How KyHealth collects, uses, discloses, stores and protects your personal information and health information.
This Privacy Policy explains how KyHealth collects, uses, discloses, stores and protects personal information and health information when you use our website, complete forms, make bookings, receive services, submit prescription information, communicate with us or use related digital services.
KyHealth handles health information and is committed to complying with the Privacy Act 1988 (Cth), the Australian Privacy Principles and other applicable health, pharmacy and records laws.
Personal information may include your name, date of birth, contact details, address, Medicare or other health identifiers where applicable, emergency contact details, payment information, account login information and communication history.
Health information may include symptoms, medical history, medication history, allergies, pregnancy or breastfeeding status, pathology or test results you provide, photographs you upload for skin or hair assessment, prescription tokens, Active Script List information, consultation notes, clinical form responses, pharmacy order information, dispensing information and delivery information.
Technical information may include device information, IP address, browser type, website usage data, cookies, analytics data and security logs.
We collect information directly from you when you use our website, complete a questionnaire, make a booking, speak with a clinician or pharmacist, upload documents or photos, submit prescription details, make a payment, contact support or use a patient portal.
We may also collect information from nurse practitioners, doctors, pharmacists, partner pharmacies, prescribing systems, dispensing systems, prescription exchange services, digital health systems, payment providers, delivery providers, carers or authorised representatives, where lawful and necessary for your care or requested service.
We collect, use and disclose personal information and health information to provide and coordinate health services; assess suitability for services; prepare for consultations; support clinical review; manage prescriptions and pharmacy fulfilment; process payments; arrange delivery; send appointment, safety, payment and delivery messages; provide customer support; comply with legal and professional obligations; manage risk, fraud and misuse; improve our services; and operate, secure and maintain our website and systems.
We will only use or disclose your information for the purpose for which it was collected, a related purpose you would reasonably expect, with your consent, or where required or permitted by law.
We may share information with your treating practitioners, nurse practitioners, doctors, pharmacists, partner pharmacies, dispensing software providers, prescription exchange services, Active Script List or digital prescription systems, Medicare, PBS, DVA or insurers where applicable, ScriptCheckWA or other prescription monitoring systems where required or permitted, wholesalers or suppliers where necessary, couriers and delivery providers, payment providers, SMS and email providers, website and cloud hosting providers, clinical software providers, professional advisers, insurers, regulators, law enforcement or government agencies where required or permitted by law.
We will take reasonable steps to share only the information necessary for the relevant purpose.
KyHealth may use third-party digital systems to deliver services. These may include Cliniko or another clinical system, Microsoft 365/Outlook for email, Twilio for SMS, Limitless Payments or another payment provider, Australia Post or other courier systems for delivery tracking, Google Cloud Platform or other cloud infrastructure, analytics tools and website hosting platforms.
Service providers may store or process information on our behalf. We take reasonable steps to ensure service providers protect information appropriately and use it only for authorised purposes.
Some technology providers may store, process or support data from locations outside Australia. Where this occurs, we will take reasonable steps required by law to protect personal information.
You can contact us for more information about likely overseas disclosures once our vendor list is finalised.
Health information is sensitive information. We generally collect health information with your consent, because it is reasonably necessary for providing health services or related services, or where otherwise permitted by law.
By submitting health information through the website or providing it to us, you consent to KyHealth collecting, using and disclosing that information as described in this Privacy Policy and any relevant collection notice.
When you complete a pre-screening form or clinical questionnaire, we may display a short collection notice explaining what we collect, why we collect it, who we may share it with and what happens if you do not provide the information.
You do not have to provide information, but if you do not provide information requested, we may be unable to assess suitability, confirm a booking, provide a service, coordinate a prescription, arrange pharmacy fulfilment or respond to your enquiry.
KyHealth collects the information you provide in this form, including health information, to understand your needs, assess suitability for services, prepare for consultations, coordinate prescriptions and pharmacy fulfilment where applicable, communicate with you, process payments, arrange delivery and meet legal and professional obligations.
We may share relevant information with nurse practitioners, doctors, pharmacists, partner pharmacies, clinical software providers, payment providers, SMS/email providers, delivery providers and regulators where required or permitted by law. If you do not provide requested information, we may be unable to assess your suitability, confirm a booking or provide the requested service.
By submitting this form, you confirm that the information is accurate to the best of your knowledge and you consent to KyHealth handling your information in accordance with our Privacy Policy.
For some services, such as skin health or hair loss pathways, you may choose or be asked to upload photographs, pathology results, referral letters or other files. Only upload information that is relevant and that you are authorised to provide.
Photographs and files may be used for clinical review, care coordination, record keeping and service delivery. They should not be used for marketing without your separate consent.
We may send you marketing communications only where permitted by law and where you have consented or would reasonably expect to receive them. You can unsubscribe from marketing communications at any time.
We may still send administrative, clinical, safety, appointment, payment and delivery messages that are necessary for providing services.
Our website may use cookies, analytics tools and similar technologies to operate the website, understand usage, improve performance, manage security and support marketing where permitted.
You may be able to disable cookies in your browser, but some website features may not work properly.
We take reasonable steps to protect personal information and health information from misuse, interference, loss, unauthorised access, modification or disclosure. Measures may include access controls, password controls, encryption where appropriate, staff training, audit logs, secure cloud systems and vendor controls.
No digital system can be guaranteed completely secure. If you believe your information has been compromised, contact us promptly.
We retain personal information and health information for as long as required for clinical, pharmacy, legal, insurance, audit, tax and business purposes. Retention periods may vary depending on the type of information, the service provided and applicable legal obligations.
When information is no longer required, we will take reasonable steps to securely destroy or de-identify it where lawful and appropriate.
You may request access to personal information we hold about you and ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading.
We may need to verify your identity before responding. In some circumstances, we may refuse access or correction where permitted by law. If we refuse, we will provide reasons where reasonable and lawful.
You may authorise another person, such as a carer, parent, guardian or support person, to communicate with us on your behalf. We may require evidence of authority before disclosing information or accepting instructions.
If you provide information about another person, you confirm that you are authorised to do so and that the information is accurate to the best of your knowledge.
If a data breach occurs, we will assess it and take appropriate action. Where required under the Notifiable Data Breaches scheme, we will notify affected individuals and the Office of the Australian Information Commissioner.
If you have a privacy concern or complaint, contact us at [insert privacy contact email] or [insert phone]. We will aim to respond within a reasonable time.
If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner at oaic.gov.au or call 1300 363 992.
We may update this Privacy Policy from time to time. The updated version will apply from the date it is published on the website.
To request access to your information, make a correction, lodge a complaint or ask about our privacy practices, please contact us:
Privacy Officer: Mack Saraswat, Ph.D
Email: support@kyhealth.com
Phone: 0897513066
Postal address: 12 Prince St, Busselton WA 6280, Australia
Office of the Australian Information Commissioner
Website: oaic.gov.au
Phone: 1300 363 992