How we collect, store, use and disclose your personal information.
TCI Health Pty Ltd (ABN 18 656 230 278) ("TCI Health", "we") is a private company which is registered in Australia.
TCI Health offers secure cloud-based services ("Services") to:
TCI Health is committed to managing personal information (including sensitive information) in accordance with the Australian Privacy Principles ("APPs") under the Privacy Act 1988 (Cth) and in accordance with other applicable privacy laws (including the Health Records Act 2001 (Vic) and equivalent State and Territory legislation). This policy sets out how we manage your personal information. In this Privacy Policy, "we", "us" and "our" refers to TCI Health and "you" or "your" refers to any individual about whom we collect personal information. This Privacy Policy tells you how we collect, store, use and disclose your personal information.
We collect personal information:
When you use TCI Health's applications, a record may be made which may include some of your personal information. The type of personal information that we collect will vary depending on the circumstances of collection and the kinds of services which we are providing to our practitioner clients.
Whenever users visit or interact with our website or application ("Platforms"), we and our third party providers may automatically or passively record their metadata information about how the Platform is accessed and used ("Usage Information"). Usage Information helps us keep our Platforms relevant to users and allows us to tailor our content. Usage Information is generally non-identifying, but if any aspect of it may identify you, we will treat it as personal information.
In addition to the above, we will also collect patients' personal information (some of which is considered sensitive information within the meaning of the APPs.) This includes but is not limited to patient names, dates of birth, patient identifiers, contact information, emergency contact details, financial and payment information, Medicare and/or health insurance information, information about patients' health, episodes of care (including information such as their surgical procedure, comorbidities and weight, and any notes made by our practitioner clients), scheduled surgeries and information about a health service that may be provide to the patient, patient medical records and information about medications; additional information considered by a health service provider necessary to facilitate the provision of health appointments or health-related services.
Our practitioner clients are solely responsible for ensuring that all necessary consents have been obtained from patients prior to the uploading of any of their information to our servers, and we endeavour not to collect patients' personal information if we have reason to believe that they have not provided their consent to the practitioner, to such collection. We will take all reasonable steps to ensure that patients are notified that their personal information has been collected to provide billing services. Where patients do not agree to our collection of their personal information or they wish to withdraw their consent to such collection, they may contact us to request deletion of their information in accordance with our policy below.
We may collect and use personal information about individuals at our practitioner clients and other medical professionals to the extent necessary to provide the Services. This may include obtaining some personal information about surgeons who refer their patients to our practitioner clients (e.g anaesthetists), their personnel as well as hospital staff, most typically in the context of providing our Services in relation to, for, or for the benefit of a patient.
We generally collect patient personal information directly from the uploads of our client practitioners or their representatives, including via Optical Character Recognition (OCR) from image uploads and PDF or sticker submissions from our practitioner clients (where they have obtained or arranged for the obtaining of the patient's consent).
We may also collect certain ancillary information directly from patients, by electronic messages (including email and SMS, or any of our integrated messaging services), and via their usage of our Platforms (including via mobile Usage Information).
We are committed to providing secure and reliable Platforms. In order to protect the personal information which we hold, we use industry-standard physical, procedural and technical security measures in accordance with our obligations under the APPs, including encryption as appropriate. Our security model and controls align with industry best practices, and are based on (but not accredited to) standards such as ISO 27001, ISO 27018 and OWASP Top 10.
Our systems are hosted on Amazon Web Services, located in Australia. This allows us to provide a reliable service and keeps your data readily available. This data centre employs leading physical and environmental security measures, resulting in highly resilient infrastructure. We take reasonable steps to protect your personal information from misuse, interference and loss and from unauthorised access, modification or disclosure.
If you are an individual whose personal information has been uploaded to the TCI Health database (whether by yourself or by our practitioner client with your express informed consent) for the purpose of us providing the Services, we will use and disclose your personal information where this is reasonably necessary for, and relevant to, our delivery of the Services, including disclosures to the relevant practitioner client and other third parties (such as Medicare Australia, third party insurers, or other regulatory payers) for the purposes of delivering and enabling the Services. We may also use and disclose this information where required or permitted by law.
We may disclose personal information to third parties who need to know it, to the extent only that they need to know it, in order to assist us in providing the Services, including contractors and service providers used for payment processing, data processing or storage, technology providers, information technology services and support, Platform maintenance/development, and email and SMS distribution services who help us supply our products and services. Those third parties are typically bound by privacy obligations in respect of that information, including under privacy laws and in some cases, additionally through agreements with us.
We will also use and disclose personal information for a range of administrative, management and operational purposes to the extent that such use and disclosure is reasonably required. This includes:
We may send our practitioner clients direct marketing to inform them about products or services, special offers, promotions and events that may be of interest.
Practitioner clients' consent to receive direct marketing communications from us in the above ways will be deemed to have taken place if they do not opt out when offered the opportunity to do so, and will remain current on an ongoing basis unless and until they advise otherwise. If you are a practitioner client and do not want to receive such offers from us, you can opt out at any time by contacting us using our contact details provided below or by utilising the "unsubscribe" function in electronic communications.
In addition to the uses and disclosures set out in this policy, we may also use or disclose your personal information where:
We only store your personal information within Australia, and will not disclose your personal information to any overseas third parties without your prior consent.
Our Platforms may contain links and integrations to third party websites and platforms. This Privacy Policy does not apply to the practices of those third parties, and we are not responsible or otherwise liable for the actions, information, representations and privacy policies of the third parties that operate or interact with those other websites.
In order to use our Services, you may be required to provide those third parties with additional information, such as your credit card information. Any information which you provide to those third parties will not be shared with us and we will not collect or hold that information.
Certain jurisdictions have specific legal requirements and grant privacy rights with respect to personal information, and we will comply with restrictions and any requests you submit as required by applicable law. You may contact us to access and update any of your information that we hold.
We will take reasonable steps to ensure that the personal information we collect, use or disclose is accurate, complete and up to date in accordance with our obligations under applicable privacy regulation.
In instances where we hold your personal information in our database, you may contact us directly to seek an update, amendment or request deletion of your personal information. We will meet this request within a reasonable timeframe.
After receiving a request from you, we will take reasonable steps to correct your information however we are not liable for the accuracy, completeness or veracity of such information which we have collected from you and any third parties.
To request access to or update your personal information please contact our privacy officer using the contact details set out below. We will respond to your request within a reasonable time in accordance with the Privacy Act 1988 (Cth) and other applicable privacy laws depending on the jurisdiction.
You will not be charged for making a request to access your personal information, but you may be charged a reasonable fee for our costs and any expenses involved in compiling information in response to your request.
We may amend this Privacy Policy from time to time, with or without notice to you, with prospective effect only. We recommend that you visit our Platforms regularly to keep up to date with any changes. By continuing to use our Services, you agree to be bound by the Privacy Policy as amended.
If you have any concerns or would like to make a complaint, please contact the Privacy Officer (details below). Please include your full name, email address and/or telephone number and clearly describe your concerns or complaint. We will endeavour to investigate your matter and respond to your complaint within 14 days after it is made. If you are unhappy with our response, you may refer the issue to the Office of the Australian Information Commissioner (see www.oaic.gov.au).
You can contact our Privacy Officer in the following ways:
TCI Health Pty Ltd
Attention: Privacy Officer
Email: info@tcihealth.com.au
Postal Address: Suite 212, 45 Glenferrie Road, Malvern VIC 3144
TCI Health Pty Ltd | ABN 18 656 230 278