Privacy Policy

# Privacy Policy Northern Skin Doctors   Last updated: 20 July 2026  ## 1. Our commitment to your privacy Northern Skin Doctors respects your privacy and understands that health information is sensitive. We are committed to handling personal information responsibly, securely and transparently. This Privacy Policy explains how Northern Skin Doctors collects, holds, uses and discloses personal information in connection with our clinics, website, online booking services and other communications. We manage personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles and other applicable healthcare, records and privacy laws. In this policy, “we”, “us” and “our” mean Northern Skin Doctors. “You” and “your” refer to patients, prospective patients, website visitors and other people whose personal information we handle.

 

 ## 2. The information we collect and hold The personal information we collect depends on how you interact with us. It may include: - your name, date of birth, gender, address, telephone number and email address; - Medicare, Department of Veterans’ Affairs, concession, private health insurance and other healthcare identifiers; - emergency contact, next-of-kin, carer, guardian or authorised representative details; - appointment, referral, recall, billing, payment and communication information; - information provided through our website, online forms, telephone calls, email, SMS or online booking services; - website and device information, such as your IP address, browser type, pages visited, referring website and cookie or analytics data; - information relevant to a complaint, feedback, incident or access request; and - where relevant, employment, contractor, student, supplier or professional information.

 

### Health and other sensitive information To provide healthcare, we may collect and hold sensitive information including: - medical history, medications, allergies, family history and relevant lifestyle or risk information; - examination findings, diagnoses, treatment plans, prescriptions, procedures and clinical notes; - referral letters, pathology, imaging, hospital and specialist reports; - clinical photographs, dermoscopic images and FotoFinder or total-body photography images; - consent forms and information about treatment outcomes; and - other health information reasonably necessary to provide safe and appropriate care. We only collect information that is reasonably necessary for our functions and activities, or where collection is required or authorised by law.

 

## 3. How we collect information Where practicable, we collect personal information directly from you. This may occur when you: - register as a patient or complete a consent or medical-history form; - make or change an appointment in person, by telephone or through an online booking service such as HotDoc; - attend a consultation, investigation, procedure or treatment; - contact us through our website, email, telephone, SMS or social media; - provide feedback, make a complaint or request access to your records; or - use our website. We may also collect information from: - a parent, guardian, carer, authorised representative or another person assisting with your care; - your referring practitioner, general practitioner, specialist, hospital, pathology provider, imaging provider, pharmacy or other healthcare provider; - Medicare, the Department of Veterans’ Affairs, private health insurers or other government bodies; - the My Health Record system, where applicable and where access is authorised; - our booking, communications, payment, IT and practice-management service providers; or - another source where you have consented, where it is unreasonable or impracticable to collect the information directly from you, or where collection is required or authorised by law. If we receive unsolicited personal information, we will determine whether we could lawfully have collected it. If not, we will securely destroy or de-identify it where lawful and reasonable to do so.

 

## 4. Why we collect, use and disclose information We collect, hold, use and disclose personal information to: - assess, diagnose, treat and manage your healthcare; - identify you correctly and maintain accurate clinical records; - arrange appointments, reminders, recalls, follow-up and results communication; - communicate with your nominated healthcare providers and support continuity of care; - arrange pathology, imaging, prescriptions, referrals, hospital care or other services; - process accounts, payments, Medicare or DVA claims and other administrative matters; - respond to enquiries, requests, feedback and complaints; - manage clinical quality, safety, training, accreditation, audit and risk; - operate, secure, maintain and improve our clinics, systems and website; - meet legal, regulatory, insurance and professional obligations; - investigate or respond to an incident, claim, subpoena, court order or lawful request; and - undertake ethically approved research or quality-improvement activities where permitted by law and subject to appropriate safeguards. We generally use or disclose health information for the purpose for which it was collected, for a directly related purpose you would reasonably expect, with your consent, or where required or authorised by law.

 

 ## 5. Who we may disclose information to Where appropriate, we may disclose relevant personal information to: - doctors, nurses, practice staff, contractors and authorised personnel involved in your care or clinic administration; - your referring practitioner, usual general practitioner, specialist, hospital, allied health provider, pharmacy or other healthcare provider; - pathology, imaging, laboratory and medical service providers; - Medicare, the Department of Veterans’ Affairs, private health insurers and other funding or claims bodies; - service providers supporting our practice, including practice-management, secure messaging, electronic prescribing, booking, payment, accounting, document storage, cloud, website, email, SMS, IT support and cybersecurity providers; - our insurers, legal advisers, accountants, auditors and other professional advisers; - regulatory, law-enforcement, public-health, child-protection or other government bodies where required or authorised by law; and - another person or organisation where you have authorised the disclosure. We do not sell patient information. Our staff and contractors are expected to maintain confidentiality and access personal information only where needed for their role.

 

 ## 6. Clinical photographs and images Clinical photographs, dermoscopic images and total-body photography may form part of your medical record and may be used for diagnosis, monitoring, treatment planning and continuity of care. We will not use identifiable patient images for advertising, social media, education or other promotional purposes without separate, express consent. Refusing promotional consent will not affect your care. If consent is withdrawn, we will stop future use where reasonably practicable, although we may not be able to retrieve material already lawfully published or distributed.

 

## 7. Our website, cookies and analytics Our website is hosted using Wix. When you visit it, Wix and any enabled analytics, security or embedded services may collect technical and usage information, including IP address, browser and device information, pages viewed, dates and times, approximate location and referring pages. Cookies and similar technologies may be used to: - make the website function correctly; - remember preferences; - protect the website from misuse; - understand website traffic and performance; and - improve our website and communications. You can restrict or delete cookies using your browser settings. Some website functions may not operate correctly if essential cookies are blocked. Our website may contain links or embedded content from third parties. Their privacy practices are governed by their own privacy policies, and we encourage you to review them. Please do not use a general website form or ordinary email for urgent medical concerns. Contact the clinic by telephone, or call 000 in an emergency.

 

## 8. Online bookings and communications We use third-party services, including HotDoc, to support online bookings, appointment reminders, recalls, forms and related patient communications. Information entered into a third-party service is also handled under that provider’s privacy policy and terms. At the date of this policy, HotDoc states that personal information entrusted to its platform is stored and processed in Australia. We encourage patients to review HotDoc’s privacy information before using the service. We may communicate with you by telephone, email, SMS, secure messaging or post. Electronic communications carry some inherent privacy and security risks. Please tell us if you prefer a particular communication method or if it is unsafe to leave messages using any of your contact details.

 

## 9. Overseas disclosure and storage Most clinical records are intended to be held in systems selected for use in Australia. Some website, cloud, email, analytics, software-support or technology providers may process or allow access to limited personal information from outside Australia. Our website provider, Wix, operates through global entities and service providers. Wix states that website-visitor information may be stored in data centres in the United States, Ireland, South Korea, Taiwan and Israel, and may also be processed in other countries where its providers operate. These locations may change over time. Before using service providers, we consider the nature of the information involved and take reasonable steps appropriate to the circumstances to protect personal information and meet our obligations concerning overseas disclosures.

 

## 10. Artificial intelligence and automated decisions Northern Skin Doctors may use technology with artificial-intelligence or computer-assisted functions, including FotoFinder imaging, to support clinical assessment, lesion monitoring, administration, safety or service improvement. These tools support—but do not replace—the professional judgement of our clinicians. We do not currently arrange for a computer program to make a solely automated clinical decision that could reasonably be expected to significantly affect a patient’s rights or interests. A qualified health practitioner remains responsible for clinical interpretation and patient-care decisions. If our use of automated decision-making changes, we will review and update this policy and provide any additional information required by law.

 

## 11. Direct marketing We may send general clinic news, preventive-health information or service updates where you have consented or where otherwise permitted by law. We will not use sensitive health information for direct marketing without the consent required by law. You may opt out of marketing communications at any time by using the unsubscribe function in the message or contacting us. Opting out of marketing will not stop clinically necessary communications such as appointment reminders, recalls, results or follow-up relating to your care.

 

## 12. Anonymity and pseudonyms You may deal with us anonymously or using a pseudonym when making a general enquiry, where lawful and practicable. However, we will usually need your correct identity and relevant health information to provide safe clinical care, maintain accurate records, prescribe medication and process Medicare, DVA or insurance claims.

 

## 13. Information security We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. Safeguards may include: - role-based access and individual user accounts; - passwords, multi-factor authentication and other technical controls; - secure clinical and practice-management systems; - secure messaging, backups and cybersecurity measures; - physical security and controlled access to clinic areas and records; - confidentiality obligations, staff training and internal procedures; and - appropriate arrangements with service providers. No system is completely secure. If a suspected data breach occurs, we will contain and assess it, take reasonable remedial action and notify affected individuals and the Office of the Australian Information Commissioner where required under the Notifiable Data Breaches scheme.

 

## 14. Retention and disposal We retain medical records and other personal information for as long as needed to provide care and meet legal, professional, insurance and business requirements. When information is no longer required and we are legally permitted to dispose of it, we take reasonable steps to securely destroy or de-identify it.

 

## 15. Accessing or correcting your information You may request access to personal information we hold about you or ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading. Please contact our Privacy Officer using the details below. We may need to verify your identity and may ask for information that helps us locate the relevant record. You do not need to use a particular form to make a request. We will respond within a reasonable period. We may charge a reasonable fee for the cost of providing access or copies, but not for making the request itself. In limited circumstances, the law may permit or require us to refuse access or correction. If that occurs, we will explain the reason and available complaint options unless it would be unreasonable or unlawful to do so. If we do not agree to a requested correction, you may ask us to associate a statement with the record noting that you consider it inaccurate.

 

## 16. Privacy enquiries and complaints If you have a question, concern or complaint about privacy, please contact: Privacy Officer / Practice Manager   Northern Skin Doctors Unit 2, 2–6 Cumberland Avenue Smithfield QLD 4878 Telephone: 07 4038 2088   Email: manager@northernskindoctors.com.au  Please describe your concern and include enough information for us to investigate it. We will acknowledge and investigate privacy complaints and aim to respond within 30 days.

 

If more time is required, we will let you know. We encourage you to contact us first so we have an opportunity to resolve the matter. If you are not satisfied with our response, you may contact the: Office of the Australian Information Commissioner (OAIC)   Website: www.oaic.gov.au   Telephone: 1300 363 992  Other healthcare complaint avenues may also be available depending on the nature of the concern.

 

 ## 17. Changes to this policy We may update this Privac