Privacy Policy

RapidAccess Medical Infusions Privacy Policy

RapidAccess Medical Infusions respects your privacy. This policy explains how we collect, use, store and share personal information when you enquire about our services, book an appointment, complete a pre-treatment assessment, receive a prescribed infusion or injection, refer a patient, or use our website. It applies to patients, referring practitioners, carers and other people who contact us.

In this policy, “we”, “us” and “our” mean TopDoc Medical Group Pty Ltd (ACN 670 520 064), operating as RapidAccess Medical Infusions. The trading name does not change the identity of the legal entity responsible for your information. If a different entity provides your care at a particular clinic, its identity and applicable privacy information must be made clear when you book or register.

Our privacy obligations include the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). For health information handled in NSW, the Health Records and Information Privacy Act 2002 (NSW) and its Health Privacy Principles also apply. Other state or territory requirements may apply where care is provided elsewhere.

You can request a free copy of this policy, including assistance accessing it in another format, using the contact details below.

1. Information we collect

We collect information relevant to providing care and managing our services. Depending on your interaction with us, this can include:

• Your name, date of birth, address, phone number, email, communication preferences and identity details.
• Emergency contacts, next of kin, carers, guardians and authorised representatives.
• Health information such as your referral, prescription, relevant blood tests and other results, medical history, allergies, medicines, treatment suitability assessments, consent, infusion or injection records, observations, adverse reactions and communications about your care.
• Appointment details, enquiries, consent records, feedback, complaints and correspondence.
• Medicare, concession, insurance and billing details where relevant, together with payment status and transaction records.
• Technical information generated when you use online services, such as IP address, browser or device details and access logs.

We handle health information as sensitive information. Booking details may also reveal information about your health because they relate to a healthcare service. We use separate systems for booking contact details and medical forms, as explained in section 5.

2. How we collect information and your choices

We generally collect information directly from you, including through clinic visits, registration forms, booking tools, telephone conversations, email and messages. Where appropriate and lawful, we also obtain relevant information from your referring practitioner, pathology providers, other treating professionals or an authorised representative.

We collect health information with your consent where it is reasonably necessary for our services, unless the law permits or requires collection without consent. We provide relevant privacy information at or before collection where practicable. This policy is not blanket consent to every use or disclosure.

You may make a general enquiry anonymously or using a pseudonym where practical and lawful. For treatment, we usually need sufficient identifying and clinical information to assess suitability, provide safe care and maintain accurate records. If essential information is not provided, we may be unable to offer the requested service; we will explain why.

For children or people requiring decision-making support, we consider the person's capacity, wishes and the representative's authority. Being a relative or emergency contact does not automatically give someone access to a patient's records.

3. Why we use information

We use relevant information to assess your referral and treatment suitability, arrange your appointment, provide preparation instructions, coordinate prescribed medicines where this is part of your care, record consent, administer and monitor treatment, and arrange follow-up. We also use information to communicate with your referring practitioner and treating team, manage billing, respond to enquiries and maintain clinical and administrative records.

Information may also be needed to investigate incidents or complaints, meet legal and professional obligations, and undertake lawful quality and safety activities. For another purpose, we seek consent or rely on a specific legal permission. In particular, a secondary use of health information must meet the applicable consent or legal requirements; a general business interest is not enough.

Where research is proposed, any use of identifiable information requires consent or an applicable lawful exception and relevant safeguards. De-identification must be effective, not simply the removal of a name.

4. Who may receive information

Subject to consent and applicable law, relevant information may be shared with:

• Our nurses, clinicians and authorised staff involved in your care; your referring doctor and other treating practitioners; and pharmacies, pathology providers or emergency services where relevant. This may include confirming that treatment occurred, providing a treatment report or raising a clinical concern.
• A person you have authorised, or another representative entitled to receive information under the law.
• Providers supporting our clinical records, bookings, communications, IT, hosting, billing and administration, to the extent needed for those services.
• Professional advisers, insurers, regulators and government bodies where there is a lawful basis for disclosure, including a legal reporting requirement or court order.

Our policy is to limit disclosures to what is needed for the permitted purpose. We do not sell patient information. A change of business ownership does not itself remove privacy protections or authorise unrestricted transfer of clinical records.

5. Records, service providers and overseas handling

Our records can include electronic clinical and administrative records, submitted forms and documents, and paper records. Information entered into a form may also become part of your clinical record or be shared with your treating team. The location of a form provider’s servers does not, by itself, establish the location of every copy, backup or recipient.

Medical forms: Snapforms, hosted in Australia

We collect medical information through Snapforms, separately from our booking platform. Medical forms and documents you submit through Snapforms are stored on servers located in Australia. Snapforms describes its Australian hosting arrangements in its security and privacy information.

We do not use GoHighLevel to collect or store your medical forms, referrals, prescriptions or test results.

Booking contact details: GoHighLevel

We use GoHighLevel (HighLevel) for the contact details you provide when booking: your name, email address and phone number. These details help us manage your booking and contact you about your appointment.

These booking contact details may be stored or processed overseas, including through technical support. HighLevel's published subprocessor list identifies:

• United States: core cloud storage and other platform services, including communications.
• India: HighLevel services and support through its affiliate.

These locations relate to HighLevel’s published service-provider arrangements for booking and communication information. Other clinical, email, messaging and administrative providers may handle information separately. The relevant provider arrangements and any overseas handling must be considered for each service; Australian form hosting does not mean all clinic information stays in Australia.

We remain responsible for meeting our Australian privacy obligations when using service providers, including the reasonable steps required by APP 8 for overseas disclosures unless a lawful exception applies. NSW health-information transfers must also meet HPP 14 where applicable. Using our booking service does not waive your privacy rights. Please contact us if you have questions about where your information is handled.

6. Appointment messages and marketing

We may contact you about an enquiry, booking, preparation, payment or follow-up using the contact details you provide. Tell us if a channel is not private or suitable, for example a shared phone or email account. We can discuss available alternatives.

Optional marketing is separate from messages needed to administer your care. Our policy is to obtain an opt-in before sending promotional email or SMS, and not to use sensitive health information for direct marketing without your consent. Choosing not to receive marketing does not affect your access to treatment.

You can unsubscribe using the instructions in a marketing message or by contacting us. We will action electronic marketing unsubscribe requests within five working days. An unsubscribe from marketing does not automatically stop essential appointment communications; contact us to discuss those preferences.

7. Automation, AI and recordings

Booking and communication software can support automated reminders and administrative workflows. Availability of an AI feature in a platform does not mean that we use it for your care.

Before introducing call recording, transcription or an AI tool that handles your personal information, we will explain its purpose, relevant information handling and available alternatives, and obtain consent where required. A website privacy policy alone is not a substitute for notice at the start of a recorded call or consultation.

If a computer system is used to make or substantially assist a decision that could significantly affect your access to care or other rights or interests, we will provide the disclosures required by applicable law. You may ask the clinic to explain an automated interaction and request staff assistance.

8. Website, cookies and third-party services

Our website and online services may generate technical logs and use cookies or similar technologies for functionality and security. Embedded booking, map or other third-party services may receive technical information when loaded. If you choose to use a map’s location feature, your browser may request permission to use your location. Such information is not necessarily anonymous, particularly if it can be linked to you or a device.

We also count page views without asking visitors to opt in. This first-party counter stores only a daily total in our Cloudflare hosting account. It uses no cookies or visitor identifiers and does not store page addresses, search terms, referrers, IP addresses, form entries or patient information. These totals measure page loads, not unique people.

When you complete an online appointment booking under the booking permissions, we use Google Ads conversion tracking to measure which advertising led to that booking. We retain Google ad click identifiers in your browser tab for up to 24 hours and send a generic booking-completed signal to Google after the calendar confirms the booking. This uses Google advertising measurement cookies and technical information, but does not send your name, email address, phone number, treatment selection, referral or appointment details. Advertising personalisation, remarketing and enhanced conversions are disabled. Optional Google Analytics remains separate. Choosing Use necessary only in Manage analytics preferences also disables this website’s booking advertising measurement. Google may process information outside Australia.

With your permission, we use Google Analytics, delivered through Google Tag Manager, to measure website visits and whether the booking calendar is opened and whether a booking is completed. Analytics cookies and Google analytics requests are blocked until you choose Allow analytics. We send general page categories instead of treatment-page names, omit URL query strings and form contents, and do not send patient names, contact details, referrals or clinical documents. Google receives technical information such as browser and device information, an online identifier and IP address when analytics is enabled, and may process information outside Australia. We do not enable advertising personalisation or remarketing in this website setup. You can decline analytics without affecting booking, and use Manage analytics preferences in this section to change your preference. Our site remembers that preference for up to 180 days. Google’s privacy policy explains its handling of data. External websites have their own privacy practices.

9. Security and record retention

We are required to take reasonable technical and organisational steps to protect information from misuse, interference, loss and unauthorised access, alteration or disclosure. Our privacy standards include need-to-know access, staff confidentiality, appropriate account and device security, secure handling of paper records and review of service-provider arrangements. No online service can guarantee absolute security.

We retain records for clinical, legal and other permitted purposes. For NSW private health services, the minimum retention requirements include:

• Information collected when a patient was an adult: at least seven years from the last occasion on which a health service was provided.
• Information collected when a patient was under 18: until the patient reaches 25 years of age.

Other obligations or a legal hold may require longer retention. When information is no longer needed and retention is not required, we take reasonable steps to securely destroy or effectively de-identify it. Required disposal or transfer records must also be kept. You can ask about deletion, but there is no general right to require removal of records we must retain.

10. Access and correction

Contact our Privacy Officer or your clinic to request access to your information or correction of information you believe is inaccurate, incomplete, out of date, irrelevant or misleading. Please identify the information concerned and how you would like to receive it. We may need to verify your identity or a representative's authority.

We aim to respond within 30 calendar days, subject to applicable legal requirements. There is no fee to make an access request or to request a correction. A reasonable, non-excessive fee may apply to providing access; we will explain any proposed charge beforehand and discuss alternatives where appropriate.

If access or correction is refused on a lawful ground, we will explain the decision in writing, subject to legal restrictions, and tell you how to complain. Where appropriate, we will consider another way to provide access. If a correction is not made, you can ask us to associate a statement of disagreement with the record. You can also ask us to notify relevant recipients of a correction, as required by law.

11. Data breaches

If a suspected privacy or security incident occurs, we will assess it, take steps to contain it and reduce potential harm. Where the Notifiable Data Breaches scheme requires notification, we will notify the OAIC and affected individuals as soon as practicable and provide relevant protective advice. Please contact us promptly if you believe your information has been sent to the wrong person or otherwise compromised.

12. Contact and complaints

For privacy questions, access or correction requests, or complaints, contact:

• Privacy Officer, RapidAccess Medical Infusions
  TopDoc Medical Group Pty Ltd
• Email: [email protected]
• Phone: 1300 070 731 (ask for the Privacy Officer)
• Post: International Tower 3, Level 17/300 Barangaroo Avenue, Barangaroo NSW 2000

Please describe your concern and the outcome you are seeking. We will acknowledge it, investigate and aim to provide a response within 30 days. If more time is needed, we will explain the reason and expected timeframe.

If you are not satisfied with our response, or we have not responded, you can contact the Office of the Australian Information Commissioner (OAIC) on 1300 363 992. For NSW health privacy matters, you can also contact the Information and Privacy Commission NSW on 1800 472 679. Each regulator can explain its complaint process and applicable time limits.

13. Changes to this policy

We will review this policy when our services, systems or legal obligations change. The current approved version will be available on our website and on request. Material changes to how information is handled may also require a separate notice or fresh consent; updating this page alone does not authorise a new use of your information.