Privacy Policy

We recognise the importance of protecting the privacy and rights of individuals in relation to their personal information. This privacy policy explains how Nurse Practitioner Clinics Australia Pty Ltd collects, holds, uses, discloses and manages personal information.

We respect your right to privacy and are committed to complying with the Privacy Act 1988 (Cth), including the Australian Privacy Principles. As a health service provider, we also handle health information carefully and in accordance with applicable health, professional and record-keeping obligations.

This privacy policy applies to people who use our services, visit our website, make an enquiry, attend a clinic, receive telehealth services, receive services through one of our partner or service locations, or otherwise provide personal information to us.

Definitions

In this privacy policy, the terms “we”, “our”, “us” and “NPCA” mean Nurse Practitioner Clinics Australia Pty Ltd.

What is personal information?

When used in this privacy policy, “personal information” has the meaning given to it in the Privacy Act 1988 (Cth). In general terms, personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable.

This may include your name, address, telephone number, email address, date of birth, Medicare details, health information, appointment information, payment information and other information that identifies you or could reasonably identify you.

Health information is a type of sensitive information. For ease of reading, this policy refers to both personal information and sensitive information as “personal information” unless otherwise stated.

What personal information do we collect and hold?

The types of personal information we may collect and hold include:

  • your name, address, email address and telephone number;
  • your age, date of birth and gender;
  • your Medicare number, Individual Healthcare Identifier, Veterans’ Affairs number, Health Care Card number, pension number, concession card details or private health fund details;
  • identity verification information, where required;
  • emergency contact or next of kin details;
  • current and previous medicines, treatments, allergies, vaccinations and health conditions;
  • information relevant to your medical care, including previous and current medical history and family medical history where clinically relevant;
  • information about prescriptions, referrals, pathology, imaging, test results, clinical notes and treatment plans;
  • information about your ethnic background, Aboriginal or Torres Strait Islander status, language or cultural background, but only where clinically relevant, required for health program purposes, or voluntarily provided by you;
  • your occupation, employer or job title, where relevant to a work-related consultation or service;
  • information about appointments, bookings, reminders, recalls, billing, invoices and payments;
  • copies of referrals, reports, correspondence and other communications with other health service providers;
  • details of any complaint, feedback, enquiry or request you make to us;
  • website, online form, booking platform, telehealth and technical information, including information collected through cookies or similar technologies; and
  • any additional information that you provide to us directly, through our staff, health practitioners, service providers, representatives, clinics, call centres, websites, booking systems or other communication channels.

We may also collect information that is not personal information because it does not identify you or anyone else. For example, we may collect anonymous survey responses or aggregated website usage information.

How do we collect your personal information?

Where reasonable and practicable, we collect personal information directly from you. This may occur when:

  • you complete a registration, consent, booking, enquiry or patient information form;
  • you make an appointment or attend a consultation;
  • you provide information during a clinic, telehealth, telephone, email, SMS or online interaction;
  • you order, request or receive a health service, prescription, vaccine, medicine, product or follow-up service;
  • you use our website, booking systems, payment systems, telehealth systems or other digital services;
  • you contact us with a question, request, complaint or feedback; or
  • you otherwise deal with us in person, by phone, online, by email, by SMS or through a third-party platform.

We may also collect personal information from third parties where it is lawful and appropriate to do so, including:

  • a person authorised by you, such as a carer, guardian, parent, family member or support person;
  • another health service provider, including a nurse practitioner, doctor, pharmacist, allied health practitioner, pathology provider, imaging provider or specialist;
  • a hospital, clinic, aged care facility, employer, insurer or government health program, where relevant to the service being provided;
  • Medicare, Services Australia, the Australian Immunisation Register, My Health Record, prescription exchange services or other health information systems, where authorised or required;
  • payment processors, booking platforms, telehealth providers, couriers, IT providers and other service providers;
  • your employer or prospective employer, where the service is work-related and you have consented or the disclosure is otherwise permitted by law; and
  • law enforcement agencies, regulators, courts, tribunals or government bodies, where required or permitted by law.

What happens if we cannot collect your personal information?

If you do not provide us with the personal information we reasonably require, some or all of the following may occur:

  • we may not be able to provide the requested service, product, treatment, prescription, appointment or advice;
  • we may not be able to properly identify you or verify important health information;
  • your diagnosis, treatment, follow-up or clinical care may be delayed, inaccurate or incomplete;
  • we may not be able to process billing, Medicare claims, private health claims, prescriptions, referrals, pathology, recalls or reminders; or
  • we may be unable to comply with our legal, professional or clinical obligations.

Why do we collect, hold, use and disclose personal information?

We collect, hold, use and disclose personal information so that we can provide health services, operate our business, meet our legal obligations and provide safe, appropriate and efficient care.

We may collect, hold, use and disclose your personal information for purposes including:

  • providing health services, consultations, telehealth, prescriptions, vaccinations, medicines, referrals, follow-up care and related services;
  • assessing your suitability for a health service, treatment, medicine, vaccine or program;
  • communicating with you about appointments, recalls, reminders, results, prescriptions, invoices, orders, enquiries and follow-up care;
  • maintaining accurate clinical, administrative, financial and business records;
  • billing, payment processing, debt recovery and claiming through Medicare, private health funds, insurers or other funding bodies;
  • liaising with other health practitioners, pharmacies, pathology providers, imaging providers, specialists, hospitals, aged care providers or other health service providers involved in your care;
  • recording information on relevant health systems, such as the Australian Immunisation Register, My Health Record or prescription exchange services, where authorised or required;
  • responding to enquiries, complaints, feedback, incidents, adverse events or clinical concerns;
  • quality assurance, training, clinical governance, auditing, accreditation, risk management and service improvement;
  • meeting professional, regulatory, legal, insurance and reporting obligations;
  • responding to lawful requests from courts, tribunals, regulators, law enforcement agencies or government bodies;
  • communicating with your employer, prospective employer, insurer or authorised representative where the consultation or service is work-related and the disclosure is authorised, required or otherwise permitted by law;
  • conducting research, evaluation, analysis or service planning, where permitted by law and where appropriate safeguards are in place;
  • providing information about services that may be relevant to you, where permitted by law and subject to your communication preferences; and
  • any other purpose for which you have provided consent or which is permitted or required by law.

Your personal information will not be shared, sold, rented or disclosed other than as described in this privacy policy, as authorised by you, or as permitted or required by law.

Who may we disclose your personal information to?

We may disclose your personal information to:

  • our employees, contractors, nurse practitioners, doctors, pharmacists, allied health practitioners, administrative staff and other people involved in providing services to you;
  • health practitioners, pharmacies, pathology providers, imaging providers, hospitals, specialists, aged care facilities and other health service providers involved in your care;
  • Medicare, Services Australia, the Department of Veterans’ Affairs, the Australian Immunisation Register, My Health Record, prescription exchange services and other health information systems, where authorised or required;
  • booking platforms, telehealth providers, secure messaging providers, IT providers, data storage providers, payment processors, web hosting providers, mailing houses, couriers, electronic communications providers and other service providers that assist us to operate our business;
  • professional advisers, including accountants, lawyers, insurers, medical defence organisations, business advisers and consultants;
  • regulators, professional bodies, accreditation bodies, courts, tribunals, law enforcement agencies and government departments, where required or permitted by law;
  • your employer, prospective employer, insurer or their authorised representative in relation to a work-related consultation or service, where authorised, required or permitted by law;
  • a parent, guardian, carer, support person or authorised representative, where you have consented or where the disclosure is otherwise permitted by law;
  • our related bodies corporate, contractors and service providers for business, administrative, clinical, technical, operational and support purposes; and
  • any other person or organisation for a purpose authorised by you or permitted by law.

We may combine information that we collect from you with information collected by our related bodies corporate or service providers, where this is necessary for the purposes described in this policy and permitted by law.

Direct marketing and service communications

We may send you service-related communications, including appointment reminders, recall notices, prescription reminders, order updates, invoices, follow-up messages and important information about services you have requested or received.

We may also send you direct marketing communications about our services, programs, products or health information that we consider may be of interest to you, where permitted by law and, where required, with your consent.

These communications may be sent by mail, SMS, email, phone or other electronic means. We will comply with applicable marketing laws, including consent and unsubscribe requirements.

You may opt out of receiving marketing communications at any time by contacting us or by using the unsubscribe or opt-out function in the communication. Even if you opt out of marketing, we may still send you important service, clinical, safety, legal or administrative communications.

Automated decision-making and technology

We may use technology systems to assist with administration, bookings, reminders, clinical record keeping, communications, payments, fraud prevention, service improvement and other operational purposes.

At the date of this policy, we do not use automated decision-making systems to make clinical decisions about you, or to make decisions that have a legal or similarly significant effect on your rights or interests, without appropriate human involvement.

If this changes, we will update this privacy policy to explain the kinds of personal information used in automated decision-making and the kinds of decisions made by automated systems, where required by law.

Cookies and website information

When you use our website, we may collect information about your device, browser, IP address, pages visited, referring website, date and time of visit and how you interact with our website.

We may use cookies and similar technologies to operate our website, improve website performance, understand usage, support online forms and provide relevant information about our services.

You may be able to disable cookies through your browser settings, although some website features may not function properly if cookies are disabled.

How can you access or correct your personal information?

You may request access to personal information we hold about you by contacting us. Where we hold information that you are entitled to access, we will provide access within a reasonable time and in a suitable format where practicable.

We may need to verify your identity before providing access. We may charge a reasonable fee for administrative costs associated with providing access, where permitted by law. We will not charge you simply for making a request.

There may be circumstances where we cannot grant access to the personal information we hold. For example, we may refuse access where granting access would unreasonably affect the privacy of another person, pose a serious threat to health or safety, prejudice legal proceedings, breach confidentiality, or where we are otherwise permitted or required to refuse access by law. If we refuse access, we will provide written reasons where reasonable and appropriate.

If you believe the personal information we hold about you is inaccurate, out of date, incomplete, irrelevant or misleading, you may ask us to correct it. We will take reasonable steps to correct the information where appropriate.

If we do not agree to make the requested correction, you may ask us to attach a statement to the information noting that you believe it is inaccurate, out of date, incomplete, irrelevant or misleading.

How do we protect your personal information?

We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification and disclosure.

We may hold personal information in electronic and hard copy form. The steps we take may include secure systems, access controls, password protection, staff training, confidentiality obligations, secure storage, secure disposal, audit processes and other technical, administrative and physical safeguards.

Personal information is retained for as long as required for the purposes for which it was collected, for clinical care, and to meet our legal, professional, insurance and record-keeping obligations. When personal information is no longer required, we will take reasonable steps to destroy or de-identify it, where permitted by law.

No method of transmission over the internet is completely secure. If you send personal information to us online, by email, SMS, web form or other electronic means, you do so at your own risk. We will take reasonable steps to protect information once we receive it.

Data breaches

If we become aware of a suspected or actual data breach involving personal information, we will take steps to assess and respond to the incident.

Where required by the Notifiable Data Breaches scheme, we will notify affected individuals and the Office of the Australian Information Commissioner if a data breach is likely to result in serious harm and we are unable to remediate the risk of serious harm.

Do we disclose personal information outside Australia?

Some of our service providers may store, process or access personal information outside Australia. This may include cloud storage providers, IT providers, booking platforms, telehealth providers, payment processors, communication platforms or other technology providers.

Where personal information is disclosed overseas, we will take reasonable steps to ensure the overseas recipient handles the information in accordance with applicable privacy requirements, unless an exception applies.

The countries in which overseas recipients are located may vary depending on the service provider used from time to time. Where practicable, we will provide further information on request.

Links to other websites

Our website may contain links to websites operated by third parties. We are not responsible for the privacy practices, security or content of third-party websites.

If you access a third-party website, you should review that website’s privacy policy and terms of use.

Results management and privacy

We are committed to maintaining the privacy of personal health information at all times. Health information is available only to the patient, their authorised representative where appropriate, and authorised members of our team who require access for clinical, administrative or operational purposes.

Where follow-up is required, we may contact you by phone, SMS, email, secure messaging, letter or another agreed method. We will take reasonable care when communicating personal health information electronically and may ask you to verify your identity before discussing sensitive information.

We encourage patients to participate in decisions about their health care and to speak with the treating practitioner if they have questions or concerns about their results, treatment or follow-up care.

Feedback and complaints

We take concerns, suggestions and complaints seriously. If you have a concern about our services or the way we have handled your personal information, please contact us so that we can review and respond to your concern.

Privacy complaints should be made in writing where possible and should include enough detail for us to investigate the issue. We will treat complaints confidentially and will aim to respond within a reasonable time.

Our process is for the issue to be reviewed first by the clinic, service location or team involved. If the issue cannot be resolved at that level, it may be escalated to a manager or authorised representative of NPCA for review.

If you are not satisfied with our response to a privacy complaint, you may contact the Office of the Australian Information Commissioner.

Complaints about registered health practitioners may also be referred to the Australian Health Practitioner Regulation Agency or the relevant health complaints body in your State or Territory.

Contacting us

If you have any questions about this privacy policy, wish to request access to or correction of your personal information, or wish to make a privacy complaint, please contact the clinic, service location or call centre where you received services.

If you are unable to contact the clinic, service location or call centre, you may contact us using the following details:

Nurse Practitioner Clinics Australia Pty Ltd
Privacy Officer
PO Box 7737
Cloisters Square PO
WA 6850
Australia

Email: privacy@npclinics.com.au

Phone: 1800 418 439

We will treat your request or complaint confidentially. Our representative will contact you within a reasonable time after receiving your request or complaint to discuss your concerns and outline options for resolution.

Changes to this privacy policy

We may update this privacy policy from time to time. Any updated version will be posted on our website and will apply from the date it is published, unless stated otherwise.

This privacy policy was last updated on June 2026.