Version: 3.0
Date Created: 26/05/2026
Review Date: 26/05/2028
Approved By: Business Manager
Author/Owner: Practice Principal
Karuna-maya Medicine – Privacy Policy
(RACGP Standards for General Practices – 5th edition aligned, with RACGP template guidance)
Introduction
This privacy policy provides information to you, our patient, about how your personal information (including your health information) is collected, used, stored and disclosed by Karuna-maya Medicine.
Karuna-maya Medicine is committed to protecting the privacy of your personal information and complies with the Privacy Act 1988 (Cth), including the Australian Privacy Principles (APPs), as well as relevant health records legislation, including the Health Records Act 2001 (Vic), the My Health Records Act 2012 (Cth) and the Healthcare Identifiers Act 2010 (Cth).
Why and when your consent is necessary
When you register as a patient of our practice, you provide consent for our GPs and practice staff to collect, access and use your personal information for the purpose of providing you with healthcare.
Only staff members who need to access your information in order to perform their duties will do so. All staff are bound by confidentiality agreements and receive privacy and confidentiality training as part of their induction and ongoing professional development.
If we need to use your information for purposes other than providing healthcare or directly related administrative activities, we will seek your additional consent unless otherwise permitted by law.
Why do we collect, use, hold and share your personal information?
We collect, use, hold and share your personal information primarily to provide safe, effective and high-quality healthcare services to you. Karuna-maya Medicine – Privacy Policy
2 | P a g e
We may also use your personal information for purposes directly related to our healthcare services and practice operations, including:
- billing, Medicare and private health insurance claims
- practice accreditation, audits and quality assurance
- staff education and training
- internal business management and planning
- complying with legal and regulatory obligations.
What personal information do we collect?
The personal information we may collect includes:
- identifying and contact information (name, date of birth, address, phone number, email)
- medical and health information, including medical history, medications, allergies, adverse reactions, immunisations, family and social history, and risk factors
- Medicare number (where applicable) for identification and claiming purposes
- healthcare identifiers
- private health insurance details.
Dealing with us anonymously
You have the right to deal with us anonymously or under a pseudonym where lawful and practicable. However, in most circumstances it will not be possible to provide medical care or comply with legal obligations without identifying you.
How do we collect your personal information?
We collect your personal information in a number of ways, including:
- When you register as a patient or make an appointment, including completion of registration forms.
- During the provision of medical services, including through:
- electronic prescribing systems (eRx)
Karuna-maya Medicine – Privacy Policy
3 | P a g e
- My Health Record (e.g. Shared Health Summaries and Event Summaries)
- SafeScript (real-time prescription monitoring). You have the right to choose whether your information is uploaded to My Health Record and may manage access controls in accordance with My Health Record legislation.
- a parent, guardian or authorised representative
- other healthcare providers involved in your care (specialists, allied health professionals, hospitals, pathology and imaging providers)
- Medicare, your health insurer, or the Department of Veterans’ Affairs where required.
- When you communicate with us via phone, email, SMS, online booking systems, our website or social media.
- Various types of images may be collected and used, including:
- Photos and medical images: These can be taken using personal devices for medical purposes, following the guidelines outlined in our guide on using personal devices for medical images. Images are stored in your electronic record.
- From third parties where it is not reasonable or practicable to collect the information directly from you, including:
Who do we share your personal information with?
We may share your personal information:
- with other healthcare providers involved in your care
- with service providers who support our practice operations (such as IT providers, accreditation bodies and secure data storage providers), who are required to comply with privacy and confidentiality obligations
- where required or authorised by law (e.g. subpoenas, mandatory disease notifications)
- where necessary to lessen or prevent a serious threat to life, health or safety
- to assist in locating a missing person
- for legal or dispute resolution purposes
- through electronic systems used in healthcare delivery (eRx, My Health Record, SafeScript).
Karuna-maya Medicine – Privacy Policy
4 | P a g e
Only individuals who require access to your information for legitimate clinical or business purposes are permitted to do so.
We do not disclose your personal information outside Australia unless permitted by law or with your express consent.
Direct marketing
Our practice will not use your personal information for direct marketing without your express consent. If you consent, you may opt out at any time by notifying us in writing.
How is your information used to improve services?
The practice may use your personal information to improve the quality of the services offered to patients through research, analysis of patient data for quality improvement and for training activities with the practice team
We may provide de-identified data to other organisations to improve population health outcomes. If we provide this information to other organisations patients cannot be identified from the information we share, the information is secure and is stored within Australia. You can let reception staff know if you do not want your de-identified information included.
At times, general practices are approached by research teams to recruit eligible patients into specific studies which require access to identifiable information. You may be approached by a member of our practice team to participate in research. Researchers will not approach you directly without your express consent having been provided to the practice. If you provide consent, you would then receive specific information on the research project and how your personal health information will be used, at which point you can decide to participate or not participate in the research project.
How are document automation technologies used?
Document automation is where systems use existing data to generate electronic documents relating to medical conditions and healthcare.
The practice uses document automation technologies to create documents such as referrals, which are sent to other healthcare providers. These documents contain only your relevant medical information. Karuna-maya Medicine – Privacy Policy
5 | P a g e
These document automation technologies are used through secure medical software Best Practice.
All users of the medical software have their own unique user credentials and password and can only access information that is relevant to their role in the practice team.
The practice complies with the Australian privacy legislation and APPs to protect your information.
All data is stored and managed in accordance with the Royal Australian College of General Practitioners Privacy and managing health information guidance.
How are Artificial Intelligence (AI) Scribes used?
The practice uses an AI scribe tool to support GPs take notes during their consultations with you. The AI scribe uses an audio recording of your consultation to generate a clinical note for your health record. The practice AI scribe service is Lyrebird Health.
Lyrebird Health
- Does not share information outside of Australia
- Destroys audio file once the transcription is complete.
- Removes sensitive, personal identifying information as part of the transcription
The practice will only use data from our digital scribe service to provide healthcare to you with your consent.
How do we store and protect your personal information?
Your personal information is stored on electronic medical records, or visual formats (such as clinical photographs).
We take reasonable steps to protect your personal information from misuse, loss, unauthorised access, modification or disclosure. These steps include:
- secure electronic systems with role-based access controls and multi-factor authentication
- confidentiality agreements for all staff and contractors
- regular review of privacy and information security procedures.
Health records are retained and securely destroyed in accordance with legislative requirements and RACGP guidance. Karuna-maya Medicine – Privacy Policy
6 | P a g e
We comply with the Notifiable Data Breaches (NDB) scheme. If an eligible data breach occurs that is likely to result in serious harm, affected individuals and the Office of the Australian Information Commissioner (OAIC) will be notified as required by law.
Accessing and correcting your personal information
You have the right to request access to, and correction of, your personal information.
Requests for access should preferably be made in writing, but verbal requests are also accepted. We will acknowledge your request within 7 days and respond within 30 days. Fees may apply for printing or copying records.
We will take reasonable steps to correct information that is inaccurate, incomplete or out of date. Requests for correction should be made in writing to:
Reception Email: reception@karunamedicine.com
Privacy complaints
We take privacy complaints seriously. If you have a concern, please submit it in writing:
Karuna-maya Medicine 22 Princes Terrace Jan Juc VIC 3228 Phone: 03 5261 4146 Email: manager@karunamedicine.com
We will acknowledge your complaint within 7 days and aim to resolve it within 30 days.
If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC). The OAIC generally requires you to allow us time to respond before they investigate. Phone: 1300 336 002 Website: www.oaic.gov.au Karuna-maya Medicine – Privacy Policy
7 | P a g e
Relevant RACGP Standards
Your policy is assessed primarily against:
- C6 – Business systems and processes
- C6.3 – Information security and privacy
- C6.3 A–D (collection, use, disclosure, storage, access, correction, complaints)
- GP-led practice governance expectations