188 Medical Privacy Policy

Effective date: 17th October 2025

1. About this policy

188 Medical (“we”, “us”, “our”) is an APP entity under the Privacy Act 1988 (Cth) and complies with the Australian Privacy Principles (APPs). This policy explains how we collect, use, disclose, store and protect Personal Information, including Sensitive Information such as health information and health records. It applies to our website, digital platforms, and our clinical and administrative operations.

2. What we collect and why

We collect only what is reasonably necessary to provide health care and run the practice, including identity and contact details, demographic and next-of-kin details, health information, Medicare/PBS information, appointment, billing and payment details, communications with you, and technical/usage data from our website. We provide a collection notice at or before data collection that explains our purpose, possible disclosures, any overseas transfers, and your rights to access or correction. If you choose not to provide certain information, this may limit our ability to deliver some services or meet our legal obligations.

Health information includes sensitive information such as medical history, test results, immunizations, and treatment plans, which are protected under the Privacy Act 1988 (Cth).

3. How we use and disclose information

We use and disclose information for the primary purpose of your care and practice operations, such as clinical record-keeping, referrals, prescriptions, recalls, Medicare/PBS billing, audits, training, and compliance. We may use or disclose information for a secondary purpose if permitted by the Privacy Act, if you would reasonably expect it, or where permitted by law (e.g. guardianship, public health, or court order). We may provide de-identified data for quality improvement, benchmarking, or community health planning, and you may opt out at any time. We do not sell personal information.

Secondary uses or disclosures will only occur where you would reasonably expect it, where required or authorised by law, or with your consent.

4. My Health Record

188 Medical participates in the national My Health Record system. Information uploaded to, or accessed from, My Health Record is handled in accordance with the My Health Records Act 2012 (Cth). This includes strict obligations around access controls, patient consent, and disclosure. Only authorised clinical staff may access My Health Record data for the purpose of providing healthcare or managing your health information. Your rights under the My Health Records Act apply, including the ability to access your record, request corrections, and view an access history of who has accessed your record. In the event of a data breach involving My Health Record information, we are required to notify both the System Operator and the Office of the Australian Information Commissioner (OAIC) as soon as practicable.

5. Third parties and contractors

We engage service providers to support the safe and efficient operation of our practice, including clinical software systems, practice management and reporting tools, secure messaging platforms, and external IT support providers. These contractors may handle personal information only under written agreement, under our instructions, and must comply with privacy and security standards equivalent to the Australian Privacy Principles (APPs). Contractors are also required to promptly notify us of any actual or suspected data breach involving personal information. We may also share de-identified data with the local Primary Health Network (PHN) for quality improvement and population-health planning. De-identified data cannot be used to identify individual patients. Patients may opt out of de-identified data sharing by notifying the practice. We maintain a register of approved providers and monitor compliance to ensure ongoing protection of information.

6. Cross-border disclosure (APP 8)

Some services may involve overseas data processing or storage. We only disclose information overseas where we reasonably believe the recipient is bound by substantially similar privacy laws, we have contractual safeguards in place, or you have provided express informed consent.

7. Access and correction

You may request access to or correction of your personal or health information at any time. We will respond within 30 days and may charge a reasonable fee for large requests. We may require proof of identity before providing access to ensure information is released securely. If access is refused, we will provide written reasons and internal review options.

8. Security, retention and destruction

We take reasonable steps to protect information from misuse, interference, loss, and unauthorised access, modification or disclosure. Safeguards include encryption in transit and at rest where supported, role-based access controls, multi-factor authentication, audit logs, secure messaging, vulnerability management, staff privacy training, secure premises, and encrypted backups. We perform regular backup integrity checks to confirm data recoverability. Records are retained as required by law and securely destroyed or de-identified when no longer required.

9. AI-assisted transcription

Doctors consulting from the rooms of 188 Medical are independent medical practitioners who may decide whether to use AI-assisted transcription tools to support clinical note-taking. These tools convert speech to text but do not record audio, store voice data, or make clinical decisions.
If a doctor opts to use such a tool, patient consent is obtained directly by that doctor, either as:
• Standing consent – you may sign once to permit transcription for future consultations with that doctor; or
• Verbal consent – your doctor may seek consent at the start of each consultation.
Consent is voluntary and not a condition of care. You may withdraw consent at any time, verbally or in writing, and transcription will cease immediately. Any transcription-only data will then be deleted or de-identified in accordance with the doctor’s retention obligations.
Each doctor is responsible for documenting consent and ensuring that any AI service used complies with the Privacy Act 1988 (Cth) and the Australian Privacy Principles, including APP 8 (cross-border disclosure) where overseas processing occurs. The transcription tool and its vendor must meet recognised privacy and security standards, store data within Australia where possible, and provide written confirmation of their data-storage and encryption practices on request. All such vendors must notify the relevant doctor of any known or suspected breach affecting patient information. Where a breach may reasonably affect 188 Medical systems or patient data stored within the practice environment, the vendor or practitioner must also notify 188 Medical. 188 Medical may review or request updated compliance information from vendors as part of its privacy oversight. The practice does not control or assume liability for the independent tools selected by doctors but requires that all practitioners using its facilities comply with applicable privacy, confidentiality, and data-security obligations.

10. AI-assisted clinical and administrative tools

We may use secure, AI-enabled tools to assist with clinical documentation, care planning, education, and other administrative functions that support high-quality patient care. These tools are used to improve efficiency and consistency in areas such as chronic condition management, referral preparation, and patient communication. All outputs are reviewed and verified by a qualified medical practitioner before being used in a patient’s care. These tools do not make diagnostic, prescribing, or treatment decisions. Only de-identified or abstracted data is entered into such tools. No identifiable patient information is entered into public AI systems. Where de-identified or summarised data is used, it is handled in accordance with the Australian Privacy Principles, Ahpra professional standards, and our internal Data Security Policy.

11. Cookies, analytics and marketing

Our website may use cookies and analytics to improve functionality. You may manage cookies via your browser. We send marketing communications only in compliance with the Spam Act 2003 (Cth), and you may opt out at any time.

12. Data breach response (Notifiable Data Breach scheme)

We maintain a Data Breach Response Plan. If we suspect a breach, we contain, assess, and if it is an eligible data breach, notify affected individuals and the OAIC as soon as practicable. For any breach involving My Health Record, we will also notify the System Operator. We record all incidents, actions, and remedial measures.

13. Identifiers

We do not adopt government identifiers (e.g. Medicare number, DVA number, Tax File Number) as our own, except where permitted by law. We may use a patient’s Medicare number / DVA Number when required to verify identity or access health information through authorised systems such as My Health Record or the Queensland Health Provider Portal, or when submitting Medicare or PBS claims.

14. Employment applications

Employment applications and résumés are used only for recruitment and securely stored. If unsuccessful, they are destroyed within a reasonable timeframe unless consent for retention is provided.

15. Complaints and enquiries

If you have privacy concerns, contact:

Practice Manager
188 Medical 188 Brisbane Road
Arundel QLD 4214
Phone: (07) 5661 9188
Email: admin@188medical.com

We acknowledge complaints within 7 business days and aim to resolve within 30 days. If you are not satisfied with our handling of your complaint, you may contact the Office of the Australian Information Commissioner (OAIC) at 1300 363 992 or GPO Box 5218, Sydney NSW 2001.

16. Changes to this policy

We may update this policy to reflect legal, technological, or operational changes. If changes materially affect previously collected data, we will notify patients on our website or via email to affected patients and seek renewed consent if required. The effective date above indicates the current version. This policy will be reviewed at least annually or sooner if required.

This Privacy Policy was last updated on 17 October 2025.