Privacy Policy

Main Street Medical Centre — Privacy and collection statement

Effective date: 4 October 2026 | Supersedes: 27 June 2026 version | Next review: June 2027

1. About this policy

Main Street Medical Centre is operated by Varamalli Pty Ltd ATF The Potter Family Discretionary Trust, ABN 88 230 966 368, at 71 Main Street, Pialba QLD 4655. This policy explains how we handle personal information about patients, representatives, website visitors, people giving feedback and job applicants.

We are subject to the Privacy Act 1988 (Cth), including the Australian Privacy Principles (APPs) and Notifiable Data Breaches scheme. Our information-handling procedures also take account of applicable healthcare legislation and RACGP standards. The Practice Manager is responsible for privacy enquiries and complaints. Contact details are in section 16.

You can obtain a free copy at reception or on our website. Please ask if you need assistance, an interpreter or the information in another accessible format. This policy explains our practices; reading it or using our website does not, by itself, give consent to every use of your information.

2. Information we collect

We collect information reasonably necessary for your care and for operating the practice. Depending on your dealings with us, this includes:

• Name, date of birth, contact details, gender, emergency contacts and authorised representatives.
• Medicare, DVA and healthcare identifiers; concession or insurance details where relevant; appointment, billing and payment information.
• Health information, including symptoms, medical and family history, medicines, allergies, immunisations, examination findings, test results, clinical photographs, correspondence, consultation notes and care plans.
• Other sensitive information relevant to care, such as cultural background, Aboriginal or Torres Strait Islander status, disability or social circumstances.
• Enquiries, feedback, complaints and survey responses; recruitment details such as a CV, qualifications, employment history and referee information.
• Website and security information described in sections 10 and 12.

Health information is sensitive information. We collect it with your consent, except where a law permits or requires collection without consent. We do not collect more information than is needed for the relevant purpose.

3. How we collect information and your choices

We usually collect information directly from you through consultations, registration forms, phone calls, bookings, correspondence and online forms. With your consent, or another lawful basis, we may also collect relevant information from other treating practitioners, hospitals, pathology and imaging providers, My Health Record, carers or authorised representatives. Where appropriate, we explain collection from another source.

You may ask to deal with us anonymously or under a pseudonym where lawful and practicable, including when giving general feedback. Identification is usually necessary for safe clinical care, prescriptions, Medicare claims and matching records. If you do not provide information needed for a service, we will explain any resulting limitation.

Tell us if your details change, or if you wish to limit a particular disclosure or withdraw consent. Withdrawal applies to future handling that relies on that consent; it does not undo earlier lawful handling or remove legal record-keeping duties. We will explain any effect on care and available alternatives.

We assess a young person’s capacity to make their own privacy decisions. A parent, partner or carer does not automatically have access to all records. Where a person cannot make the relevant decision, we check the authority of their representative and disclose only as authorised or otherwise permitted by law.

4. Why we use information

We use information to assess, treat and coordinate your care; prepare care plans and referrals; arrange appointments; manage recalls, reminders and results; communicate with you; bill for services and process Medicare or DVA claims; and maintain clinical records.

We also use relevant information to manage enquiries and complaints, maintain secure systems, meet accreditation and professional obligations, and undertake internal quality improvement. For external planning and statistical reporting, including to the local Primary Health Network, we use de-identified information wherever possible.

Other uses require your consent or a legal basis, such as a directly related purpose you would reasonably expect. Identifiable information for research or teaching is handled only with appropriate consent or another applicable legal authority and safeguards. We do not sell or trade personal information. We do not use health information for direct marketing without your consent; you can withdraw marketing consent.

5. Who may receive information

We share only information relevant to the purpose, with your consent or as otherwise permitted or required by law. Recipients may include:

• Practitioners and services involved in your care, including specialists, hospitals, allied health providers, Sullivan & Nicolaides, QML, I-MED Radiology and Bayside Radiology.
• Your authorised representative, or an insurer, solicitor or other recipient specifically authorised by you. We check identity, authority and the scope of the request.
• Medicare, DVA and other authorities where required for claims, public health notifications, legal duties or a valid court or tribunal order. Limited disclosure may also be lawful in an emergency or to address a serious threat.
• Service providers supporting the practice: Best Practice for clinical records; Noytech for IT support; Cubiko for practice analysis; Automed and HotDoc for booking and patient communications; HealthLink for secure messaging; and MyGPMPtool, Lyrebird and Heidi as explained below.
• Website, communications and administration providers, including SiteGround for hosting and Google services for online forms, documents, email, website backups and website measurement.

Authorised clinical and administrative staff access information according to their duties. Providers handling information on our behalf are subject to applicable privacy and security requirements. Their involvement does not remove our responsibility for information we control.

6. AI scribes, care plans and computer-assisted processes

Doctors may use Lyrebird or Heidi to capture consultation speech, transcribe it and prepare draft notes or correspondence. Before using an AI scribe, the doctor explains its use and obtains and records your informed consent. You may decline, ask for it to be paused or stopped, or withdraw consent to future use without being disadvantaged in your routine care. The doctor can document the consultation another way.

We also use MyGPMPtool (My GPMP) to prepare and manage care plans and support care coordination. Relevant information may include your identifiers, medical history, conditions, medicines, test results, care goals and treating providers. We explain the use and sharing involved and obtain consent where required. Ask your clinician about alternatives if you do not want a particular optional tool used.

These tools may process spoken information, supplied clinical information and draft documents. Audio, transcripts and drafts may have different retention settings from the final medical record; your doctor can explain what is captured and the applicable settings. Reviewed notes and care plans saved in Best Practice become part of your clinical record. We do not authorise unrelated use of patient information for advertising or AI-model training.

AI can make errors. The treating practitioner reviews and corrects drafts and remains responsible for clinical decisions. Computer programs do not independently determine your diagnosis, treatment or access to our services. Care-planning tools may assist preparation of management recommendations; clinicians assess their suitability with you. Practice systems, including Cubiko and recall systems, may assist staff to identify follow-up, care or billing opportunities using relevant clinical, demographic and appointment information. Staff review the information before acting.

You can ask how a tool was used, raise concerns about an output or request correction of information in your record. We review these practices when tools or their functions change, including the privacy transparency requirements for significant computer-assisted decisions commencing on 10 December 2026.

7. My Health Record and healthcare identifiers

Where authorised, we use healthcare identifiers to accurately match records and access or upload relevant information to My Health Record for your healthcare, under the Healthcare Identifiers Act 2010 and My Health Records Act 2012 and their rules. We respect your access controls and any applicable consent requirements. Tell your clinician if you do not want a particular document uploaded; we must respect that request. My Health Record is separate from the complete medical record we hold at the practice.

8. Communication and confidentiality

We communicate by phone, SMS, email and secure clinical messaging, including HealthLink. Please tell us your preferred contact method and whether messages may be left. We check contact details and limit information in reminders to reduce unintended disclosure.

Ordinary email and SMS have privacy risks. We discuss suitable options when sending health information and use secure methods where appropriate. Choosing a communication method does not waive our privacy responsibilities.

Website forms, feedback forms, email and social media are not monitored for urgent clinical matters. Do not send urgent symptoms or detailed medical information through them. Call (07) 4325 4000 for clinical enquiries or book an appointment. In an emergency, call 000.

9. Feedback, surveys, enquiries and recruitment

Information you submit in an enquiry or feedback form is used to respond, investigate concerns and improve services. Providing contact details enables us to follow up. You may give anonymous feedback, although anonymity may limit our ability to investigate or reply. An anonymous survey can still identify you if you include identifying details in free-text answers. Google Forms processes responses and technical information under Google’s privacy terms.

For job applications, we use your contact details, CV, qualifications, work history and other supplied information to assess suitability and contact you. We contact nominated referees with appropriate permission. Please obtain permission before providing someone else’s details. Access is limited to people involved in recruitment and relevant service providers. Application information is not a patient record.

10. Website, cookies, analytics and social media

Our website uses cookies and similar technologies for functionality, security and measurement, including Google Analytics, Google Ads and Google Tag Manager. Information may include IP address, browser and device details, approximate location, referral source, pages visited and interactions such as booking-link or phone-link clicks. This is not necessarily anonymous information. Tag Manager manages tags; the services those tags activate determine the information processed.

Google may process this information outside Australia. See Google’s privacy policy. You can manage cookies and tracking through browser privacy controls and Google’s privacy controls. Restricting cookies may affect some features. Links to booking platforms and other websites take you to services with their own privacy terms.

We use Facebook and Instagram for general practice information. Do not post private health information on public pages or send clinical requests through social media. Those platforms handle account and usage information under their own policies.

11. Australian storage and overseas services

Our Best Practice clinical records and their backups are kept in Australia. That does not mean every technology service processes all information only in Australia.

Lyrebird states that Australian patient data is stored and processed in Australia. MyGPMPtool’s published policy states that patient and clinical information is not shared with overseas third parties; its non-clinical customer billing and service arrangements may involve the United Kingdom, European Union and United States.

Heidi’s Australian arrangements provide for storage in Australia, but overseas processing by subprocessors may occur. Its published global provider locations include the United States, Canada, United Kingdom, Switzerland, Japan, Sweden and United Arab Emirates, and countries within the European Union. Which arrangements apply depends on the service and account configuration. See Heidi’s current subprocessors.

Google services may store or process form responses, correspondence, documents, website backups and usage information overseas, including in the United States. Its global infrastructure includes Belgium, Denmark, Finland, Germany, Ireland, the Netherlands, Chile, Uruguay, Japan, Singapore and Taiwan. Support may involve further countries listed in Google’s service-provider list; see also Google’s data-centre locations. Location depends on the service and settings, and these provider lists may change.

Before disclosing information overseas, we take reasonable steps required by APP 8 to protect it, or rely on another lawful exception. We explain relevant arrangements when seeking consent for a clinical tool. This policy is not a request for blanket consent to overseas disclosure or a waiver of Australian privacy protection. Contact us for information about an arrangement relevant to you.

12. Storage, security and data breaches

We hold information in electronic clinical systems, authorised administration and communication systems, and paper records where needed. We use access restrictions, password protection, encryption, backups and physical safeguards appropriate to the information. Staff and contractors must protect confidentiality and access information only for authorised work.

CCTV operates in communal and external building areas for security. Footage may be accessed by authorised personnel and disclosed where necessary for a security incident or as permitted or required by law.

If we suspect a data breach, we take steps to contain it, assess harm and reduce the risk. Where an eligible breach is likely to cause serious harm and the legal notification conditions are met, we notify affected people and the OAIC as soon as practicable. My Health Record incidents are also subject to the separate notification requirements of that legislation.

13. How long we keep information

We retain clinical records for continuing care and applicable legal, professional and record-keeping obligations. The appropriate period depends on the record, the patient’s circumstances and any complaint, investigation or litigation. Clinical records are not subject to the two-year period for routine website submissions.

Routine website enquiries, feedback, survey responses and unsuccessful job applications are normally retained for up to two years, then securely deleted or de-identified when no longer needed. Relevant information may be retained longer for ongoing care, an unresolved complaint, a legal obligation or proceedings. Successful applicants’ information may become part of employment records. De-identified service-improvement summaries may be kept longer.

When information is no longer needed for an authorised purpose and retention is not required by law, we take reasonable steps to destroy or de-identify it, including managing copies and backups through their retention cycles. There is no unconditional right to have a clinical record erased.

14. Access, copies and transfers

You can request access to the personal information we hold about you, including clinical records, by contacting the Practice Manager. Please identify the information and preferred access method. We check your identity and any representative’s authority without seeking unnecessary identification. We respond within a reasonable period, generally within 30 calendar days.

Making an access request is free. A reasonable fee may apply for providing copies or transferring records, usually around $40. We explain the proposed fee in advance; it must reflect the work and costs involved and must not be excessive or discourage access. Ask us about the fee and available access options if cost is a concern.

We provide access in the requested way where reasonable and practicable. Access may be limited only on a lawful ground, such as an unreasonable impact on another person’s privacy or a serious safety risk. If we refuse access or the requested method, we explain the reasons in writing, subject to lawful limits, and available complaint options. We consider alternatives, such as redaction or access through an agreed intermediary. Moving to another practice does not automatically require deletion of the original record.

15. Correcting your information

Tell us if information is inaccurate, out of date, incomplete, irrelevant or misleading. Requesting and making a correction is free. We consider requests within a reasonable period, generally within 30 calendar days. Corrections to clinical records preserve an appropriate record of the original entry and the change.

If we decline a correction, we provide written reasons and complaint options. You may ask us to attach a statement of your disagreement to the information. If you request it, we take reasonable steps to notify other organisations to which we previously disclosed corrected information, unless doing so is impracticable or unlawful.

16. Questions and complaints

Contact the Practice Manager, Main Street Medical Centre:
71 Main Street, Pialba QLD 4655
Phone: (07) 4325 4000
Email: kp@mainstreetmed.com.au

You may raise a privacy concern in person, by phone, in writing or through the website feedback form. A written account can help us understand the issue, but is not required. We handle complaints confidentially, investigate the concern, explain the outcome and any action, and respond within a reasonable time. Making a complaint will not disadvantage your care.

If you are dissatisfied with our response, or we have not responded within 30 days, you can contact the Office of the Australian Information Commissioner: OAIC privacy complaints, phone 1300 363 992. For complaints about healthcare services in Queensland, you can also contact the Office of the Health Ombudsman: OHO complaints, phone 133 646.

17. Review and further information

We review this policy when our services, technology or legal obligations change, and at the scheduled review. The current version is available on our website and at reception. Specific collection notices and consent discussions provide further information at the point information is collected.

Provider information: Lyrebird privacy and security; Heidi privacy policy; MyGPMPtool privacy policy. These describe the providers’ practices and do not replace our obligations.

Last reviewed October 2026