Privacy Policy

---

1. Our Commitment to Privacy

Kendall Clinical and Melodies Pty Ltd ("we", "our", "us" or "Kendall Clinical and Melodies") respects your privacy and is committed to protecting the privacy, dignity and confidentiality of the people whose personal information we collect.

As a healthcare provider, we may collect personal information, including sensitive information and health information. We understand the importance of keeping this information private, confidential and secure.

We handle personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs) and other applicable Australian laws, regulations and professional obligations.

This Privacy Policy explains how we collect, use, disclose, store, protect and otherwise handle personal information.

2. Who This Policy Applies To

This Privacy Policy applies to personal information we collect about:

• patients and clients;
• family members, carers and authorised representatives;
• employees and contractors;
• students and volunteers;
• job applicants;
• suppliers and business partners; and
• visitors and users of our website and digital services.

3. What Is Personal Information?

Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable.

Sensitive information includes certain categories of information that receive additional protection under Australian privacy law, including health information.

Health information includes information about your health, disability, medical history, treatment, healthcare services or other information recognised as health information under Australian law.

Because health information is sensitive information, we take particular care when collecting, using, disclosing and storing it.

4. Information We May Collect

Depending on the services we provide, we may collect information including:

• name;
• date of birth;
• residential and postal address;
• telephone number;
• email address;
• emergency contact details;
• Medicare details or other government identifier details where reasonably necessary;
• health history;
• medical and health information;
• allergies;
• medications;
• treating practitioner details;
• referral information;
• assessments;
• clinical records and progress notes;
• care and treatment information;
• information relevant to the safe provision of services;
• invoices and payment information;
• employment information, where relevant;
• qualifications and professional registrations for workforce members; and
• other information reasonably required to provide our services or meet our legal, regulatory and professional obligations.

We aim to collect only information that is reasonably necessary for our functions and activities.

5. How We Collect Information

Where reasonable and practicable, we collect personal information directly from you.

We may collect information through:

• consultations and assessments;
• telephone conversations;
• email;
• online forms;
• referral forms;
• our website;
• healthcare and clinical documentation;
• appointments and service interactions; and
• communications with you.

Where reasonably necessary and authorised or permitted by law, we may also collect information from third parties, including:

• your authorised representative;
• treating practitioners;
• hospitals;
• healthcare providers;
• aged care providers;
• disability service providers;
• government agencies;
• insurers; and
• other organisations involved in your care or the provision of our services.

6. Why We Collect Personal Information

We may collect, use and hold personal information to:

• provide nursing and healthcare services;
• provide healthcare consulting and related professional services;
• assess and manage your healthcare needs;
• coordinate your care with other healthcare providers;
• communicate with you;
• verify your identity;
• arrange and manage appointments;
• manage referrals;
• maintain clinical and healthcare records;
• prepare reports and professional documentation;
• improve the quality and safety of our services;
• process payments and manage accounts;
• manage employees, contractors and business relationships;
• manage and improve our website and digital services;
• meet legal, regulatory and professional obligations; and
• protect the health, safety and wellbeing of individuals where appropriate.

7. Sensitive and Health Information

We may collect sensitive information, including health information, where permitted by law and where reasonably necessary for our functions or activities.

Where required, we will seek your consent to collect sensitive information.

In some circumstances, information may be collected, used or disclosed without consent where this is permitted or required by Australian law.

We take additional care when handling health information because of its sensitive nature.

8. What Happens If You Do Not Provide Information?

You may choose not to provide certain personal information.

However, if information that we reasonably require is not provided, we may be unable to:

• provide particular healthcare services;
• assess or safely manage your care;
• coordinate your care with other healthcare providers;
• process a referral;
• communicate with you effectively;
• administer your services; or
• meet certain legal or professional obligations.

Where particular information is necessary for us to provide a service, we will explain this where reasonably practicable.

9. How We Use and Disclose Information

We generally use and disclose personal information for the purpose for which it was collected or for a related purpose permitted by law.

Where reasonably necessary, relevant information may be disclosed to:

• treating practitioners;
• hospitals and healthcare providers;
• aged care providers;
• disability service providers;
• pathology providers;
• radiology providers;
• insurers;
• government agencies;
• legal and professional advisers;
• contractors and service providers assisting our operations; and
• other organisations involved in providing or supporting your care.

We may also disclose information where required or authorised by law, or where another exception under applicable privacy legislation applies.

We do not sell personal information.

We will only disclose information that is reasonably necessary for the relevant purpose, where required or permitted by law.

10. Government Identifiers

Where reasonably necessary, we may collect government identifiers such as Medicare details.

Government identifiers will be handled in accordance with applicable privacy laws.

We will not use or disclose government identifiers except as permitted or required by law.

11. Overseas Disclosure and Cloud Services

Some of our technology, cloud storage, software and service providers may store, process or access information outside Australia.

Where personal information is disclosed to an overseas recipient, we will take reasonable steps to comply with the requirements of the Privacy Act 1988 (Cth) and the Australian Privacy Principles, including requirements relating to overseas disclosures.

The location of data storage or processing may vary depending on the technology and service providers we use.

Where required, we will provide additional information about overseas disclosures through our privacy notices or other appropriate communications.

12. Website, Cookies and Digital Services

When you use our website or digital services, we may collect limited technical information to maintain, secure and improve our website.

This may include:

• IP address;
• browser type;
• device information;
• operating system;
• website usage information; and
• information relating to website security and performance.

We may use cookies and similar technologies where appropriate.

You may be able to manage or disable certain cookies through your browser settings. Disabling cookies may affect some website functionality.

We will handle information collected through our website in accordance with this Privacy Policy and applicable privacy laws.

13. Direct Marketing

We may contact you about our services where permitted by law.

Where applicable, we will comply with privacy and electronic marketing requirements, including the Spam Act 2003 (Cth).

You may ask us to stop sending direct marketing communications at any time.

We will provide an appropriate method for you to unsubscribe from electronic marketing communications.

14. How We Protect Personal Information

We take reasonable steps to protect personal information from:

• misuse;
• interference;
• loss;
• unauthorised access;
• unauthorised modification; and
• unauthorised disclosure.

Depending on the circumstances, our security measures may include:

• password protection;
• access controls;
• secure information systems;
• secure cloud services;
• encryption where appropriate;
• device and network security measures;
• staff and contractor confidentiality obligations;
• privacy and security procedures;
• workforce training; and
• secure destruction or de-identification of information when it is no longer required and retention is not otherwise required by law.

No method of electronic storage or transmission can be guaranteed to be completely secure.

15. Data Breaches

We maintain procedures for identifying, containing, assessing and responding to suspected or actual privacy and data security incidents.

If we become aware of a suspected or actual data breach, we will take reasonable steps to:

1. assess the incident promptly;
2. contain and minimise the breach where practicable;
3. determine what information has been affected;
4. assess whether the breach is likely to result in serious harm;
5. notify affected individuals and the Office of the Australian Information Commissioner where required under the Notifiable Data Breaches scheme;
6. meet any other applicable notification requirements; and
7. implement corrective measures to reduce the risk of the incident occurring again.

All employees, contractors and other personnel are expected to report suspected privacy or security incidents as soon as possible.

16. Accuracy and Quality of Information

We take reasonable steps to ensure that personal information we collect, use and hold is accurate, up to date, complete, relevant and not misleading for the purposes for which it is used.

If you believe information we hold about you is inaccurate, incomplete or out of date, please contact us so that we can review and, where appropriate, correct it.

17. Access to Your Personal Information

You may request access to personal information we hold about you.

We will generally provide access unless an exception under applicable law applies.

We may need to verify your identity before providing access to your information.

In certain circumstances, we may refuse or limit access where permitted or required by law.

Where required, we will explain the reasons for refusing access and any available complaint mechanisms.

18. Correction of Your Personal Information

You may request that we correct personal information we hold about you if you believe it is:

• inaccurate;
• out of date;
• incomplete;
• irrelevant; or
• misleading.

We will take reasonable steps to correct information where appropriate.

If we refuse a correction request, where required by law we will provide reasons and explain any available complaint mechanisms.

19. Retention and Destruction of Information

We retain personal and health information for as long as reasonably necessary for the purposes for which it is held and for any period required by applicable legislation, professional standards, contractual obligations or other legal requirements.

When information is no longer required and there is no legal or other requirement to retain it, we will take reasonable steps to securely destroy or permanently de-identify it.

20. Privacy Complaints

If you believe we have not handled your personal information appropriately, you may make a privacy complaint to us.