Our Privacy Policy

Affinity Family Medical – Effective Date: June 2026

1. Our Commitment and RACGP Standards

Affinity Family Medical is committed to protecting the privacy and confidentiality of your personal information, including sensitive health details.1 This policy outlines how we manage personal information collected through this website and explains your rights under the Australian Privacy Principles (APPs) and the Privacy Act 1988 (Cth).

This policy is maintained to comply fully with the RACGP Standards for general practices (5th edition), ensuring transparent communication (C1.4 A), secure information management (C1.1), and a clear complaints process (C2.1).

2. Collection of Information via the Website

We collect different types of information depending on how you interact with our website.

Type of InformationHow It Is CollectedPurpose of Collection
Personal IdentifiersSubmitted by you through online forms (e.g., appointment requests, registration, feedback).To manage your appointment, update your medical record, and respond to your specific request.
Sensitive Health InformationSubmitted by you through specific secure patient portals (e.g., online repeat prescription request, pre-screening forms).To enable safe and appropriate clinical management. This information is uploaded directly to your secure patient file.
Website Usage Data (Non-Identifying)Automatically collected through standard analytics using cookies and IP addresses.To improve website functionality, assess traffic, and enhance services. This data does not personally identify you as a patient.

3. Security, Storage, and Staff Accountability (RACGP C1.3 & C1.1)

We take reasonable steps to protect the personal information collected via our website, covering both technical and organisational measures as required by law and the RACGP Standards.

    • Technical Security: Our website uses SSL encryption. All patient data is transferred to our accredited practice software system, protected by multi-factor authentication and robust cybersecurity protocols.
    • Organisational Accountability:
      • Staff Training: All staff members (including GPs, nurses, and administrative staff) are provided with mandatory, documented training on privacy obligations, data handling, and the requirements of this policy before commencing duties and at least annually thereafter.
      • Access Control: Access to your electronic health record is strictly controlled and limited to authorised personnel only on a need-to-know basis for the purpose of providing care.
    • Third-Party Providers: We only engage with third-party providers (e.g., secure booking software) that comply with Australian privacy legislation and implement security measures that meet our RACGP compliance standards

4. Automated Decision-Making

Affinity Family Medical currently does not use automated decision-making programs (such as Artificial Intelligence) that rely on your personal information to make decisions that would reasonably be expected to significantly affect your rights or interests.

5. External Links and Cookies

  • External Links: Our website may contain links to external health-related websites. Affinity Family Medical is not responsible for the privacy practices of external sites.
  • Cookies: We use cookies to enhance your browsing experience.2 Cookies do not collect sensitive personal health information. You can manage cookie settings in your browser.3

6. Access: Your Rights to Access and Correction (RACGP C1.4 A)

You have the right to request access to and correction of the personal and health information we hold about you.4

  • Access Request Process: To request access to your medical record, please submit your request in writing to the Practice Manager (contact details below). The Practice Manager will process this request according to the practice’s documented policy, ensuring access is provided within a reasonable timeframe and following guidelines on third-party information and potential fees.
  • Correction: If you believe any information we hold about you is inaccurate, out-of-date, or incomplete, please notify the Practice Manager immediately so we can investigate and update your records.

7. Contact and Complaints (RACGP C2.1)

If you have any questions about this Privacy Policy or wish to make a complaint about how your personal information has been handled, please contact our Practice Manager. Your complaint will be managed according to our documented Patient Feedback and Complaints Policy (C2.1).

Contact DetailPurpose
The Practice ManagerGeneral privacy queries, access requests, and formal complaints.
Email:business@affinitymedical.com.au
Telephone:07 4804 5680

External Regulator

If you are not satisfied with our internal response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

Medical records

Medical records contain personal health information which is used by doctors at Affinity Family Medical to manage and plan patient health care.

A typical medical record will contain information such as:

  • patient identification sheet
  • •notes recording patient care
  • summaries and reports from consulted specialists and diagnostic services
  • test results
  • prescribed medications

It is necessary to collect and keep this information to provide a history of patient health care and
to identify safe and effective future treatments.

Some of the information collected by the clinic may also be used to evaluate our service and plan
for the future. If a medical record is used for this purpose, information that identifies the patient
will be removed.

Patient confidentiality

Affinity Family Medical respects the rights of patients to decide how their personal health information
is used or disclosed.

Affinity Family Medical will always ensure that patients:

  • agree to have their personal health information collected
  • consent to any disclosure to a third party

Reasons personal health information may be disclosed to a third party include:

  • seeking a second opinion from another medical practioner
  • referral to a specialist
  • requesting diagnostic testing or examination (such as pathology or radiology)
  • admission to casualty or hospital
  • disclosure to obtain Medicare or insurance payments
  • medical research

Disclosure of personal health information without patient consent will only occur in situations
where:

  • the doctor is compelled by court order
  • the doctor believes that a higher duty prevails in order to protect the public interest
  • the disclosure is necessary to avoid a serious risk of harm to the person concerned
  • there is a legal obligation under applicable Commonwealth or State legislation eg
    statutory provisions requiring the notification of certain infectious diseases or suspected
    child abuse.

Patient access to medical records

Under the Privacy Act 1988, patients have the right to request amendments be made if the record contains information that is:

  • inaccurate
  • incorrect
  • out of date
  • misleading

If a patient requests an amendment, the doctor concerned should add notes to the record to
indicate the nature of the request and the changes made.

If a patient requests access to their medical record, this information can be provided by way of a
summary. Provision of a medical record or summary should always be accompanied by an
explanation from the doctor and an offer to discuss any patient concerns.

On rare occasions, a doctor may request that some information not be made available to a
patient. This may be necessary if it is believed the information may be detrimental to a patient’s
health and well being if read by the patient.

If requested by a patient, the clinic will also transfer a copy of the medical record or summary to
another medical clinic or practitioner.

Queries

Patient queries regarding the management of personal health information at Affinity Family Medical
should be referred to the Practice Manager, Nicky Jardine.

Storage and security

Active records
Medical records (computerised and paper) are retrievable only by authorised staff at Affinity Family Medical.

Affinity Family Medical is legally obliged to keep medical records for 7 years. The medical records of a
minor must be held until the patient turns 25.

All active records are stored securely on the premises.

Inactive records
A medical record is considered inactive when a patient has not attended the clinic for more than
three years.

Doctors will be responsible for confirming that a patient’s medical record is inactive. The doctor
will then produce a summary of the medical record and advise administration staff of the need for
archiving.

Reception staff will arrange archiving of inactive medical records and archived records will be reviewed annually and destroyed as required.