Search for helpful articles, research papers, and guides.
(Version 3 – 11 March 2020)
This Policy applies to our handling of personal information. ‘Personal information’ means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information is true or not and whether the information is recorded in a material form or not.
Personal information includes ‘sensitive information’, which is a particular type of personal information. Sensitive information includes identifying health information about you (such as details of your health and medical history or the health services you have received). Sensitive information also includes information about racial or ethnic origin, political opinions or associations, religious or philosophical beliefs, and sexual orientation or practices.
We may collect personal information from you so that we can provide our services to you, or where this is otherwise necessary for our functions or activities, including provision of the System. In particular, we will collect the personal information of medical practitioners and patients, to enable you to use the System.
We collect patient and/or medical practitioner personal information:
to allow medical practitioners to use the System to help manage patient care, including to:
dictate, review and send letters;
utilise clinical decision support tools;
access and manage health data;
capture and upload images; or
use our other practice management functions;
to allow patients to use the System to:
book and manage appointments;
make payments; or
view clinical information; and
You are not required to disclose your personal information to us. However, if you do not provide the information requested, you may not be able to use the System effectively.
What types of personal information do we collect?We may collect the following personal information from medical practitioners (and other medical practice staff):
We may collect personal information from individuals who are not medical practitioners or patients, such as job applicants, service providers or contractors, to enable us to work or transact with them. This may include personal information provided through job applications, proposals and contracts.
If you are a medical practitioner or patient we generally use your personal information for the following main purposes:
If you are a job applicant, service provider or contractor, we may use your personal information to manage our relationship with you.
We may also use your personal information for purposes which are permitted under the applicable privacy laws, which include:
We respect the privacy of your personal information and we will take reasonable steps to keep it confidential and protected.
The System has integrations with third-party software and systems (third-party vendors) to enable:
We may need to disclose personal information to these third-party vendors to the limited extent required to enable and support these integrated functions.
We will not otherwise disclose your personal information to third parties unless you have consented, or we are otherwise permitted or required to do so by law. This may include disclosure of your personal information in the following circumstances:
If you are a job applicant, service provider or contractor, we may disclose your personal information to manage our relationship with you.
Will we transfer your personal information overseas?
We generally do not transfer personal information overseas.
In the event that we need to disclose personal information overseas, we will comply with the requirements of the Privacy Act 1988 (Cth) and the Health Records and Information Privacy Act 2002 (NSW) when disclosing personal information outside of New South Wales and overseas.
We will only disclose your personal information overseas if:
We will in all cases take reasonable steps to ensure that any such recipient of your personal information does not breach the APPs and HPPs.
If C2C intends to engage in any marketing communications, we may send you such communications in accordance with any previous consent you have provided or any marketing communication preferences that you have notified to us, and in accordance with the requirements under the Privacy Act 1988 (Cth) and the Spam Act 2003 (Cth).
If you have previously agreed to receive such marketing communications, but no longer wish to receive such marketing communications you can contact us using our contact details set out below to modify your preferences, or you can simply opt-out of such communications using the instructions or opt-out link provided in the marketing communication sent to you.
You have a right to seek access to, and correction of the personal information we hold about you.
Authorised users of the System can log into their account and access the personal information held by C2C about them.
You may also request access to the personal information that we hold about you, using our contact details set out below. In certain circumstances, we may refuse to allow you access to your personal information where this is authorised by the law, such as where providing access would have an unreasonable impact on the privacy of other individuals, providing access would pose a serious threat to the life or health of any person or to public health or safety, or giving access would be unlawful.
If you believe that the personal information we hold about you requires correction (for example, because the information is inaccurate, out-of-date, incomplete, irrelevant or misleading), you may request that the information be corrected using our contact details set out below.
If we refuse your request for access or correction, we will provide you with reasons for the refusal in writing, and details about how you may complain about the decision.
We take reasonable steps to protect personal information we hold about you from misuse, interference and loss, and from unauthorised access, modification or disclosure.
We use physical and technological security measures to protect the personal information we hold.
We may hold your personal information in a number of ways including electronically and in physical format.
We use a secure third-party cloud storage provider with servers located in Australia.
We also use secure third-party messaging software and SMS messaging services, which are encrypted.
When your personal information is no longer required to be retained under law (and in the case of your health information, the information has been retained for the required periods under the HPPs) we will take steps to securely destroy the information or to ensure that the information is permanently de-identified.
We are required to comply with mandatory ‘notifiable data breach’ scheme (the NDB scheme) under the Privacy Act 1988 (Cth). The NDB scheme applies when an ‘eligible data breach’ of personal information occurs.
An ‘eligible data breach’ occurs when:
Where we have reasonable grounds to believe that we have experienced an eligible data breach (and remedial action cannot be used), we will promptly notify affected individuals and the Office of the Australian Information Commissioner about the breach in accordance with the Privacy Act 1988 (Cth).
We may collect your personal information through your interactions with the System and via the C2C website at www.clinictocloud.com.
We will deal with any personal information collected via the C2C website in accordance with this Policy and the law.
We also collect data through our use of ‘cookies’ and other internet technologies.
Cookies are small data files which are stored on your device’s browser. Cookies are stored in order for your internet browser to navigate a website. Cookies will not identify you, but they do identify your internet service provider and browser type.
The default setting of most internet browsers is to accept cookies automatically, but you can choose whether to allow cookies through your browser settings.
We also collect your IP address to create an audit trail of events that take place on the C2C website and to track and aggregate non-identifiable information, your referring website addresses, browser type and access times.
If you are not satisfied with our response, or if you do not wish to raise a question or complaint with us directly, you may wish to contact:
the Office of the Australian Information Commissioner. See www.oaic.gov.au; or
the New South Wales Health Care Complaints Commission. See www.hccc.nsw.gov.au.
Our contact details for privacy related issues
If you would like to contact us regarding any privacy matters, including where:
please contact us using the following details:
We may update this Policy from time to time. We will notify you about any changes to this Policy through our website at www.clinictocloud.com, and we will make the most current version of the Policy available when you receive services from us, or on your request.