Privacy Policy
1. About this policy
CURA MD Pty Ltd (ABN 1234567890), trading as CURA ("CURA", "we", "us" or "our"), provides private physician and related health services in Australia.
We take privacy seriously because the information entrusted to a medical practice is often among the most personal information a person holds.
This Privacy Policy explains how CURA collects, holds, uses and discloses personal information, including health information, in connection with:
- the CURA website, including curamd.com.au and any associated Webflow domain;
- enquiries and expressions of interest;
- appointments and consultations;
- CURA membership;
- the CURA member portal and other digital services; and
- clinical care provided by CURA in Australia.
CURA is subject to the Privacy Act 1988 (Cth) and the Australian Privacy Principles. In Victoria, health information is also regulated by the Health Records Act 2001 (Vic) and the Health Privacy Principles.
Services provided in New Zealand may also be subject to New Zealand privacy and health-information requirements and may be covered by separate patient documentation.
2. Information we collect
The personal information we collect depends on your relationship with CURA. It may include:
- your name, date of birth and contact details;
- address, occupation and other identifying information;
- information submitted through our website or enquiry forms;
- appointment and membership information;
- correspondence with CURA;
- emergency-contact or nominated-representative details;
- Medicare or other healthcare identifiers where relevant to a particular service;
- billing and transaction information;
- information about your health, medical history, medications, investigations, diagnoses and treatment;
- sexual, reproductive, mental-health and lifestyle information;
- family medical history;
- genetic, pathology, imaging, biometric, wearable and other health data where clinically relevant;
- information received from other doctors, hospitals, laboratories, imaging providers and allied-health practitioners; and
- technical information associated with use of our website or digital services, such as IP address, device type, browser information, cookies and website activity.
Health information is sensitive information under Australian privacy law and receives additional protection.
3. How we collect information
We may collect information:
- directly from you;
- through our website, forms, telephone, email or member portal;
- during consultations and other clinical interactions;
- from a person you have authorised to communicate with us;
- from your current or former healthcare providers;
- from pathology, imaging and other diagnostic providers;
- from hospitals, specialists and allied-health practitioners involved in your care;
- from wearable devices or health platforms you choose to connect;
- from publicly available or legally permitted sources where appropriate; and
- through our technology and administrative service providers.
You do not need to provide more medical information through the general website enquiry form than is reasonably necessary to explain why you wish to speak with us. Detailed clinical information is preferably collected through our clinical systems once care is being arranged.
4. Why we collect and use information
We may collect, hold, use and disclose personal information where reasonably necessary to:
- respond to an enquiry;
- determine whether a CURA service may be appropriate;
- arrange and administer appointments;
- provide medical assessment, treatment and ongoing care;
- maintain an accurate clinical record;
- coordinate care with other healthcare professionals;
- arrange investigations, referrals and prescriptions;
- communicate results and follow-up requirements;
- operate CURA membership;
- provide access to member services and the member portal;
- process payments and maintain financial records;
- manage complaints, quality assurance and clinical governance;
- maintain security and prevent misuse of our systems;
- comply with professional, regulatory, insurance and legal obligations; and
- communicate with you about CURA where you have consented to receive such communications or where otherwise permitted by law.
We will not use health information for unrelated marketing simply because you are a patient or member.
5. Clinical confidentiality and disclosure
CURA does not sell patient information.
We may disclose relevant information where reasonably necessary to provide your care, including to:
- medical specialists;
- general practitioners;
- pathology and imaging providers;
- hospitals;
- pharmacists;
- allied-health professionals;
- other healthcare providers involved in your care; and
- providers assisting with care when you are travelling or living overseas.
We may also disclose information to organisations providing services to CURA, including:
- clinical-record and practice-management providers;
- secure communications and patient-portal providers;
- website and hosting providers;
- payment processors;
- information-technology and cybersecurity providers;
- accountants, lawyers, insurers and professional advisers; and
- contractors who require information to perform services for CURA.
These providers are given access only to information reasonably necessary for their function and are expected to handle it appropriately.
Information may also be disclosed where required or authorised by law, including in connection with mandatory reporting, court orders, regulatory requirements, serious threats to health or safety, or other circumstances recognised by applicable privacy or health law.
6. Digital systems and service providers
CURA uses third-party technology to operate parts of its website and clinical infrastructure.
Our present website is built using Webflow. Information submitted through the public website may therefore be processed outside Australia.
CURA seeks to use clinical systems that apply appropriate security controls for health information, including access controls, authentication and encryption where appropriate. Payment-card information may be entered directly into a payment provider rather than stored within CURA systems.
Where information is disclosed to an overseas recipient, CURA will take reasonable steps required by applicable Australian privacy law.
7. International care
CURA members may sometimes request assistance while travelling or residing outside Australia.
Where you ask us to coordinate with an overseas healthcare provider, we may disclose relevant clinical information to that provider with your authority or where otherwise permitted by law. Healthcare and privacy laws in another country may differ from Australian law.
8. Website cookies and analytics
Our website and its service providers may use cookies and similar technologies for functions such as:
- website operation and security;
- remembering preferences;
- understanding website traffic and performance; and
- improving website usability.
You can usually control cookies through your browser settings. Disabling some cookies may affect website functionality.
If CURA introduces additional analytics, advertising pixels or behavioural tracking technologies, this policy should be updated to identify them appropriately.
9. Payments
Payments may be processed through third-party payment providers. Where a payment provider receives card details directly, CURA does not ordinarily receive or store the complete payment-card number. We may retain information about the transaction, such as the amount, date, status and invoice details.
10. Direct communications and marketing
We may send administrative or clinical communications where necessary for your enquiry, appointment, membership or care.
Promotional communications will be sent only where permitted by law. You may unsubscribe from promotional communications at any time. Unsubscribing from marketing does not prevent CURA from sending necessary clinical or administrative communications.
11. Security
CURA takes reasonable administrative, physical and technical measures to protect personal and health information from misuse, interference, loss, unauthorised access, modification or disclosure.
Depending on the system concerned, these measures may include encryption, authentication, access controls, audit logging, secure hosting and restrictions on staff and contractor access.
No internet transmission or electronic system can be guaranteed to be completely secure.
12. Data breaches
If CURA becomes aware of a privacy or security incident, we will assess and respond to it in accordance with applicable law. Where a breach meets the requirements of the Notifiable Data Breaches scheme, affected individuals and the Office of the Australian Information Commissioner will be notified as required.
13. Retention of health records
Health information is retained for the period required by applicable law. For health records governed by Victorian law, adult patient records are generally retained for at least seven years after the last health service was provided. Different requirements apply to records created while a person was a child. Other legal, professional or clinical considerations may require information to be retained for longer.
14. Access and correction
You may ask to access personal or health information CURA holds about you or request that inaccurate information be corrected. Some limited exceptions apply under privacy and health-records legislation. Where permitted by law, reasonable charges may apply to providing access to health records.
Requests should be sent to:
Privacy Officer
CURA
Email
hello@curamd.com.au
Address
Osler House, 159 Wattletree Road, Malvern
Website
15. Privacy complaints
If you believe CURA has mishandled your personal or health information, please contact us first so we can investigate. We will acknowledge and consider privacy complaints promptly and aim to provide a substantive response within a reasonable period.
If you are dissatisfied with our response, you may have the right to complain to the Office of the Australian Information Commissioner and/or the Health Complaints Commissioner Victoria.
16. Changes to this policy
We may update this Privacy Policy where our services, technology or legal obligations change. The current version will be published on the CURA website with its effective date.