Privacy Policy | Patient Data Protection & Confidentiality

Our Commitment to Your Privacy

Shellharbour Skin is committed to protecting your privacy and handling your personal and health information with care, confidentiality and respect.

This Privacy Policy explains how we collect, hold, use, disclose and protect personal information, including sensitive and health information.

We handle personal and health information in accordance with applicable Australian privacy laws, including the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs) and the Health Records and Information Privacy Act 2002 (NSW), including the Health Privacy Principles (HPPs).

This Privacy Policy applies to personal information we collect about patients, prospective patients, website visitors, purchasers and other individuals who interact with Shellharbour Skin, including through our Clinic, website, patient forms, patient app and portal, telephone, email, SMS and other electronic communications, consultations, purchases and services.

It should be read together with our Patient Terms of Service, consent forms and any specific privacy or collection notices provided to you.

This Privacy Policy explains our information-handling practices. Where your consent is required for a particular collection, use or disclosure of personal or health information, we will seek that consent in accordance with applicable law.

What Information We Collect

We collect personal information and, where reasonably necessary for our functions and activities, sensitive information including health information.

Depending on your interaction with Shellharbour Skin and the services you receive, this may include:

your name, date of birth, address and contact details;
emergency contact details;
Medicare, DVA, health fund or other healthcare and billing information;
medical history, medications, allergies and other relevant health information;
symptoms, diagnoses and clinical findings;
consultation notes and treatment records;
treatment plans and recommendations;
pathology, investigation or imaging results;
referrals and correspondence with other healthcare providers;
prescriptions and medication-related information;
clinical photographs and images;
medical history, consent and other patient forms;
appointment, recall and communication records;
payment, invoice, purchase and transaction information;
communication and marketing preferences;
feedback, complaints and patient survey responses;
information you provide, upload, access or manage through our website, patient app or patient portal;
information processed when AI-assisted clinical documentation is used; and
technical information collected when you interact with our website or digital services.

How We Collect Your Information

Where practicable, we collect personal and health information directly from you or from a person authorised to act on your behalf.

We may collect information when you:

make, manage or enquire about an appointment;
attend Shellharbour Skin;
complete a medical history, consent or other patient form;
communicate with us by telephone, SMS, email or other electronic messaging;
use our website, Shellharbour Skin patient app or patient portal;
provide photographs, documents or other information;
complete a patient survey or provide feedback;
make a payment or purchase;
subscribe to communications from us; or
receive a consultation, procedure or treatment.

Where appropriate and permitted by law, we may also collect information from:

referring or treating healthcare practitioners;
pathology or diagnostic providers;
pharmacies;
Medicare or DVA;
parents, guardians or authorised representatives; and
other persons or organisations involved in your healthcare or the administration of our services.

If we receive personal or health information about you that we did not request, we will handle that information in accordance with applicable privacy laws.

Why We Collect Your Information

We collect, hold, use and disclose information where reasonably necessary to:

provide medical, dermal and aesthetic medicine services;
assess your health, concerns and suitability for treatment;
provide consultations, examinations, procedures and treatments;
develop and review treatment or care plans;
maintain accurate clinical and administrative records;
communicate with you regarding appointments, confirmations, recalls and follow-up care;
provide pre-treatment and aftercare information;
arrange pathology, referrals, prescriptions or other healthcare services where applicable;
communicate with healthcare professionals involved in your care;
process payments, invoices, purchases, Medicare or DVA claims where applicable;
administer your patient account;
provide and operate our patient app and portal;
respond to enquiries, feedback, complaints and requests;
conduct patient experience and service feedback activities;
undertake appropriate quality assurance, clinical governance and service improvement activities;
operate, maintain and improve our website and digital services;
protect the safety and security of our patients, staff, systems and services;
meet legal, regulatory, insurance and professional obligations; and
send marketing communications where permitted by law and where any required consent has been provided.

If you choose not to provide information that is reasonably necessary for your care, we may be unable to safely or appropriately assess you or provide a particular service.

Anonymity and Pseudonyms

Where it is lawful and practicable, you may interact with Shellharbour Skin anonymously or by using a pseudonym, for example when making a general enquiry.

However, it will generally not be practicable to provide healthcare, maintain an accurate clinical record, prescribe medication, process certain healthcare claims or meet our legal and professional obligations without correctly identifying you.

Government-Related Identifiers

Shellharbour Skin may collect and use government-related identifiers, including Medicare and DVA details, where reasonably necessary and permitted or required by law.

We do not use government-related identifiers as our own patient identifier except where permitted by law.

AI-Assisted Clinical Documentation

To support accurate and efficient clinical documentation, Shellharbour Skin may use approved artificial intelligence (AI)-assisted clinical documentation technology, including Heidi Health, during consultations.

Where AI-assisted clinical documentation is used:

your treating clinician will explain its use and obtain your consent before it is used;
the technology may temporarily process information discussed during your consultation for the purpose of assisting with clinical documentation;
AI is used to assist in preparing clinical notes and does not replace the independent clinical judgement, diagnosis or decision-making of your treating clinician;
AI-generated documentation is reviewed, verified and amended where necessary by the treating clinician before it forms part of your clinical record; and
your treating clinician remains responsible for reviewing and approving the clinical documentation.

You may decline or withdraw your consent to the use of AI-assisted clinical documentation. Your decision will not affect your ability to receive healthcare from Shellharbour Skin.

Shellharbour Skin does not rely on AI-assisted clinical documentation technology to independently make clinical decisions about your care.

Clinical Photography

Clinical photographs may be taken where reasonably necessary or appropriate for:

clinical documentation;
assessment and treatment planning;
monitoring treatment progress;
continuity of care; and
maintaining an accurate health record.

Clinical photographs that form part of your health record are treated as confidential health information.

The collection and use of photographs for clinical purposes is separate from consent to use photographs for advertising, marketing, social media, education, publications or other secondary purposes.

Identifiable clinical photographs will not be used by Shellharbour Skin for a secondary purpose without appropriate separate consent unless otherwise permitted or required by law.

Choosing not to consent to the use of photographs for marketing or other secondary purposes will not affect the healthcare you receive.

Use and Disclosure of Your Information

Personal and health information is primarily used and disclosed for the purpose for which it was collected, including providing and managing your healthcare.

We may also use or disclose information for a related or directly related purpose where you would reasonably expect us to do so and where permitted by law, or where:

you have provided consent;
the use or disclosure is required or authorised by law; or
another exception permitted under applicable privacy legislation applies.

Depending on the circumstances, information may be disclosed to:

doctors, nurses, dermal clinicians and other healthcare professionals involved in your care;
pathology and diagnostic providers;
referring or receiving healthcare providers;
pharmacies and medication-related service providers;
Medicare, DVA or other relevant government agencies;
professional advisers, insurers or legal representatives where reasonably necessary;
technology and service providers supporting the Clinic; and
regulatory, law enforcement or other authorities where disclosure is required or authorised by law.

We take reasonable steps to limit disclosure to information reasonably necessary for the relevant purpose.

We do not sell, rent or trade your personal or health information.

Where consent is required for a particular collection, use or disclosure, we will seek that consent rather than relying solely on your attendance at the Clinic, use of our website or use of our services.

Third-Party Technology and Service Providers

Shellharbour Skin uses a range of third-party technology and service providers to support the delivery of healthcare and the operation, administration and security of our Clinic.

These may include providers of:

clinical and practice management systems;
electronic medical records;
electronic forms and consent management;
AI-assisted clinical documentation;
patient portals and mobile applications;
appointment booking and management;
SMS, email and other patient communications;
patient feedback, experience and survey services;
marketing and email communication platforms;
review and reputation management services;
pathology, diagnostic and other healthcare services;
prescription and medication-related services;
payment processing and financial services;
website hosting and administration;
website analytics and digital functionality;
cloud storage and data hosting;
information technology and cybersecurity; and
professional, administrative and other services necessary to operate the Clinic.

Our clinical and practice management systems include DappleOS and Xestro.

DappleOS also supports the Shellharbour Skin patient app and patient portal, through which patients may access or manage certain information and services, including appointments, forms, communications, treatment-related information, invoices, account information and other functionality made available through the platform.

We may also use Heidi Health or another AI-assistant to assist clinicians with clinical documentation, as described in the AI-Assisted Clinical Documentation section of this Privacy Policy.

The type of information provided to or processed by a third-party provider depends on the service it performs. Not all third-party providers have access to your health information or complete clinical record.

For example, communications, survey, marketing or review-management providers may process contact details, communication preferences, feedback or other information reasonably necessary to provide that service without having access to your complete clinical record.

We take reasonable steps to limit personal and health information made available to third-party providers to what is reasonably necessary for the relevant purpose and to select and manage providers having regard to applicable privacy, confidentiality and information-security requirements.

Patient Surveys, Feedback and Reviews

From time to time, we may invite you to provide feedback about your experience with Shellharbour Skin, participate in a patient survey or leave a review.

Participation is voluntary unless we advise you otherwise in relation to a particular process.

Survey or feedback responses may contain personal or health information depending on the information you choose to provide. Where this occurs, that information will be handled in accordance with this Privacy Policy and applicable privacy laws.

We may use third-party platforms to administer patient communications, surveys, feedback or review requests. Information made available to those platforms will be limited to what is reasonably necessary for the relevant purpose.

Any use or publication by Shellharbour Skin of patient feedback, testimonials, reviews, photographs or other patient information will also be subject to applicable privacy, consent and healthcare advertising requirements.

Interstate Handling of Information

Some technology and service providers used by Shellharbour Skin may store or process information, or permit authorised access to information, outside New South Wales or Australia.

Where personal or health information is transferred or disclosed outside New South Wales or Australia, Shellharbour Skin will take reasonable steps to ensure that the information is handled in accordance with applicable privacy laws.

Where personal information is likely to be disclosed to overseas recipients, we will provide information about the countries in which those recipients are likely to be located where required by law and where practicable.

Marketing Communications

Where permitted by law, Shellharbour Skin may use communication and marketing platforms to provide clinic news, educational information and information about our services, skincare products, events or promotions.

Where consent is required for a particular marketing use or disclosure, we will obtain that consent.

Health information and other sensitive information will not be used or disclosed for direct marketing unless the consent required by law has been obtained.

Marketing communications will provide an appropriate way to opt out where required.

You may withdraw marketing consent or opt out of marketing communications at any time by using the unsubscribe function provided in the communication or by contacting Shellharbour Skin.

Withdrawing marketing consent will not affect the healthcare you receive.

We may continue to send non-marketing communications reasonably necessary for your healthcare or administration of our services, including appointment reminders and confirmations, recalls, follow-up information, invoices and other service-related communications.

Accessing Your Information

You may request access to personal or health information we hold about you.

Requests may be made by contacting Shellharbour Skin. We may ask you to make the request in writing and will take reasonable steps to verify your identity before providing access.

You may authorise another person to request access on your behalf, subject to appropriate verification of their identity and authority.

Access may be provided in different ways depending on the circumstances and applicable law.

Where permitted by law, a reasonable fee may apply to costs associated with providing access. We will advise you of any applicable fee.

In some circumstances, access may be limited or refused where permitted or required by law. Where required, we will provide reasons for our decision and information about available complaint or review options.

Correcting Your Information

We take reasonable steps to ensure personal and health information we hold is accurate, complete, up to date, relevant and not misleading.

If you believe information we hold about you requires correction, you may contact us and request that it be corrected or updated.

Where appropriate and required by law, we will take reasonable steps to correct the information.

If we do not agree to make a requested correction, we will deal with the request in accordance with applicable privacy laws, including any applicable right to have a statement associated with the record.

Children and Young People

Shellharbour Skin may collect and hold personal and health information about children and young people when providing healthcare.

Consent, confidentiality and access to information will be managed having regard to the individual’s age, maturity and capacity, the nature of the healthcare being provided and applicable legal and professional obligations.

Parents, guardians and authorised representatives may provide or request information in appropriate circumstances.

A parent or guardian’s access to a young person’s health information is not automatic in every circumstance and will be managed in accordance with applicable privacy, healthcare and professional obligations.

Data Security

Shellharbour Skin takes reasonable steps to protect personal and health information from misuse, interference, loss, unauthorised access, modification and disclosure.

Our safeguards may include:

secure clinical and practice management systems;
appropriate user access controls;
password-protected systems and devices;
restricted staff access based on role and need;
staff privacy and confidentiality obligations;
appropriate technology and cybersecurity measures;
secure storage of physical records where applicable; and
secure destruction or de-identification processes.

Access to patient information is limited to people who require it for legitimate clinical, administrative, operational or legal purposes.

While we take reasonable steps to protect information, no electronic system or method of transmission can be guaranteed to be completely secure.

Data Breaches

If we become aware of a suspected loss of, unauthorised access to, or unauthorised disclosure of personal information, we will take reasonable steps to contain, investigate and assess the incident.

Where notification is required, we will notify affected individuals, the Office of the Australian Information Commissioner (OAIC) and/or other relevant authorities in accordance with applicable law.

Retention of Health Records

Shellharbour Skin retains personal and health information for the periods required under applicable NSW legislation and relevant legal and professional requirements.

Different retention requirements may apply depending on factors including the patient’s age when the health information was collected.

When information is no longer required to be retained, we take reasonable steps to securely destroy or de-identify it where permitted by law.

Cookies, Website Analytics and Digital Technologies

Our website may use cookies, analytics tools, pixels and similar technologies to operate and improve our website, understand website usage and measure the effectiveness of communications.

Depending on the technology used, information collected may include:

IP address;
browser and device information;
pages visited;
referring websites;
date and time of access; and
interactions with our website.

Third-party analytics, communications or advertising providers may also use cookies or similar technologies in accordance with their own privacy practices.

You can adjust your browser settings to manage or disable cookies. Some website functions may not operate as intended if cookies are disabled.

Third-Party Websites

Our website, patient app, patient portal or communications may contain links to websites or services operated by third parties.

Shellharbour Skin is not responsible for the privacy practices or content of independent third-party websites. We encourage you to review their privacy policies before providing personal information.

Privacy Questions and Complaints

If you have a question or concern about how Shellharbour Skin handles personal or health information, would like to request access to or correction of your information, or wish to make a privacy complaint, please contact:

Privacy Officer
Shellharbour Skin
Email: [email protected]

We will acknowledge and investigate privacy complaints and endeavour to respond within a reasonable timeframe.

If you are not satisfied with our response, you may be entitled to contact the:

Office of the Australian Information Commissioner (OAIC) — for matters arising under the Privacy Act 1988 (Cth) and Australian Privacy Principles.

Information and Privacy Commission NSW (IPC NSW) — for matters concerning health information under the Health Records and Information Privacy Act 2002 (NSW).

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to legislation, technology, our services or our information-handling practices.

The current version will be published on our website together with the date it was last updated.

Your Privacy Choices and Consent

Providing personal information to Shellharbour Skin means you acknowledge that you have been provided with information about how we handle personal and health information as described in this Privacy Policy.

Your attendance at Shellharbour Skin, use of our website, patient app or portal, or use of our services does not, by itself, constitute consent to every possible collection, use or disclosure of your personal or health information.

Where consent is required for a particular collection, use or disclosure, we will seek that consent in accordance with applicable law.

This may include specific consent for matters such as: