Healthengine Limited (ACN 138 767 021) and its related bodies corporate (Healthengine, we or us) is committed to protecting the privacy of your personal information. We take our responsibility for handling sensitive personal information seriously and we have put measures in place to maintain the integrity of personal information and provide full transparency on conduct. We are bound by the Australian Privacy Principles under the Privacy Act 1988 (Cth) (Privacy Act) about how we handle your personal information.
This Privacy Policy sets out how and why Healthengine collects, stores, uses and discloses your personal information, and how to contact us if you have any questions about how we handle your personal information or would like to access the personal information we hold about you.
Healthengine provides a range of services that are primarily offered through our website and associated bookings mobile applications (Healthengine Network) or through our customers’ websites and mobile applications (Health Professional Network) and include:
Healthengine may also collect your personal and sensitive information if you create a Healthengine account. If you decide to create a Healthengine account on the Healthengine Network, we will store that information securely in the Healthengine database for the purpose of making your future interactions with Healthengine more convenient and personalised.
Healthengine also offers a range of services through related entities, including website design and online resources.
We are constantly evolving our services, and new services may be offered from time to time.
The personal information we collect depends on which of our services you use and the information you choose to provide.
When you use our services, you may choose to provide to Healthengine, and we may collect personal information such as:
If you choose to use the Healthengine Network for obtaining health related services from telehealth providers, we may collect personal information including health information from you which is reasonably required to deliver this service. You should review the privacy policy for that telehealth provider for information on how the telehealth provider will collect, hold, use and disclose your personal information.
Where you book an appointment or complete a form based or form-assisted digital medical consultation with a health professional (including telehealth providers), we may collect information about your symptoms, prescriptions, relevant medical history, conditions and other health information you may provide when using the service. Your personal information will be disclosed to that health professional for the purpose of them providing you with health services.
If you choose to use our booking system for appointments with medical specialists, we may collect information from you as provided by your referring health professional regarding your treatment such as copies of referral letters which may include relevant medical history, symptoms, investigation results, medication and management, and other health information.
If you choose to use our digital forms or online pre-vaccination screening service, we may collect information about your health, billing information (including MBS item numbers and rebates), and other information you may provide when using these services for the purposes of facilitating your health appointment or the administration of your health appointment or vaccination, as appropriate.
If you choose to use our online prescription service, we may collect information about your prescriptions, symptoms, treating health professional and other information you may provide when using the service.
If you request to access your prescription through the Healthengine mobile application, Healthengine will collect and disclose your prescription token to its mobile intermediary, Oexa Pty Ltd, for the purposes of enabling you to manage your prescription through the Healthengine mobile application. Healthengine’s third party mobile intermediary, Oexa Pty Ltd, discloses the prescription token to the prescribing system and prescription exchanges operated by eRx Script Exchange Pty Ltd and Medication Knowledge Pty Ltd to enable you to access and manage your prescription medicines and repeats through the Healthengine mobile application.
If you request prescription fulfilment and medication delivery services through the Healthengine Network, we may collect your name, mobile phone number, email address, delivery address, a copy of your prescription, any government identifies that are relevant to the prescription fulfilment (such as your Medicare, Pension, Health Care Card and Veteran Affairs number and details) and information (which may include health information) that is relevant to the fulfilment of your prescription and delivery of your medication. We will disclose this personal and sensitive information to our partner, Chemist2U, for the purposes of facilitating the prescription fulfilment and medication delivery service. Chemist2U will collect your personal and sensitive information for the purposes of connecting you with pharmacies for the purchase and delivery of your medication. You should review Chemist2U’s privacy policy for information on how Chemist2U will collect, hold, use and disclose your personal information.
If you request the services of a third party service provider through the Healthengine Network, we may collect your personal information for the purpose of facilitating the provision of the third party services you have requested such as payment processing or referral services.
If you are applying for employment with us, we will collect information about you for recruitment purposes (including possible future recruitment opportunities) and human resources activities. Information collected may include but not be limited to your occupation, qualifications, citizenship, information contained in your resume, medical or health related information, employee records and other human resources personal information. We may also conduct and collect psychometric, technical skills or behavioural analysis type assessments.
If you are a health professional using our online directory, we will collect information about you and your practice (for the online directory).
If you are a referring health practitioner, we may collect information about you and your practice such as name, contact details, provider number and information relevant to providing services to referred patients.
Usually we collect your personal information directly from you. Healthengine may collect your personal information from you in various ways, including via telephone, the Healthengine Network, and email.
We may also collect information from third parties, such as:
We use cookies and similar technologies (such as web beacons and proprietary measurement software) on the Healthengine Network to analyse trends, administer our services, diagnose problems, improve the quality of our products and services, track users’ movements around the Healthengine Network, and to gather demographic information about our user base as a whole.
A cookie is a small text file that the Healthengine Network may place on your device to store information. We may use persistent cookies (which remain on your computer even after you close your browser) to store information that may speed up your use of the Healthengine Network for any of your future visits to the Healthengine Network. We may also use session cookies (which no longer remain after you end your browsing session) to help manage the display and presentation of information on the Healthengine Network. You may refuse to use cookies, web beacons or some of the proprietary measurement software features by selecting the appropriate settings on your browser or the settings section of your mobile or tablet device. However, please note that if you do this, you may not be able to use the full functionality of the Healthengine Network.
You do not have to use our services, and you may choose which of our services you wish to use. Some of our services, such as our online directory of health professionals and practices, do not require you to provide us with personal information. However, the majority of our services do, and when you use such services, we require you to provide accurate details and do not permit you to use a pseudonym or remain anonymous. For some services, certain information is designated as mandatory (which is required to use the service) and some is optional (which you may choose not to provide, but your failure to provide that information may limit your use of the service). If you do not provide personal information to Healthengine that is designated as mandatory, we will be unable to provide you with that service.
Healthengine uses social networking services such as Facebook, Twitter and Instagram to communicate with the public about its activities. Healthengine may collect your personal information when you communicate with us by using these social networking services, and the social networking services will also handle your personal information for their own activities. These social networking sites have their own privacy policies.
Healthengine uses both internally built survey software and third party vendors for the collection, aggregation and analysis of some survey data (such as Alchemer). The information you provide is stored in a secure data warehouse in either Australia or the United States and is accessed by Healthengine in accordance with a third party vendor’s privacy policy. If you do not want your personal information being stored offshore, you can decline to provide this information by not responding to these surveys.
The primary reason Healthengine uses your personal information is to provide the services you have elected to receive.
Health Professional Networks: Healthengine may also collect and use your personal and sensitive information if you interact with Health Professional Networks that have incorporated Healthengine technology in the course of the health professional providing health services to you.
Where Healthengine has collected personal and sensitive information through the Health Professional Network that incorporate Healthengine’s technology, it will:
The protections that apply to such personal information will be described in the individual privacy policies of those health professionals, and not in this Privacy Policy. To learn more about the privacy and data security practices of those health professionals, you should read the respective health professional’s privacy policy carefully.
Subject to above in relation to Health Professional Networks that utilise Healthengine’s technology, Healthengine may use your personal information:
When you use the Healthengine Network for booking appointments with health professionals, requesting form based or form assisted digital medical consultations, or completing digital forms which assist with the registration of patients and/or the provision of health-related services, we will disclose your personal information to the health professionals that you have selected and their practices for the purpose of arranging such appointments, facilitating the request for online provision of health services or provision of other health related services. Each health professional has to comply with applicable privacy laws with regards to their use of your personal information. However, we have no control over, and are not responsible for how the health professional uses your information. To learn more about how a health professional may use your information, you should review their privacy policy.
If you are a health professional using our online directory, we will make the information you provide publicly available including on the Healthengine Network. We may also make the information you provide available to Healthdirect for inclusion in the National Health Services Directory. Healthdirect will make the information publicly available on the Healthdirect website and mobile applications. Healthdirect’s privacy policy can be found at https://www.healthdirect.gov.au/privacy-policy.
Healthengine may also disclose your personal information to other persons, such as:
We may also disclose de-identified information of our users to third parties that collect and process data for analysis, research and quality assurance purposes, such as:
Some third party service providers used by Healthengine may store your personal information on servers located overseas. However, they must also meet our requirements for privacy and data security.
Healthengine will take reasonable steps to ensure that your personal information which we may collect, use or disclose is accurate, complete and up-to-date. However, we rely on the accuracy of the personal information as entered by you or provided to us by third parties.
Healthengine will take reasonable steps to protect your personal information from misuse, interference and loss and from unauthorised access, modification or disclosure. Healthengine implements security measures including:
We store your personal information on secure servers located in Australia in an encrypted, electronic format.
Before disclosing personal information to an entity or person located overseas, Healthengine takes steps to ensure that the recipients of such information do not breach the APPs in relation to the information, by including relevant contractual provisions.
We will only retain your personal information for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal information for a longer period in the event of a complaint or for legal purposes.
To determine the appropriate retention period for personal information, we consider the amount, nature and sensitivity of the personal information, the potential risk of harm from unauthorised use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.
You have a right to request:
In some circumstances, we may not be able to comply with a request that you make in respect of your personal information. For example, we may be required to retain certain information that you ask us to delete for various reasons, such as where there is a legal requirement to do so. Where these reasons to refuse a request in respect of your personal information exist, we will advise you of those reasons at the time you make your request.
If we do agree to your request for the deletion of your personal information, we will delete your data but will generally assume that you would prefer us to keep a note of your name on a register of individuals who would prefer not to be contacted. That way, we will minimise the chances of you being contacted in the future where your data is collected in unconnected circumstances. If you would prefer us not to do this, you are free to say so.
If you request that your personal information is changed, and if Healthengine does not agree to change your personal information, we will enclose your statement of the requested changes with your personal information.
If you would like to obtain access to, delete or request changes to your personal information you can ask our Privacy Officer (details below).
Healthengine can charge a reasonable fee for the time and cost of collating, preparing, and photocopying material for you if you request access to your personal information.
Where we have obtained your consent to handle your personal information, or consent to send you information, you may withdraw your consent at any time and we will cease to carry out the particular activity that you previously consented to, unless we consider that there is an alternative reason to justify our continued handling of your personal information for this purpose, in which case we will inform you of this condition.
Where Healthengine provides services directly to health professionals, this may involve Healthengine receiving and handling information separately on behalf of the health professional, for the purpose of providing those services. In these circumstances, Healthengine will return, retain or destroy any personal information that we have collected in delivering our services to a health professional in accordance with our end user terms and conditions that we agree with that health professional and/or the Health Professional Agreement.
If you have questions about this Privacy Policy, if Healthengine does not agree to provide you with access to your personal information; or if you have a complaint about our information handling practices, you can contact our Privacy Officer on the details below.
In particular, if you wish to make a complaint about how we have handled your personal information, you should forward a written complaint to our Privacy Officer.
We will respond in writing within 30 days of receipt of a complaint. If you are not satisfied with our decision, you can contact us to discuss your concerns.
If the complaint remains unresolved, you have the option of notifying the Office of the Australian Information Commissioner (OAIC). Contact details can be found at OAIC's website:www.oaic.gov.au