Privacy Policy

We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Because we are a health service provider, all personal information we collect about you as a patient is treated as health information, which the Privacy Act classes as sensitive information and protects with additional safeguards.

1. The information we collect

• Identity and contact: name, date of birth, sex and gender, mobile, email, address, emergency contact.
• Medicare: Medicare card number, individual reference number and expiry (a current Medicare card is needed for the pathology we request).
• Health information: medical, surgical, medication, allergy, reproductive and family history; symptoms; lifestyle; body measurements and vital signs; health goals; pathology results and reports; our Doctor's notes, assessments and reports.
• Consent and signature: the consents you give, when you gave them, and your signature.
• Service information: appointment and order records, payment records (we do not store card numbers), and messages between you and us.
• Technical information: the device and browser used to complete our forms, and access logs kept for security.

2. How we collect it

Mostly directly from you: through the MEDLAB360 intake form (sent to you by a personal invitation link), during consultations, and when you contact us. With your consent we also receive information about you from pathology laboratories and other health providers involved in your care. We do not use your intake answers for advertising and we do not sell personal information.

3. Why we collect, hold, use and disclose it

• to assess your health, plan and conduct consultations, and provide advice, recommendations and reports;
• to request pathology on your behalf, and to receive, review and explain your results;
• to communicate with you about appointments, results, recalls and follow-up;
• to manage bookings, orders and payments;
• to keep the clinical records the law and our professional obligations require;
• to keep our systems secure and to investigate incidents;
• for any other purpose you consent to, or that the law requires or permits.

4. Who we disclose it to

• Pathology laboratories that perform the tests requested for you, and the secure clinical-messaging providers that deliver results to us.
• Other health providers involved in your care, with your consent or where permitted by law.
• Service providers that host our systems, deliver our email and SMS messages and process payments. They act on our instructions under contracts that limit their use of your information.
• Government agencies, courts and regulators where the law requires it.

5. Where your information is stored and how it is protected

Your intake and clinical records are stored in Google Firebase in the australia-southeast1 (Sydney) region, Australia. Information is encrypted in transit and at rest. Access is limited to our Doctor and authorised clinic staff. Access to patient records through our systems is logged.

Our email and SMS providers (United States) and our payment provider (United States and Ireland) handle limited contact and transaction details outside Australia. Your intake answers and your results are not sent to them. Some order and reminder notifications name the tests involved, and pathology request forms sent by email include the tests requested and your Medicare details. Where we disclose information overseas we take reasonable steps to ensure it is handled in accordance with the APPs.

6. How long we keep it

We keep clinical records for at least seven years from the last entry, and for patients under 18 until they turn 25, in line with professional record-keeping standards; after that we securely destroy or de-identify them. Draft intake answers that are never submitted are deleted automatically after the invitation expires.

7. Your rights: access and correction

You may ask us for access to the personal information we hold about you and ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading. Contact support@medlabglobal.com or 1800 007 008. We will respond within a reasonable time and will explain any reason we cannot give you access.

8. Anonymity

Because we provide clinical care and request pathology in your name, we cannot provide our services anonymously or under a pseudonym.

9. Data breaches

If we become aware of a data breach that is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

10. Direct marketing

We do not use your health information for marketing. If we send you service updates or health information by email you can opt out at any time using the unsubscribe link or by contacting us. Clinical recalls and results notifications are not marketing and will continue.

11. Complaints

If you believe we have breached the APPs, contact our privacy contact at support@medlabglobal.com or 1800 007 008. We will acknowledge your complaint promptly and aim to resolve it within 30 days. If you are not satisfied with our response you may complain to the Office of the Australian Information Commissioner at www.oaic.gov.au or 1300 363 992.

12. Changes to this policy

We may update this policy from time to time. The version you agreed to is recorded with your consent. The current version is always published at this address.