Privacy Policy

About this policy

This privacy policy explains how Everion Health (ABN 11 698 379 083) of 14 Harold Street, Glenroy VIC 3046, Australia (“we”, “us”, “our”) handles personal information, including health information. It applies to people who visit our website, contact us, complete our online questionnaire, book a consultation or receive care from our GPs.

We are bound by the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth) and, as a Victorian health service provider, by the Health Privacy Principles in the Health Records Act 2001 (Vic). Where those laws set different requirements, we follow the stricter requirement. You can read the APPs on the Office of the Australian Information Commissioner (OAIC) website.

The information we collect

Personal information

Depending on how you deal with us, we may collect:

• your name, date of birth, gender, address, email address and phone number
• emergency contact details, and the details of a parent, guardian or other authorised representative where relevant
• identity documents or details used to verify your identity before a telehealth consultation
• billing and payment information (card payments are processed by our payment provider and we do not store full card numbers)
• the content of messages, enquiries and complaints you send us

Health information

Health information is a type of sensitive information and receives a higher level of protection under privacy law. It includes any information or opinion about your physical or mental health, the health services you have received or asked for, and personal information collected in providing a health service. For us, this may include:

• your answers to our online pre-screening questionnaire and any health information included in a website enquiry
• your medical, mental health, developmental, family, social and educational history
• symptoms, assessment findings, diagnoses, clinical notes and the results of screening tools completed during your care
• current and past medicines, allergies and adverse reactions, and any prescriptions issued
• referral letters, specialist reports, pathology and other test results, and correspondence with other health practitioners
• care plans, management plans and follow-up arrangements
• consultation records and metadata, such as the date, time, duration, practitioner and platform used for each consultation
• Medicare, Department of Veterans' Affairs and private health insurance details and claims

Government and healthcare identifiers

We may collect your Medicare number, Department of Veterans' Affairs file number and Individual Healthcare Identifier (IHI). We use and disclose these identifiers only for the purposes allowed by law, such as Medicare claiming, electronic prescribing and the Healthcare Identifiers Act 2010 (Cth). We do not adopt a government identifier as our own way of identifying you.

Information collected when you use our website

When you visit our website we may collect technical information such as your IP address, browser and device type, pages viewed, the page that referred you, and the time and date of your visit. See Cookies, analytics and advertising below.

How we collect information

Wherever reasonable and practicable, we collect information directly from you: through our website forms and online questionnaire, when you book, during consultations, and when you phone or email us.

With your consent, or where the law allows, we may also collect information from other people involved in your care, such as your regular GP, specialists, psychologists, pathology providers, a parent or guardian, or a person you have authorised to act for you. If we collect information about you from someone else, we will take reasonable steps to let you know.

Unsolicited information

From time to time, we may receive personal or health information that we did not solicit. Where we receive unsolicited personal information, we will promptly assess whether that information is of a kind we could have collected under our standard collection practices. If it is not, and it is lawful and reasonable to do so, we will destroy or de-identify it.

Anonymity and pseudonyms

You may make a general enquiry about our services without giving your name. However, due to the nature of the health services we provide, it is generally impracticable for us to deal with individuals who have not identified themselves. Accurate identification is required to ensure the safety and continuity of clinical care, to comply with our legal and professional obligations under applicable health legislation, and to meet the requirements of Medicare and private health insurance billing.

Why we collect, use and disclose information

We collect, use and disclose your information to:

• respond to your enquiries and assess whether a telehealth consultation may be suitable for you
• book, deliver and follow up your consultations
• provide health care, including assessment, treatment review, ongoing care, referrals and coordination with other providers, with your consent
• issue electronic prescriptions where clinically appropriate
• process payments and Medicare or private health insurance claims
• meet our legal, regulatory, professional and insurance obligations
• manage complaints, quality assurance, clinical audit and risk management
• improve our website and services using de-identified or aggregated information where possible

We only use or disclose your information for another purpose if you consent, if it is directly related to the original purpose and you would reasonably expect it, or if the law requires or allows it.

Who we may disclose information to

Where needed for the purposes above, we may disclose information to:

• other health practitioners involved in your care, such as your regular GP, specialists, psychologists and allied health providers, with your consent
• pathology and diagnostic imaging providers when your GP requests tests
• the pharmacy you choose to present a prescription to, and the electronic prescription and prescription exchange services used to send it
• Medicare (Services Australia), the Department of Veterans' Affairs and private health insurers for billing and claims
• government agencies where required by law, including the Victorian Department of Health for medicines and poisons regulation and its real-time prescription monitoring system, SafeScript
• our service providers, such as our booking and practice management, video consultation, email, IT, hosting and payment providers, who handle information only to provide their services to us
• our professional indemnity insurers, lawyers and auditors, under confidentiality obligations
• anyone you have authorised to receive it, or anyone we are required or permitted by law to disclose it to

We do not sell personal information. Some disclosures are required by law even without your consent, for example to lessen or prevent a serious threat to someone's life, health or safety, for child protection reporting, for mandatory notifications under the Health Practitioner Regulation National Law, or in response to a court order or subpoena. Our Terms and Conditions explain these limits of confidentiality.

Telehealth consultations and your privacy

All consultations are held as real-time video consultations with a qualified Australian GP. To protect your privacy and safety:

• your GP will verify your identity at the start of each consultation, for example by confirming your full name, date of birth and address, and may ask to see photo identification
• your GP will confirm where you are and ask who else is present. You may have a support person with you; please tell the GP if anyone joins or leaves during the consultation
• we ask you to take part from a private location where you cannot be overheard, using a device and internet connection you trust
• we do not record consultations without your express consent, and we ask that you do not record them without the GP's consent
• if your GP decides telehealth is not suitable for your needs, they may end the consultation and recommend in-person care. The information collected up to that point forms part of your health record

Website forms, email and our service providers

When you submit a form on our website, including our contact form and online pre-screening questionnaire, your responses are sent to us by email using Amazon Web Services (AWS) Simple Email Service in its Sydney, Australia region, and are received in our business email system.

Appointment bookings, clinical records and billing are held by our booking and practice management provider. We choose providers that store health information in Australia wherever practicable and that are bound by contract to protect it.

Overseas disclosure

We aim to store your health information in Australia. Some of our service providers are based overseas or may access information from overseas to provide technical support:

• our email and cloud providers may give their support personnel limited access from outside Australia, including from the United States
• website analytics and advertising providers, if used, such as Google and Meta, process website usage data in the United States and other countries (see Cookies, analytics and advertising)

Before disclosing personal information overseas, we take reasonable steps under APP 8 to ensure the recipient handles it consistently with the APPs, including through contractual privacy and security obligations. We will not send your health information to a recipient outside Australia without your consent, unless the Privacy Act 1988 (Cth) and the Health Records Act 2001 (Vic) otherwise allow it.

Cookies, analytics and advertising

Cookies are small files stored on your device. Because the pages you view on a health website can reveal sensitive interests, we handle website data carefully:

• Essential cookies make the website work and keep forms secure.
• Analytics cookies, such as Google Analytics, help us understand how the website is used in aggregate.
• Advertising cookies and pixels, such as the Meta Pixel, help us measure whether our advertising reaches people who visit the website.

We do not send your questionnaire answers, form content or health information to analytics or advertising providers, and we do not create advertising audiences based on health conditions. Where we use non-essential cookies, you can accept or decline them through our cookie banner, and you can block or delete cookies in your browser settings. Some parts of the website may not work as intended if you block all cookies.

Direct marketing

We only send marketing emails or messages if you have given your express consent, through a separate opt-in that is not a condition of receiving care. Every marketing message includes a simple way to unsubscribe, and you can opt out at any time by contacting us. We do not use your health information for marketing or to target advertising, and we do not sell or share your information with others for their marketing. Messages about your appointments and care are not marketing and will continue while you are a patient.

Automated tools and artificial intelligence

Our online pre-screening questionnaire uses automated rules to suggest whether booking a consultation may be a suitable next step. It does not diagnose any condition and does not decide whether you will receive any treatment.

No clinical decision, including any decision about diagnosis, treatment or prescribing, is made by an automated tool or artificial intelligence without review by your GP. If we use artificial intelligence tools in your care, such as software that helps prepare clinical notes, we will tell you beforehand and ask for your consent, your GP will review any output before it is added to your record, and the provider will be required to protect your information.

My Health Record

Everion Health does not currently view or upload information to your My Health Record. If this changes, we will update this policy before we do so. You can control access to your own My Health Record through the Australian Digital Health Agency.

Storage and security

We hold information in electronic systems with access controls, encryption in transit, multi-factor authentication where available, and audit logs. Only staff and contractors who need information to do their work can access it, and they are bound by confidentiality obligations. No method of electronic storage or transmission is free from risk, so we review our safeguards regularly.

Data breaches

We follow the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act 1988 (Cth). If we suspect a data breach, we act quickly to contain it and assess it within 30 days. If an eligible data breach is likely to result in serious harm to any individual, we will notify the affected individuals and the OAIC as soon as practicable, and tell you what happened and what steps you can take. You can read more on the OAIC's Notifiable Data Breaches page.

How long we keep your records

Under Health Privacy Principle 4 of the Health Records Act 2001 (Vic), we keep health records:

• for adults, for at least 7 years from the last occasion on which we provided a health service to you (the date of the last entry in your record)
• if the information was collected while you were under 18, at least until you turn 25

After these periods, we securely destroy or de-identify records unless another law requires us to keep them longer. Information that is not part of a health record, such as a general website enquiry, is kept only as long as we need it and then securely deleted.

Accessing and correcting your information

You can ask to see or get a copy of the personal and health information we hold about you, and ask us to correct it if it is inaccurate, out of date, incomplete or misleading. Please contact us in writing. We will verify your identity before releasing information and respond within 30 days.

We do not charge for making a request. We may charge a reasonable fee for providing copies, which will not exceed the amount allowed under Victorian health records regulations, and we will tell you the fee first. In limited circumstances the law allows us to refuse access, for example where giving access would pose a serious threat to someone's life or health. If we refuse access or correction, we will explain why in writing and tell you how to complain.

Complaints

If you have a concern about how we have handled your information, please contact our Privacy Officer using the details below. We will acknowledge your complaint promptly and aim to respond within 30 days.

If you are not satisfied with our response, you can contact:

• the Office of the Australian Information Commissioner (OAIC) on 1300 363 992 or at oaic.gov.au
• the Victorian Health Complaints Commissioner, which handles complaints under the Health Records Act 2001 (Vic), on 1300 582 113 or at hcc.vic.gov.au

Changes to this policy

We may update this policy from time to time. The current version is always on this page, with the date it was last updated.

Contact us

Privacy Officer, Everion Health

• Address: 14 Harold Street, Glenroy VIC 3046
• Email: [email protected]
• Phone: 0468 918 507

See also our Terms and Conditions and Disclaimer.