Your rights matter
Privacy Policy
At Health and Wellbeing Wulguru, we are committed to protecting the privacy of your personal health information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
Last updated: August 2026
Our Privacy Policy
This Privacy Policy explains how Health and Wellbeing Wulguru, located at 346–348 Stuart Drive, Wulguru QLD 4811, collects, uses, discloses, stores, and protects your personal health information. Our policy is based on the Royal Australian College of General Practitioners (RACGP) privacy policy template and complies with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), and the My Health Records Act 2012 (Cth).
We handle your personal information with the utmost care and confidentiality. This policy applies to all patients, visitors, and anyone whose information we hold. By attending our practice or providing us with your personal information, you consent to the collection, use, and disclosure of that information as described in this policy.
This Privacy Policy is available in the following formats:
- Displayed in our waiting room
- Included in our new patient registration pack
- Published on our practice website
- Provided upon request to any patient or visitor
Collection of personal health information
We collect personal information that is necessary to provide you with quality healthcare. This includes your name, date of birth, address, contact details, Medicare number, health fund details, emergency contact information, and detailed health information such as medical history, medications, allergies, test results, and clinical notes.
We collect your information directly from you wherever practicable — through registration forms, during consultations, via telephone, or through our online booking system. In some circumstances we may collect information from third parties such as other treating practitioners, hospitals, specialists, pathology and radiology providers, or your authorised representative.
Patient consent is obtained and documented at the earliest stage of clinical care. You will be informed about how your personal health information will be used, including the organisations to which we typically disclose patient information, any legal obligations for collecting specific information, and how your information may be used to provide healthcare services.
Types of information we collect
- Personal identifiers: name, date of birth, address, phone, email
- Medicare and health fund details
- Medical history, diagnoses, and clinical notes
- Medications, allergies, and adverse reactions
- Pathology, radiology, and specialist reports
- Immunisation and preventive health records
- Mental health and sensitive health information
- Emergency contact and next-of-kin details
Use and disclosure of personal health information
Your personal health information is primarily used to provide you with healthcare services. We will only use or disclose your information for the purpose for which it was collected, or a directly related secondary purpose that you would reasonably expect, or with your consent.
Under the Privacy Act 1988 and the Australian Privacy Principles, personal health information may be used or disclosed for a secondary purpose without additional consent where the secondary purpose is directly related to the primary purpose of collection and you would reasonably expect such use or disclosure.
Secondary purposes for use or disclosure
In delivering healthcare services, we may use or disclose your information for the following purposes:
- Referrals to specialists, allied health providers, and other treating practitioners
- Pathology, radiology, and diagnostic testing
- Hospital admissions and discharge planning
- Medicare, DVA, and health fund billing and processing
- Practice management, administration, and appointment reminders
- Quality improvement, accreditation, and clinical audit activities
- Compliance with legal and regulatory requirements
- Complaint resolution and incident management
- Training and supervision of healthcare students and staff (de-identified where possible)
How we ensure transparency
We inform patients about potential secondary uses of their personal health information through:
- Discussions with your GP during consultations
- Our practice privacy statement in the new patient information pack
- Signage within the practice outlining privacy policies
- The new patient registration form, which includes a privacy consent statement
Disclosure to third parties
We do not sell, rent, or trade your personal information to third parties. We may disclose your information to external organisations only where necessary to provide your healthcare, where required by law, or with your consent. These may include other treating practitioners, hospitals, Medicare Australia, the Department of Veterans' Affairs, health insurers, pathology and radiology services, and government health agencies.
Where we engage third-party service providers (such as IT systems, billing software, or cloud storage), we take reasonable steps to ensure those providers handle your information in accordance with the Privacy Act 1988 and our contractual obligations.
My Health Record
Health and Wellbeing Wulguru participates in the My Health Record system. We may upload clinical documents such as shared health summaries, event summaries, and referral letters to your My Health Record where clinically appropriate and in accordance with the My Health Records Act 2012 (Cth).
You have the right to control access to your My Health Record, including restricting access to specific documents or healthcare providers. You may also cancel your My Health Record at any time. For more information, visit myhealthrecord.gov.au or speak with your GP.
Data quality and security
We take reasonable steps to ensure that the personal information we hold is accurate, up to date, complete, and relevant. We encourage you to inform us of any changes to your personal details so we can keep your records current.
We store your health records securely using industry-standard clinical software with access controls, encryption, and audit logging. Physical records are stored in locked facilities. Only authorised staff with a legitimate need to access your information may do so.
We retain health records in accordance with Queensland Health retention requirements — generally a minimum of seven years from the date of last entry for adult patients, or until the patient turns 25 years of age (whichever is later) for records created when the patient was a minor.
In the event of a data breach that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988.
Your rights
You have a number of rights in relation to your personal health information held by our practice. We are committed to upholding these rights and will respond to any request within a reasonable timeframe.
Patients have the right to opt out of secondary use or disclosure of their personal health information. If you express concerns or refuse consent for a particular secondary use of your information, your non-consent will be documented in your patient file and respected.
Access your records
You have the right to request access to the personal health information we hold about you. Requests should be made in writing to our Practice Manager. We may charge a reasonable fee for providing access.
Correct your information
If you believe information we hold is inaccurate, out of date, incomplete, or misleading, you may request a correction. We will take reasonable steps to correct the information or note your request in your file.
Opt out of secondary use
You may refuse consent for secondary use of your information, such as for research or training purposes. Your non-consent will be documented in your patient file and respected.
Make a complaint
If you believe your privacy has been breached, you may contact our Practice Manager in the first instance. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC).
Anonymity and pseudonymity
Where lawful and practicable, you may request to interact with us anonymously or using a pseudonym. However, this may limit our ability to provide you with safe and effective healthcare.
Withdraw consent
You may withdraw consent for the use or disclosure of your personal information at any time, subject to legal or contractual restrictions. Withdrawal of consent will not affect any prior use or disclosure made with your consent.
Website and online privacy
Our website (healthandwellbeingwulguru.com.au) may collect non-identifiable information such as browser type, pages visited, and time spent on the site through analytics tools (including Google Analytics). This information is used to improve our website and services and is not linked to your personal health information.
Our website uses a cookie consent mechanism. Analytics cookies are only activated after you provide consent. You may withdraw consent at any time by adjusting your browser settings or using the cookie preference controls on our website.
Our online booking system (HotDoc) is operated by a third-party provider. When you book online, your information is handled in accordance with HotDoc's privacy policy as well as our own. We encourage you to review HotDoc's privacy policy at hotdoc.com.au.
Questions about your privacy?
If you have any questions or concerns about how your personal health information is managed, please speak with our friendly staff or contact our Practice Manager directly.