Privacy policy

About this policy

Toowoomba CPAP and Sleep Clinic ("we", "us", "our") is a mobile sleep health service in Toowoomba, Queensland. We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), which apply to all health service providers regardless of size.

This policy explains how we collect, use, store and share your personal and health information. It covers our sleep testing and therapy services, our website, our online sleep check questionnaire, and any contact you have with us by phone, email or in person. Our services are for adults aged 18 and over.

What information we collect

We only collect information we need to provide our services. This may include:

• Contact and identity details: your name, date of birth, address, phone number and email address.
• Health information: your medical history, symptoms, medications, height, weight, neck measurement, blood pressure history, sleep questionnaire answers, sleep study recordings and reports, and details of any CPAP or other therapy, including usage and therapy data from your CPAP device or its connected app or cloud platform where you agree to share it.
• Referral and billing details: your Medicare number, private health fund details, referral letters, and your referring doctor's and GP's details.
• Payment details: information needed to process payment for privately funded services.
• Contact with us: records of your calls, emails, messages and appointments.

You can choose to deal with us anonymously or under a pseudonym when making a general enquiry. However, we need to identify you to perform a sleep study, provide therapy or claim Medicare benefits.

How we collect it

Wherever we can, we collect information directly from you. That includes when you:

• call, email or message us
• fill in a form on our website, including the sleep check questionnaire
• complete paperwork or questionnaires before your sleep study
• take part in a sleep study or therapy appointment

We may also receive information from other people with your consent or where the law allows. Examples are your GP or referring doctor, the sleep physician who reports your study, the company that scores your sleep study data, other health professionals involved in your care, or a family member or carer you've asked to help you.

Why we collect and use it

We collect, use and disclose your information to:

• assess whether a sleep study is right for you, and arrange and perform it
• have your study analysed and reported, and send results to your doctors
• provide, adjust and follow up on CPAP and other sleep therapy
• claim Medicare benefits or process payment for private services
• contact you about appointments, results and your ongoing care
• meet our legal, professional and insurance obligations
• improve the quality and safety of our services

We only use your health information for these purposes, for a directly related purpose you would reasonably expect, with your consent, or where the law requires or allows it. We do not sell your information, and we do not use it to send you marketing such as newsletters or offers.

Who we share it with

We only share your information when it's needed for your care or required by law. This may include:

• Your doctors: your GP, referring doctor and other treating health professionals.
• Reporting sleep physician: Dr Ravindranath Balasubramaniam, the qualified sleep physician who reviews and reports your study.
• Sleep study scoring: Polysom Services Australia, who score the data recorded during your sleep study before it is reported.
• Medicare and health funds: to process claims for your services. Medicare claims are usually lodged through Tyro.
• Service providers: businesses that help us run the clinic, such as Cliniko (practice records), Dropbox (file storage), Medical Objects (secure messaging with doctors), Wix (our website), Google (email), Square and Tyro (payments and claims), and our IT and equipment suppliers. They may only use your information to provide that service to us.
• As required by law: for example, under a court order or mandatory reporting obligations, or where needed to lessen a serious threat to someone's life, health or safety.

We won't share your information with anyone else, including family members, without your consent.

Our website and sleep check questionnaire

Our online sleep check uses the Epworth Sleepiness Scale and STOP-Bang questionnaire. You can complete it and see your scores without giving us any personal details. Your answers are not sent to us unless you choose to send them.

If you choose to send your results, we will receive your name, the phone number and email address you provide, your scores, and your answer to each question, including any height and weight you entered. We only receive this when you tick the consent box and press send. We use it to contact you about your sleep and possible next steps, and it becomes part of your record with us.

Information from our website forms is delivered by email to our clinic inbox. Our website is hosted by Wix.com, which may use cookies and collect basic technical information such as your browser type, device and pages visited. You can block or delete cookies in your browser settings, although some parts of the site may not work as intended.

Our website may link to other sites, such as Medicare, equipment manufacturers or health resources. This policy doesn't apply once you leave our site, so we recommend reading the privacy policy of any site you visit.

How we store and protect it

We keep your health records in Cliniko, a secure practice management system, and store files such as sleep study data in Dropbox. We send referrals, results and reports to your doctors through Medical Objects, a secure messaging service for Australian health providers. Any paper records are kept to a minimum. We take reasonable steps to protect your information from misuse, loss, and unauthorised access, change or disclosure. These include:

• password and two-step login protection on our systems and email
• limiting access to the people who need it to provide your care
• keeping sleep study equipment and devices secure, and clearing patient data from them once it has been transferred
• storing any paper records securely
• processing payments through Square and Tyro, secure payment providers that meet the Payment Card Industry Data Security Standard (PCI DSS); we don't store your full card details

We keep health records for at least 7 years after your last contact with us, in line with guidance for adult health records in Australia. When we no longer need your information, we securely destroy or de-identify it.

Information stored overseas

We don't send your health information overseas as part of your care. Our practice records in Cliniko are stored in Australia, and our secure messaging with doctors goes through Medical Objects, an Australian service. Some of our other providers may store data outside Australia, including in the United States. These include Dropbox (file storage), Wix.com (our website and online forms), Google (our email) and Square (payments). Where this happens, we take reasonable steps to make sure those providers protect your information in a way consistent with the Australian Privacy Principles.

Accessing and correcting your information

You can ask for a copy of the information we hold about you, or ask us to correct anything that is inaccurate, out of date or incomplete. Contact us using the details below. We'll respond within 30 days.

We may need to confirm your identity first. There is no charge to request access or to receive copies of your records. In rare cases the law allows us to refuse access, for example where it would pose a serious threat to someone's health or safety. If we refuse, we'll explain why in writing.

Data breaches

If a data breach is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches scheme. We'll tell you what happened and what you can do to protect yourself.

Making a complaint

If you're concerned about how we've handled your information, please contact our Privacy Officer first using the details below. We'll acknowledge your complaint within 7 days and aim to resolve it within 30 days.

If you're not satisfied with our response, you can contact:

• Office of the Australian Information Commissioner (OAIC): 1300 363 992 or oaic.gov.au/privacy/privacy-complaints
• Office of the Health Ombudsman (Queensland): 133 OHO (133 646) or oho.qld.gov.au/make-a-complaint

Changes to this policy

We may update this policy from time to time. The latest version will always be on our website, with the date it was last updated. If the clinic is sold, merged or transferred to another provider, your records may be transferred to the new provider so your care can continue. They would remain protected under Australian privacy law, and we would let you know.