Kildare Road Medical Centre Privacy Policy

Last updated: August 2026

1. About this Privacy Policy

Kildare Road Medical Centre is a registered business name of The Trustee for the KRMC Unit Trust, ABN 80 196 184 549. In this Privacy Policy, “KRMC”, “we”, “us” and “the medical centre” refer to Kildare Road Medical Centre as the operator of the medical centre at 36 Kildare Road, Blacktown NSW 2148.

KRMC is committed to protecting the privacy and confidentiality of personal information. This Privacy Policy explains how KRMC collects, holds, uses and discloses personal information, including health information, and how individuals may access or correct their information or make a privacy complaint.

Doctors and other health practitioners provide services at KRMC as consulting practitioners. They have their own legal and professional obligations regarding patient confidentiality and privacy. This policy applies to personal information handled through KRMC’s administrative, communication, billing and clinical information systems. A consulting practitioner may also provide a separate privacy notice where they collect or hold information independently of KRMC.

KRMC handles personal and health information in accordance with applicable laws, including the:

• Privacy Act 1988 (Cth) and the Australian Privacy Principles;
• Health Records and Information Privacy Act 2002 (NSW) and the Health Privacy Principles;
• My Health Records Act 2012 (Cth); and
• Healthcare Identifiers Act 2010 (Cth),

where those laws apply.

This policy is intended to explain KRMC’s information-handling practices. It does not replace any consent that KRMC or a consulting practitioner may need to obtain for a particular collection, use or disclosure.

2. What personal information does KRMC collect?

The information KRMC collects depends on the nature of a person’s interaction with the medical centre. It may include:

• name, date of birth, address, telephone number, email address and preferred method of contact;
• sex or gender information where relevant to care;
• emergency contact, next-of-kin, parent, guardian, carer or authorised representative details;
• Medicare number, Individual Healthcare Identifier, Department of Veterans’ Affairs details, concession information and other government-issued identifiers;
• private health insurance, workers compensation, compulsory third-party insurance, employer or other billing information where relevant;
• medical history, family history, medications, allergies, immunisation history, symptoms, diagnoses, examination findings and treatment information;
• consultation notes, care plans, prescriptions, referrals, medical certificates, reports and clinical correspondence;
• pathology, radiology and other investigation requests and results;
• hospital, specialist, allied health, pharmacy and other healthcare information;
• Aboriginal or Torres Strait Islander status, cultural or linguistic background and other sensitive information where relevant to the person’s healthcare or where collection is otherwise permitted;
• clinical photographs, recordings or other clinical material where relevant and appropriately authorised;
• appointment, waiting-list, recall, reminder and attendance information;
• telephone, SMS, email, online form and other communications with KRMC;
• billing, payment, account and Medicare claim information;
• feedback, complaints and incident information;
• website usage information, including IP address, browser type, device information, pages viewed and cookie or analytics data; and
• information about job applicants, contractors, suppliers and business contacts where necessary for KRMC’s operations.

KRMC seeks to collect only information that is reasonably necessary for its functions or activities, including the provision and support of healthcare services.

3. How does KRMC collect information?

KRMC will generally collect information directly from the person concerned or from their authorised representative. This may occur:

• in person at reception or during an appointment;
• through registration, consent, request or assessment forms;
• by telephone, email, SMS or secure electronic messaging;
• through KRMC’s website;
• through online booking, patient engagement or telehealth platforms;
• when a person provides identification, Medicare, insurance or payment information; or
• through correspondence, feedback or complaint processes.

KRMC may also receive information from:

• doctors and other health practitioners consulting at KRMC;
• a patient’s previous or current medical practice;
• hospitals, specialists, allied health practitioners and other healthcare providers;
• pathology, radiology and pharmacy providers;
• My Health Record and authorised health registers;
• Medicare, the Department of Veterans’ Affairs, Services Australia or other government bodies;
• a parent, guardian, carer, family member or authorised representative;
• an employer, insurer or legal representative where a relevant occupational, insurance or medico-legal service has been requested and the disclosure is authorised;
• emergency services or another person where the patient cannot provide information and collection is necessary for care; or
• another source where collection is authorised or required by law.

Where it is reasonable and practicable, KRMC will take steps to tell the person that information has been collected from another source.

If KRMC receives unsolicited personal information, it will determine whether it could lawfully have collected that information. Information that is not required may be securely destroyed or de-identified where lawful and practicable.

4. Why does KRMC collect, use and disclose information?

KRMC may collect, use or disclose personal information to:

• arrange, confirm, reschedule and manage appointments;
• identify patients accurately and maintain reliable patient records;
• support doctors and other health practitioners in providing and coordinating healthcare;
• communicate about consultations, results, referrals, prescriptions, recalls and follow-up care;
• provide preventive-health reminders and other clinically relevant communications;
• communicate with hospitals, specialists, allied health practitioners, pathology providers, radiology providers, pharmacies and other healthcare services;
• process Medicare, Department of Veterans’ Affairs, insurer and other claims;
• administer MyMedicare and other government healthcare programs where applicable;
• manage accounts, payments and debt recovery;
• undertake electronic prescribing and secure clinical messaging;
• maintain and improve the quality and safety of services;
• conduct clinical audits, accreditation activities, incident reviews and quality-improvement activities;
• respond to complaints, legal claims, regulatory enquiries or professional-indemnity matters;
• meet public-health, mandatory-reporting and other legal obligations;
• manage information security and investigate suspected unauthorised access;
• undertake business planning and service analysis, preferably using de-identified or aggregated information;
• provide education, training or research where the information is de-identified, consent has been obtained, or the activity is otherwise authorised by law and applicable ethical requirements; and
• manage KRMC’s staff, contractors, systems, premises and business operations.

Where a service is requested by an employer, insurer, solicitor or another third party, KRMC or the relevant consulting practitioner will ordinarily explain what information or report is proposed to be released and obtain the person’s authority, unless disclosure is otherwise authorised or required by law.

If necessary information is not provided, KRMC or a consulting practitioner may be unable to provide an appropriate service, safely identify the person, communicate important information or process a Medicare, insurance or other claim.

5. Can a person remain anonymous?

A person may interact with KRMC anonymously or by using a pseudonym where this is lawful and practicable. For example, it may be possible to make a general enquiry without providing identifying information.

For most clinical services, KRMC and consulting practitioners need accurate identifying information to:

• provide safe and appropriate healthcare;
• maintain an accurate medical record;
• match results and clinical correspondence;
• issue prescriptions, referrals and certificates;
• verify Medicare or insurance eligibility; and
• comply with legal and professional requirements.

6. When may information be disclosed?

KRMC limits access to personal information to people who require it for an authorised purpose. Depending on the circumstances, information may be disclosed to:

• a doctor or other health practitioner involved in the person’s care;
• authorised nursing, reception, administration, billing and management staff;
• hospitals, specialists, allied health practitioners and other healthcare providers;
• pathology, radiology, pharmacy and other diagnostic or treatment providers;
• Medicare, Services Australia, the Department of Veterans’ Affairs and other government agencies or registers;
• My Health Record, where permitted;
• insurers, employers, workers compensation bodies or legal representatives where authorised;
• technology, hosting, booking, secure-messaging, telecommunications, records-storage, payment, accounting and professional-advisory providers;
• accreditation bodies, auditors, insurers and professional advisers;
• public-health units, regulators, courts, tribunals, law-enforcement bodies or other authorities where required or authorised by law;
• a person’s parent, guardian, carer or authorised representative where permitted; or
• another organisation involved in a change of ownership or management of the medical centre, subject to applicable privacy and health-record requirements.

Only information reasonably necessary for the relevant purpose will be disclosed.

Pathology, radiology, pharmacy and other businesses operating at or from the KRMC premises may be separate organisations with their own privacy policies and information systems. Information is not shared merely because another service is located at the same premises. Information will only be provided where it is needed for a patient’s care, the patient has authorised the disclosure, or the disclosure is otherwise permitted or required by law.

KRMC does not sell patient information.

7. My Health Record and healthcare identifiers

KRMC and consulting practitioners may access or upload information to My Health Record where this is clinically relevant and authorised under the My Health Record system.

Information handled through My Health Record is also subject to the My Health Records Act 2012 and associated rules. Patients can manage access controls and other My Health Record settings through their My Health Record account.

KRMC may use Medicare numbers, Individual Healthcare Identifiers and other government identifiers only where reasonably necessary and permitted by law. Healthcare provider organisations participating in My Health Record must maintain appropriate security and access policies.

8. Appointment reminders, recalls and communications

KRMC may communicate with patients by telephone, SMS, email, mail, secure message or an online patient platform. Communications may include:

• appointment confirmations and reminders;
• requests to confirm, cancel or reschedule an appointment;
• clinical recalls and follow-up requests;
• notification that a result or correspondence requires review;
• preventive-health reminders;
• information about changes affecting an appointment or service; and
• other administrative or healthcare-related communications.

SMS and email communications may reveal that the recipient has a relationship with KRMC. KRMC therefore seeks to limit the amount of sensitive information included in these messages.

Patients should tell reception if they have particular communication preferences or do not wish to receive certain categories of messages. Opting out of appointment reminders does not necessarily prevent KRMC or a consulting practitioner from contacting a patient where communication is reasonably necessary for clinical care, patient safety or a legal obligation.

Email and ordinary SMS may not always be completely secure. Patients should avoid sending highly sensitive or urgent clinical information by ordinary email or through general website forms.

9. Direct marketing

KRMC does not use a patient’s health information for direct marketing without appropriate consent or another lawful basis.

KRMC may occasionally provide information about services, clinics, health programs or events where the recipient has consented or where the communication is otherwise permitted. Marketing communications will include a way to opt out.

Clinical recalls, appointment reminders, public-health messages and preventive-health communications are not treated as ordinary promotional marketing where their purpose is to support healthcare or patient safety.

10. Online bookings and third-party services

KRMC currently provides online appointment booking through HotDoc. When a person uses HotDoc or another external platform, the external provider may collect and handle information under its own privacy policy in addition to this KRMC Privacy Policy.

Information required to manage an appointment may be exchanged between the booking provider and KRMC. This may include the patient’s name, date of birth, contact details, appointment details, practitioner selected and relevant consent preferences. KRMC’s website currently links to HotDoc for bookings.

Third-party services linked from or embedded in the KRMC website may include mapping, video, payment, analytics or communication services. Those providers have their own privacy practices, and KRMC does not control how a third-party website handles information collected directly by that third party.

11. Website information, cookies and analytics

When a person visits the KRMC website, KRMC or its technology providers may collect technical information such as:

• IP address;
• browser and device type;
• operating system;
• pages visited;
• referring website;
• date and time of access;
• approximate location derived from an IP address; and
• interactions with website features.

The website may use cookies and similar technologies for essential functionality, security, performance measurement and analytics. A person can control or disable cookies through their browser, although this may affect some website functions.

KRMC does not intentionally provide names, clinical records, appointment notes or other directly identifying clinical information to website analytics or advertising providers.

The KRMC website is intended to provide general information and appointment access. Website content and general website forms should not be used for emergencies or as a substitute for individual medical advice.

12. Overseas access and disclosure

KRMC generally seeks to keep clinical records in Australia.

Some providers supporting KRMC’s website, email, telecommunications, analytics, software support or cloud services may have parent companies, personnel, infrastructure or subcontractors outside Australia. This may involve limited personal, technical, account, communications or support information being made accessible overseas, including in the United States and other countries in which those providers operate.

KRMC does not routinely disclose complete patient clinical records overseas. Before disclosing personal information to an overseas recipient, KRMC will take the reasonable steps required by applicable privacy law, unless an exception applies.

Where practicable, KRMC will identify the relevant overseas countries in this policy or in a collection notice relating to the particular service. Australian Privacy Principle 1 requires a policy to state whether overseas disclosure is likely and, where practicable, the countries involved.

13. How does KRMC protect information?

KRMC takes reasonable administrative, physical and technical steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure.

Safeguards may include:

• individual user accounts and access controls;
• limiting access according to a person’s role and responsibilities;
• password and multi-factor authentication requirements;
• security monitoring and malware protection;
• secure backups and business-continuity arrangements;
• physical security for premises and paper records;
• confidentiality obligations and privacy training;
• secure messaging and transmission methods where appropriate;
• review of third-party service providers; and
• secure destruction or de-identification when records are no longer required.

No electronic or physical information system can be guaranteed to be completely secure. If KRMC becomes aware of a suspected data breach, it will investigate and take appropriate steps to contain and assess the incident.

Where a breach is likely to result in serious harm, KRMC will notify affected individuals and the Office of the Australian Information Commissioner as required under the Notifiable Data Breaches scheme. Different notification requirements may apply to information connected with My Health Record.

14. How long does KRMC keep medical records?

KRMC retains health information for at least the minimum period required under NSW law:

• where the patient was an adult when the information was collected, for at least seven years from the last occasion on which a health service was provided; and
• where the information was collected while the patient was under 18, until the patient reaches 25 years of age.

Information may be kept for longer where reasonably required for continuing care, a legal claim, professional-indemnity requirements, an investigation or another legal or clinical reason.

When information is no longer required, KRMC will take reasonable steps to destroy or permanently de-identify it securely, subject to applicable record-retention requirements.

15. Accessing personal information

A person may request access to personal information KRMC holds about them, including their medical record.

Requests should preferably be made in writing and sent to the Privacy Officer using the contact details below. KRMC may ask for identification and other information reasonably necessary to verify the request and locate the relevant records.

KRMC will respond within a reasonable period, generally within 30 days. Access may be provided by:

• supplying an electronic or paper copy;
• allowing inspection of the record;
• providing a summary;
• explaining the information; or
• providing access through an agreed healthcare professional or authorised representative.

There is no charge for making an access request. KRMC may charge a reasonable amount for the actual cost of providing access, such as copying, secure media or postage, and will explain any proposed charge in advance.

Access may be refused or limited in circumstances permitted by law, including where access would unreasonably affect another person’s privacy, pose a serious threat to health or safety, or be unlawful. If access is refused, KRMC will ordinarily provide written reasons and information about how to make a complaint.

16. Correcting information

Patients should tell KRMC if they believe their personal information is inaccurate, out of date, incomplete, irrelevant or misleading.

KRMC will take reasonable steps to investigate a correction request and will generally respond within 30 days. There is no charge for requesting a correction or for correcting information.

Clinical opinions or contemporaneous clinical notes will not ordinarily be deleted merely because a patient disagrees with them. Where an amendment is not appropriate, it may be possible to add a statement recording the patient’s view or the requested correction.

If KRMC refuses a correction request, it will ordinarily explain the reasons and the available complaint process in writing.

17. Children, guardians and authorised representatives

KRMC may communicate with a parent, guardian, carer or authorised representative where that person has appropriate authority or where disclosure is otherwise permitted by law.

A child or young person’s capacity, wishes, safety and right to confidentiality will be considered when deciding whether information should be provided to a parent or another person.

KRMC may require evidence of guardianship, power of attorney, executor status, authority to act or patient consent before releasing information to a representative.

18. Privacy complaints

A person who believes KRMC has mishandled their personal information may make a privacy complaint.

The complaint should include:

• the person’s name and contact details;
• a description of what occurred;
• relevant dates or communications; and
• the outcome being requested.

Complaints may be made to the Privacy Officer by email, post, telephone or in person. KRMC will acknowledge the complaint, investigate it appropriately and aim to provide a response within 30 days.

Where a complaint relates principally to information handled independently by a consulting practitioner or a separate healthcare organisation, KRMC may involve or refer the matter to that practitioner or organisation and will explain this to the complainant.

If the complaint is not resolved, the person may contact:

• the Office of the Australian Information Commissioner; or
• the Information and Privacy Commission NSW.

Both the Commonwealth Privacy Act and the NSW health-privacy framework may be relevant to private health service providers in NSW.

19. Contacting KRMC

Privacy enquiries, access requests, correction requests and complaints should be directed to:

Privacy Officer
Kildare Road Medical Centre
36 Kildare Road
Blacktown NSW 2148

Telephone: (02) 8822 3000
Email: admin@kildaremedical.com.au

Please do not send urgent or time-sensitive clinical information to the administrative email address. Contact reception by telephone or seek appropriate emergency assistance where required.

A copy of this Privacy Policy is available free of charge from reception. Assistance can be provided where a person needs the policy in another format or requires help understanding it.

20. Changes to this Privacy Policy

KRMC may update this Privacy Policy when its services, systems, information-handling practices or legal obligations change.

The current version will be published on the KRMC website and will display the date it was last updated. Material changes may also be communicated through reception, patient notices or other appropriate channels.