top of page

Privacy Policy

Privacy Policy

Last updated: 30 August 2026

1. Our commitment to your privacy

Yorkeys Medical is committed to protecting the privacy and confidentiality of our patients and their families.

We handle personal and health information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles, the My Health Records Act 2012 (Cth) and other applicable Australian laws and professional obligations.

This policy explains:

  • What information we collect

  • Why and how we collect it

  • How we use and disclose it

  • How we protect it

  • How you can access or correct your information

  • How to raise a privacy concern or complaint

In this policy, “Yorkeys Medical”, “we”, “us” and “our” refer to Yorkeys Medical and the people and service providers authorised to handle information on its behalf.

2. Information we collect

The information we collect depends on your relationship with Yorkeys Medical and the services you receive.

Personal information

This may include:

  • Your name, date of birth, address and contact details

  • Emergency contact and next-of-kin details

  • Medicare, Department of Veterans’ Affairs and concession card details

  • Private health insurance information

  • Billing, payment and account information

  • Appointment and communication preferences

  • Cultural background, preferred language and interpreter requirements

  • Details of a parent, guardian, carer or authorised representative

Health information

This may include:

  • Current and previous medical conditions

  • Symptoms, diagnoses and treatment plans

  • Medications, allergies and adverse reactions

  • Pathology and diagnostic imaging results

  • Immunisation history

  • Family, social and lifestyle history relevant to your care

  • Mental health information

  • Specialist, hospital and allied health correspondence

  • Consultation notes, referrals, prescriptions and certificates

  • Clinical photographs or dermoscopic images where clinically appropriate

  • Information about procedures and treatment outcomes

  • Information contained in or uploaded to My Health Record

Health information is sensitive information and receives additional protection under Australian privacy law.

3. How we collect information

We generally collect information directly from you when you:

  • Register as a patient

  • Book or attend an appointment

  • Complete a form or questionnaire

  • Speak with our doctors, nurses or reception team

  • Contact us by telephone, email, SMS or through our website

  • Use our online booking provider

  • Participate in telehealth

  • Provide information through an authorised representative

We may also receive information from:

  • Your parent, guardian, carer or authorised representative

  • Other doctors and healthcare providers

  • Hospitals, specialists, pharmacists and allied health professionals

  • Pathology and diagnostic imaging providers

  • Medicare, Services Australia or the Department of Veterans’ Affairs

  • The Australian Immunisation Register

  • My Health Record

  • Insurers, employers or legal representatives where authorised

  • Emergency services, public health authorities or government agencies

  • Other sources where you have consented or collection is permitted by law

Where practical, we will collect information directly from you.

4. Why we collect and use information

We collect, use and hold information where it is reasonably necessary to provide healthcare and operate the practice.

This may include:

  • Assessing, diagnosing and treating medical conditions

  • Providing preventive healthcare and health checks

  • Managing chronic conditions and care plans

  • Providing immunisations and maintaining vaccination records

  • Providing skin checks and minor procedures

  • Coordinating care with other healthcare providers

  • Preparing prescriptions, referrals, certificates and reports

  • Managing appointments, recalls and clinical reminders

  • Communicating test results and follow-up requirements

  • Processing Medicare, DVA, insurance and private billing claims

  • Managing accounts and payments

  • Responding to enquiries and complaints

  • Meeting accreditation, quality improvement and clinical governance requirements

  • Maintaining secure clinical and administrative systems

  • Complying with legal, regulatory and professional obligations

We may also use information for a directly related purpose that you would reasonably expect, or where you have consented or the use is otherwise permitted by law.

5. When we disclose information

We may disclose information when reasonably necessary for your healthcare or the operation of the practice.

Recipients may include:

  • Doctors, nurses and authorised staff at Yorkeys Medical

  • Specialists, hospitals and other treating healthcare providers

  • Pathology and diagnostic imaging services

  • Pharmacists and electronic prescribing services

  • Allied health professionals

  • Medicare, Services Australia and the Department of Veterans’ Affairs

  • The Australian Immunisation Register

  • My Health Record

  • Accreditation bodies, auditors, insurers and professional advisers

  • Information technology, software, storage and communication providers

  • Billing, accounting and debt-recovery providers

  • Government, regulatory, public health or law-enforcement bodies where authorised or required

  • Another person or organisation with your consent

We may also disclose information where:

  • Disclosure is required or authorised by law

  • There is a serious threat to a person’s life, health or safety

  • Mandatory reporting obligations apply

  • It is necessary to respond to a court order, subpoena or lawful request

  • It is reasonably necessary to establish, exercise or defend a legal claim

We do not sell patient information.

6. Children, young people and representatives

Yorkeys Medical provides healthcare to children and young people.

Whether a young person can make their own privacy and healthcare decisions depends on their maturity and their ability to understand the proposed decision and its consequences. This is assessed individually rather than solely by age.

Where a child or young person does not have sufficient capacity, information may be collected from or disclosed to a parent, guardian or other authorised representative.

Where a young person has sufficient understanding to make their own decisions, we will respect their privacy and confidentiality, subject to:

  • Their safety and wellbeing

  • Mandatory reporting obligations

  • Other legal requirements

  • Situations involving a serious threat to life, health or safety

We may ask a representative to provide evidence of their identity and authority before giving them access to another person’s information.

7. My Health Record and electronic health information

Where Yorkeys Medical is registered to participate in the My Health Record system, authorised healthcare professionals may access or upload information when it is appropriate for your healthcare and permitted by law.

Information uploaded may include:

  • Shared health summaries

  • Event summaries

  • Prescriptions and dispensing information

  • Pathology or diagnostic imaging reports

  • Immunisation information

  • Other clinically relevant documents

You can manage access controls and document visibility through your My Health Record account.

If you do not want a particular document uploaded, please discuss this with your doctor. We will respect your request where legally and clinically appropriate.

My Health Record does not replace the medical record maintained by Yorkeys Medical.

8. Clinical photographs and images

Clinical photographs, dermoscopic images or other images may be collected when relevant to your assessment, treatment, monitoring or referral.

Before collecting an image, we will explain its clinical purpose and seek consent where required.

Clinical images form part of your health record and are protected accordingly. They will not be used for teaching, publication, promotion, social media or another unrelated purpose without separate and specific consent.

You may withdraw consent for future non-clinical use. However, images already required as part of the clinical record may need to be retained.

9. Our website, cookies and analytics

Our website is built and hosted using Wix.

When you visit our website, Wix and other enabled services may collect technical information such as:

  • Your IP address

  • Browser and device information

  • Approximate location

  • Pages viewed and time spent on the website

  • Referring websites

  • Links and buttons selected

  • Cookie and preference information

This information may be used for website security, functionality, analytics and service improvement.

Visiting pages about particular health services may reveal or allow inferences about a person’s health interests. We seek to limit unnecessary tracking and use non-essential tracking technologies only where they are appropriately configured and accompanied by suitable notice or choice.

We do not intentionally send clinical records or information entered into our clinical systems to advertising platforms.

Our website may contain links to external websites. Yorkeys Medical is not responsible for the privacy practices or content of those websites.

Please do not use a general website form to send urgent or highly sensitive medical information unless we have specifically invited you to do so.

10. Online bookings and electronic communications

Yorkeys Medical may use third-party providers, including HotDoc, for online bookings, patient forms, appointment reminders, recalls and related communications.

These providers handle information under their own privacy policies and security arrangements. Information supplied through an online booking service may also be transferred into our practice management system.

We may communicate with you by:

  • Telephone

  • SMS

  • Email

  • Online booking notifications

  • Patient messaging systems

  • Telehealth platforms

Electronic communication carries some privacy and security risks. We take reasonable steps to use appropriate systems, but cannot guarantee the security of every external email, telephone network or device.

Please tell us if you do not want to receive particular types of electronic communication. Opting out of optional communications will not prevent us from contacting you when reasonably necessary for your healthcare, safety, appointment management or legal obligations.

Yorkeys Medical does not ordinarily provide clinical results by unsecured email. Please contact reception if you require a copy of a result or medical document.

11. Overseas storage and disclosure

Some service providers used by Yorkeys Medical or our website may store or process information outside Australia.

For example, Wix and certain analytics, cloud, security or communication providers may process information using infrastructure located in Australia or overseas.

Where overseas handling occurs, we take reasonable steps appropriate to the circumstances to assess providers, limit the information shared and protect information through contractual, technical and organisational safeguards.

Some overseas recipients may operate under privacy laws that differ from Australian law.

Clinical and booking information processed by HotDoc is represented by HotDoc as being stored in Australia. Patients should also review the privacy policies of services they choose to use.

12. Artificial intelligence and automated functions

Some software used by Yorkeys Medical may include artificial intelligence, computer-assisted or automated features.

These features may support:

  • Administrative work

  • Appointment management

  • Clinical documentation

  • Cybersecurity and fraud prevention

  • Quality assurance

  • Clinical decision support

These tools assist rather than replace professional clinical judgement. Yorkeys Medical does not rely on a solely automated clinical decision that is expected to significantly affect a patient.

A qualified healthcare professional remains responsible for clinical assessment and decision-making.

Identifiable patient information must not be entered into a publicly available, general-purpose artificial intelligence service unless its use has been specifically approved, appropriately assessed, secured and permitted by law.

13. Direct marketing

Yorkeys Medical may occasionally send information about our services, changes to the practice or health-related programs where permitted by law.

We will not use sensitive health information for direct marketing without the consent required by law.

You can unsubscribe from marketing communications at any time. This will not stop appointment reminders, recalls, test-result notifications or other communications reasonably necessary for your care.

We do not sell personal information or patient mailing lists.

14. Anonymity and pseudonyms

You may ask whether you can interact with us anonymously or using a pseudonym.

This may be possible for a general enquiry. However, it is usually impractical for clinical care because we need to identify patients accurately, maintain safe and complete medical records, prescribe medicines, make referrals and process Medicare or insurance claims.

We will explain when identification is required.

15. Security and data breaches

Yorkeys Medical takes reasonable steps to protect personal and health information from:

  • Loss

  • Misuse

  • Interference

  • Unauthorised access

  • Unauthorised alteration

  • Unauthorised disclosure

Our safeguards may include:

  • Role-based access controls

  • Passwords and multi-factor authentication

  • Secure clinical and administrative systems

  • Encryption where appropriate

  • Physical security measures

  • Staff confidentiality obligations and privacy training

  • Software updates, backups and monitoring

  • Policies for remote access, devices and information handling

  • Review of third-party service providers

No electronic or physical system can be guaranteed to be completely secure.

If a suspected data breach occurs, we will investigate and take appropriate steps to contain and assess it. Where a breach is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner when required by law.

16. Retention and secure disposal

We retain health records and other information for the periods required by law, professional obligations and legitimate clinical or business needs.

When information is no longer required, we take reasonable steps to securely destroy it or permanently de-identify it, unless we are legally required to retain it.

Some information may remain in secure backups until those backups are replaced or deleted through normal system processes.

17. Accessing and correcting your information

You may request access to personal or health information held about you.

Access may be provided by:

  • Allowing you to inspect your record

  • Providing a copy

  • Giving you a summary

  • Arranging for your doctor to explain the information

  • Transferring information to another healthcare provider at your request

We may need to verify your identity and authority before providing access.

A reasonable fee may be charged for preparing or providing access, including copying or transferring records. We will explain any applicable fee before proceeding. There is no fee simply for making an access request.

Access may be refused or limited where permitted by law, including where providing access would create a serious threat to someone’s life, health or safety or would unreasonably affect another person’s privacy. If access is refused, we will generally provide written reasons and explain the available complaint options.

You may also ask us to correct information you believe is inaccurate, incomplete, out of date, irrelevant or misleading. If we do not make the requested correction, you may ask us to attach a statement to the record explaining your position.

We aim to respond to access and correction requests within 30 days.

18. Privacy questions and complaints

If you have a privacy question, concern or complaint, please contact:

Privacy Officer / Practice Manager
Yorkeys Medical
1D, 455 Varley Street
Yorkeys Knob QLD 4878

Telephone: (07) 4220 9884
Email: admin@yorkeys-medical.com.au

Please provide enough information for us to understand and investigate your concern. We will treat privacy complaints confidentially and aim to respond within 30 days.

If you are dissatisfied with our response, you may contact:

Office of the Australian Information Commissioner
Telephone: 1300 363 992
Website: www.oaic.gov.au

You may also contact:

Office of the Health Ombudsman Queensland
Telephone: 133 OHO (133 646)
Website: www.oho.qld.gov.au

19. Changes to this policy

We may update this privacy policy when our services, systems, providers or legal obligations change.

The current version will be available on our website and will show the date it was last updated.

bottom of page