Privacy Policy

1. Purpose and scope

Medics Online Pty Ltd (Medics Online, we, us or our) provides telehealth and related healthcare services. We respect the privacy of our patients and other individuals and are committed to handling personal information, including sensitive health information, in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), the My Health Records Act 2012 (Cth), the Healthcare Identifiers Act 2010 (Cth), and other applicable laws and professional obligations.

This Privacy Policy explains the kinds of information we collect and hold, how we collect, use, disclose and protect it, and how you can request access or correction or make a privacy complaint.

2. Personal and sensitive information we may collect

The information we collect depends on the services you use and may include:

• Identity and contact information, including your name, date of birth, address, telephone number and email address;
• Medicare, Department of Veterans’ Affairs and Individual Healthcare Identifier details, where relevant;
• Health information, including medical history, symptoms, diagnoses, medications, allergies, consultation notes, treatment information and clinical correspondence;
• Photographs, pathology or radiology reports, referral letters and other documents provided for clinical assessment;
• Information about prescriptions, medical certificates, referrals, test requests and other healthcare services;
• Booking, payment, invoicing and transaction information. We generally do not retain complete payment-card details where these are processed by our booking or payment provider;
• Communications with us, including telephone, email, SMS, website and complaint correspondence; and
• Technical information associated with use of our website, such as IP address, browser type, device information and cookies or similar technologies.

Health information is sensitive information under the Privacy Act. We collect it only where reasonably necessary for our functions and activities and where collection is permitted by law, including with your consent or as necessary to provide a health service.

3. How we collect information

We usually collect information directly from you, including through HotDoc booking and pre-consultation forms, telephone consultations, email, SMS, website enquiries and documents or photographs you provide when requested.

Where permitted or authorised, we may also collect information from a parent, guardian or authorised representative; another treating practitioner or healthcare provider; a pharmacy; a pathology or diagnostic-imaging provider; Medicare, DVA, the Healthcare Identifiers Service or My Health Record; or another person or organisation involved in your care.

If you provide personal information about another person, you should be authorised to do so and should tell that person about this Privacy Policy where appropriate.

4. Why we collect, use and disclose information

We may collect, use and disclose personal information for purposes including:

• Confirming identity, eligibility and contact details;
• Providing, coordinating and documenting healthcare;
• Assessing clinical suitability for telehealth and recommending in-person or urgent care where required;
• Issuing or transmitting prescriptions, medical certificates, referrals and test requests where clinically appropriate;
• Communicating with patients, representatives, pharmacies, other practitioners and healthcare providers;
• Managing bookings, billing, payments, refunds, accounts and administration;
• Maintaining clinical and business records, quality assurance, clinical governance, training and service improvement;
• Responding to enquiries, feedback, incidents, claims and complaints;
• Meeting legal, regulatory, professional, insurance, public-health and reporting obligations; and
• Protecting the safety, rights and legitimate interests of patients, practitioners, staff and the public.

We may also use or disclose information for a related secondary purpose where you would reasonably expect this, with your consent, or where otherwise required or authorised by law. We do not sell patient information.

5. Service providers and disclosures

We may disclose relevant information, on a need-to-know basis and where permitted by law, to:

• Our medical practitioners, authorised staff and contractors involved in providing or administering services;
• HotDoc for bookings, patient communications and payment processing;
• Best Practice and other authorised clinical-record, secure messaging, electronic prescribing, email, telecommunications, hosting, cybersecurity and IT-support providers;
• Pharmacies, electronic-prescribing services, pathology and diagnostic-imaging providers, specialists and other treating practitioners;
• Medicare, DVA, the Healthcare Identifiers Service, My Health Record and other government bodies where applicable;
• Professional advisers, insurers, auditors, accreditation bodies, regulators, courts and law-enforcement bodies where required or authorised; and
• Another person or organisation where you have consented or requested that we do so.

Third-party services may have their own privacy notices. We take reasonable steps to use reputable service providers and to require appropriate handling and protection of personal information.

6. My Health Record and healthcare identifiers

Where Medics Online accesses or contributes information to My Health Record, it does so in accordance with applicable legislation, patient access controls and healthcare-provider obligations. You may manage access controls and ask that particular information not be uploaded where the law permits. Information downloaded into our own clinical system is then handled as part of our clinical record.

We may collect and use an Individual Healthcare Identifier to correctly identify you and support electronic healthcare services, including electronic prescriptions.

7. Clinical photographs and documents

If a practitioner requests photographs or documents for a telehealth assessment, you may be instructed to provide them by email or another approved method. These materials may become part of your clinical record and will be used for your care, clinical documentation and related lawful purposes.

Email may carry security risks. Please send only the information requested, check the recipient address carefully and avoid including unnecessary identifying information. A photograph-based or telephone assessment does not replace dermoscopy, physical examination, biopsy or other in-person assessment when clinically required.

8. Direct marketing

We do not currently use patient health information for direct marketing. If we introduce service-related marketing in the future, we will comply with applicable privacy and electronic-communications laws, obtain consent where required and provide a simple way to opt out. We may send non-marketing communications that are reasonably necessary for your care, booking, billing, safety or administration.

9. Overseas disclosure and cloud services

Medics Online does not currently authorise overseas staff to access identifiable patient information. Some technology, communications or cloud-service providers may nevertheless process, support or store information using infrastructure located outside Australia. Before disclosing personal information to an overseas recipient, we will take reasonable steps required by the APPs and will assess the provider’s privacy and security arrangements. Where practicable, we will provide further information about likely overseas locations on request.

10. Security and data breaches

We use reasonable administrative, technical and physical safeguards designed to protect information from misuse, interference, loss and unauthorised access, modification or disclosure. These measures may include access controls, authentication, staff confidentiality requirements, secure clinical systems, backups, monitoring and incident-response procedures.

No electronic system or method of transmission is completely secure. If an eligible data breach occurs, we will assess and respond to it in accordance with the Notifiable Data Breaches scheme and any applicable My Health Record requirements, including notifying affected individuals and regulators where required.

11. Retention and destruction

We retain clinical, booking, billing and business records for the periods required by applicable laws, professional standards, contractual obligations and legitimate clinical or administrative needs. Different retention periods may apply depending on the record type and whether the patient was a child when the service was provided. When information is no longer required, we take reasonable steps to securely destroy it or permanently de-identify it, unless retention is required or authorised by law.

12. Access to and correction of information

You may request access to personal information we hold about you or ask us to correct information you believe is inaccurate, out of date, incomplete, irrelevant or misleading. Please email hello@medics-online.com.au and provide enough information for us to identify you and understand your request.

We may require proof of identity. We will respond within a reasonable period and will provide access in the manner requested where reasonable and practicable. We do not charge for making a request, but we may charge a reasonable administrative cost for providing access where permitted. If we refuse access or correction, we will generally provide written reasons and information about available complaint mechanisms, unless the law permits otherwise.

13. Privacy complaints

If you have a privacy concern or believe we have not complied with this policy or applicable privacy law, please contact our Privacy Officer at hello@medics-online.com.au. Include your name, contact details, a description of the concern and any relevant documents.

We will acknowledge and investigate the complaint and aim to provide a substantive response within 30 days. If additional time is required, we will explain why and provide an updated timeframe.

If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner through www.oaic.gov.au. Other healthcare complaint or regulatory avenues may also be available depending on the nature of the concern.

14. Website links and cookies

Our website may use cookies and may link to services operated by third parties, including HotDoc. External websites and platforms are governed by their own terms and privacy practices. We are not responsible for third-party content or privacy practices, but we encourage you to review the relevant notices.

15. Changes to this policy

We may update this Privacy Policy to reflect changes to our services, technology, legal obligations or practices. The current version and effective date will be published on our website.

16. Contact

Privacy Officer
Medics Online Pty Ltd
ABN 12 696 699 153
Email: hello@medics-online.com.au

Effective date: 23 August 2026