Privacy Policy

1. About this Privacy Policy

Leafwise ("Leafwise", "we", "us" or "our") is committed to protecting the privacy, confidentiality and security of the personal and health information entrusted to us.

This Privacy Policy explains how we collect, hold, use, disclose and protect personal information when you interact with Leafwise, including when you visit our website, make an enquiry, book an appointment, attend an in-clinic or telehealth consultation, receive healthcare services, communicate with our clinical team, obtain prescriptions or otherwise interact with Leafwise.

We handle personal information in accordance with applicable Australian privacy and health information legislation, including the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) and, where applicable, relevant state and territory health records legislation.

2. Information we collect

The information we collect depends on how you interact with Leafwise and the healthcare services you receive.

Personal information may include:

• name, date of birth and gender;
• residential and postal address;
• telephone number and email address;
• emergency contact details;
• Medicare and healthcare identifiers where applicable;
• identification information;
• payment and billing information;
• appointment and booking information;
• correspondence and communications with Leafwise;
• information submitted through our website or patient forms; and
• enquiries, feedback and complaints.

As a healthcare provider, we also collect sensitive and health information where reasonably necessary to provide your care. This may include:

• medical history;
• current and previous health conditions;
• symptoms and health concerns;
• medications and previous treatments;
• allergies and adverse reactions;
• pathology, imaging and test results;
• prescriptions and dispensing information;
• clinical notes and care plans;
• information supplied by your GP, specialist, pharmacist or other healthcare provider;
• relevant family medical history;
• relevant lifestyle and health information; and
• other information reasonably necessary to assess, provide and manage your healthcare.

3. How we collect information

Where practicable, we collect information directly from you.

This may occur when you:

• use our website;
• complete an enquiry, registration or consent form;
• book an appointment;
• communicate with our team;
• attend an in-clinic or telehealth consultation;
• provide medical records or supporting documentation;
• receive healthcare or treatment; or
• use our pharmacy, prescription or related services.

Where appropriate and permitted by law, information may also be collected from your GP, specialist, pharmacist, pathology or diagnostic provider, hospital, allied health provider, authorised representative, insurer, workers compensation provider or another healthcare provider involved in your care.

4. Why we collect your information

We collect, hold, use and disclose information as reasonably necessary to:

• provide healthcare and clinical services;
• assess your health and suitability for services or treatments;
• manage appointments and consultations;
• maintain your medical record;
• develop, review and monitor care plans;
• communicate with you about your care;
• issue and manage prescriptions where clinically appropriate;
• facilitate dispensing and medication delivery where requested;
• communicate with other healthcare professionals involved in your care;
• arrange pathology, diagnostic testing or referrals;
• provide telehealth services;
• process payments and eligible Medicare claims;
• manage workers compensation matters where applicable;
• respond to enquiries and complaints;
• undertake clinical governance, quality assurance and patient safety activities;
• meet legal, regulatory and professional obligations;
• administer and operate the clinic;
• improve our services; and
• protect our patients, practitioners, staff and systems.

5. Health information and consent

Health information is sensitive information under Australian privacy law.

By providing health information to Leafwise in connection with your care, you consent to its collection, use and disclosure for purposes reasonably necessary to provide and manage your healthcare, subject to applicable law.

There may be circumstances in which information may or must be collected, used or disclosed without consent, including where required or authorised by law or where necessary to address a serious threat to life, health or safety.

6. Working with your healthcare team

Leafwise can work alongside your existing GP, specialist, pharmacist and other healthcare providers.

With your consent, we may exchange information reasonably necessary to support safe treatment, medication management, continuity and coordination of care.

7. Prescriptions, pharmacy and medication delivery

Where medication is prescribed, information necessary to issue, manage and dispense your prescription may be shared with your nominated pharmacy, our onsite or associated pharmacy, electronic prescribing services or other relevant providers.

If you request medication delivery, relevant information including your name, contact information and delivery address may be provided to pharmacy, courier or logistics providers as necessary to fulfil your request.

8. Telehealth

Leafwise offers secure telehealth consultations for suitable services.

Information may be transmitted electronically through our practice management, telehealth, clinical and communication systems.

We take reasonable steps to protect the privacy and security of telehealth consultations. Patients should participate from a private environment and use a secure internet connection where reasonably possible.

9. Technology providers and contractors

Leafwise uses third-party systems, technology providers and contractors to operate the clinic and provide healthcare and administrative services.

These may include:

• Halaxy for practice management, patient records, bookings, telehealth, billing, Medicare processing, prescribing and related clinical functions;
• Microsoft for business communications, administration, document management and cloud-based services;
• Lovable and GoDaddy for website development, hosting, domain and associated website services;
• Klaviyo for permitted email communications, marketing and customer relationship management;
• payment processors and payment gateways integrated with Leafwise or Halaxy;
• pharmacy, prescribing and medication-related systems;
• courier and logistics providers; and
• authorised Australian and offshore contractors who support administrative and operational functions.

Access to personal information is intended to be limited to what is reasonably necessary for a provider or contractor to perform its authorised function.

Leafwise does not intend to use Klaviyo as a repository for clinical notes or medical records. Marketing communications are subject to applicable consent and electronic communications requirements.

10. Offshore access and overseas disclosure

Some of Leafwise's technology providers, service providers and authorised contractors may operate from or process information in locations outside Australia.

Leafwise may engage offshore contractors to provide administrative or operational support. Where access to personal information is required, we take reasonable steps to limit access to information necessary for the contractor's authorised role and require appropriate confidentiality, privacy and security protections.

Some technology providers may also use overseas infrastructure, personnel or subprocessors.

Where personal information is disclosed overseas, Leafwise will take reasonable steps required under applicable Australian privacy laws in relation to that disclosure.

This section may be updated to identify relevant countries as Leafwise's technology and contractor arrangements are finalised.

11. Website information, cookies and analytics

When you visit the Leafwise website, technical information may be collected automatically, including your IP address, browser and device information, pages visited, referring website and general website usage information.

We may use cookies and similar technologies to operate and improve our website, understand website usage, remember preferences and measure performance.

Third-party analytics or website technologies may also collect information in accordance with their applicable privacy practices.

12. Marketing communications

We may communicate with you about Leafwise services, clinic information and updates where permitted by law and where the necessary consent has been obtained.

You can opt out of marketing communications at any time using the unsubscribe function provided or by contacting us.

Clinical communications, appointment reminders, patient safety communications and administrative messages relating to your care are not considered marketing communications.

We do not use health information for direct marketing except where permitted by law and any required consent has been obtained.

13. Disclosure of information

We may disclose information where reasonably necessary to:

• healthcare professionals involved in your care;
• pharmacies and dispensing providers;
• pathology and diagnostic providers;
• hospitals and healthcare facilities;
• authorised representatives;
• Medicare and relevant government agencies;
• workers compensation insurers or authorities where authorised;
• technology and service providers;
• payment processors;
• delivery and logistics providers;
• professional advisers;
• regulatory bodies; or
• law enforcement agencies, courts or government authorities where required or authorised by law.

Leafwise does not sell patient health information.

14. Medicare, DVA and private health insurance

Leafwise may process eligible Medicare claims where applicable.

Leafwise does not currently provide DVA-funded services.

Private health insurance claims are not processed directly by Leafwise. Where appropriate, patients may be provided with a receipt to submit to their private health insurer. Eligibility for any rebate is determined by the relevant insurer and policy.

15. Payment information

Payments may be processed through a payment gateway integrated with Halaxy or another payment provider selected by Leafwise.

Payment providers may collect and process information required to complete your transaction. Leafwise does not intentionally retain complete payment card details where those details are processed securely by an external payment provider.

16. Protecting your information

Leafwise takes reasonable steps to protect personal and health information against misuse, interference, loss, unauthorised access, modification and disclosure.

Measures may include secure practice management systems, access controls, authentication requirements, secure data storage, staff and contractor confidentiality obligations, privacy procedures and cybersecurity safeguards.

No electronic system can be guaranteed to be completely secure. We review our information-handling practices and security controls as appropriate.

17. Retention of medical records

Medical records and personal information are retained for periods required by applicable healthcare, privacy, record-keeping and professional requirements.

When information is no longer required and there is no legal obligation to retain it, we take reasonable steps to securely destroy or de-identify it.

18. Accessing your medical records

You may request access to personal and health information Leafwise holds about you.

We may need to verify your identity before releasing records. Access may be limited or refused in circumstances permitted by law, in which case we will provide an explanation where legally permitted.

Reasonable administrative charges may apply where permitted by law.

19. Correcting your information

If you believe information held by Leafwise is inaccurate, incomplete or out of date, please contact us.

We will take reasonable steps to correct information where appropriate and in accordance with applicable law.

20. Data breaches

Leafwise maintains processes for responding to suspected and confirmed data breaches.

Where a data breach is likely to result in serious harm and notification is required under applicable law, Leafwise will take appropriate action, including notifying affected individuals and the Office of the Australian Information Commissioner where required.

21. Privacy complaints

If you have concerns about the way Leafwise has handled your information, please contact our Privacy Officer.

We will investigate privacy complaints and endeavour to respond within a reasonable timeframe.

If you are not satisfied with our response, you may have the right to make a complaint to the Office of the Australian Information Commissioner (OAIC) or another applicable state or territory privacy or health complaints authority.

22. Third-party websites

Our website may contain links to third-party websites or services.

Leafwise is not responsible for the privacy practices of third parties, and we encourage you to review their privacy policies before providing personal information.

23. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes to our services, technology, providers, information-handling practices or legal obligations.

The current version will be published on the Leafwise website.

24. Contact us

For privacy enquiries, requests to access or correct your information, or privacy complaints, please contact: