1. Introduction and purpose
Arc Specialist Care is a private specialist medical practice providing healthcare services across a range of medical specialties.
Medical practitioners consulting at Arc Specialist Care operate as independent practitioners, supported by a shared service entity that provides practice facilities, administrative support, information technology systems and other practice management services.
Arc Specialist Care Pty Ltd (ABN 11 702 909 742) is the service entity that provides administrative, facilities, information technology and practice management services to independent medical practitioners consulting at Arc Specialist Care. It is the entity contracting with Xestro for the shared practice system.
The medical practitioners currently consulting at Arc Specialist Care are:
- Dr Shaun McGrath – Gynaecologist and Gynaecological Oncologist
- Dr Jessica McGrath – Paediatric Rheumatologist
Each practitioner operates independently and is responsible for the clinical care they provide and their associated professional and privacy obligations.
This Privacy Policy applies to the handling of personal and health information by the service entity and the independent practitioners consulting at Arc Specialist Care, in connection with services provided through the practice.
In providing shared services, Arc Specialist Care Pty Ltd may collect, hold, access, use and disclose patient information where reasonably necessary for practice administration, information management and other lawful purposes. Both the service entity and individual practitioners are responsible for complying with applicable privacy obligations in relation to the personal and health information they handle. They are committed to protecting its privacy, confidentiality and security.
This policy explains how personal information is collected, held, used and disclosed in connection with services at Arc Specialist Care, and how patients can access information, seek correction or make complaints. Information is managed in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), and other applicable Commonwealth and Queensland laws.
2. What personal information do we collect?
We collect information reasonably necessary to provide healthcare and administer the practice, including:
- Personal and contact details: name, date of birth, address, telephone, email, emergency contacts and next of kin.
- Healthcare and identification details: Medicare, DVA, private health insurance and relevant identifiers.
- Clinical information: histories, medications, allergies, diagnoses, examinations, treatment plans and consultation notes.
- Specialist records: referrals, pathology and imaging, operative reports, hospital summaries and correspondence.
- Administrative and financial information: bookings, invoices, payment details and claiming information.
- Other information reasonably necessary for care, legal obligations or practice administration.
Health information is sensitive information under Australian privacy law and is handled with particular care.
3. How do we collect personal information?
We generally collect information directly from patients through registration forms, consultations, telephone and electronic communications, appointments and online services. We may also receive relevant information from referring practitioners, hospitals, pathology and imaging providers, allied health professionals, previous treating practices, Medicare, DVA and insurers, where authorised or permitted by law.
Patients may choose not to provide information, but this may limit appropriate care or administration. Anonymous or pseudonymous general enquiries are possible where lawful and practicable; identification is generally needed for clinical care and billing.
4. Why do we collect, use and disclose information?
We handle information to assess, diagnose, treat and monitor conditions; prepare clinical notes and correspondence; communicate with healthcare providers; arrange investigations, procedures, admissions and follow-up; coordinate care; manage appointments and reminders; process payments and claims; maintain records; improve service quality; and comply with professional and legal obligations.
Other uses and disclosures occur only where permitted by law or with appropriate consent. We do not sell patient information or use identifiable health information for unrelated commercial marketing without appropriate consent.
6. Electronic medical records and practice management — Xestro
Arc Specialist Care uses Xestro, a cloud-based practice management and electronic medical records system, for patient records, appointments, correspondence, billing and administration.
Xestro describes technical and organisational security measures including encryption of data in storage and during transmission, role-based access controls, two-factor authentication, device authentication, automated backups and security monitoring. These platform capabilities do not mean that records are technically segregated between practitioners at Arc Specialist Care.
Xestro reports that it maintains an independently certified Information Security Management System in accordance with ISO/IEC 27001 and undertakes regular security assessments, including external penetration testing.
Patient information stored within Xestro is hosted in Australia.
Medical practitioners consulting at Arc Specialist Care operate independently while using shared electronic medical records and practice management infrastructure. Patient records in the shared system are not technically segregated by practitioner. Authorised practitioners and administrative staff may therefore have technical access to records of patients whose care they do not personally provide.
Access is governed by professional confidentiality obligations, practice policies and applicable privacy legislation. Patient information must only be accessed, used or disclosed where reasonably necessary for clinical care, practice administration or another purpose permitted by law. Technical availability within the shared system does not, in itself, authorise access for unrelated purposes.
7. AI-assisted clinical documentation — Heidi Health
Some practitioners at Arc Specialist Care use Heidi Health, an Australian-developed AI-assisted clinical documentation platform, to assist with consultation notes and correspondence. Its use varies between practitioners and consultations; not all practitioners use it routinely.
Where used, Heidi may process consultation information to produce draft documentation, which is reviewed by the treating practitioner before inclusion in the medical record. Clinical decisions and responsibility for the accuracy of clinical documentation remain with the treating practitioner.
Heidi stores Australian customer data on Australian-based infrastructure, using Amazon Web Services (AWS) servers located in Sydney. Heidi employs technical and organisational security measures, including encryption, access controls, security monitoring and independent security assessments. Heidi reports ISO/IEC 27001 and ISO/IEC 42001 certifications and SOC 2 Type II attestation.
Consultation audio is generally deleted following processing unless a recording retention feature is enabled. Clinical notes and transcripts are retained in accordance with applicable account settings and retention arrangements.
Heidi states that patient consultation information from paid individual subscriptions is not used to train its AI models. While patient information is stored in Australia, some third-party service providers may process information overseas, subject to applicable privacy requirements and contractual safeguards.
Patients will be informed when Heidi is proposed for use during a consultation, and appropriate consent will be obtained before use. Patients may decline the use of Heidi without affecting their access to medical care.
8. Electronic communication and telehealth
We may use secure messaging and referrals, email, SMS, electronic prescriptions, electronic requests, telehealth and appointment reminders. We take reasonable security steps, but ordinary email and SMS can carry privacy risks. Patients may discuss communication preferences with reception.
9. Storage, security and retention
Arc Specialist Care takes reasonable steps to protect personal and health information against misuse, interference, loss and unauthorised access, modification or disclosure. Information may be held electronically or in paper form. Security measures include appropriate access permissions, authentication, secure communications, data backups, staff confidentiality obligations, training and oversight of third-party service providers.
Medical records are retained in accordance with applicable Australian legal and professional requirements. As a general policy, adult medical records are retained for at least seven years following the last entry, and records relating to children are retained until at least age 25 or seven years after the last entry, whichever is later. Records may be retained for longer where required for ongoing clinical care, legal, professional or medicolegal reasons.
When information is no longer required and there is no legal or professional obligation to retain it, records are securely destroyed or permanently de-identified in accordance with applicable privacy requirements.
If Arc Specialist Care changes its electronic medical records or practice management provider, the service entity and practitioners remain responsible for meeting their applicable record-retention obligations. Patient records will be securely transferred, retained or otherwise managed in accordance with applicable legal and professional requirements. Reasonable steps will be taken to protect the confidentiality, integrity and accessibility of records during the transition, including arranging appropriate export and retention before access to the former system ends.
Arc Specialist Care maintains procedures for identifying, containing, assessing and responding to suspected or confirmed data breaches. Where a breach meets the requirements of the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth), affected individuals and the Office of the Australian Information Commissioner will be notified as required by law.
10. Australian data hosting and overseas disclosure
Arc Specialist Care places particular importance on the secure storage and management of patient information within Australia. Our principal clinical information systems, Xestro and Heidi Health, provide Australian-based storage of patient information.
These systems may use third-party technology providers and subprocessors to support their operation, security, maintenance and delivery of services. Australian hosting does not mean that all processing, support or access occurs in Australia. Depending on the services and arrangements involved, patient information may be accessed or processed overseas and may be disclosed to overseas recipients.
Where personal information is disclosed to an overseas recipient, we take the steps required by Australian privacy law. Unless an exception under APP 8 applies, this includes taking reasonable steps before disclosure to ensure that the recipient does not breach the APPs (other than APP 1) in relation to the information. We consider the privacy and security arrangements of relevant providers, including contractual safeguards. We do not sell patient health information.
11. Third-party service providers
Arc Specialist Care engages external service providers to support the delivery and administration of healthcare services. These may include providers of electronic medical records, practice management software, secure messaging, prescribing, information technology, cloud infrastructure, AI-assisted documentation, payments, accounting, telehealth and communications.
These providers may engage their own technology partners or subprocessors to deliver their services. We take reasonable steps to assess relevant providers' privacy and security arrangements and to ensure that access to patient information is limited to what is reasonably necessary for the services and managed in accordance with applicable privacy requirements. Overseas handling is addressed in Section 10.
12. Accessing and correcting personal information
Patients may request access to their personal information, including medical records, subject to legal exceptions. Requests should be made using the contact details below. We may verify identity and will respond within a reasonable time. Any reasonable fee for providing access, where legally permitted, will be explained in advance. We do not charge for making an access request or for requesting or making a correction.
Patients may request correction of inaccurate, incomplete, out-of-date, irrelevant or misleading information. Where access or correction is refused, we explain the reasons where required and advise of available options, including association of a statement with the record.
13. Transfer of medical records
Patients may request transfer of records to another provider. We facilitate appropriate transfers in accordance with privacy law, professional duties and applicable authorisations. We may obtain records from prior practices where authorised or otherwise legally permitted. Records received are managed under this policy.
14. My Health Record
Where practitioners access or use My Health Record, they do so in accordance with applicable law, professional obligations and patient access settings. Further information is available from the Australian Digital Health Agency at www.digitalhealth.gov.au.
15. Research, quality improvement and education
De-identified information may be used where appropriate for audit, quality assurance, service evaluation or education. Identifiable information is used or disclosed for research, education or other secondary purposes only with consent or where otherwise permitted by law.
16. Website privacy
Our website may collect technical information such as IP address, browser, device and usage data for functionality, security and performance. Cookies, analytics and third-party services, if used, are subject to applicable privacy requirements. Information sent via online forms is used to respond to enquiries. Patients should avoid sending sensitive clinical details through general enquiry forms.
17. Privacy complaints and concerns
Questions and complaints can be directed to the Practice Manager/Privacy Officer by telephone, email or in writing. We will acknowledge and investigate complaints and aim to respond within 30 days, advising if more time is needed.
If dissatisfied, patients may contact the Office of the Australian Information Commissioner (OAIC): www.oaic.gov.au, 1300 363 992. For concerns relating to health services in Queensland, patients may also contact the Office of the Health Ombudsman: www.oho.qld.gov.au.
18. Changes to this policy
This policy may be updated to reflect changes in law, technology, services or operations. The current version will be available on our website or on request.
19. Contact details
- Practice
- Arc Specialist Care
- Legal entity
- Arc Specialist Care Pty Ltd
- Address
- PO Box 931, Fortitude Valley QLD 4006
- Telephone
- 07 3102 4068
- reception@arcspecialistcare.com.au
- Website
- www.arcspecialistcare.com.au
- Privacy contact
- reception@arcspecialistcare.com.au