Privacy policy

Privacy policy

How your personal and health information is collected, used, stored and shared in Dr Morgan Etienne's practice.

Last updated July 2026

Introduction

The Privacy Act 1988 and the Australian Privacy Principles require me to have a document that clearly sets out my policies on handling personal information, including health information.

This privacy policy is to provide information to you, my patient, on how your personal information (which includes your health information) is collected and used within my practice, and the circumstances in which I may share it with third parties. It is on my website, and is readily presented to anyone who asks.

I am an independent sole contractor operating my own practice from Neighbourhood Medical, Level 1, Suite 1, 530 Milton Road, Toowong QLD 4066. Neighbourhood Medical's own privacy policy also applies to information the practice collects — at reception, on the phone and through its booking and communication systems.

Why and when your consent is necessary

When you register as a patient of my practice, you provide consent for me and the practice staff to access and use your personal information so we can provide you with the best possible healthcare. Only staff who need to see your personal information will have access to it. If I need to use your information for anything else, I will seek additional consent from you to do this.

Why I collect, use, hold and share your personal information

I need to collect your personal information to provide healthcare services to you. My main purpose for collecting, using, holding and sharing it is to manage your health. I also use it for directly related business activities, such as financial claims and payments, practice audits and accreditation, and business processes such as staff training and the teaching of medical students and doctors in training.

What personal information I collect

The information I collect about you includes your:

• Name, date of birth, address and contact details
• Medical information, including medical history, medications, allergies, adverse events, immunisations, social and family history, and risk factors
• Medicare number, where available, for identification and claiming purposes
• Healthcare identifiers
• Health fund, DVA and concession details
• Clinical images or photographs, taken only with your consent at the time
• Information generated or processed through AI-enabled tools used in clinical or administrative work

Dealing with me anonymously

You have the right to deal with me anonymously or under a pseudonym, unless it is impracticable for me to do so, or unless I am required or authorised by law to only deal with identified individuals.

How I collect your personal information

My practice may collect your personal information in several different ways.

• When you make your first appointment, practice staff collect your personal and demographic information via your registration.
• During the course of providing medical services I may collect further personal information. Information may also be collected through electronic transfer of prescriptions (eTP), My Health Record, electronic sharing of health information with other health professionals via Medical Objects, and secure messaging services with Queensland Health facilities.
• I may also collect your personal information when you send an email or SMS, telephone the practice, or make an online appointment through HotDoc.

In some circumstances personal information may also be collected from other sources, often because it is not practical or reasonable to collect it from you directly. This may include information from:

• Your guardian or responsible person
• Other involved healthcare providers, such as specialists, allied health professionals, hospitals, community health services, and pathology and diagnostic imaging services
• Your health fund, Medicare, or the Department of Veterans' Affairs, as necessary

When, why and with whom I share your personal information

I will sometimes share your personal information:

• With third parties who work with my practice for business purposes, such as accreditation agencies or information technology providers — these third parties are required to comply with the Australian Privacy Principles and this policy
• With other healthcare providers involved in your care
• When it is required or authorised by law, for example a court subpoena
• When it is necessary to lessen or prevent a serious threat to a patient's life, health or safety, or to public health or safety, or where it is impractical to obtain the patient's consent
• To assist in locating a missing person
• To establish, exercise or defend an equitable claim
• For the purpose of a confidential dispute resolution process
• Where there is a statutory requirement to share certain personal information, for example diseases requiring mandatory notification
• During the course of providing medical services, through eTP, My Health Record (for example via a Shared Health Summary or Event Summary), Medical Objects, and the Secure Transfer Service used by Queensland Health

Only people who need to access your information will be able to do so. Other than in the course of providing medical services, or as otherwise described in this policy, my practice will not share personal information with any third party without your consent. I will not share your personal information with anyone outside Australia, unless under exceptional circumstances permitted by law, without your consent.

My practice will not use your personal information to market goods or services directly to you without your express consent. If you do consent, you may opt out of direct marketing at any time by notifying my practice in writing.

My practice may use your personal information to improve the quality of the services I offer, through research and analysis of patient data. I may provide de-identified data to other organisations to improve population health outcomes. That information is secure, patients cannot be identified, and it is stored within Australia. Let reception know if you do not want your information included.

Use of artificial intelligence

I use an AI scribe — digital notetaking software that listens to the consultation and drafts the clinical note — so that I can spend the appointment listening to you rather than typing.

• I will tell you at the start of the consultation and ask for your consent before it is switched on
• You can decline, or ask for it to be turned off at any point, and your care will be exactly the same
• The recording is used to draft the note and is not retained as an audio file
• I read, correct and approve every note before it is saved to your record
• The finished note is stored in your medical record in Best Practice, the clinical software used at Neighbourhood Medical
• Your information is not used to train AI models unless your express consent has been obtained
• All outputs generated by AI systems are subject to human review and clinical oversight, and no automated decision-making tool is used in this practice

The practice may also use AI-assisted tools for administrative purposes such as triage, appointment scheduling and chatbots. All AI use is consistent with the Australian Privacy Principles and relevant ethical standards. If you have any questions about this, please ask me.

How I store and protect your personal information

Your personal information is stored in electronic form in Best Practice, the clinical software used at Neighbourhood Medical, and all personal information is stored securely. Information I hold is protected by:

• Securing the premises
• Passwords and varying access levels on databases, to limit access and protect electronic information from unauthorised interference, access, modification and disclosure
• Locked cabinets and rooms for the storage of physical records
• Regular backups, staff privacy training, and a cybersecurity framework with regular audits and software updates

Records are retained in line with legal and professional obligations — generally at least seven years from your last visit for an adult, and until the age of 25 for a child. Information no longer required, once the minimum retention period has passed, is destroyed securely.

If a data breach occurs that is likely to cause you serious harm, you and the Office of the Australian Information Commissioner will be notified.

Children and young people

A parent or guardian usually consents to care and can access the record for a young child. As young people mature they may be assessed as able to consent to their own care — in that case their consultations are confidential, and their information is not shared with a parent without their agreement, unless there is a serious risk of harm.

How you can access and correct your personal information

You have the right to request access to, and correction of, your personal information. I require you to put this request in writing, and the practice will respond within 30 days. A small administrative fee may apply to cover copying and postage, but not for making the request itself.

The practice will take reasonable steps to correct your personal information where it is not accurate or up to date. From time to time I will ask you to verify that the information held about you is correct and current. You may also request that I correct or update your information, and you should make such requests in writing to the practice manager. Clinical notes cannot be deleted, but a correction can be recorded alongside them.

Online booking and this website

Appointments are booked through HotDoc, an Australian booking service. When you book, HotDoc collects your details under its own privacy policy and passes them to the practice.

This website does not ask you to submit any health information. The map on the contact page is provided by Google, which may set cookies when it loads. Email is not a secure channel — please don't send clinical or sensitive information by email, and never use it for anything urgent.

How to lodge a privacy-related complaint

I take complaints and concerns regarding privacy seriously. Please express any privacy concerns you have in writing, and I will attempt to resolve the matter in accordance with the practice's resolution procedure. Please address complaints to:

You may also contact the Office of the Australian Information Commissioner. Generally, the OAIC will require you to give the practice time to respond before it will investigate. Visit oaic.gov.au or call 1300 363 992. In Queensland you may also contact the Office of the Health Ombudsman at oho.qld.gov.au or on 133 646.

This policy is reviewed at least annually, and whenever there are changes to my practice, to legislation, or to the technology in use. Significant changes will be communicated in the practice and on this website.