Privacy Policy

About this policy

Specialist Sports Medicine (operated by Specialist Sport and Exercise Medicine Network Pty Ltd, ABN 77 696 596 175) is committed to protecting the privacy and confidentiality of all personal and health information we collect. This policy explains how we collect, use, store and disclose personal information, and your rights in relation to that information.

We are bound by the Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs). This policy applies to all patients, prospective patients, referrers, and other individuals whose information we hold. It applies equally to both of our clinics: Noosa Specialist Sports Medicine, at Noosa Civic MediHub, and Maroochydore Specialist Sports Medicine, at Maroochy Private Hospital.

1. Information we collect

Personal information

We collect personal information including name, date of birth, address, contact details, Medicare details, and emergency contacts.

Health information

We collect health and sensitive information including medical history, current conditions, medications, investigation results, imaging and pathology reports, clinical notes, treatment plans, and correspondence with other treating practitioners.

How we collect it

• Directly from you at the time of booking or during your consultation. Reception and booking services for both clinics are provided by staff at Sunshine Coast Orthopaedic Group, who access our systems under their own login credentials and are bound by the same confidentiality obligations as our own staff. Your information is entered directly into our practice management system and is not held in any separate Sunshine Coast Orthopaedic Group system.
• From referral letters sent by your GP or other treating practitioners.
• From other health providers involved in your care (with your consent where required).
• From Medicare and health fund systems during billing.
• Via electronic intake forms, which we request through Consentic (consentic.com) and which integrate with our Gentu practice management system; forms may also be completed on paper. From 1 July 2026, these include an assignment-of-benefit consent form, completed through Consentic, which records your consent for the Medicare benefit for eligible services to be claimed and paid directly to the practice.
• Via SMS, where we send you appointment confirmations, reminders and links to your intake and consent forms. See section 8.
• Via telehealth platforms when consultations are conducted remotely.
• Via the contact form on our website, for non-booking enquiries only (see section 7).

2. Why we collect and use your information

Your information is collected and used to:

• Provide medical assessment, treatment and management.
• Communicate with other practitioners involved in your care.
• Process Medicare billing.
• Meet legal and regulatory obligations including mandatory reporting requirements.
• Respond to complaints, legal claims or regulatory enquiries where relevant.
• Conduct quality improvement and clinical audit activities (using de-identified data where practicable).

3. Disclosure of your information

We will not disclose your personal or health information to a third party without your consent, except where required or permitted by law. Circumstances where we may disclose without consent include a serious and imminent threat to health or safety, a court order or legal obligation, mandatory reporting requirements, or Medicare and insurer billing.

We share information with other members of your treating team as part of your ongoing care. You may request that we do not share your information with particular practitioners.

Reception and booking services. Reception and booking for our clinics is provided by staff at Sunshine Coast Orthopaedic Group. Their staff access our practice management and email systems under their own login credentials, and are bound by the same confidentiality and privacy obligations that apply to our own staff. Our systems are entirely separate from those of Sunshine Coast Orthopaedic Group. Your information is held in our records and is not transferred into any Sunshine Coast Orthopaedic Group system.

Insurer-funded appointments. For appointments funded by WorkCover Queensland or another insurer, we disclose information required under the relevant scheme rules. This includes notification of non-attendance where the scheme requires it.

4. Storage and security

Your clinical records are stored in Gentu, a cloud-based practice management system operated by Magentus Pty Ltd, on Australian servers. We take reasonable steps to protect personal information from misuse, loss, and unauthorised access through password-protected systems, role-based access controls, encrypted data transmission, and secure messaging via Medical Objects.

Retention. We keep your clinical records for the periods required by law and our professional obligations. In Queensland this is generally at least seven years from the date of your last attendance for an adult, and, for a patient who was a child at the time of treatment, until they reach 25 years of age. When records are no longer required to be kept, they are securely destroyed or de-identified.

5. Telehealth consultations

We offer telehealth consultations via video or telephone using platforms that comply with Australian privacy obligations. The same documentation and confidentiality standards apply as for in-person consultations.

6. AI-assisted clinical note-taking (Heidi Health)

Heidi Health processes audio from your consultation to generate a draft clinical note. The treating clinician reviews and edits the note before it is saved to your medical record.

Topic	Detail
Audio retention	According to Heidi Health, audio is deleted once the note is generated and is not retained.
Server location	Heidi Health states that clinical note data is encrypted in transit and at rest and stored on servers in Australia, and that some processing may occur on overseas services where necessary for performance, using pseudonymised data. Heidi Health states that it holds ISO 27001 and SOC 2 Type II security certification.
Secondary use	Heidi Health advises that de-identified data may be used to improve the tool, and that no identifiable health information is sold or otherwise disclosed to third parties for their own purposes.
Your rights	You may decline the use of Heidi Health at any time. Let your clinician or reception know before or during your consultation. Your care is not affected.

From December 2026, the Privacy Act will require practices to disclose details of personal information used in automated processes. This policy will be updated at that time.

For a plain-language explanation of how Heidi Health is used in consultations, see How We Use AI.

7. Website: contact form, cookies and analytics

The contact form on our website lets you send a non-clinical message to the clinic. Bookings are not made via the form (phone bookings only). If you choose to use the form, the following applies.

What is collected

• The name, email address, and (optionally) phone number you provide.
• The topic you select (general enquiry, referrer enquiry, privacy or records request, feedback, media, careers, or other).
• The text of your message.
• Basic technical information automatically captured by the form provider for spam protection (such as IP address and timestamp).

How it is processed

Form submissions are processed by Web3Forms, a third-party form-handling service operated by Web3Forms LLC. Web3Forms receives your submission, and forwards the message by email to enquiries at ssem.com.au. The website itself does not store form submissions in any database.

Topic	Detail
Server location	Web3Forms processes data on servers located outside Australia (United States). See web3forms.com/privacy for their full privacy commitments.
Retention	Submissions are held briefly by Web3Forms to enable email delivery. The clinic's copy is retained in our email system in line with general business correspondence retention.
Spam protection	Automated spam protection (hCaptcha, operated by Intuition Machines, Inc.) is not currently active on our form. We may reinstate it. If we do, it will process minimal technical data for the sole purpose of detecting automated submissions, and that processing may occur outside Australia.
What we do with the message	Form submissions are read by clinic administrative staff and replied to where appropriate. Where a message contains health information despite the warning above, the message is treated with the same confidentiality as other patient communications and managed under this policy.

If you would prefer not to use the form, you may contact the clinic by phone on (07) 5415 0428 or in person.

Cookies, local storage and website analytics

Our website uses a small amount of browser local storage to remember your choices (for example, dismissing a notice, or your cookie-consent selection). This is essential to the website working as expected and does not track you.

We do not currently run website analytics or advertising cookies. If analytics is introduced in future (for example, Google Analytics), it will load only after you accept analytics via the cookie-consent banner. You may decline, and you may change your choice at any time via the "Cookie settings" link; declining does not affect your care or your use of the website. Where analytics data is processed overseas, section 9 applies.

8. SMS and electronic communications

We use SMS to communicate with you about your appointment. This includes booking confirmations, appointment reminders, and links to the electronic intake and consent forms you need to complete before your visit.

We do not use SMS for marketing. You will not receive promotional messages, service advertising or newsletters from us by text.

Our SMS system cannot receive replies. If you would prefer not to receive text messages from us, please phone reception on (07) 5415 0428 and we will disable them on your file. We will then contact you about your appointment by phone or email instead.

We also send some communications by email, including consent form links and correspondence. Email is not a fully secure medium. If you would prefer we did not contact you by email, please let us know.

9. Overseas disclosure

Some technology systems we use may store or process data on servers outside Australia. This includes Heidi Health (AI-assisted clinical notes, see section 6) and Web3Forms (website contact form, see section 7). If automated spam protection is reinstated on our contact form, that provider may also process limited technical data overseas, as described in section 7. Where personal information is disclosed overseas, we take reasonable steps to ensure it is handled in accordance with the Australian Privacy Principles, or we obtain your consent.

10. Accessing and correcting your information

You have the right to access personal information we hold about you and to request corrections where information is inaccurate or incomplete. Contact us using the privacy contact details in section 12, or in writing. We will respond within 30 days. A reasonable fee may apply for record retrieval.

11. Data breaches

We are subject to the Notifiable Data Breaches scheme under the Privacy Act. If a data breach is likely to cause serious harm, we will notify you and the OAIC as soon as practicable. To report a suspected privacy issue, contact us using the privacy contact details in section 12.

12. Privacy complaints

If you have a concern about how we have handled your personal information, please contact us first:

We aim to respond within 30 days. If you are unsatisfied, you may contact the Office of the Australian Information Commissioner (OAIC):

• Web: oaic.gov.au
• Phone: 1300 363 992
• Post: GPO Box 5218, Sydney NSW 2001

13. Changes to this policy

This policy is reviewed annually and updated when practices, technology or obligations change. The current version is available at reception and on our website. Next review: May 2027.

Update history

• Version 1.3 (30 July 2026): updated the privacy contact email; replaced visible email addresses sitewide on this page with links to the website enquiry form; added a new section 8 (SMS and electronic communications); added Sunshine Coast Orthopaedic Group reception-access detail to sections 1 and 3; added a WorkCover/insurer-funded-appointments disclosure note to section 3; corrected section 7 to reflect that hCaptcha spam protection is not currently active on the contact form; added the Maroochydore clinic to the "About this policy" scope and the section 12 privacy-complaints contact.
• Version 1.2 (7 July 2026): named the Consentic assignment-of-benefit consent form (from 1 July 2026) in section 1; added a cookies, local storage and website analytics subsection to section 7.
• Version 1.1 (9 May 2026): added section 7 covering the website contact form, including Web3Forms processing and overseas disclosure. Web3Forms reference added to the section then numbered 8, Overseas disclosure (now section 9). Reception bullet added to section 1 (How we collect it).
• Version 1.0 (May 2026): initial publication.

---

Version 1.3 · July 2026 · last updated 30 July 2026 · Specialist Sport and Exercise Medicine Network Pty Ltd ABN 77 696 596 175 · Next review: May 2027