Privacy Policy

Advanced Performance Clinic Pty Ltd (ABN 62 696 381 825), of PO Box 6006, Townsville, QLD, 4810 (we, us, our), is committed to protecting the privacy of your personal and health information. This policy explains how we collect, hold, use and disclose that information.

We comply with the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth). Because we handle health information, we also comply with any health privacy laws that apply in the states and territories where our patients are located. A copy of the APPs is available from the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

Anonymity and pseudonymity

Where it is lawful and practicable to do so, you can deal with us without identifying yourself. For example, you can make a general enquiry about how the clinic works, or ask a question about this policy, without giving us your name.

For the clinical services we provide, it is generally impracticable for us to deal with individuals who have not identified themselves. Accurate identification is required to confirm you are the person receiving care, to keep your clinical record safe and continuous, to issue and dispense a prescription lawfully where one is issued, and to comply with our legal and professional obligations under applicable health legislation.

Our peptide and cellular health services are private-pay. We do not claim Medicare or private health insurance benefits for them, so identification for billing purposes is not a reason we require it for those services. Where a service is one for which Medicare or private health fund claiming is available and you ask us to claim, we will tell you at the time what identification that requires.

The information we collect

Personal information includes your name, date of birth, address, email, phone number, and payment details.

Health information is a type of sensitive information. It may include your medical history, current symptoms, medications, allergies, family history, pathology and test results, diagnoses, clinical notes, referrals, care plans, consultation records and metadata (such as the date, time and channel of a consultation), and any Medicare or private health fund claim information. Health information is far more than your name and email. We collect it only with your consent or where otherwise permitted by law.

How we collect information

We collect information directly from you, through our website, our intake questionnaire, your consultations, and your communications with us. Where reasonable and practicable, we collect personal information only from you. In some circumstances we may collect it from a third party (for example, a pathology provider or your treating practitioner) with your consent or as permitted by law.

From time to time, we may receive personal or health information that we did not solicit. Where we receive unsolicited personal information, we will promptly assess whether that information is of a kind we could have collected under our standard collection practices.

Why we collect and how we use your information

We collect, hold and use your information for the primary purpose of providing telehealth consultations and related care. We also use it for directly related secondary purposes you would reasonably expect. These include billing, administration, quality and safety, and meeting our legal and professional obligations. Any treatment is a clinical decision made by your treating practitioner. A consultation does not guarantee that any treatment will be prescribed.

Direct marketing

We will only send you marketing communications where you have given express consent. We will never use your health information to target marketing. Every marketing message includes a simple way to opt out. You can withdraw your consent at any time by contacting us.

Disclosure of your information

Your information may be disclosed to:

• your treating practitioner and our care team, for the purpose of your care;
• the dispensing pharmacy, where required to dispense or coordinate the supply of a prescribed medicine. Where a compounding pharmacy is involved, this may include the prescription, the details needed to identify you, and delivery details where the medicine is sent to you;
• pathology providers and other healthcare providers involved in your care, with your consent;
• our service providers (such as our telehealth video platform and secure IT providers) under confidentiality obligations; and
• others where required or authorised by law.

Collection notices on our forms

This policy explains our information handling generally. It does not replace the notice we give you at or before the point we collect your information. When you use our discovery call form, our intake questionnaire, a pathology form, or a patient registration form, that form carries its own collection notice telling you, for that collection:

• who is collecting the information and how to contact us;
• what we are collecting and why we need it;
• whether any field is optional and what happens if you do not provide it;
• who we are likely to disclose it to, including any overseas recipient; and
• how to access, correct or complain about the information we hold.

Where a form collects sensitive information, including health information, we also ask for your consent at that point.

Overseas disclosure

We aim to store and process your information in Australia, and our clinical records are held in Australia. Some of our service providers may store or process data overseas, for example cloud hosting, secure IT infrastructure, our telehealth video platform, and administrative software.

The country in which a particular provider stores or processes information depends on that provider's infrastructure. Where we can identify the country, we name it in the collection notice for the service concerned and, where it is practicable to do so, in this policy. If you would like to know where a specific part of your information is held, contact us at [email protected] and we will tell you.

Before any of your information is disclosed to an overseas recipient, we take reasonable steps to ensure the recipient does not breach the APPs, usually through contractual commitments to handle the information consistently with Australian privacy law. Consent is only one of several bases on which APP 8 permits an overseas disclosure, and we do not rely on it in every case. Where we do rely on your consent, we will ask for it and explain what you are consenting to.

Government and healthcare identifiers

We may collect government-related identifiers such as your Medicare number or Individual Healthcare Identifier (IHI). We collect them only where reasonably necessary to carry out our functions, and we will not adopt, use or disclose them except as permitted by law. We do not use these identifiers as our own reference for you.

Because our peptide and cellular health services are private-pay, a Medicare number is not required for those services. Where we ask for one, providing it is optional and we will tell you why we are asking. You can decline to give it without affecting your access to a private-pay consultation. We may need an IHI where we are required to use one for a specific purpose, such as a My Health Record interaction, and we will explain that at the time.

Telehealth privacy

We verify your identity before each consultation. Consultations are conducted in private, and we will tell you who is present. If we consider telehealth is not suitable for your needs, your practitioner may recommend in-person assessment, a general practitioner review, a specialist referral, further investigation, urgent care, or no treatment. In an emergency, call 000.

Automated tools and artificial intelligence

Where we use automated tools, including artificial intelligence, we use them for administration only. They do not make or assist with clinical decisions. Every clinical decision, including any decision to prescribe, is made by a qualified practitioner exercising their own independent judgement.

Specifically:

• What the tools do. Administrative tasks such as transcribing or summarising notes for a practitioner to review and correct, drafting routine correspondence, organising and categorising records, and scheduling.
• What information is processed. Only the information needed for that task. Where a task involves your health information, that information is processed under confidentiality obligations.
• Third-party providers and overseas storage. Some of these tools are supplied by third parties who may process or store information outside Australia. Our overseas disclosure section below explains how we handle that.
• Training. We do not permit your personal or health information to be used to train third-party artificial intelligence models, and we require this of our providers by contract.
• Automated decision-making. We do not use automated decision-making, with or without artificial intelligence, to make decisions about your care, your eligibility for a service, or any other decision that affects your rights or interests.

If you would like to know which tools we currently use for a particular purpose, contact us at [email protected] and we will tell you.

Cookies and tracking

Browsing health-related content can reveal sensitive interests about you. We take that seriously, so this section sets out the full scope of the technologies this website uses or may use, how to check what is running at any given moment, and the commitments that apply whatever is running.

Always active on this website:

• Essential storage. Your browser's local storage is used to keep your progress through our intake questionnaire, so you do not lose your answers. This stays on your device.
• Campaign attribution. If you arrive from an advertisement or a link with campaign parameters, we store those parameters (such as utm_source, utm_campaign, gclid and fbclid) in your browser for up to 30 days and attach them to an enquiry you choose to submit. This tells us which campaign an enquiry came from. It records the campaign, not the health pages you viewed.

Analytics and advertising technologies. These are the categories of technology we use, or may use, on this website. Not all of them are running at any given time, and which are active can change as our website and marketing change:

• Website analytics — to understand how the website is used and to improve it. Where we use these, they are typically Google Analytics 4 and Google Tag Manager.
• Advertising measurement — to measure whether our advertising works. Where we use these, they are typically the Meta Pixel and the Meta Conversions API. The Conversions API sends a hashed record of an enquiry from our server so that a single enquiry is not counted twice.
• Remarketing and audience building — to show our advertising to people who have visited the website. Where we use this, it operates through the advertising platforms above.
• Feedback and website review tools — used during development and review periods to collect feedback on the website itself.

How to find out what is active right now. Where any non-essential technology above is running, we display a consent mechanism that lists it, and that listing is the authoritative, up-to-date record. If no consent mechanism is shown to you, no non-essential analytics, advertising or remarketing technology is running. You can also ask us at any time by emailing [email protected] and we will tell you what is in use and for what purpose. We point you to the consent mechanism rather than to this policy alone so that what you are told is always current.

Our commitments, whatever is running:

• Non-essential technologies load only where you have consented, through the consent mechanism, wherever consent is required. You can withdraw consent at any time and it takes effect from then on.
• We do not use tracking technologies to build a profile of the specific health topics or conditions you have browsed, and we do not use your browsing of health content to target advertising to you about a health condition.
• We do not sell your personal information, and we do not disclose your health information to an advertising platform.
• We will not introduce session recording, heat-mapping or similar behaviour-capture tools without disclosing them here and obtaining consent where it is required.
• We only collect what is reasonably necessary for the purpose, in line with the data-minimisation approach the OAIC expects.

You can control cookies through your browser settings and through the consent mechanism we display. Blocking or declining non-essential cookies does not affect your ability to use the website, complete our questionnaire, or contact us.

My Health Record

My Health Record operates under a national framework that includes Share by Default requirements for certain services and record types. Where a provider participates and those requirements apply, consent is not required for every upload, although specific state and territory law exceptions apply. We do not claim a blanket position either way in this policy, because what applies depends on our current participation status and the service involved.

You can ask us at any time whether we participate in My Health Record and what that means for your records, and we will tell you.

You can ask us not to upload a particular record or a particular piece of information, and we will follow that request subject to the rules that apply. You control access to your My Health Record through your own account, including setting access controls and viewing the audit log of who has accessed it. If you would like to discuss what is uploaded, contact us at [email protected].

Security of your information

We store your information in a manner that reasonably protects it from misuse, interference, loss, and unauthorised access, modification or disclosure. We use appropriate technical and organisational measures to do this.

Data breaches

We comply with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988 (Cth). If a data breach is likely to result in serious harm, we will notify you and the OAIC as soon as practicable, and within 30 days of becoming aware of the breach.

How long we keep your information

We retain clinical records in line with our professional obligations and any applicable state or territory health records law. As a general standard, we keep an adult's clinical record for at least 7 years from the date of the last entry in that record. For a person who was under 18 when we last provided care, we keep the record until they turn 25. When a record is no longer required and the law permits, we securely destroy or de-identify it.

Accessing and correcting your information

You may request access to, and correction of, the personal information we hold about you, subject to certain exceptions. To protect your privacy we may require identification before releasing information. We do not charge to make a request, but we may charge a reasonable administrative fee for providing access.

Complaints and enquiries

If you have a question or complaint about how we handle your information, please contact us at [email protected]. Our Complaints Policy sets out how we handle complaints and the timeframes we work to, and our Communication Policy explains how we contact you. If you are not satisfied with our response, you may contact the OAIC at www.oaic.gov.au or on 1300 363 992.

Changes to this policy

We may update this policy from time to time. The current version is always available on our website.