Privacy Policy
Malvern Endocrinology & Diabetes is committed to protecting the privacy of your personal and health information. This policy explains what we collect, why we collect it, who we share it with, how we keep it safe, and how you can see or correct your record. It applies to everything we do as a practice, including this website.
Effective: 29 July 2026 Last reviewed: 29 July 2026 Next review: December 2026
Who we are and what governs us
Malvern Endocrinology & Diabetes is a specialist private endocrinology and diabetes practice at Suite 49, Cabrini Malvern, 183 Wattletree Road, Malvern VIC 3144. In this policy, "we", "us" and "our" mean the practice and the practitioners and staff who work in it.
Because we provide a health service, we are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles regardless of the size of our practice. We are also bound by the Health Records Act 2001 (Vic) and the Victorian Health Privacy Principles, which set specific rules for handling health information in this State. Our practitioners are separately bound by their professional obligations of confidentiality and by the codes of conduct of the Medical Board of Australia and the Nursing and Midwifery Board of Australia.
Health information is treated as sensitive information under the Privacy Act, which means it attracts a higher level of protection than ordinary personal information. We treat it that way.
What information we collect
The information we hold about you generally falls into three groups.
Identifying and contact details
- Your name, date of birth, address, phone numbers and email address
- Your emergency contact, and the name of your next of kin or carer where relevant
- Your Medicare number, Department of Veterans' Affairs number, pension or concession card details, and private health fund membership where these apply
- The name and contact details of your general practitioner and any other treating specialists
Health information
- Your referral, medical history, presenting problem, and family history where it is clinically relevant
- Consultation notes, examination findings, assessments and management plans
- Pathology and imaging results, and reports from other health services
- Medicines you are taking, allergies, adverse reactions and immunisation history
- Data from glucose monitoring devices, insulin pumps and similar equipment where you bring it to a consultation or share it with us
- Correspondence to and from your general practitioner and other treating practitioners
Billing and administrative information
- Appointment history, including attendance and cancellations
- Accounts, receipts, claiming records and payment method — we do not store full credit card numbers
- Any correspondence between you and the practice
Some of this information may reveal things the Privacy Act treats as especially sensitive, such as your racial or ethnic background, your gender identity, or your religious beliefs, where these are relevant to your care. We only collect that information where it is reasonably necessary for your treatment, and we handle it with the same care as the rest of your record.
How we collect it
Wherever it is reasonable and practicable, we collect information directly from you — when you telephone the practice to make an appointment, when you complete a registration or history form, and during your consultation.
We also collect information about you from other people, in the ordinary course of your care:
- from the doctor who referred you, in the referral letter and any attached history
- from pathology and diagnostic imaging providers, who send us your results
- from hospitals and other health services involved in your treatment, including Cabrini
- from your family member, carer or interpreter where you have asked them to speak with us, or where you are not able to communicate with us directly
If we receive information about you that we did not ask for and do not need, we destroy or de-identify it where the law permits us to do so.
Why we collect it and how we use it
We collect your information so that we can:
- assess, diagnose and manage your condition, and provide safe and continuous care
- communicate with your general practitioner and other members of your treating team
- arrange investigations, referrals and follow-up
- manage appointments and send you reminders
- bill you and, where relevant, claim from Medicare, the Department of Veterans' Affairs or your health fund
- meet our obligations under Australian law and our professional obligations
- review and improve the quality and safety of the care we provide
We use your health information for these purposes and for purposes directly related to them that you would reasonably expect. We do not use your health information for marketing, we do not sell it, and we do not disclose it to anyone for a commercial purpose.
Appointment reminders. We send appointment reminders by SMS or email through a third-party messaging provider engaged by the practice. Those reminders contain only what is needed to identify the appointment — your name, and the date, time and location. They do not contain clinical details. Tell reception if you would prefer not to receive them, or would prefer a different method of contact.
If we ever wanted to use your information for something outside these purposes — research, teaching or quality assurance beyond our own practice, for instance — we would seek your consent first, or use information that has been de-identified so that you cannot be recognised from it.
How we store and protect your information
Your clinical record is held electronically in practice management software hosted in Australia by a contracted provider. Any paper documents we receive are kept securely at the practice and are scanned into your electronic record.
We protect your information by:
- requiring individual logins and passwords, so that access is traceable to a person
- limiting access to the staff and practitioners who need it to do their work
- encrypting information in transit and at rest, and using secure messaging rather than ordinary email to exchange clinical correspondence wherever the receiving practice supports it
- keeping the premises, consulting rooms and any paper records physically secure
- maintaining backups, and keeping our systems and antivirus protection up to date
- requiring every staff member to sign a confidentiality agreement, and training them on their privacy obligations
- securely destroying paper records and wiping electronic media when they are no longer required to be kept
No system can be guaranteed to be completely secure, but we take reasonable steps to protect your information from misuse, interference, loss, and unauthorised access, modification or disclosure.
Information sent overseas
Your clinical record is held in Australia. The practice management software we use, and the backups of it, are hosted here, and we do not send your medical history, results or consultation notes overseas.
Some of the general technology services that support the practice are supplied by companies based outside Australia, so a limited amount of information may be handled overseas. The country most likely to be involved is the United States. Specifically:
- This website is hosted by Netlify, Inc. (United States). Like any web host, it records standard technical information about each visit — IP address, browser type, the page requested and the time. This is not linked to your clinical record and we do not use it to identify individual visitors.
- Some pages load typefaces, and our home page an embedded map, from Google LLC (United States). See This website below.
Where we use an overseas provider, we take reasonable steps to satisfy ourselves that it will handle information consistently with the Australian Privacy Principles. If our arrangements ever change so that your health information would be held overseas, we will update this policy before that happens.
How long we keep your records
The Health Records Act 2001 (Vic) sets minimum retention periods, and we follow them:
- for an adult, we keep your health record for at least seven years from the date we last provided a health service to you
- if the information was collected while you were under 18, we keep it until you turn 25, or seven years from your last service with us, whichever is later
We often keep records for longer, because doing so supports the continuity of your care. When a record is no longer required, it is destroyed securely or de-identified.
If the practice closes or a practitioner leaves, we will take reasonable steps to let affected patients know what is happening to their records and how they can obtain access to them or have them transferred, as the Health Records Act requires.
Seeing and correcting your record
You have a right to ask for access to the personal and health information we hold about you, and to ask us to correct it if it is wrong, out of date, incomplete or misleading.
How to ask
Put your request in writing to the Practice Manager, using the contact details in Concerns and complaints below. We will need to verify your identity before we release anything. If you are asking on behalf of someone else, we will also need evidence of your authority to do so.
Requests for access
- We will acknowledge your request and respond as quickly as we can, and in any case within 45 days.
- You can ask to inspect your record, to be given a copy, or to have a practitioner take you through it and explain it — whichever suits you best.
- There is no charge for making a request. We may charge a reasonable fee for giving you access. Those fees are capped by the Health Records Regulations 2023 (Vic) and are indexed each year. We will tell you what it will cost before we do the work.
Requests for correction
- There is never a charge for correcting your record.
- We will tell you our decision as quickly as we can, and in any case within 30 days.
- If we correct your information, we will take reasonable steps to notify any other health service provider we previously gave it to who might rely on it in future. You do not have to ask us to do this.
- If we do not agree that a correction is needed, you can ask us to attach a statement of your view to the record, and we will.
We can refuse access in limited circumstances set out in the legislation — for example, where giving access would pose a serious threat to someone's life, health or safety, or would unreasonably affect another person's privacy. If we refuse, we will tell you in writing why, and explain how you can have that decision reviewed. Where we can give you part of the record, or provide it through an intermediary such as your general practitioner, we will offer that instead of a flat refusal.
Dealing with us anonymously
You can contact the practice anonymously or under a pseudonym to ask a general question about our services, fees or location.
We cannot provide clinical care anonymously. Safe treatment depends on an accurate, identifiable record, and Medicare and health fund claiming requires your correct identity. If you have a particular concern about being identified, please raise it with us — there may be something we can do within those constraints.
This website
This website is deliberately simple. It has no contact form, no booking system, no patient login and no newsletter sign-up, so there is no way to submit personal information through it. To contact us, please telephone the practice or send an email.
- Cookies. We do not set any cookies of our own. The Google Map embedded in the contact section of our home page is served by Google and may set its own cookies in your browser when that page loads.
- Analytics. We do not run Google Analytics or any other visitor tracking or advertising script.
- Server logs. Our hosting provider records standard technical information about each visit, such as your IP address, browser type, the page requested and the time. This is used for security and to keep the site running. We do not use it to identify you.
- Fonts and maps. Our pages load typefaces from Google Fonts, and the contact section of our home page loads an embedded Google Map. Loading these sends a request to Google's servers, which is subject to Google's own privacy policy.
- Email. If you email us, we treat that email as part of our records. Ordinary email is not a secure channel, so please do not send us detailed clinical information that way — telephone the practice instead.
This site links to other organisations, such as hospitals and universities. We are not responsible for the privacy practices of those sites, and we encourage you to read their own privacy policies.
If something goes wrong
We have procedures for responding to a suspected data breach. If your information were lost or disclosed without authorisation, we would contain the breach, assess what had happened, and take steps to reduce any harm.
Where a breach is likely to result in serious harm to you, the Notifiable Data Breaches scheme under the Privacy Act requires us to notify you and the Office of the Australian Information Commissioner. We would do so as soon as practicable, and tell you what had happened and what you can do about it.
Questions, concerns and complaints
If you have a question about this policy, want to access or correct your record, or are concerned about how we have handled your information, please contact our Practice Manager first. Most concerns are resolved quickly once we understand them.
Practice Manager
Malvern Endocrinology & Diabetes
Suite 49, Cabrini Malvern
183 Wattletree Road
Malvern VIC 3144
Tel: (03) 9086 2814
Fax: (03) 9086 4145
admin@malvernendocrinology.com.au
We will acknowledge your complaint, investigate it, and respond to you in writing, normally within 30 days. If we need longer, we will tell you why.
If we have not responded within 30 days, or you are not satisfied with our response, you can take the matter to either of these independent bodies at no cost:
Health Complaints Commissioner (Victoria)
For complaints about health information held by a Victorian health service provider.
Tel: 1300 582 113
hcc.vic.gov.au
Office of the Australian Information Commissioner
For complaints under the Privacy Act 1988 (Cth).
Tel: 1300 363 992
GPO Box 5288, Sydney NSW 2001
oaic.gov.au
Making a complaint will not affect your care with us.
Changes to this policy
We review this policy at least once a year, and whenever our practices or the law change. The current version is always published here, and the effective date at the top of the page tells you when it last changed.
If you would prefer a copy in another format — printed, or in larger type — ask at reception or telephone the practice and we will arrange it.