Privacy Policy

This policy applies to all clients, referrers, website visitors and any other individuals whose personal information we collect. It also explains how our team members, including administrative staff, handle information on our behalf. By engaging our services or submitting information through our website or contact form, you consent to the collection and use of your information as described in this policy.

Personal Information

• Full name, date of birth and gender
• Contact details including address, phone number and email address
• Medicare card number, DVA or ADF details, or NDIS participant number
• GP or specialist referral details and referring practitioner information
• Health fund details (where applicable)
• Emergency contact information
• Payment information processed securely through Tyro (card payments)

Health Information (Sensitive Information)

• Medical history, diagnoses and current medications
• Nutritional assessments and dietary intake information
• Anthropometric measurements (height, weight, body composition)
• Pathology results and clinical investigation reports
• Treatment plans, progress notes and clinical correspondence
• Enteral nutrition and tube feeding details (where applicable)
• Goals, care plans and NDIS support plan details

Website & Administrative Information

• IP address, browser type and device information
• Pages visited, time on site and approximate location (based on IP address)
• Information submitted via contact forms or online booking
• Appointment booking and scheduling data
• Billing and invoicing records
• Cookies and analytics data (see Section 7)

We collect information:

• Directly from you during consultations (including telehealth), via intake forms or over the phone
• Through our administrative staff when you phone, email or contact the practice, including when they enter or update your details in our practice software on your behalf
• From your GP, specialist, support coordinator or other treating practitioner via referral
• From Medicare, DVA, Bupa ADF Health Services, NIISQ or the NDIS (with your consent or as required for billing)
• Through our website contact form or online booking system
• From support workers, family members or carers (with your consent)

Practice Platforms

• Provide safe, evidence-based dietetic care, including via telehealth
• Communicate with you and your care team regarding treatment
• Process Medicare, DVA, ADF, NDIS, NIISQ and My Aged Care billing and claims
• Generate invoices and manage accounts through Xero
• Process card payments securely through Tyro
• Write clinical reports, progress notes and referral letters
• Manage appointment bookings and clinical records via Nookal
• Send appointment reminders by phone, SMS or email
• Carry out day-to-day practice administration, including data entry, records management, correspondence and file preparation
• Meet legal, regulatory and professional obligations as an Accredited Practising Dietitian (APD)
• Improve the quality and safety of our services
• Respond to enquiries submitted via our website or phone

These activities may be carried out by our dietitians or by authorised administrative staff working in accordance with this policy (see Section 5).

Thompson Community Dietitians is operated by a team that includes Accredited Practising Dietitians and administrative staff. Administrative staff are essential to running the practice, and this section explains what they may see and do with your information.

What Our Administrative Staff Do

• Book, confirm, reschedule and cancel appointments
• Answer enquiries by phone, email and through our website
• Enter and update your contact, referral, funding and health details in our practice software
• Prepare invoices, process payments and lodge Medicare, DVA, ADF, NDIS and NIISQ claims
• Send appointment reminders and practice communications
• Manage referrals, reports, clinical correspondence and requests for records

To perform these duties, administrative staff may access records held in our practice systems, including health information, where their role requires it. For example, staff may view referral details to lodge a claim, attach a clinical report to outgoing correspondence, or update your health fund and NDIS plan details.

How Staff Access Is Controlled

• Team members sign confidentiality agreements and receive privacy training before accessing client records
• Each team member has an individual login, and access is limited to what their role requires
• Activity in our practice software is logged and can be audited
• All of our team members are based in Australia and access records from within Australia
• Confidentiality obligations continue after a team member leaves the practice

All team members handle your information on behalf of Thompson Community Dietitians, in accordance with this policy and the Privacy Act. Internal access by our own staff is part of normal practice operations and is not a disclosure to a third party.

Healthcare Providers

• Your referring GP or medical specialist
• Other allied health professionals involved in your care
• Hospitals or residential aged care facilities (where applicable)

Government & Funding Bodies

• Medicare Australia (for EPC billing and claims)
• Department of Veterans’ Affairs (DVA) for eligible veterans
• Bupa ADF Health Services for serving Australian Defence Force members
• National Disability Insurance Agency (NDIA) for NDIS participants
• NDIS Support Coordinators or Plan Managers (as authorised)
• National Injury Insurance Agency Queensland (NIISQ) support planners, and My Aged Care or Support at Home providers, where they fund your care

Third-Party Service Providers

We use Nookal, Xero, Tyro, and the platforms described in Section 3, including our telehealth platform, email tools, SMS reminders, website hosting, and IT support. We only disclose what is necessary and require appropriate security safeguards from our providers.

Debt Recovery

If an account is significantly overdue, we may disclose limited information (name, contact details, invoice details and service dates) to a debt recovery service. We do not disclose clinical details to debt recovery services unless required by law.

We may use cookies and similar technologies to operate our website and understand how visitors use it (for example, pages viewed, time on page and approximate location based on IP address). Analytics tools such as Google Analytics may set cookies or collect usage data. You can usually control cookies through your browser settings. We do not attempt to identify you from website analytics unless you choose to submit your details via a form.

We do not use your health information for direct marketing. If we send service updates or clinic communications, you can opt out at any time using the unsubscribe option or by contacting us directly. We comply with the Spam Act 2003 (Cth) and will not send commercial electronic messages without your consent.

• Password-protected and encrypted electronic records stored in Nookal
• Secure, reputable practice management, accounting and payment software
• Physical security for any paper-based records
• Restricted staff and contractor access on a need-to-know basis
• Individual staff logins, with activity logged in our practice software
• Confidentiality agreements and privacy training for all staff and contractors
• Secure deletion or de-identification of records no longer required

Clinical records are retained for a minimum of 7 years from last contact with an adult client, or until a minor client reaches 25 years of age. Records are disposed of securely when no longer required.

You have the right to request access to the personal and health information we hold about you, and to request corrections if it is inaccurate, incomplete or out of date. Contact us using the details in Section 19. We will respond within 30 days and explain any refusal in writing. There is no charge for making a request, though a reasonable fee may apply for copies of records.

When we collect health information, we will seek and record consent in an appropriate form, written or electronic consent on an intake form, verbal consent during a consultation, or consent implied by providing information as part of receiving a health service. You can ask questions before consenting. You may withdraw consent at any time; doing so may limit our ability to continue providing services. Where a client is a child or lacks capacity, consent will be sought from a parent, guardian or authorised representative.

Where practicable and lawful, you may interact with us anonymously or using a pseudonym, for example, when making a general enquiry. To provide clinical services, however, we are required to identify you and collect relevant health information.

We take reasonable steps to ensure the security of electronic transmissions during telehealth. By participating, you acknowledge:

• Telehealth involves the electronic transmission of your health information
• You are responsible for ensuring a private environment during your consultation
• We use reputable, secure platforms for video consultations
• Some clinical assessments cannot be performed via telehealth
• We do not record sessions without the explicit consent of all participants
• You should not record sessions without advising us first

Our team, including administrative staff, is based in Australia and accesses practice records from within Australia. Some providers, including Xero, our telehealth platform and email/calendar tools, may process data in the United States or other countries. We take reasonable steps to ensure overseas recipients handle your information consistently with the Australian Privacy Principles. Nookal stores data on Australian servers. Tyro payment data is handled solely by Tyro. By using our services, you consent to potential cross-border transfer of data to the extent it occurs through these platforms.

We do not routinely upload information to My Health Record unless required, requested or clinically appropriate. If we participate in My Health Record, we will comply with the My Health Records Act 2012 (Cth) and the My Health Records Rule 2016, including maintaining a Security and Access Policy as required.

We comply with the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988 (Cth). In the event of an eligible data breach likely to result in serious harm, we will notify both affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by law.

Please contact us first. We will acknowledge within 5 business days and aim to resolve within 30 days. If unresolved, contact the OAIC: oaic.gov.au · 1300 363 992 · GPO Box 5218, Sydney NSW 2001.

We may update this Privacy Policy from time to time, including as our team grows or our systems change. The current version is available at thompsondietetics.com.au/privacy-policy.