Privacy Policy.

High Ground is an Australian telehealth service. We recognise the importance of protecting your privacy and are committed to handling your information with care.

This Privacy Policy describes how we collect, use, disclose and protect your personal information when you use our website, patient portal and services. We are bound by the Privacy Act 1988 (Cth), including the Australian Privacy Principles, and by state and territory health records laws where they apply. When we use the My Health Record system and the Healthcare Identifiers Service, we also comply with the My Health Records Act 2012 (Cth) and the Healthcare Identifiers Act 2010 (Cth).

We ask for your consent to collect and handle your health information when you create your account, and we confirm it with you again during your consultation. This policy explains how we handle that information.

Our services are for adults aged 18 and over. We do not knowingly collect personal information from anyone under 18. If we become aware that we have, we will stop providing services to that person and handle any records as the law requires.

We collect the personal information we need to provide our services safely and effectively:

• Personal information: your name, date of birth, contact details (address, email and phone number), Medicare details, your Individual Healthcare Identifier (IHI), and your GP’s contact details.
• Identity information: details or copies of identity documents we ask for to confirm who you are. Once your identity is verified and recorded in your clinical record, we remove copies of identity documents from our other systems, such as our customer support platform.
• Sensitive health information: your current and past medical history, illnesses, symptoms, medications (including details of any medicine prescribed through our service), allergies, and other health information you give us or that we consider necessary for your care. This can include results or reports from other healthcare providers where they are relevant to your consultation.
• Consultation records: your consultations take place by phone. With your consent, an AI transcription tool creates a written record of the consultation for your clinical notes. No audio recording is kept.
• Payment information: details of the payments you make to us. Card payments are processed by our payment provider, and we do not store your full card number. If you choose to save your card with our payment provider, for example through Stripe Link, the provider holds it under its own terms.
• Communications: records of your emails, messages, support requests and other contact with us.
• Technical and usage data: your IP address, device and browser information, and how you use our website and patient portal. See “Cookies, analytics and advertising measurement” below.

We collect personal information fairly and lawfully, mostly from you directly, when you:

• Create an account on our patient portal.
• Complete online forms, questionnaires or surveys.
• Attend a telehealth consultation with one of our nurses or doctors.
• Contact us by email, phone, message or through the patient portal.

We also collect information about you from others, where it is needed for your care or required by law:

• Other healthcare providers, such as your GP, specialists or pathology services, usually as part of your consultation and only ever with your consent.
• My Health Record, if you have one (see “My Health Record” below).
• The Healthcare Identifiers Service, to confirm your Individual Healthcare Identifier.
• Real-time prescription monitoring systems and the state and territory authorities that regulate Schedule 8 medicines.
• Your dispensing pharmacy, which may tell us whether and when your prescription has been dispensed.

You can complete our initial suitability check without giving your name or contact details. If you are not suitable to continue, the answers you gave are not stored.

Where it is lawful and practicable, you can deal with us without identifying yourself, for example when completing the suitability check or asking a general question. We cannot provide clinical care anonymously.

If you choose not to provide personal information, we may not be able to provide our services.

We collect, hold, use and disclose personal information for the main purpose of providing and managing healthcare services:

• Providing clinical care: to carry out telehealth consultations, maintain your health records and manage your treatment plan.
• Communication: to send appointment reminders, check in on your care (including by SMS), provide information and respond to enquiries.
• Administrative purposes: to process payments, verify your identity and manage your account.
• Regulatory compliance: to meet our legal obligations, including Therapeutic Goods Administration (TGA) requirements for the medicines our doctors prescribe, state and territory laws on Schedule 8 medicines, and health record retention.
• Service improvement: to carry out de-identified analysis and reporting to improve our services, patient portal and patient outcomes.
• Direct marketing: with your consent, to send you information about our services. We use only your contact details for this, never your health information. You can opt out at any time using the link in any message or by contacting us.

Our online suitability check is automated. It uses the answers you enter about how long you have had your condition, your age, whether you have tried other treatments before, and whether you have a condition that would make our service unsafe for you. From those answers, the check decides on its own, without a person reviewing it, whether you can continue to book a consultation. It will not let you continue if your condition has lasted less than three months, if you are under 18, if you have not tried any other treatments, or if you have a condition that means our service would not be safe for you. The check does not ask for your name or contact details, and if you cannot continue, your answers are not stored. If you have questions about the check, contact us at privacy@highgroundclinic.com and a member of our clinical team can discuss it with you.

We use AI tools to support our team. With your consent, an AI transcription tool creates a written record of your consultation. Our customer support platform also includes AI features that help our team find information and draft responses to support enquiries. A member of our team reviews AI output before it is used or sent, and AI is not used to make clinical decisions about you. Our AI providers are bound by contract to handle your information securely and only to provide their services to us.

High Ground is registered to use the My Health Record system. If you have a My Health Record, our clinicians may view it when it is relevant to your care. We only upload documentation to your My Health Record if you specifically request it. When your doctor issues an electronic prescription, it is sent via the National Prescription Delivery Service (NPDS), which by default sends a record of your prescription to your My Health Record. You can use the access controls in your My Health Record to limit who can see it, or add and remove documents from it.

Real Time Prescription Monitoring (RTPM) is not related to My Health Record. When a prescription in Australia is written for a Schedule 8 or other monitored medicine, this information is sent to the National Data Exchange (NDE). This allows health care providers who are caring for you to see which Schedule 8 or monitored prescriptions you have, from which practitioners and what has been dispensed. This system is on by default, and it’s mandatory for healthcare providers to actively monitor it in the course of providing care. This system is separate from My Health Record, so your My Health Record settings do not affect it. Most states and territories require pharmacists and prescribers to check it.

We disclose personal information only for the purposes set out in this policy or where required or authorised by law. This may include sharing it with:

• Healthcare practitioners who provide your care through our service.
• The pharmacy you choose to dispense your prescription. You can use any pharmacy that is able to dispense it. We also offer an optional arrangement with a partner pharmacy to make dispensing easier. If you choose it, we share the information that the pharmacy needs to dispense and supply your medicine, and it tells us when your prescription has been dispensed. Using it is your choice, and choosing another pharmacy does not affect your care or your fees.
• Electronic prescription services: prescriptions are issued electronically through Australia’s electronic prescription system, and your prescription token is sent to you or the pharmacy you choose by SMS or email.
• Your nominated GP or other specialists, with your consent.
• Third-party service providers who help us deliver our services, including clinical records, AI transcription, telephony, SMS messaging, customer support, workflow automation, email and document storage, internal communication, cloud hosting and payment processing. These providers are bound by contract to handle your information securely and only for the services they provide to us.
• Government and regulatory bodies, as required or authorised by law, including the TGA, state and territory health departments and the authorities that regulate Schedule 8 medicines. Our doctors’ reports to the TGA, and to the ethics committee that oversees their prescribing authorisations, contain patient numbers only and do not identify you.
• Overseas service providers: some of our service providers store or process information outside Australia. We use these providers for operational support and administrative services. These are currently located in the United States and the European Union. Some of these providers operate globally and may also process information in other countries. Where we disclose information overseas, we take reasonable steps to make sure the recipient handles it in line with the Australian Privacy Principles, and we remain responsible for how it is handled. Your medical records and prescriptions are stored in Australian data centres.

Cookies are small text files placed on your device when you visit a website. Session cookies are deleted when you close your browser. Persistent cookies stay on your device for a set period or until you delete them. We use both, along with similar technologies, for the following purposes:

• Strictly necessary: to keep our website and patient portal working and secure, for example keeping you signed in and processing payments. The patient portal will not work properly without them.
• Preferences: to remember choices you make, such as staying signed in.
• Analytics: we use Google Analytics and Google Tag Manager on our website and patient portal, and Plausible on our website, to see which pages are visited and how people move through them. These tools collect technical information such as your IP address, device and browser type, and the pages you view. They do not receive your name, contact details, or the health information you enter into forms.
• Advertising measurement: we use Google Ads to measure whether a visit to our website came from one of our ads and whether it led to a booked appointment. To do this, a Google tag records in the patient portal when a booking is confirmed. Google is told that a booking happened, along with technical information such as your IP address and a cookie identifier that links the booking to the ad. It does not receive your name, contact details, or anything you enter into a form. We have turned off advertising personalisation, so this information is not used to build a profile of you or to target you based on health interests. Some of our website pages relate to particular health topics, so the address of a page you visit can indicate the topic you were reading about.

Some of these cookies are set by third parties, such as Google. Those providers have their own privacy policies, which explain how they handle information.

You can also block or delete cookies in your browser settings. If you block strictly necessary cookies, some parts of our website and patient portal may not work properly.

We take reasonable steps to protect your information from misuse, interference, loss and unauthorised access, modification or disclosure. These include technical security (encryption, firewalls and multi-factor authentication) and strict access controls.

Protections for prescription and health information

Your clinical record is stored on Australian servers using clinical software that meets Australian Digital Health Agency standards. This information is collected only to the extent necessary for clinical care, is accessible only to authorised staff who need it for their role, and is used and disclosed only for the purposes set out in this policy or as required or authorised by law.

How long we keep information

• Clinical records are kept for at least 7 years from the date of the last entry or, for patients who were under 18 at the time, until they turn 25, in line with state and territory requirements.
• Support communications are kept for the same period as clinical records.
• Payment records are kept for 7 years, as tax laws require.
• Marketing preferences are kept until you opt out, after which we keep a record of your opt-out so we do not contact you again.

When information is no longer needed or required to be kept, we securely destroy it or permanently de-identify it, unless we need to keep it longer because of a legal matter, complaint, investigation or regulatory audit. Our Data Retention and Data Destruction Policy sets out these periods in more detail, and you can ask our Privacy Officer about it.

If a data breach is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

You have the right to:

• Request access to the personal information we hold about you.
• Request correction if information is inaccurate, incomplete or out of date.

To exercise these rights, contact our Privacy Officer. We will respond within 30 days. We may need to verify your identity first, and there is no charge to make a request. If we refuse a request, we will tell you why in writing and how you can complain.

If you have concerns or wish to make a complaint about how we have handled your personal information, contact our Privacy Officer. We will investigate and respond within 30 days.

Privacy Officer email: privacy@highgroundclinic.com

Address: Level 19, 10 Eagle Street, Brisbane QLD 4000, Australia

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au, 1300 363 992) or to the health complaints body in your state or territory:

• ACT: ACT Human Rights Commission (Health Services Commissioner)
• NSW: Health Care Complaints Commission
• NT: Health and Community Services Complaints Commission
• Queensland: Office of the Health Ombudsman
• South Australia: Health and Community Services Complaints Commissioner
• Tasmania: Health Complaints Commissioner Tasmania
• Victoria: Health Complaints Commissioner
• Western Australia: Health and Disability Services Complaints Office

We may update this Privacy Policy from time to time. The latest version will always be available on this website. If we make a significant change to how we handle your health information, we will let you know before it takes effect.