Privacy Policy

The Law We Follow

TRC is committed to complying with the Privacy Act 1988 (Cth) (as amended) (the “Privacy Act”) and the Australian Privacy Principles (APPs) made under it, as well as the “Handbook for the Management of Health Information in Private Medical Practice” (published by the Royal Australian College of General Practitioners and the Committee of Presidents of Medical Colleges). Where we send commercial electronic messages (such as SMS or email marketing), we also comply with the Spam Act 2003 (Cth). Where we make marketing telephone calls, we comply with the Do Not Call Register Act 2006 (Cth).

Your Reasonable Expectations of TRC

As a patient of TRC, you have the right to expect each of our employees, contractors and students to:

• Be open and honest in their dealings with you
• Respect your privacy and keep your personal information confidential unless disclosure is authorised by you or by law
• Use your personal information only for the purpose of providing you with the most appropriate care and services
• Satisfy your right to see and request amendments to your personal information based on the processes outlined in this policy
• Follow government and organisational policies and protocols to protect the privacy of your information

Your health information refers to information about your health, medical history, and past and future medical care. As a patient of TRC, we ask that you provide your personal details and health information so we can properly assess, diagnose, treat and be proactive in your health care needs.

We require your consent to collect, use and disclose your personal health information. Your consent is collected when you register as a patient by signing our “Patient Registration Form”, and verbally before any medical procedure is conducted.

Where we use AI or automated systems to process information that identifies you — including health (sensitive) information — we obtain your consent as described in Section 4 (“Our use of AI and automated systems”). Where we send you SMS or email marketing, we obtain your consent as described in Section 7 (“SMS and email marketing”).

As a healthcare provider, we collect personal information so we can provide you with effective and appropriate care, and for related business purposes such as claims and payments, practice audits and accreditation, and staff training. Information we collect includes, but is not limited to:

• Personal details: full name, date of birth, addresses, contact numbers and email, emergency contact and next of kin details, signature.
• Medical information: family and personal health history, medications, allergies, adverse reactions, immunisations, healthcare identifiers.
• Financial information: where applicable, Medicare number, government health card details and health fund details, for identification and claiming. Card/bank payment details are collected and stored by our third-party payment processor under its own privacy policy, not by us.
• Clinical information: consultation notes, referrals and letters to/from other providers, results and reports, past medical history.
• Communications information: information you provide when you contact us or we contact you — including how you contacted us, your marketing preferences, and details you choose to share by phone, email, SMS, our website, online booking or social media.
• Call and message information: phone numbers, call times and duration, voicemail messages, and transcripts and summaries of calls and messages (including details you provide to an automated voice assistant, where we use one).

We collect this information in a number of ways, including: when you register and during booking; during the provision of medical services; when you contact us or we contact you by phone, email, SMS, our website, online booking or social media; and when you sign up to receive SMS or email updates from us.

In some circumstances we collect information from other sources where it is not practical or reasonable to collect it from you directly, including from your legal guardian or delegated contact; other involved healthcare providers (specialists, allied health, community health, pathology and imaging services); and, where applicable, Medicare, government health agencies, the Department of Veterans’ Affairs, and your health fund.

We aim to collect information directly from you and to keep it accurate and current. You have the right to deal with us anonymously or under a pseudonym unless it is impracticable, or we are required or authorised by law to deal only with identified individuals. If you do not wish for us to collect certain information, please let us know and we will discuss any consequences for your care.

We only use or disclose your information in ways you would reasonably expect and for purposes directly related to your care, or for a secondary purpose where permitted by law or with your consent. Examples include:

• For the diagnosis and treatment of health conditions, including disclosure to other doctors in the practice, specialists, locums and other providers to ensure quality care, and communications about treatments and recommended preventative health services
• Where you have specifically requested and consented to the disclosure
• To your responsible carer where you are physically or legally incapable of giving consent, or for compassionate reasons, unless there is evidence of your wish to the contrary
• For use by third parties directly associated with our practice — such as our IT providers, telephony provider, AI/automated-system providers, email/SMS marketing provider, and accreditation agencies — all of whom are required to comply with confidentiality obligations and this policy
• For billing, accounting and claiming purposes
• Through Electronic Transfer of Prescriptions (eTP) and My Health Record where applicable
• To allow medical students and staff to participate in training, using de-identified information
• Where necessary to lessen or prevent a serious threat to an individual’s life, health or safety, or to prevent a crime or seriously improper conduct
• Where required for judicial, administrative or coronial proceedings, a court order, subpoena or search warrant, or to identify or locate a patient or missing person
• To assist in organ donation, or to establish, exercise or defend a legal claim
• Where legally obliged (e.g. notification of certain infectious diseases, suspected child abuse)
• For research, accreditation and quality assurance within the practice, using de-identified aggregate information

We will not use your personal information for direct marketing without a lawful basis and, where required, your consent (see Section 7).

To provide our services we rely on third-party providers — including our IT, telephony, AI/automated-system and email/SMS marketing providers — and some of them store or process personal information outside Australia, including in the United States. This is described in Sections 5 and 7. Where information is processed overseas, we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles. Other than through these service providers, we will not disclose your personal information to anyone outside Australia without your consent, except where permitted by law (for example, if you need urgent medical assistance overseas or medical evacuation is required).

We use, or are preparing to use, AI and automated tools to help us run the practice more efficiently and improve the service you receive. We remain fully responsible under the Privacy Act for how these tools handle your personal information. This section explains what we use them for and your rights.

What we use AI for

We currently use, or are preparing to use, AI and automated systems to:

• Convert voicemail messages and calls into written transcripts (we process the content of calls; we do not retain call audio recordings unless we tell you and obtain any consent required);
• Summarise calls and messages so our team can respond accurately;
• Analyse call and contact information (such as phone numbers and call times) to help us manage and route enquiries;
• Draft emails, messages and other written communications, which a member of our staff reviews before sending;
• Operate, in future, an automated voice assistant (“voice agent”) that may answer or make calls and — only with your agreement during the call — collect details such as your name, contact details and the reason for your enquiry.

The specific AI tools we use

To be transparent about the technology behind the uses described above, the AI and automated tools we currently use, or are preparing to use, are:

• Claude (Anthropic), Microsoft Copilot and ChatGPT (OpenAI) — general-purpose AI assistants that help our staff with administrative tasks, such as drafting and reviewing written communications, and with some general data analytics;
• Chatbase — the automated chat assistant (“chat widget”) on our website, which answers general enquiries and helps direct your message to the right place;
• ElevenLabs — the technology behind the automated voice agent described above (this is not yet live);
• IPC Phone Solutions — our telephony provider, which converts voicemail messages into written text for our team.

We do not actively enter information that identifies you into our general-purpose AI assistants (Claude, Microsoft Copilot and ChatGPT), and our staff use these tools only through practice-controlled work accounts, never personal ones. We use them to help with administrative tasks and for general data analytics — such as call and email volumes and the rate at which consultations lead to treatment — which we carry out only after identifying details have been removed. Some of the tools that handle calls and messages you send to us — such as voicemail transcription and, in future, the voice agent — necessarily process the information you choose to give us; we handle that information as described in the rest of this section and in Section 3.

Please note that our website chat assistant (Chatbase) keeps a saved record of every conversation, and collects your device’s IP address and approximate location even if you do not enter any details. Please do not type sensitive health information into the website chat. If you give your name or contact details there, we use them only to respond to your enquiry.

You will always know when you are dealing with an automated system

When you interact with an automated voice agent or other customer-facing automated system, it will identify itself as automated at the start of the interaction. Before it collects any personal details from you, it will tell you what it is collecting and why, and ask for your agreement to continue. You can ask to speak with a member of our staff at any time.

A person reviews the important decisions

AI helps our team by transcribing, summarising and drafting. A member of our staff reviews AI-generated summaries and drafts before they are relied upon, sent, or added to your record. We do not use AI to make final decisions about your clinical care on its own.

Automated decision-making transparency

From 10 December 2026, the Privacy Act requires organisations to disclose in their privacy policy where a computer program is used to make, or to substantially and directly assist in making, decisions that could reasonably be expected to significantly affect an individual’s rights or interests, and where personal information is used to do so. Our current practice is that significant decisions about you are made by our staff, not by an automated system on its own. Where AI is involved, it assists our staff (for example, by summarising a call or drafting a proposed response), and a member of our staff makes the final decision. If this changes, we will update this policy to describe the personal information the system uses and the kinds of decisions it makes or substantially assists.

Sensitive and Health Information

Some information handled by these tools — such as the content of a voicemail or call — may include health or other sensitive information. We treat it with additional care and will not process your sensitive information through an AI system for a purpose beyond your care and the running of the practice without your express consent. If you do not wish for your sensitive information to be processed by an AI system, please tell us and we will discuss any effect on the service we can provide.

The AI providers we use and where your information is processed

We choose AI tools with privacy protections appropriate to the information involved. Our staff access these tools only through practice-controlled work accounts, not personal accounts, and we take reasonable steps to avoid entering information that identifies you into general-purpose AI assistants. Some of our AI providers, or their sub-processors, store or process information outside Australia (including in the United States); where that is the case, we take reasonable steps to protect it consistently with the Australian Privacy Principles.

Accuracy of AI-generated information

AI tools can sometimes produce information that is incomplete or incorrect. We take reasonable steps to check the accuracy of AI-generated summaries, transcripts and drafts containing personal information before they are sent or added to your record. If you believe information we hold about you is inaccurate — including anything generated from a transcript or automated summary — you can ask us to correct it (see Section 9).

Your Choices

You can ask to deal with a member of our staff rather than an automated system; decline to have your details collected by an automated voice agent (we will offer an alternative where practicable); ask us how AI was used in a communication or summary concerning you; and ask us to correct information generated by an automated system.

Our staff are educated in the importance of doctor–patient confidentiality and the protection of our systems. Only staff who need to see your personal information have access to it; this applies equally to information processed by our AI, automated and marketing systems. We take all reasonable steps to protect your information from misuse, loss, and unauthorised access, modification and disclosure. Information is held in electronic form; paper records are scanned into your electronic medical record and then de-identified and destroyed confidentially. A complete backup of the electronic medical record is performed daily and stored securely, and access is password protected with passwords changed regularly.

If we need your information for a purpose not covered here, we will seek your consent directly. During your care, you may be asked to complete supplementary consent forms and may specify restrictions on information we hold. Please speak with your healthcare provider if you have any concerns.

With your consent, we may send you SMS (text message) and email communications — such as newsletters, health reminders, appointment-related prompts, and information about our services that may interest you. We use a third-party marketing platform to help us manage these communications.

How we obtain your consent

We will send you marketing messages only where you have asked us to, or have otherwise given us your consent — for example, by opting in when you register, when you sign up through our website or in the practice, or when you provide your details for this purpose. When you sign up, we will make clear what you are agreeing to receive.

How to opt-out

You can unsubscribe at any time using the unsubscribe link or reply keyword (such as STOP) included in our messages, or by contacting us at contact@rclinic.com.au. If you opt out of marketing messages, we may still send you non-promotional messages necessary for your care or administration, such as appointment confirmations and clinical results notifications.

Our marketing platform and where your data is processed

To deliver these messages we share the contact details you provide (such as your name, mobile number and email address) with our marketing platform provider, which processes this information on our behalf. This provider may store or process your information outside Australia (including in the United States).

We will ask for your consent before sharing your personal information with any third party for that third party’s own direct marketing purposes.

We keep your personal information only for as long as necessary for the purpose it was collected, or as required by law. In deciding how long to keep information, we consider its amount, nature and sensitivity, the risk of harm from unauthorised use or disclosure, the purpose for which we need it, and applicable legal requirements — including the minimum periods for which health records must be retained. We may retain information where necessary to comply with our legal obligations or to establish, exercise or defend a legal claim. Details of retention periods for particular records are available on request.

You have the right to access your personal health information. Requests should be made in writing to your treating doctor or TRC staff. It is at the discretion of our medical practitioners whether they provide an up-to-date summary or a copy of the full record. We will respond within 5 business days of receiving a request and give access in the manner requested where reasonable and practicable. A reasonable administration fee may apply.

Access may be refused, in full or part, where: disclosure may result in physical or mental harm to you or another person; it may affect another individual’s privacy; it relates to existing or anticipated legal proceedings; it would prejudice negotiations with you; or refusal is required or authorised by law. If we refuse, we will provide written notice of the reasons (except where inappropriate) and how to complain.

You may request correction of your personal information — including information generated by an AI or automated system — if you believe it is inaccurate. We will take reasonable steps to correct information that is not accurate or up to date, and on request will take reasonable steps to notify third parties to whom we have disclosed it. If we refuse, we will provide written notice of the reasons and how to complain. On arrival at each consultation we will ask you to verify your details.

You may: access or request correction of your personal information; ask us to stop using it in particular ways (including processing by AI or automated systems, or for marketing); and, where we have relied on your consent, withdraw that consent at any time. Some of these choices may limit our ability to manage your health care, and we will discuss any consequences with you.

We take privacy complaints seriously. Formal complaints should be made in writing to our Practice Manager, marked private and confidential, by post or to manager@rclinic.com.au. We aim to respond within 10 business days, setting out the outcome, the reasons, and any follow-up available to you. If you remain dissatisfied, you may contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or 1300 336 002 (the OAIC generally requires you to allow us time to respond first).

We may update this Privacy Policy from time to time to reflect changes in our practices, including changes to how we use AI and marketing. When we make significant changes, we will take appropriate steps to inform you. Please check this page from time to time for the latest version.

If you have questions about this Privacy Policy, our handling of your personal information, or your rights, please contact:

The R Clinic

4 Grazier Lane, Belconnen ACT 2617

manager@rclinic.com.au