacy Officer, Healthengine Limited, PO Box 7754, Cloisters Square, WA 6850, Australia.
By email: email@example.com