Privacy Policy
Current as of 11 October 2026
This policy gives you, our patient, clear information on how your personal information is collected and used at Thrive Clinic. Occasionally we also need to share your personal information to involve others in your healthcare, and this policy explains when, how and why we do that.
Thrive Clinic follows the Australian Privacy Principles in the Privacy Act 1988 (Cth) and the Health Privacy Principles in the Health Records and Information Privacy Act 2002 (NSW).
Who can I contact about this policy?
For enquiries about this policy, please contact our Practice Manager at admin@thriveskinclinic.com.au, on (02) 4272 5070, or by post at 5 Tannery Street, Unanderra NSW 2526.
When and why is your consent necessary?
When you register as a patient of Thrive Clinic, you consent to our doctors, nurses, dermal therapists and practice staff accessing and using your personal information to provide your healthcare. Access to your personal information is restricted to team members who need it for your care. If we ever want to use your personal information for any other purpose, we will ask for your consent first.
It is important to us that you understand why we collect and use your personal information. By acknowledging this policy, you consent to us collecting, holding, using, retaining and disclosing your personal information as described below.
Why do we collect, use, store and share your personal information?
We collect, use, store and share your personal information mainly to manage your health safely and effectively. This includes providing consultations and treatments, keeping your medical records, and accurate billing and payments. We may also use your information for internal quality and safety processes, such as practice audits, accreditation and staff training.
What personal information is collected?
The information we collect about you includes your:
names, date of birth, addresses and contact details
medical information, including medical history, medicines, allergies and adverse reactions, immunisations, social history, family history and risk factors
Medicare number (where available) for identification and claiming purposes
healthcare identifier numbers
health fund details
clinical photographs taken before, during and after treatment
questionnaires you complete for us, such as the menopause symptom score
payment details, which are held securely by our booking and payment providers.
Can you deal with us anonymously?
You can deal with us anonymously or under a pseudonym unless it is impracticable for us to do so, or unless we are required or authorised by law to deal only with identified individuals. For example, you can ask a general question without giving your name, but we need to identify you to provide medical care and to claim Medicare rebates.
How is personal information collected?
We may collect your personal information in several ways:
When you make your first appointment, we collect your personal and demographic information through your registration and new patient form.
We may also collect your personal information when you visit our website, email or text us, telephone us, book online, complete an online form, or contact us through social media. We do not use social media to discuss clinical matters.
In some circumstances, we may collect information from other sources, such as your guardian or responsible person; other healthcare providers involved in your care, such as specialists, allied health professionals, hospitals, and pathology and imaging services; and your health fund, Medicare or the Department of Veterans' Affairs.
While providing medical services, we may also collect information through electronic prescribing, My Health Record and online appointments.
Clinical photographs are taken to plan and track your treatment. They are taken and stored using our secure clinical photography system (Clinical Imaging Australia), which keeps all images encrypted in Australian data centres and does not use them to train AI. They are never used in advertising or on social media without your separate written consent.
We will always comply with our privacy obligations when collecting personal information from third-party sources. This includes being transparent with you, obtaining the necessary consents, keeping information accurate, keeping it secure, and using it only for the purposes described.
When, why and with whom do we share your personal information?
We sometimes share your personal information:
with third parties for business purposes, such as accreditation agencies or information technology providers. These third parties are required to comply with the Australian Privacy Principles and this policy
with other healthcare providers involved in your care, for example in referral letters, or with our in-house naturopath when you are seeing her as part of your plan
when it is required or authorised by law, for example a court subpoena
when it is necessary to lessen or prevent a serious threat to a patient's life, health or safety, or to public health or safety, or it is impractical to obtain your consent
to assist in locating a missing person
to establish, exercise or defend an equitable claim
for a confidential dispute resolution process
when there is a statutory requirement to share certain information, for example mandatory notification of some diseases
when providing medical services through electronic prescribing or My Health Record.
Only people who need to access your personal information will be able to do so. Other than to provide medical services, or as otherwise described in this policy, we will not share your personal information with any third party without your consent.
Some of the services we use store information outside Australia: Timely (Australia and the United States) for bookings and payments, Jotform (United States) for online questionnaires, Google (United States and other countries) for email and documents, and Squarespace and Shopify (United States and Canada) for our website and online shop. Apart from these, we do not share your personal information with anyone outside Australia without your consent, unless the law permits it.
Will your information be used for marketing purposes?
We will not use your personal information to market goods or services directly to you without your express consent. This includes our newsletter and promotions by email or SMS. If you do consent, you can opt out at any time by using the unsubscribe link in any message, replying STOP to any text, or letting us know in writing.
How is your information used to improve services?
We may use your personal information to improve the quality of our services, through analysis of patient data for quality improvement and through training activities for our team.
We do not share your data, including de-identified data, with other organisations for research or population health purposes.
How are AI scribes used?
With your permission, Dr Grant uses an AI scribe called Heidi to help take notes during your consultation. Heidi uses the audio of your consultation to draft a clinical note, which Dr Grant checks and edits before it is added to your health record. Heidi:
does not store the audio recording once the note is drafted
stores all data in Australia
holds the draft note only briefly; once Dr Grant has finalised it, the note is saved in your record in MediRecords and deleted from Heidi.
We only use data from our AI scribe to provide healthcare to you. You can ask us not to use it at any time, and this will not affect your care.
How is your personal information stored and protected?
Your personal information is stored electronically in our secure clinical software, MediRecords, which keeps all data within Australia, and in Timely, our booking system. Clinical photographs are kept in our clinical photography system (Clinical Imaging Australia), which stores images encrypted in Australian data centres. Any paper records are kept in a secured environment. We protect your information with individual logins and passwords, access limited to each team member's role, and confidentiality agreements for staff and contractors.
We keep health records for at least 7 years after your last visit, or until you turn 25 if you were first seen as a child, as required by NSW law. After that, records are destroyed securely. If a data breach is likely to cause you serious harm, we will tell you and the Office of the Australian Information Commissioner.
How can you access and correct your personal information?
You have the right to request access to, and correction of, your personal information. Please make your request in writing to admin@thriveskinclinic.com.au. We will respond within 30 days. There is no charge for making a request, but a reasonable fee may apply to cover the cost of providing copies, which we will tell you about first.
We will take reasonable steps to correct your personal information if it is not accurate or up to date. From time to time, we will ask you to check that the information we hold about you is correct and current.
How can you lodge a privacy-related complaint, and how will it be handled?
We take complaints and concerns about privacy seriously. Please contact our Practice Manager at admin@thriveskinclinic.com.au, on (02) 4272 5070, or by post at 5 Tannery Street, Unanderra NSW 2526. We will acknowledge your complaint within 7 days and aim to resolve it within 30 days.
If you feel we have not resolved your concern, you can contact the Office of the Australian Information Commissioner (www.oaic.gov.au, 1300 363 992), which will usually ask you to give us time to respond first. You can also contact the NSW Information and Privacy Commission (www.ipc.nsw.gov.au, 1800 472 679).
How is privacy on the website maintained?
Any personal information you share with us through our website, online forms, email or social media is handled securely and confidentially. Our website uses cookies, Google Analytics and the Meta (Facebook) pixel to understand how people use the site and to show our ads to people who have visited it. We never share your medical records or health information with Google, Meta or any other advertiser. You can block cookies in your browser settings.
Policy review statement
We review this privacy policy regularly to make sure it meets our current obligations. If we make changes, they will be shown on our website, and significant changes may be sent to you by email. Please check this policy from time to time, and contact us if you have any questions.
