Affirm Medical (Lillach Pty Ltd) Privacy Policy

This Privacy Policy outlines how your personal information is collected, used, and protected by.

Please read this policy carefully to understand how we handle your data.

We are committed to keeping your information safe and secure and only use it for healthcare, administration and billing purposes. We will never sell or trade your information.

Privacy Policy:

1. Retention of Medical Records:

• Medical records may be retained for up to 7 years in compliance with legal and regulatory standards.

• Personal Information: We collect your name, contact details, and relevant medical history.
• We may also collect your Personally Identifiable Information including Medicare Number and details, Immunisation History and Registry details.
• We collect personal information directly from you when you register as a new patient, when you make an appointment, during consultations, and when you communicate with us via phone, email, our website or third party booking systems.

3.  How We Use Your Information:

• Collection purpose: Your personal and medical information is used to provide health care.  
• Specifically, we collect information to maintain and update your medical records, to communicate with you about your healthcare, for payment purposes and to comply with our legal obligations, such as reporting to government registries.
• Appointment Management: Information is used for scheduling and managing appointments via our website and booking portal.
• Communication: We may contact you for appointment reminders, follow-ups, or to provide important information.
• All employees of Lillach Pty Ltd are required to observe the obligations of confidentiality in the course of their employment
• Website and Booking Portal:
  • Data Security: We employ industry-standard measures to secure your data on our website and booking portal.
  • Where appointments are booked by third-parties, we cannot guarantee the same levels of protection on their systems.
  • Cookies: We may use cookies for a better user experience. Refer to our Cookie Policy for details.
• Payment information: we do not store bank, credit or debit card information. Our payments processors may retain transaction details as per their privacy policies. Our payments processors are Tyro Health, Medicare, and Square.

4. Medical Records Software:

• Secure Storage: Your medical records are stored securely within Australia.
• Access Control: Access to medical records is restricted to authorised personnel only.
• We take reasonable steps to protect your personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure, in line with the RACGP's Computer and Information Security Standards.
• Remote access to medical records systems will be over secured VPN using Modern Cryptography.

5. Marketing and Other Contacts

• Non-medical data including Internet Protocols, contact data, scheduling and emails are recorded in email, Customer Relationship Management (CRM) and Marketing software systems hosted in Australian and/or European data centres. Some data transfers and processing may be completed at various global locations as per industry norms for internet traffic. 
• These are kept completely separate to all patient health data.
• Patient health information should not be sent by insecure methods such as email.

6. Access Permissions:

• Default permissions grant practising medical staff and senior administration staff access to patient records for treatment purposes.

7. Sharing Restrictions:

• Patient records will not be shared without permission except where to lessen or prevent a serious threat to a patient's life, health or safety, or public health or safety.
• Patients may request medical records be transferred to another practice
• Patient data may be shared with specialists or other facilitators of Care Plans as discussed with patients.
• Records may be shared with third parties who work with our practice for business purposes, such as accreditation agencies or information technology providers.
• There may also be occasions where disclosure is required for purposes like medicolegal matters, audits by government agencies (e.g., Medicare), or to our medical insurance or legal defence teams.
• We may also disclose your information without your consent when required or authorised by law, such as in response to a subpoena or to report a notifiable disease."
• These are regulated under The Commonwealth's Privacy Act (1988). 

8. Disclosure of Information:

• Except with permission in relation to Section 6 above, we do not sell, trade, or otherwise transfer your information to outside parties without your consent, except as required by law.

9. Your Rights:

• Access to this and other relevant policies. Copies can be requested by emailing privacy@affirmmedical.com.au
• You have the right to access, correct, or de-identify your personal information, subject to legal requirements. Contact us for any privacy-related requests (privacy@affirmmedical.com.au).
• Individuals have the right to obtain their personal information in accordance with the Federal Privacy Act. Requests must be made in writing and an acknowledgement letter will be sent to the patient within 14 days confirming the request and detailing whether the request can be complied with, and an indication of any costs associated with providing the information. Administration and labour costs can be passed on to the requesting patient.
• Individuals may be asked to clarify the scope of the request
• We may deny access to your medical records in certain circumstances permitted by law, for example, if disclosure may cause a serious threat to your health or safety. We will always tell you why access is denied and the options you have to respond to our decision
• We will attempt to respond to written requests for access within a reasonable period (generally 20 business days).
• It is essential to verify the identity of the requesting person.
• We may not provide access if we reasonably believe:
  • it would unreasonably impact the privacy of another person
  • it might threaten the life, health or safety of another person or the public
  • other exceptions to providing access might also apply.
• Refusal to grant access will be communicated in writing with reasons and the process for lodging a complaint.

10. Updates to Privacy Policy:

• We may update this Privacy Policy periodically. Check our website for the latest version.

11. Office of the Australian Information Commissioner (OAIC)

• You may also contact the OAIC if you are not satisfied with our handling of Privacy matters. Generally, the OAIC will require you to give them time to respond before they will investigate. For further information visit www.oaic.gov.au or call the OAIC on 1300 363 992.

Superseding Legal Requirements

• All terms and provisions outlined in this agreement shall be subject to any current or future legal requirements, regulations, or laws. In the event of any conflict between the terms of this agreement and such legal obligations, the latter shall prevail

Consent:

• By using our services, you consent to the terms outlined in this Privacy Policy.
• If you have any questions or concerns about our Privacy Policy, please contact us. Thank you for entrusting us with your personal information.

updated 18/9/2025