Loading…
Effective date: [date]·Last updated: [date]
This Privacy Policy applies to [legal entity name] (ABN [ABN]), trading as Leyla Oxley Naturopathy and Highlands Dispensary (“we”, “us”, “our”). It covers our website at highlandsdispensary.com.au, our online dispensary and patient portal, our naturopathic consultations, and our related services.
We take your privacy seriously. As a health service provider in New South Wales, we are bound by:
Because we provide a health service and hold health information, we are covered by the Privacy Act regardless of our annual turnover (the small-business exemption does not apply to us).
This policy explains what personal and health information we collect, why, how we hold it, who we share it with, and the rights you have over it.
We collect personal information and, in the course of providing naturopathic care, health information (a category of sensitive information that attracts higher protection).
Identity and contact information. Name, date of birth, gender, email address, phone number, and postal and delivery addresses.
Account information. Login email for magic-link authentication, and records of your activity within the patient portal.
Health information. Information you provide during intake and consultation, your health history, symptoms, conditions, medications and supplements, lifestyle information, the results of mineral screening (including Oligoscan reports), consultation notes and recordings or transcripts of consultations, your signed Protocol, and any Treatment Plan or supplement Stack prepared for you.
Transaction information. Records of your consultations, orders, subscriptions, the products supplied to you, and dispensing records.
Payment information. Payment is processed by our payment provider (Stripe). We do not store full card numbers on our systems; we receive limited transaction details such as the outcome of a payment and the last digits and type of card.
Technical information. When you use the website we may collect your IP address, device and browser type, and usage information through cookies and similar technologies (see section 10).
We collect health information only where it is reasonably necessary for, and directly related to, providing your care, and we collect it with your consent.
We collect information:
If we receive health information about you from a third party, we will take reasonable steps to make you aware that we hold it, as required under the HRIP Act.
Wherever it is lawful and practicable, you may deal with us anonymously or under a pseudonym. In most cases this will not be practicable, because we cannot safely consult, prescribe, compound or dispense without knowing who you are.
We use your information to:
We only use or disclose your health information for the purpose for which it was collected, for a directly related purpose you would reasonably expect, or where you consent or the law otherwise permits or requires it.
We do not sell your personal or health information. We share it only as needed to provide our services or as required by law, including with:
We require our service providers to handle your information consistently with this policy and the law, and we limit what we share to what each provider needs.
Some of our service providers are located, or store data, outside Australia, primarily in the United States (for example, certain payment, transcription, file-storage and AI-processing services). Our primary patient database and application hosting are located in Australia (Sydney region).
The HRIP Act places specific restrictions on transferring health information outside New South Wales. We will only transfer your health information outside NSW or overseas where one of the conditions permitted under HPP 14 and APP 8 applies, including where:
Where we disclose personal information overseas, we take reasonable steps to ensure the recipient handles it in accordance with the Australian Privacy Principles. Please note that by providing your information and using our services you consent to these transfers on the basis described in this policy.
We take reasonable technical and organisational steps to protect your information against loss, misuse, and unauthorised access, modification or disclosure. These include access controls, encryption in transit, role-based access, audit logging, and append-only dispensing records.
If we experience a data breach that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in line with the Notifiable Data Breaches scheme.
We retain health information for at least as long as the law requires. Under section 25 of the HRIP Act, we generally keep your health information:
We keep other personal and transaction information for as long as needed for the purposes described in this policy and to meet our legal, tax and record-keeping obligations, after which we take reasonable steps to destroy or de-identify it.
We use AI tools to assist with tasks such as organising consultation notes and surfacing relevant information from clinical records. These tools support the practitioner; they do not make clinical decisions about your care. All clinical assessments, prescriptions, compounded formulations and dispensing approvals are made by Leyla Oxley as the practitioner of record. We do not make decisions that have a legal or similarly significant effect on you solely by automated means.
We will send you communications necessary to provide your care, manage your orders and operate your account. We will only send you marketing communications where you have consented or where the law otherwise permits, and every marketing message will include a way to unsubscribe, consistent with the Spam Act 2003 (Cth). You can opt out of marketing at any time by using the unsubscribe link or by contacting us.
Our website uses cookies and similar technologies to operate the site, keep you signed in, remember your preferences, and understand how the site is used. You can control cookies through your browser settings, though some features may not work properly if you disable them. Where we use analytics, we use it to improve the website and our services.
You have the right to ask for access to the personal and health information we hold about you, and to ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading.
To make a request, contact us using the details in section 13. We will respond within a reasonable time and without excessive delay or expense. In limited circumstances we may decline access or correction as permitted under the Privacy Act or the HRIP Act, in which case we will explain why and how you can seek review. We may need to verify your identity before acting on a request.
If you have a concern about how we have handled your personal or health information, please contact us first using the details below so we can try to resolve it.
If you are not satisfied with our response, you can complain to:
[legal entity name]
Trading as Leyla Oxley Naturopathy and Highlands Dispensary
ABN [ABN]
[postal address]
Email: [privacy contact email]
Phone: 0430 154 556
We may update this policy from time to time. The current version will always be available on our website, and the “Last updated” date shows when it last changed. Significant changes will be notified where required by law.