Privacy

Privacy Policy

Effective date: 30 July 2026

1About this policy

Alana Hayes is a private health service provider and handles information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles and the Health Records and Information Privacy Act 2002 (NSW). This policy applies to face-to-face care, telehealth, home visits, phone and email contact, online bookings and website use.

2Information collected

Only information reasonably needed to provide safe care, manage the practice or meet legal obligations is collected. This may include:

• your identity and contact details, emergency contact, Medicare or insurance information;
• referrals and details of your GP, endocrinologist and other treating clinicians;
• your medical history, diagnoses, medicines, allergies, pathology results, clinical notes and diabetes management information;
• glucose meter, continuous glucose monitor, insulin pump and other diabetes technology data;
• appointment, payment, Medicare claim, form, email and communication records; and
• limited website data, such as your IP address, browser, device and pages visited.

Information is usually collected directly from you. It may also come from an authorised representative, a referring or treating clinician, hospital, pathology service, pharmacy, diabetes technology provider, online booking system or another organisation involved in your care. If essential information is not provided, the practice may be unable to provide a service safely or process a booking, payment or Medicare claim.

3How information is used and shared

Your information is used to provide and coordinate your healthcare, communicate with you, prepare prescriptions, pathology requests, referrals and clinical letters, manage bookings and telehealth, process payments and Medicare claims, and meet professional, legal, insurance and regulatory requirements.

Relevant information may be shared with your treating healthcare team, pathology services, pharmacies, hospitals, diabetes technology providers, Medicare, insurers, payment providers, and the clinical, booking, telehealth, secure messaging, accounting and IT services used by the practice. Information may also be disclosed where required or authorised by law, or in an emergency where this is necessary to protect health or safety.

The practice does not sell your personal or health information. De-identified information may be used for audit, quality improvement, education or service planning.

4Communication, technology and My Health Record

The practice may contact you by phone, voicemail, SMS, email, secure messaging, telehealth or post. Email and SMS are convenient but may not be completely secure. Please tell the practice if you prefer not to receive sensitive information in a particular way.

Third-party platforms, including Halaxy, Healthdirect and diabetes technology systems, may be used to support care. These providers also handle information under their own privacy policies. If My Health Record is used, information will only be accessed or uploaded in accordance with applicable laws and your record settings.

5Storage, security and overseas processing

Reasonable safeguards are used to protect information from loss, misuse, unauthorised access, change or disclosure. Records are stored in secure electronic systems and access is limited to what is needed for your care and practice administration.

Some website, cloud, communication, accounting or technical service providers may process limited information outside Australia. Likely locations may include the United States and New Zealand. Reputable providers and appropriate privacy and security protections are used where overseas processing occurs.

Health records are kept for the period required by law. In NSW, information collected when a patient is an adult is generally kept for at least seven years after the last health service. Information collected when a patient is under 18 is generally kept until the patient turns 25. Records may be kept longer where legally or clinically required.

6Website, cookies and external links

This website may use cookies and similar tools to operate properly, improve performance and understand website use. You can block or delete cookies through your browser, although some features may not work as intended. Information submitted through an enquiry form, booking link or email will be used to respond to you and may become part of your clinical or administrative record where relevant.

The website may link to external websites. This policy applies only to information handled by Alana Hayes. The practice is not responsible for the privacy or security practices of other websites, so you should read their privacy policies before providing information.

7Access, correction and privacy complaints

You may ask to access the personal or health information held about you or request a correction if it is inaccurate, incomplete, misleading or out of date. Requests should be made in writing using the contact details below. Identity may need to be confirmed before information is released. Requests will be handled as promptly as possible and within applicable legal timeframes. Access may only be limited or refused where permitted by law.

Please contact the practice first if you have a privacy question or complaint. The concern will be reviewed and a response provided within a reasonable time. If you are not satisfied, you may contact the Office of the Australian Information Commissioner (oaic.gov.au) or the Information and Privacy Commission NSW (ipc.nsw.gov.au).

8Changes and contact details

This policy may be updated when the practice, its systems or legal requirements change. The current version and effective date will be published on this website.

Alana Hayes Privacy Policy  ·  Effective 30 July 2026