Privacy Policy

1. About this policy

Melbourne Echo Clinic Pty Ltd (MEC, we, us, our) provides bulk-billed echocardiography services at partner clinic sites across Victoria.

This policy explains how we collect, use, store, and disclose personal information and health information. It applies to our patients, to the doctors who refer to us, and to visitors to this website.

Most of the information we hold is health information about patients, which is treated as sensitive information under Australian privacy law and given a higher level of protection than ordinary personal information.

2. The law we operate under

We are bound by:

• the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs)
• the Health Records Act 2001 (Vic) and the Health Privacy Principles (HPPs)

The small business exemption in the Privacy Act does not apply to organisations that provide a health service and hold health information. As a health service provider, we are bound by the Privacy Act in full, regardless of our size.

3. What information we collect

Identity and contact information

Your name, date of birth, address, phone number, and email address.

Medicare information

Your Medicare card number and the details we need to claim the Medicare benefit for your echocardiogram.

Referral and clinical information

Your referral, the clinical reason for the referral, and the information your referring doctor provides. We may also ask you about relevant symptoms, medical history, medications, and previous cardiac investigations at your appointment, where these affect how the scan is performed or interpreted.

Your echocardiogram

The images and measurements recorded during your scan, and the report prepared by the reporting cardiologist.

Correspondence

Emails, phone notes, text messages, and other correspondence with you or your doctor.

Website visitors

We do not place any tracking on your device when you visit this website. We use no advertising or social media pixels and no tracking scripts. The site sets no cookies and stores nothing in your browser, which is why you will not see a cookie banner. There are no forms on the site, so there is no way to submit personal information through it — when you contact us, you do so from your own phone or email account and the website plays no part in it.

On our Locations page only, the interactive map loads its software and map images from two map providers. Those requests disclose your IP address, browser, and the fact that you are viewing that page to them. This happens automatically as the page loads. No other page on our site loads content from another company.

We receive nothing back from these companies and do not use them to identify you.

Our website is hosted by a hosting provider, whose servers necessarily receive your IP address and the page you requested in order to deliver it. Our host also provides us with basic visitor statistics — such as how many people visited, which pages were most viewed, and where visits came from. These statistics are generated by our host from its own server records rather than by anything placed on your device, and they are reported to us as aggregate numbers. We use them only to understand how our website is being used.

If you click through to book an appointment, you leave our website for our booking provider, who will receive the page you came from and then handles your booking under their own privacy policy. Nothing is sent to them unless you click.

If you do not provide information

You do not have to give us your information, but we may not be able to provide the service without it. We need your referral and your Medicare details to bulk-bill your echocardiogram, and we need relevant clinical information to perform and interpret your scan accurately.

4. How we collect it

Wherever it is reasonable and practicable, we collect information directly from you.

We collect information:

• from you, in person at your appointment, or by phone or email
• from your referring GP or specialist, through your referral
• through our online booking system, when you book an appointment
• from the practice where your appointment takes place

Referrals received through partner practices

Arrangements vary between our sites. At some practices, referrals are completed digitally by the doctor and emailed to us, either by the doctor or by the practice's reception. At others, a paper referral may be given to you to bring to your appointment, or handed to reception and passed to your sonographer on the day. Where a practice holds a paper referral for us, it is passed on to us and not kept.

Booking lists at partner practices

We manage all bookings ourselves. Some partner practices keep a list of patients expected on a clinic day, so they know how many people to expect and can direct you when you arrive. This list holds your name and appointment time, not your clinical information.

Partner practices do not hold your echocardiogram images or report, unless the doctor who referred you works at that practice.

Sometimes we receive information about you from your referring doctor before you contact us — for example, when a referral is sent to us directly. This is a normal part of how referred health services operate.

5. Why we collect it and how we use it

We use your information to:

• perform the echocardiogram you have been referred for
• have your study reported by a consultant cardiologist
• send the report to your referring doctor, and to any other practitioner you have nominated
• claim the Medicare benefit for your service
• contact you about your appointment, including appointment reminders
• meet the quality assurance and accreditation requirements that apply to diagnostic imaging services and to accredited sonographers
• meet our legal and professional obligations

Using images for teaching

Echocardiography is a specialised field, and teaching is part of professional practice. We may use images or video clips from echocardiograms for teaching and professional education.

Before any image is used, all details that identify you are removed — your name, date of birth, patient number, and the date of your scan. The image shows only the heart. Where an image could still identify you despite this — for example, if your condition is unusual — we will ask your permission first, and you are free to say no. Declining will not affect your care in any way.

What we do not do with your information

We do not use your information for research or publication. We do not use your echocardiogram images or report in our marketing or advertising, and we do not use them to develop or test software.

We do not use your information for marketing, and we do not sell personal information or health information to anyone.

6. Who we share it with

Your referring doctor, and any other practitioner you have nominated, receive your report. This is the purpose for which the scan was requested. Where your referring doctor works within a practice, the report may be received through that practice's clinical system, so that it can be actioned promptly even if your doctor is away. We do not send your report to a practice that was not involved in referring you, including a practice whose rooms we used for your appointment.

The reporting cardiologist, an independent consultant cardiologist engaged by Melbourne Echo Clinic, accesses your study within our reporting platform in order to report it. They do not hold a separate copy of your images or report.

If your echocardiogram shows a finding that needs prompt attention, the reporting cardiologist may contact your referring doctor directly so that it can be acted on without delay.

Services Australia, for the purpose of claiming the Medicare benefit for your service.

Our service providers, who help us run the practice — our booking and practice management system, our imaging and reporting platform, the secure messaging service that transfers your report between those systems, and our email and appointment reminder providers. These providers hold or handle your information only to provide those services to us.

Where the law requires it, including in response to a subpoena or court order, or where we are required or authorised by law to disclose information.

We do not disclose your information for any other purpose without your consent, unless we are permitted to do so under the Privacy Act or the Health Records Act.

7. Overseas disclosure

We use third-party software to run our practice. Your echocardiogram images and reports are stored in Australia, but some information may be accessed or handled overseas, as set out below.

Our imaging and reporting platform stores all patient studies, measurements, and reports in Australia, and backups remain in Australia. The provider's support team is based in New Zealand, and may access patient data where necessary to provide support and operate the service.

Appointment reminder text messages are sent through a messaging provider based in the United States, which means your mobile number and the content of the reminder are handled by that provider.

Billing and accounting

Our practice management system is connected to an accounting platform that stores data in the United States, for the purpose of managing our invoicing and accounts.

Email correspondence, including referrals sent to us by email, is held in a business email service provided by a global provider. Data in this service may be stored and processed outside Australia.

Our website

Our web host and the map providers used on our Locations page are based overseas. Visiting our website discloses your IP address to them, as described in section 3.

Where information may be accessed or handled overseas, we take reasonable steps to ensure it is handled consistently with Australian privacy law.

8. How we store and protect your information

Your information is held in secure, access-controlled systems. We take the following steps to protect it:

• Access is limited to those who need it. Only our directors and the clinicians involved in your care can access your information. Reporting cardiologists can view and report only the studies assigned to them, and their access is removed when they stop working with us.
• Our clinical systems are password protected, and are provided by established healthcare software providers with recognised information security certification.
• Our phones and computers are passcode-protected and encrypted, and are not backed up to personal cloud accounts.
• Our ultrasound equipment holds studies only temporarily. Studies are transferred to our secure reporting platform and deleted from the machine once no longer needed. The equipment is transported directly between clinic sites and secure storage, and is not left unattended.
• Paper referrals are scanned into your record and the paper copy is then securely destroyed.

How long we keep it

We are required to keep health records for a minimum period. Under the Health Records Act 2001 (Vic), health information must generally be kept for at least seven years from the date we last provided you with a service. If you were under 18 at the time of your service, we must keep your records until you turn 25.

Destruction. Once the retention period has passed, health information is securely destroyed or de-identified. Melbourne Echo Clinic has not yet reached the end of a retention period for any patient record.

If Melbourne Echo Clinic ceases operating. If our practice is sold, transferred, or closed, we will notify patients and handle your health information in accordance with the Health Records Act 2001 (Vic), which sets out how records must be transferred or retained and how patients must be notified.

9. Accessing and correcting your information

You have the right to ask for access to the health information we hold about you, and to ask us to correct it if it is inaccurate, out of date, incomplete, or misleading.

Getting your results

Your report is sent to the doctor who referred you. Asking them is usually the quickest way to get your results, and they can explain what the findings mean in the context of your history and symptoms. Our sonographers are not able to discuss findings with you.

Requesting a copy from us

If you would prefer a copy directly from us, you can request one. There is no charge for this.

How to make a request

Please put your request in writing, by email to admin@melbourneechoclinic.com.au. Let us know whether you would like your report, your images, or both.

Confirming your identity

Because your health information is sensitive, we need to be confident we are giving it to the right person. We will ask you to confirm details we already hold, such as your date of birth and contact details, and we will send your information to an email or postal address already recorded in your file, or you can collect it in person. If we cannot match your details, or you would like it sent somewhere new, we will ask to sight photo identification first.

If someone else is requesting on your behalf — a family member, lawyer, insurer, or another clinic — we will need your written authority before we release anything.

How long it takes

We will respond to your request within 30 days.

Correcting your information

If you believe something we hold about you is wrong, tell us and we will correct it. Where a correction relates to a clinical finding rather than an administrative detail, we may need to consult the reporting cardiologist, and we may note your request on the record alongside the original information rather than deleting it, so that your care history remains complete.

If we have already given your information to someone else — for example, your referring doctor — and we then correct it, you can ask us to let them know about the correction. We will do so unless there is a valid reason not to.

When we may not be able to provide access

In limited circumstances the law permits us to refuse access — for example, where giving access would pose a serious threat to someone's life, health or safety, or would unreasonably affect another person's privacy. If we refuse, we will tell you why and explain how you can complain.

10. Data breaches

We are subject to the Notifiable Data Breaches scheme, and we maintain a data breach response plan. If a data breach occurs that is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner, as required by the Privacy Act.

11. Automated decision-making

We do not use automated decision-making. No computer program is used to make, or to substantially assist in making, decisions about your care or about the service we provide to you. Your echocardiogram is performed by a qualified sonographer and reported by a consultant cardiologist.

We use booking and practice management software to manage appointments and send appointment reminders. This software does not make decisions about your care.

12. Complaints

If you believe we have mishandled your personal information or health information, please tell us. We would rather hear about it and put it right.

Complaints should be directed to our Privacy Officer:

If you would prefer to make your complaint in writing by post, please contact us and we will provide a postal address.

We will acknowledge your complaint within 5 business days, and respond in full within 30 days. If we need longer than that, we will let you know and explain why.

If you are not satisfied with our response, you can contact:

13. Changes to this policy

We review this policy periodically and may update it. The current version is always available on this page, and the date it was last updated is shown at the top.

14. How to contact us

If you would prefer to write to us, please contact us by email or phone and we will provide a postal address.