Privacy Policy

Last updated: 13th September 2026

St George Private Cardiology (“St George Private Cardiology”, “we”, “our” or “us”) respects your privacy and is committed to protecting the personal and health information entrusted to us. We handle personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), the Health Records and Information Privacy Act 2002 (NSW) and other applicable privacy and health-records legislation.

This Privacy Policy explains how we collect, use, disclose, store and protect personal information, including health information, and how you may access or correct information we hold about you.

Information we may collect

The information we collect depends on your interaction with St George Private Cardiology and may include:

• your name, date of birth, address and contact details;
• Medicare, Department of Veterans’ Affairs and private health insurance details;
• emergency-contact and next-of-kin information;
• information provided by your referring doctor and other healthcare providers;
• information about your current and previous medical conditions, symptoms, medications, allergies and relevant family medical history;
• consultation notes, clinical correspondence, test results, medical images, reports and treatment information;
• information relating to procedures, hospital admissions and follow-up care;
• appointment, billing and payment information;
• information provided through our website, telephone, email, online forms and appointment or enquiry services; and
• technical information relating to use of our website, such as IP address, browser type, device information and website activity.

Health information is sensitive information under Australian privacy law. We will collect health information only where reasonably necessary for healthcare or related purposes and where collection is permitted or required by law.

How we collect information

We generally collect personal information directly from you, or from a parent, guardian or authorised representative. Where appropriate, we may also collect information from:

• your referring doctor, general practitioner or other treating specialist;
• hospitals and other healthcare facilities;
• pathology and diagnostic-imaging providers;
• allied health professionals and other members of your treating team;
• Medicare or the Department of Veterans’ Affairs;
• private health insurers; and
• other persons or organisations involved in your care, where permitted by law.

We may also collect information when you communicate with us by telephone, email, through our website, or through online appointment, booking or enquiry services.

Where lawful and practicable, you may interact with us anonymously or using a pseudonym. However, we will ordinarily require accurate identifying and health information to provide safe and effective medical care.

Why we collect and use your information

We may collect, hold, use and disclose your personal information to:

• arrange and manage appointments;
• assess, diagnose and manage your health;
• provide cardiology consultations, investigations, procedures, treatment and follow-up care;
• communicate with you and other healthcare providers involved in your care;
• obtain, review and provide relevant medical records, test results, images and reports;
• coordinate care with hospitals and other healthcare services;
• process Medicare, Department of Veterans’ Affairs, private health insurance and billing matters;
• maintain appropriate clinical, administrative and financial records;
• respond to enquiries, feedback and complaints;
• maintain, administer and improve our practice, systems and website;
• meet professional, accreditation, insurance, regulatory and reporting requirements;
• undertake quality assurance, clinical audit, education or research where permitted by law; and
• comply with our professional, ethical and legal obligations.

We will generally use personal information for the purpose for which it was collected, or for a related purpose that you would reasonably expect. We may use or disclose information for another purpose where you have consented, where permitted or required by law, or where otherwise authorised under applicable privacy legislation.

Disclosure of information

To provide appropriate healthcare and operate our practice, we may disclose relevant personal information to:

• doctors, nurses, administrative staff and other personnel involved in providing services through St George Private Cardiology;
• your general practitioner, referring doctor, treating specialists and other members of your healthcare team;
• St George Private Hospital and other hospitals or healthcare facilities involved in your care;
• pathology providers, diagnostic-imaging providers, pharmacies and allied health professionals;
• Medicare, the Department of Veterans’ Affairs and private health insurers;
• organisations involved in arranging or facilitating your healthcare, where appropriate;
• service providers supporting our practice-management, medical-record, appointment, billing, communications, information-technology and document-storage systems;
• professional advisers, insurers, auditors and accreditation bodies; and
• government agencies, regulators, courts or law-enforcement bodies where disclosure is authorised or required by law.
• You at your request

If you request transfer of records via email, you understand and accept the email is not a secure medium. It may be obtained and used without consent if cyber breaches of email occur. 

We will disclose only information that is reasonably necessary for the relevant purpose, subject to applicable law.

We do not sell patients’ personal or health information.

Hospital and healthcare-provider information

Where you receive care at St George Private Hospital or another hospital or healthcare facility, relevant clinical information may be exchanged between St George Private Cardiology, the hospital and other members of your treating team to facilitate safe and appropriate care. This may include referrals, consultation information, medication information, investigation results, medical imaging, procedure reports, discharge information and follow-up correspondence. Information may also be incorporated into, or accessed through, electronic medical-record and healthcare-information systems used by healthcare providers involved in your care.

Website enquiries and email

Information submitted through our website or by email is not intended for urgent medical matters.

Please do not use a general website enquiry form or ordinary email to provide extensive or highly sensitive medical information unless St George Private Cardiology has specifically requested that information through that channel. Although we take reasonable steps to protect electronic communications, ordinary email and internet transmissions cannot be guaranteed to be completely secure. Submitting an online enquiry does not create a doctor–patient relationship or guarantee that your enquiry will be reviewed within a particular timeframe. If you are experiencing a medical emergency, call 000 or attend your nearest hospital emergency department.

Cookies and website information

Our website may use cookies and similar technologies to:

• support website functionality;
• understand how visitors use our website;
• monitor website performance; and
• improve the online experience.

This may involve collecting information such as your IP address, browser type, device information, pages visited and the date and time of your visit. This information will not ordinarily identify you directly. However, it may constitute personal information where it can reasonably be associated with an identifiable individual.

You may be able to limit or disable cookies through your browser settings. Some website functions may not operate correctly if cookies are disabled.

Storage and security

We take reasonable physical, administrative and technical measures to protect personal information against loss, misuse, interference and unauthorised access, modification or disclosure. These measures may include:

• secure clinical and practice-management systems;
• appropriate access controls and user permissions;
• confidentiality obligations for staff and contractors;
• password protection and authentication measures;
• secure electronic and physical storage; and
• policies and procedures governing the handling of personal information.

No electronic system or method of transmission can be guaranteed to be completely secure.

If we become aware of a data breach involving personal information, we will assess and respond to the incident in accordance with applicable privacy and data-breach notification requirements, including the Notifiable Data.

Breaches scheme where applicable.

We retain clinical and administrative records for the periods required by law and applicable professional standards. When information is no longer required to be retained, we take reasonable steps to securely destroy it or permanently de-identify it.

Overseas disclosure and service providers

Some technology, website-hosting, email, data-storage, software or support providers used by St George Private Cardiology may process or store information outside Australia, including in the United States or other countries where those providers operate. Where personal information is disclosed to or accessed by an overseas service provider, we take reasonable steps to ensure that the information is handled in accordance with applicable Australian privacy requirements. Where practicable, we seek to use systems and service providers that provide appropriate security and privacy protections for Australian healthcare information.

Accessing and correcting your information

You may request access to personal or health information we hold about you.

You may also ask us to correct information if you believe it is inaccurate, incomplete, out of date or misleading.

Requests should generally be made in writing and should contain sufficient information to allow us to verify your identity and locate the relevant records. We will respond to requests within a reasonable period and in accordance with applicable privacy and health-records legislation. In some circumstances, access may be limited or refused where permitted or required by law. If this occurs, we will generally provide written reasons and explain any available options. A reasonable administrative fee may apply to providing access to or copies of records where permitted by law. You will not be charged simply for making an access request.

Direct communications

From time to time, St George Private Cardiology may send practice-related communications where permitted by law. You may ask us not to send non-essential or promotional communications by using an unsubscribe facility where provided or by contacting the practice. Opting out of non-essential communications will not prevent us from sending communications reasonably required for your appointments, treatment, billing, results, follow-up care or other healthcare purposes.

Privacy enquiries and complaints

If you have a question, concern or complaint about the way St George Private Cardiology has collected, used, disclosed or handled your personal or health information, please contact us using the contact details published on our website. Please provide sufficient information about your concern to allow us to investigate the matter.

We will acknowledge and investigate privacy complaints and provide a response within a reasonable period, having regard to the nature and complexity of the complaint. If you are not satisfied with our response, or if you wish to make a complaint directly to a privacy regulator, you may contact:

• the Office of the Australian Information Commissioner (OAIC); or
• the NSW Information and Privacy Commission (IPC NSW).

Further information about making a privacy complaint is available from those organisations.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our services, information-handling practices, technology or legal obligations. The current version will be published on our website and will identify the date on which it was last updated.