Moon Street Medical Centre
We collect health information so that we can care for you safely.
Only the people involved in your care, and the staff who support them, see it.
We keep it on secure systems in Australia. Card details are handled by a payment company, not by us.
You can ask to see or correct your information at any time.
If you are unhappy with how we have handled your information, you can complain to us and then to the privacy regulators.
Moon Street Medical Centre, 11 Moon Street, Ballina NSW 2478. Phone 02 6686 2611. Email pm@moonstmedical.com.au.
This policy covers the practice and the doctors who work here. It also covers the new patient enquiry service at beforeyourvisit.com.au.
Identity and contact details: your name, date of birth, address, phone number, email address and emergency contact.
Medicare and DVA details: your card numbers, so that we can bulk bill.
Health information: your conditions, medicines, allergies, ongoing pain, alcohol use, hospital stays, the other health professionals and services who look after you (including NDIS and carer details), care plans and compensation claims, your records from previous practices, test results and the notes from your visits.
Other sensitive information: whether you are of Aboriginal or Torres Strait Islander origin, which every patient is asked, and whether you need an interpreter.
Card details for a first appointment: these go directly to our payment company. We do not see or store the full card number.
Invitations: If the practice invites you to complete the form, your first name, last name, mobile number and email address, kept for 90 days after the link is used or closes.
We collect most information from you: on our forms, by phone, online and during your visits.
With your consent, we also collect information from other people. These include your previous GP practice, your specialists, hospitals, pathology and imaging services, and a carer or family member you have nominated. Doctors are also required to check the prescription monitoring system (SafeScript NSW) before prescribing certain medicines.
If you fill in a form for someone else, you must be their parent, guardian or authorised representative.
To decide whether we can offer you an appointment, and to plan your care.
To provide care, order tests, write prescriptions and referrals, and follow up results.
To bill Medicare or DVA.
To send appointment reminders and recalls.
To meet our legal and professional obligations, including accreditation and quality checks.
If you choose not to give us information, we may not be able to consider an enquiry or provide care safely.
We share your information only when it is needed for your care, when you have agreed, or when the law requires it.
For your care: other doctors, specialists, hospitals, pathology and imaging services, pharmacists and allied health professionals involved in your care.
Government programs: Medicare, DVA, My Health Record (unless you have opted out), immunisation and screening registers.
Our service providers: our clinical records software, the company that sends our SMS reminders (HotDoc), and the providers of the new patient enquiry service described below.
When the law requires it: for example a court order, or the reporting of certain infectious diseases.
The online enquiry at beforeyourvisit.com.au is run for the practice by Lantern Labs Pty Ltd (ABN [PLACEHOLDER]), an Australian company. Your answers and any files you upload are stored encrypted on a server in Sydney, Australia, and are opened only by the practice staff who review enquiries. Each time an enquiry or a file is opened, a record is kept of who opened it and when.
Card details: entered on a secure page run by Stripe Payments Australia Pty Ltd. The practice and Lantern Labs never see or store the full card number; the practice holds only a reference that allows the agreed missed-appointment fee to be charged. The missed-appointment fee is collected by Lantern Labs Pty Ltd through Stripe and paid to the practice; card details are held by Stripe only. Stripe may process card information in other countries, including the United States, under its own privacy policy.
Emails: the service sends these emails only: an invitation with the link to the form (and a reminder, and a note when the link closes) if the practice invited you; a six-digit code to confirm your email address when you start; an acknowledgement that your enquiry has been received; a short note of the practice's decision; a receipt if the missed-appointment fee is charged; and notices to the practice that an enquiry has arrived or been decided (an enquiry number and a link, nothing else). Your health answers are never emailed.
Text messages: if you asked the practice by phone for the link, the link, one reminder and a closing notice are sent by text message. They carry the link only, never an answer.
Uploaded files: photos or PDF documents you choose to add (for example a medicine list or a hospital letter) are checked, re-saved and encrypted on the server, and are deleted with the enquiry.
Privacy contact for the enquiry service: for more information about how your personal information is handled by the service, or to make a privacy complaint, email privacy@lanternlabs.com.au. If you are not satisfied with our response you can contact the Office of the Australian Information Commissioner (oaic.gov.au).
We do not sell your information, and we do not use it for marketing.
Your health information is stored in Australia. Some functions of the service, such as email delivery and card handling, rely on third-party providers whose servers may be located overseas; this never includes your health answers. Information may remain in secure backups for a limited period after deletion.
Health records are kept in password-protected systems, and each staff member has their own login.
Staff and doctors have signed confidentiality agreements.
Completed forms are never sent by ordinary email. The enquiry service stores your answers encrypted, and staff log in with a password and an authenticator code.
The premises have physical security measures.
If a data breach is likely to cause serious harm, we will tell you and the privacy regulator.
An enquiry you start but do not finish is kept for 24 hours on the device you started it on, then deleted with any files.
A completed enquiry is held by the service only until the practice has filed it in its clinical record or has decided not to offer an appointment — at most 90 days after that — then deleted. We keep only the enquiry number and the dates it was received and deleted. The practice keeps your record in line with its own privacy policy and NSW health records law.
A missed-appointment fee, if one is charged: the date of the missed appointment, the reason, the amount and the payment reference are kept for seven years (tax records). No health information is kept with it.
Clinical records of patients of the practice: adults, seven years after your last visit; children, until the patient turns 25.
When records are destroyed, we keep a note of the name, the period covered and the date.
You can ask to see your information, or to have it corrected, at any time. Contact the Practice Manager on 02 6686 2611 or at pm@moonstmedical.com.au, or write to us at the address above. We will respond within 30 days.
[PLACEHOLDER — wording for approval]
[Choose one] There is no charge for a copy of your enquiry. / A reasonable charge for copying may apply to clinical records and will be quoted first.
In a small number of situations the law allows us to refuse, and if that happens we will explain why in writing.
[PLACEHOLDER — wording for approval]
Please tell the Practice Manager first, using the contact details above. We will acknowledge your complaint within [5 business days] and respond within 30 days.
If you are not satisfied, you can contact:
the Office of the Australian Information Commissioner, at oaic.gov.au or on 1300 363 992
the Information and Privacy Commission NSW, at ipc.nsw.gov.au or on 1800 472 679
the Health Care Complaints Commission, at hccc.nsw.gov.au or on 1800 043 159, for concerns about your care.
We review this policy every year and whenever our systems change. The version number and date are at the top.