1. Who we are and how to contact us
Lynne’s Nutritional and Western Herbal Medicine Clinic, ABN 36200887735, provides private nutritional medicine and Western herbal medicine services in Gosford, NSW and online.
Privacy enquiries, access or correction requests and privacy complaints may be directed to Lynne at lynneb2011@gmail.com, by telephone on 0483 284 085, or by post to PO Box 6182, West Gosford NSW 2250.
2. Our privacy obligations
The clinic handles personal information and health information in accordance with the Privacy Act 1988, the Australian Privacy Principles, the Health Records and Information Privacy Act 2002 NSW and the applicable Health Privacy Principles. The clinic also follows relevant professional, record keeping and consumer obligations.
3. Information we may collect
Depending on how you interact with the clinic, we may collect your name, date of birth, contact details, emergency contact details, appointment information, payment and transaction information, consent records and correspondence.
When providing a health service, we may collect health history, current concerns, symptoms, allergies, food and lifestyle information, prescribed medicines, nutritional medicines, Western herbal medicines, pathology reports or results, relevant correspondence from other health professionals, consultation notes, recommendations and follow up information.
Website hosting, booking and payment providers may process technical information such as Internet Protocol address, browser and device details, activity and cookie preferences, depending on the service used. Square booking or customer profiles may contain administrative contact, appointment and payment details. The clinic does not use these profiles for clinical notes.
4. Why we collect and use information
We collect and use information where reasonably necessary to respond to enquiries, arrange appointments, assess whether our services are suitable, provide safe and individualised care, prepare and review recommendations, communicate with you, manage payments, rebates and clinic administration, maintain records, meet legal and professional obligations, improve clinic operations, protect security and respond to complaints or incidents.
With your authority, relevant information may also be used to communicate and collaborate with your medical, pharmacy or allied health professionals.
5. How information is collected
Information is usually collected directly from you during enquiries, booking, consultations, approved forms, telephone conversations and documents you provide. With your consent, or where otherwise permitted by law, information may also be collected from an authorised representative, medical practitioner, pharmacist, allied health professional, pathology provider or another relevant person or organisation.
Where lawful and practicable, you may make a general enquiry without identifying yourself or by using a pseudonym. Your identity and sufficient relevant information will normally be required before the clinic can accept a booking, provide an individual health service or issue a receipt or invoice.
6. Website, booking and clinical records
This website is hosted through ChatGPT Sites. It does not collect appointment payments itself. Its appointment buttons open the clinic’s separate Square booking page, where bookings and deposits are processed.
The clinic uses Square Appointments for scheduling and Square Payments for consultation payments. Square booking tools should be used only for administrative information needed to arrange and pay for an appointment, such as your name, contact details, selected service, appointment time and payment status. Even the service selected may reveal something about your health interests, so information supplied should be kept to the minimum needed.
Please do not enter detailed health history, medication lists, diagnoses, pathology reports or results, medical images or other sensitive clinical documents into a Square booking form, customer profile or message, website contact form or ordinary email. If this information is required, the clinic will provide separate instructions for supplying it. Do not send full payment-card details through these channels.
The website, Square customer profiles and Square Appointments are not the clinic’s clinical record system. Detailed clinical notes and documents are kept separately from the public website under clinic controlled record keeping procedures. Online clinical intake, clinical messaging or document uploads will not be introduced until the clinic has approved a suitable secure clinical system. This policy will be updated before any such system is introduced.
7. Disclosure of information
Information may be disclosed where reasonably necessary to organisations that support clinic operations, including Square AU Pty Ltd and its service providers for appointment administration and payments, OpenAI and its service providers for website hosting, Google for current email services, and providers of accounting, secure information technology, insurance, legal or professional advisory services. Square confirmations, reminders or other administrative functions will be used only as enabled and checked by the clinic.
Relevant information may also be disclosed to your healthcare professionals with your consent, to a person you authorise, to prevent or address a serious threat where permitted by law, or to courts, regulators, insurers or other parties where disclosure is required or authorised by law.
The clinic does not sell personal information. It does not sell identifiable or de identified client health information or provide client health information for unrelated advertising. This describes the clinic’s practices; Square’s separate handling of booking and transaction data is explained in its Buyer Privacy Notice, including its own analytics and advertising arrangements.
8. Overseas processing
Square’s Buyer Privacy Notice identifies possible overseas processing or storage in the United States, Canada, Japan, Ireland, France, Spain, the United Kingdom and other countries. Using Square for bookings or payments does not mean that information stays exclusively in Australia.
Website hosting through ChatGPT Sites may involve processing in the United States and other countries where OpenAI, its partners or service providers operate. Clinical records must not be uploaded to this website.
The clinic currently uses Gmail provided by Google for general email communication. Google operates global systems, so email information may be processed on servers outside Australia. Detailed clinical information should not be sent through ordinary email.
The clinic takes reasonable steps to select and review service providers and to manage overseas handling in accordance with applicable Australian privacy laws. Provider locations may change. Current information is available in the Square Buyer Privacy Notice, OpenAI Privacy Policy and Google Privacy Policy.
9. Security
The clinic uses reasonable physical, administrative and technical safeguards appropriate to the sensitivity of the information held. Depending on the information and system, safeguards may include restricted access, strong passwords, two factor authentication, protected devices, secure storage, backups and procedures for handling records and responding to incidents.
Access is limited to people who need the information for authorised clinic duties or services. No electronic system, storage method or transmission method can be guaranteed to be completely secure.
The current Gmail address is intended for general enquiries and administrative communication. Ordinary email and SMS should not be used for detailed or urgent health information. Website messages and email are not monitored continuously. For urgent or life threatening concerns, call 000 or attend the nearest emergency department.
10. Retention and disposal
Health information collected when a client is an adult is generally retained for at least seven years from the last occasion on which the clinic provided a health service. If health information is collected when a person is under 18, it is generally retained until that person reaches 25. Information may be retained longer where required by law, professional obligations, insurance requirements or a current or anticipated legal matter.
Website enquiries, booking information, payment information and administrative records are retained only for as long as reasonably required for the purpose for which they were collected and any applicable legal, accounting, security or dispute requirements. Information that is no longer required is securely destroyed or de identified where lawful and practicable.
11. Access and correction
You may ask for access to personal or health information held about you, or ask for information to be corrected if it is inaccurate, out of date, incomplete, irrelevant or misleading. Please contact the clinic using the details in section 1. We may need to verify your identity before responding.
Access may be subject to lawful exceptions and a reasonable fee may apply where permitted. If a request is refused in whole or in part, the clinic will explain the reason and available complaint options where required.
12. Cookies, analytics and marketing
The website hosting service may use cookies or similar technologies for operation and security. The clinic has not added third-party analytics, advertising pixels, a public blog comment form or an embedded Square booking or payment widget to this website.
Square’s separate booking and payment pages may use cookies and similar technologies under its Buyer Privacy Notice. That notice also describes Square’s own advertising and transaction-data uses and related choices; see Square’s personalised-advertising information. The clinic’s decision not to add advertising pixels does not disable Square’s independent platform practices.
If the clinic adds analytics, customer accounts or other optional website features, it will review the data collected and update this policy as needed. Browser settings may restrict cookies, although some booking or payment functions on Square’s separate pages may then be affected.
Marketing communications will be sent only where permitted and where the required consent has been obtained. You may unsubscribe at any time by using the unsubscribe function in the communication or by contacting the clinic. Appointment confirmations, reminders, receipts and service messages are administrative communications and are not promotional marketing.
Administrative receipts and notifications should contain only the information needed for the appointment or transaction, not detailed clinical findings, health histories, medicine lists or treatment discussions. Marketing consent must not be assumed from payment or booking alone.
13. Data breaches
The clinic will investigate suspected loss, unauthorised access or disclosure of personal information and take appropriate steps to contain and assess the incident. Affected individuals, the Office of the Australian Information Commissioner and any other relevant regulator will be notified where required by applicable data breach laws.
14. Privacy complaints
Please contact the clinic first so that we can investigate and respond to your concern. The clinic aims to acknowledge privacy complaints promptly and provide a written response within a reasonable period.
If you are not satisfied with the response, you may contact the Office of the Australian Information Commissioner or the Information and Privacy Commission NSW.
15. Changes to this policy
The clinic may update this policy when its services, legal obligations, website features, booking arrangements, payment provider, email provider, analytics tools or clinical record systems change. The current version and effective date will be published on this page.