☰

How we protect your information

Privacy Policy

Your health information is some of the most personal information there is. This policy explains, in plain language, what we collect, why we collect it, who can see it, and the control you have over it. If anything here is unclear, please ask us. We would rather have the conversation than leave you wondering.

1.Who we are and who this covers

This policy applies to Kairos Health Klinic, operated by [[ legal entity name ]] (ABN [[ ABN ]]), referred to below as "we", "us" and "our". It covers everyone we deal with: clients and their families, people who enquire through our website, and people who subscribe to our emails.

As a health service provider, we are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles. This applies to us regardless of our size or turnover. Health information is treated as sensitive information under that Act, which means it carries a higher level of protection than ordinary personal information, and we generally need your consent before we collect it.

Because we consult by telehealth across Australia, state and territory health records laws may also apply depending on where you live. Where those laws set a higher standard than the Privacy Act, we follow the higher standard.

2.What we collect

2.1 Information that identifies you

Your name, preferred name, date of birth and gender.
Your contact details, including email address, phone number and postal address for prescriptions.
Your occupation, and your emergency contact's name, phone number and relationship to you.
Payment details for consultations and prescriptions. We do not store full card numbers ourselves.
How you heard about us.

2.2 Your health information

This is the heart of what we hold, and the reason we take this policy seriously. It includes:

Your main health concerns, when they began, what relieves or aggravates them, and how severe they are.
Your health history, diagnosed conditions, pre-existing conditions, surgeries and hospitalisations.
Medications and supplements you take, allergies and intolerances, and any internal medical devices.
Whether you are pregnant or lactating, and relevant family health history.
Lifestyle information relevant to your care, including diet, exercise, alcohol and smoking.
Test results, scans and reports you choose to upload or share with us.
Consultation notes, your treatment plan, and the herbal and nutritional prescriptions we make for you.

We only ever collect health information that is reasonably necessary for your care.

If you would prefer not to answer a particular question, you are welcome to say so. Sometimes that will limit what we can safely recommend, and if that is the case we will tell you plainly rather than working around it.

2.3 Information about children

We provide paediatric and whole-family care, so we often hold health information about children. That information is collected from a parent or guardian, and is treated with exactly the same protection as an adult's. As a child grows older and is able to make their own decisions about their health, we will involve them directly in decisions about their information wherever it is appropriate to do so.

2.4 Information collected through our website

What you send us through our contact form or newsletter sign-up, including your name, email, phone number and the message you write.
Technical information collected automatically, including your IP address, browser and device type, the pages you visit and how you arrived at our site. See section 8.

Please do not send us detailed health information through the website contact form. It is a general enquiry form, not a secure clinical channel. Once you are a client, we will give you a more appropriate way to share clinical details.

3.How we collect it

Wherever possible we collect information directly from you: through our intake form, during consultations, in follow-up emails or messages, through our booking system, and through our website.

Occasionally we may receive information about you from someone else, for example a family member arranging care on your behalf, or another practitioner you have asked to share information with us. We only accept information from a third party where it is unreasonable or impractical to collect it from you directly, and we will let you know if that happens.

4.Why we collect it and how we use it

We use your information to:

Investigate the root cause of your concerns and provide naturopathic care to you and your family.
Prepare and dispense your personalised herbal and nutritional prescriptions.
Manage your appointments, send reminders and confirmations, and issue invoices and receipts.
Keep accurate clinical records, as we are professionally required to do.
Answer your questions and respond to your enquiries.
Send you email updates and resources, but only if you have asked us to. See section 9.
Improve our services and our website.
Meet our legal, professional and insurance obligations.

We will not use your information for a purpose you would not reasonably expect, unless you have consented or the law requires it.

5.When we share your information

We do not sell your information. We do not share it with anyone for their own marketing purposes. Ever.

We share your information only in these situations:

With your consent. For example, if you ask us to send a summary to your GP, specialist or another practitioner, or to speak with a family member about your care.
With the service providers who run our systems. These providers store and process information on our behalf under confidentiality obligations, and are not permitted to use it for their own purposes. See section 6.
Where the law requires or authorises it. For example, a court order, a subpoena, or a mandatory reporting obligation.
Where there is a serious threat. If we reasonably believe it is necessary to lessen or prevent a serious threat to anyone's life, health or safety, or to public health or safety.

If we ever needed to share your information for a reason not listed above, we would ask you first.

6.Where your information is stored, including overseas

We use two main platforms to run the clinic, and we want to be upfront that both store information on servers outside Australia, principally in the United States:

Our practice management and CRM system, which holds your contact details, intake form, clinical notes, prescriptions, bookings and our correspondence with you.
Google Workspace, which we use for email, file storage and Google Meet for telehealth consultations.

Before disclosing your information to an overseas recipient we take reasonable steps to ensure they handle it in a way consistent with the Australian Privacy Principles. You should be aware that once information is held overseas, Australian privacy law may be harder to enforce in practice, and the recipient may be subject to the laws of the country they operate in.

By providing your information to us and continuing as a client, you consent to it being stored and processed in this way. If you are not comfortable with this, please tell us and we will talk through what alternatives are workable.

7.How long we keep it

We are required to keep clinical records for a minimum period, even after you stop seeing us. Our practice is to keep:

Adult health records for at least seven years from the date of the last service we provided you.
Health records for anyone under 18 at the time of their last service until they turn 25.
Records for longer where a law, an insurer or an unresolved matter requires it.

Information we hold that is not part of your clinical record, such as marketing contacts and website enquiries, is kept only as long as it is needed, and is deleted or de-identified after that.

8.Cookies, analytics and our website

Our website uses cookies and similar technologies. These fall into three groups:

Essential cookies, which make the site work: remembering your session, keeping forms functioning, and keeping the site secure. These cannot be turned off.
Analytics, which tell us how people find and move through our site so we can make it more useful. This is reported to us in aggregate.
Advertising and social media tools, which may set cookies allowing us to measure how our advertising performs and to show relevant content to people who have visited our site.

We do not connect your website browsing to your clinical record. You can block or delete cookies through your browser settings, and you can opt out of personalised advertising through your Google and social media account settings, though some parts of our site may not work as well if you block essential cookies.

9.Emails and marketing

We will only send you newsletters, resources or promotional emails if you have asked us to receive them. That is your choice to make, and it is separate from the emails we send about your actual care, such as appointment confirmations, reminders and prescription updates, which we need to send you as part of providing the service.

Every marketing email includes an unsubscribe link, and we act on unsubscribes promptly. You can also reply to any email or contact us directly and we will remove you. We handle marketing communications in accordance with the Spam Act 2003 (Cth).

10.How we keep it secure

We take reasonable steps to protect your information from misuse, interference, loss, and unauthorised access, modification or disclosure. In practice that means access controls and strong authentication on the systems that hold your records, encryption in transit, keeping access limited to those who need it to provide your care, and secure destruction of records once their retention period has passed.

No system can be guaranteed completely secure. If a data breach occurs that is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

11.Seeing and correcting your information

You have the right to ask for a copy of the personal and health information we hold about you, and to ask us to correct anything that is wrong, out of date or incomplete.

Please make your request in writing, so that we have a record of it.
We will respond within 30 days, and will let you know sooner if we need to discuss the best way to provide the information.
A small administrative fee may apply to cover the cost of retrieving and copying records. We will always tell you the amount before we proceed.
In limited circumstances we may not be able to give you full access, for example where doing so would pose a serious threat to someone's life or health, or would unreasonably affect another person's privacy. If that happens we will explain why in writing, and look for another way to give you what you need, such as a summary or access through another health practitioner.

12.Being anonymous, and your other choices

You can ask us a general question anonymously or under a pseudonym. We cannot provide clinical care that way, because safe prescribing depends on knowing who you are and what else is going on for you, but a general enquiry does not require you to identify yourself.

You can also withdraw your consent to us handling your information at any time. Please note that we may still need to retain your clinical records for the periods described in section 7, because that obligation exists independently of your consent.

13.If you have a concern

If you think we have mishandled your information, please tell us first. We would genuinely like the chance to put it right. Contact us using the details below, set out what happened, and we will acknowledge your complaint promptly and respond in writing within 30 days.

If you are not satisfied with our response, you can take the matter to the Office of the Australian Information Commissioner:

Online at oaic.gov.au
By phone on 1300 363 992

Depending on where you live, your state or territory privacy or health complaints body may also be able to help, and we are happy to point you to the right one.

14.Changes to this policy

We may update this policy from time to time as our practice or the law changes. The current version will always be available on this page, with the date it was last updated shown at the bottom. If we make a change that materially affects how we handle your information, we will let existing clients know directly rather than relying on you to notice.

15.How to contact us

For anything to do with your privacy, including access requests, corrections and complaints, please contact:

Privacy Contact, Kairos Health Klinic

Email: [[ privacy contact email address ]]
Phone: 0452 638 088
Post: [[ postal address for written requests ]]

16.The short version

This summary is here to help, and does not replace the sections above.

What you might be wondering	The short answer
Do you sell my information?	No. Never, to anyone.
Who can see my health records?	Your practitioner, and the secure systems we use to run the clinic. Nobody else, unless you ask us to share them or the law requires it.
Is my information stored in Australia?	Not all of it. Our practice management system and Google Workspace store information overseas, mainly in the United States. See section 6.
Can I see my own records?	Yes. Ask us in writing and we will respond within 30 days. A small admin fee may apply.
Can I get marketing emails turned off?	Yes, at any time. Use the unsubscribe link or just tell us.
How long do you keep my records?	At least seven years after your last appointment. For children, until they turn 25.
What if something goes wrong?	Tell us first and we will respond within 30 days. If you are still unhappy, the OAIC can step in.