Privacy policy

About this policy

This policy explains how Umbrella Aged Care (“we”, “us”) collects, holds, uses and discloses personal information, including health information. It also explains how you can access or correct your information and how to make a privacy complaint.

We handle personal information in accordance with the Privacy Act 1988 (Cth), including the Australian Privacy Principles, and the Health Records and Information Privacy Act 2002 (NSW), including the Health Privacy Principles.

Umbrella Aged Care provides coordination and administrative support to independent general practitioners who care for residents of residential aged care homes. Clinical records for residents are kept in a shared clinical record system that we provide and that the doctors who practise with us use. Each doctor also has their own professional and legal obligations to protect patient privacy.

What information we collect

Depending on how you deal with us, we may collect:

• Residents: name, date of birth, contact and next-of-kin details, Medicare, DVA and concession numbers, the aged care home you live in, and health information such as your medical history, medicines, allergies, test results, care plans, advance care planning documents and notes of consultations and assessments.
• Family members, substitute decision-makers and representatives: name, relationship to the resident, contact details, and the authority you hold to act for the resident.
• Aged care home staff: name, role, work contact details and communications about residents’ care.
• Doctors, nurse practitioners and others applying to work with us: name, contact details, area, registration and qualifications, and the information you choose to give us.
• Website visitors who submit a form: the details entered in the form.

Health information is “sensitive information” under privacy law. We collect it only with consent or where the law otherwise allows, and only when it is reasonably necessary to provide health care.

How we collect it

Where practicable, we collect information directly from you. We also collect it from:

• the resident’s family, substitute decision-maker or representative, where the resident cannot provide it or has asked them to;
• the aged care home and its clinical staff;
• the resident’s previous GP, specialists, hospitals, pathology and imaging providers and other treating health professionals, for example when a medical record is transferred to us;
• My Health Record, where the resident has one and has not restricted access;
• forms submitted through this website, email and phone calls.

You can deal with us anonymously or using a pseudonym for general enquiries. For health care this is usually not practicable, because your doctor needs to identify you, keep an accurate record and claim Medicare benefits.

If we receive personal information we did not ask for, we will decide whether we could have collected it lawfully. If not, we will destroy or de-identify it where it is lawful and reasonable to do so.

Why we collect, use and disclose it

We use and disclose personal information for the purpose it was collected and for directly related purposes you would reasonably expect, including to:

• provide medical care to residents, including consultations, comprehensive assessments, care planning, medication reviews and follow-up;
• communicate with aged care home staff, families and representatives about a resident’s care;
• refer residents to, and share information with, other treating health professionals, hospitals, pathology and imaging providers;
• claim Medicare and DVA benefits and manage registration under government programs such as MyMedicare;
• meet our legal, professional, accreditation and quality-improvement obligations, including clinical audit and the handling of complaints and incidents;
• respond to enquiries, including enquiries from doctors and other clinicians interested in working with us.

We may also disclose information where the law requires or permits it, for example to lessen or prevent a serious threat to someone’s life, health or safety, to comply with a court order or mandatory reporting obligation, or to our insurers and legal advisers in connection with a claim.

We do not sell personal information. We do not use health information for marketing.

How we store and protect it

Clinical records are kept in electronic form in Best Practice clinical software. Paper documents are scanned into the record where practical and then stored securely or destroyed.

We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. These steps include access limited to people who need it for their role, individual logins and passwords, secure storage of devices and documents, and confidentiality obligations for everyone who works with us.

We keep health records for at least seven years from the last occasion of service for an adult, as required by NSW law, or longer where another law or a legal matter requires it. When information is no longer needed, we destroy or de-identify it securely.

Service providers and disclosure outside Australia

We use third-party service providers to run our clinical software, website, email and other systems. They may hold personal information on our behalf, and we require them to protect it.

This website is hosted by Netlify, a provider based in the United States. Information you submit through a form on this website is stored by Netlify and may be held outside Australia, including in the United States. Some of our other service providers, including email services, may also store information outside Australia. If you would rather not send information this way, please phone us instead.

We do not otherwise disclose personal information to recipients outside Australia unless you have consented or the law permits it.

This website

This website does not use advertising or analytics cookies, and it does not track you across other websites. Like most websites, our host’s servers record technical information such as your IP address, browser type and the pages requested, which is used to operate and secure the site.

Please do not use the website forms or email for urgent clinical matters. In an emergency, call 000.

Accessing and correcting your information

You can ask for access to the personal information we hold about you, and ask us to correct information you believe is inaccurate, out of date, incomplete, irrelevant or misleading. A resident’s authorised representative can make the request on their behalf.

Please make your request in writing to our Privacy Officer (details below). We will respond within 30 days. We do not charge for making a request, but we may charge a reasonable fee to cover the cost of providing access, and we will tell you about any fee first.

In limited circumstances the law allows us to refuse access, for example where giving access would pose a serious threat to someone’s life, health or safety. If we refuse access or decline to make a correction, we will tell you why in writing and how to complain. If we do not correct your information, you can ask us to attach a statement to the record.

Data breaches

If a data breach is likely to result in serious harm to anyone whose information is involved, we will notify the people affected and the Office of the Australian Information Commissioner, as required by the Notifiable Data Breaches scheme.

Privacy complaints

If you are concerned about how we have handled your personal information, please contact our Privacy Officer first so we can try to resolve it. We will acknowledge your complaint promptly, investigate it, and give you a written response within 30 days.

If you are not satisfied with our response, you can complain to:

• the Office of the Australian Information Commissioner — oaic.gov.au, 1300 363 992;
• the NSW Information and Privacy Commission, for matters under NSW health privacy law — ipc.nsw.gov.au, 1800 472 679;
• for complaints about the health care itself, see our feedback and complaints page (/complaints/).

Changes to this policy

We review this policy regularly and will publish any changes on this page. A printed copy is available free of charge on request.