1. Who this policy covers
This policy concerns the surgical practice of Professor Charles Mosse and its website. It is intended to explain privacy practices in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles and other applicable health-records requirements. The legal name of the practice entity responsible for personal information, and any distinct responsibilities of hospitals or third-party clinics, will be identified when the policy is finalised.
2. Information that may be collected
Depending on your interaction with the practice, information may include your name, date of birth, contact details, Medicare/private-health-fund and billing details; referral correspondence; medical and surgical history; medicines, allergies, diagnostic results, imaging, appointment details, clinical notes and care-related communications. Website use may also produce enquiry contents and technical records such as IP addresses, browser information, logs and cookie-related data depending on the website services enabled.
3. How information is collected
Information may be supplied by you, a representative you authorise, a referring doctor, hospitals, diagnostic services, other treating practitioners and administrative or technical systems involved in delivering care or managing the practice. Where lawful and practicable, you may enquire anonymously, although sufficient identification is generally needed for appointments, referrals and healthcare.
4. Purposes of collection, use and disclosure
Information is used where lawful and appropriate to respond to enquiries; arrange consultations and procedures; provide medical care; coordinate referrals, investigations and multidisciplinary care; issue invoices and process payments; maintain records; meet regulatory and legal obligations; manage quality and safety; and administer the practice and website. Separate permissions or legal grounds will be used where required for uses such as research, teaching, direct marketing or publication of clinical materials.
5. Sharing with others
As permitted or required by law, relevant information may be shared with treating doctors and hospitals, pathology and imaging providers, allied health professionals, insurers, Medicare and other health or administrative services involved in care and billing, as well as service providers engaged to support secure administration and records management. Disclosures for other purposes will depend on consent or another lawful basis. Hospitals and other independently operated services may have their own privacy policies.
6. Storage, security and access controls
Reasonable administrative, physical and technical safeguards appropriate to the sensitivity of personal and health information are intended to protect it against misuse, interference, loss, unauthorised access, modification and disclosure. Depending on the systems confirmed as used by the practice, these may include access restrictions, staff confidentiality and training, authentication, protected records storage and service-provider controls. No internet transmission or storage system can be guaranteed completely risk-free. The public policy does not disclose confidential technical configurations or imply a security certification that has not been verified.
7. Website forms, cookies and external services
Information entered into website forms may be processed by the website platform and by configured notification, email or scheduling providers. The website may use necessary cookies and, if enabled, analytics or other third-party technologies. Before final publication, the practice will identify its actual website form destinations, analytics/cookie services, retention arrangements and any relevant consent or notification requirements. Avoid sending urgent or sensitive medical information through general website contact facilities unless the practice has specifically authorised that channel.
8. Overseas disclosures
Some software, website hosting or service providers may process or store information outside Australia. The practice will confirm whether it is likely to disclose personal information to overseas recipients and, if so, identify the relevant countries where practicable, as required by applicable privacy law. This draft makes no unverified claim that all information remains within Australia.
9. Retention and disposal
Medical and administrative records are retained for periods required by applicable professional, privacy and health-records laws, and legitimate clinical and legal needs. When personal information is no longer required and lawful retention obligations have ended, reasonable steps are taken to destroy it securely or de-identify it as applicable. Actual clinical records retention schedules must be confirmed for the practice and relevant jurisdiction.
10. Access and correction
You may request access to personal information held about you and ask for inaccurate or incomplete information to be corrected. Requests can be made using the practice contact details once the privacy contact is identified. Identity verification may be required, and any refusal or access restriction will be explained to the extent required by law.
11. Privacy enquiries and complaints
If you have a privacy concern, please contact the designated practice privacy officer through the practice contact arrangements. The practice will consider and respond to privacy complaints in accordance with applicable law. If a concern cannot be resolved, you may be able to complain to the Office of the Australian Information Commissioner at oaic.gov.au or another relevant authority.
12. Data breaches
Suspected or confirmed privacy and security incidents are assessed and managed according to applicable legal obligations. Where the Notifiable Data Breaches scheme requires notification of an eligible data breach, affected individuals and the OAIC will be notified as legally required. The practice should maintain a separate internal incident response plan; detailed operational procedures are not published here.
13. Automated decisions, AI and future changes
If the practice uses automated systems or artificial intelligence to process personal information in ways that trigger specific transparency obligations, this policy will describe those activities and any significant automated decisions as required by applicable law, including relevant changes commencing in December 2026. This policy is reviewed when practices or legal obligations change.
See also the Medical Disclaimer & Website Terms of Use.