PRIVACY POLICY
How we collect, use, store and protect personal and health information.
1. Introduction
Dr Hon Chuen Cheng (Alan) Obstetrics & Gynaecology (we, us, our, the Practice), is committed to protecting the privacy of our patients and website visitors. This Privacy Policy explains how we collect, use, store, disclose and otherwise handle your personal information and sensitive health information.
Our practice is located at 1187 Logan Road, Holland Park West 4121. We provide specialist obstetrics & gynaecological medical services to patients.
This Privacy Policy applies to all personal information collected by dralancheng.com.au , whether collected in person, through our website (dralancheng.com.au), through our technology platforms, or through any other means.
We recommend you read this Privacy Policy carefully. By attending our practice or using our services, you consent to the practices described in this Policy.
2. Our Legal Obligations
We are bound by a number of laws that govern how we handle your personal and health information:
- Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs), which set out how we must collect, use, disclose, and store personal information;
- Any applicable Queensland health, privacy and confidentiality laws and requirements relevant to the healthcare services we provide.
- My Health Record Act 2012 (Cth), which governs how we access and upload information to the national My Health Record system;
- Healthcare Identifiers Act 2010 (Cth), which regulates how we use Individual Healthcare Identifiers (IHIs) and Healthcare Provider Identifiers;
- Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988 (Cth), which requires us to notify you and the OAIC if your information is involved in a data breach that is likely to cause serious harm; and
- Spam Act 2003 (Cth), which applies to commercial electronic messages we send to you.
Where there is any inconsistency between the requirements of these laws, we will comply with the more stringent obligation.
3. What Personal Information We Collect
The types of personal and health information we collect and hold about you include:
3.1 Personal Information
- Your full name, date of birth, gender identity, and contact details (address, phone number, email address);
- Emergency contact details;
- Medicare number and Individual Healthcare Identifier (IHI);
- Private health insurance details (where applicable);
- Billing and payment information collected through the payment systems or service providers used by the relevant clinic or healthcare provider
- ); and
- Information you provide when completing intake forms, questionnaires, or when contacting us.
3.2 Sensitive Health Information
Health information is a category of sensitive information under the Privacy Act and attracts a higher level of protection. Under Australian Privacy Principle 3.3, we will only collect sensitive health information about you with your express consent, or where collection is required or authorised by law. We collect and hold:
- Medical history, presenting symptoms, diagnoses, and clinical assessments;
- Medications, allergies, and treatment plans;
- Referral letters and specialist correspondence;
- Pathology and imaging results;
- Clinical notes generated during or after your consultation, including notes generated with the assistance of AI tools (see Section 7);
- Telehealth consultation records; and
- Any other information you provide to us in the course of seeking medical care.
3.3 Information Collected Through Our Technology
- Information entered when booking appointments or completing online forms;
- Information collected when you interact with our website, including analytics data (see Section 12); and
- Information captured through our AI recording and transcription tools during consultations (with your express consent – see Section 7).
3.4 Unsolicited Information
If we receive personal or health information about you that we did not request, we will assess whether that information is information we could have collected under this Policy. If it is, we will handle it in accordance with this Policy. If not, we will destroy or de-identify it as soon as practicable, provided it is lawful and reasonable to do so.
4. How We Collect Your Information
- Directly from you – when you register as a patient, complete intake forms or questionnaires, attend a consultation (in person or via telehealth), contact us, or sign up for our newsletter;
- From other healthcare providers – referrals, specialist reports, pathology results, or clinical correspondence;
- From Medicare and Services Australia – in connection with claims and healthcare identifier verification;
- Through authorised health information systems and technology platforms used in connection with your care, including Genie for medical records and, where applicable and authorised, the My Health Record system.
We will generally collect personal information directly from you. If we need to collect information about you from a third party, we will take reasonable steps to notify you.
4.1 Anonymity and Pseudonymity
Under Australian Privacy Principle 2, you have the right to deal with us anonymously or using a pseudonym where it is lawful and practicable. For medical treatment, it is generally not practicable to treat patients anonymously, as we are required to maintain accurate clinical records and verify your identity for Medicare purposes. However, where you interact with our website or make a general enquiry that does not involve receiving a health service, you may do so without identifying yourself, where our systems permit this.
5. Why We Collect and Use Your Information
- Providing you with medical care and treatment;
- Managing your healthcare, including communicating with treating clinicians, specialists, pharmacies, and allied health providers;
- Booking, confirming, and managing your appointments;
- Processing payments and submitting Medicare or private health insurance claims;
- Uploading clinical information to the My Health Record system (where applicable);
- Sending appointment reminders, health recalls, and newsletters or health updates (where you have consented);
- Complying with our legal, regulatory, and professional obligations including AHPRA and Medicare; and
- Internal administration, quality improvement, and practice management.
We will not use your personal information for any purpose unrelated to your healthcare or our practice management without your consent, unless required or authorised by law.
6. Who We Share Your Information With
6.1 Healthcare Providers
- Specialists and other healthcare providers to whom we refer you;
- Other treating clinicians involved in your ongoing care;
- My Health Record – we may upload relevant clinical information where you participate in the system; and
- Diagnostic and allied health services (pathology, imaging), where necessary for your treatment.
6.2 Administrative and Operational Third Parties
- Our payment platforms – Tyro
- Third-party medical administration, reception and virtual assistant services engaged by the Practice from time to time. These contractors are required to handle patient information confidentially and in accordance with our privacy obligations; and
- Our technology vendors include Genie; our AI scribe and dictation providers; and our patient communications, CRM, AI chatbot and AI telephony providers. Some of these vendors may store data overseas – see Section 8.
6.3 Regulatory and Legal Bodies
- Medicare / Services Australia – for processing claims and verifying healthcare identifiers;
- AHPRA – where we are required to report or respond to a regulatory matter;
- Courts, tribunals, or law enforcement agencies – where required or authorised by law; and
- The OAIC or the Health Complaints Commissioner ) – in connection with a complaint or investigation.
We will not sell your personal information to any third party, nor disclose it for marketing purposes without your consent.
7. Overseas Disclosure of Your Information
We may use third-party service providers and technology platforms to support the delivery of healthcare, administration, communications, payments and other related services.
Some service providers may process or store personal information outside Australia. Where personal information is disclosed to an overseas recipient, we will take reasonable steps to ensure that it is handled in accordance with applicable Australian privacy requirements, including Australian Privacy Principle 8 (APP 8), where relevant.
We will only disclose personal information overseas where reasonably necessary for the provision of our services, or where otherwise permitted or required by law.
Where practicable, we will seek to use service providers that apply appropriate privacy and security safeguards. Data storage locations may vary between providers and may change from time to time.
9. How We Store and Protect Your Information
9.1 Primary Clinical Records
Your primary clinical records are currently maintained using Genie. If we transition to another clinical record system in the future, relevant records may be migrated to that system in accordance with applicable privacy, security and record-keeping requirements.
We take reasonable steps to protect personal and health information from misuse, interference, loss, unauthorised access, modification or disclosure, including through appropriate access controls and security measures.
9.2 Quality of Information
We take reasonable steps to ensure that the personal and health information we hold, use, and disclose is accurate, up to date, complete, and relevant. We encourage you to notify us if any of your information changes or if you believe any information we hold is inaccurate. See Section 14.2 for your right to seek correction of your records.
9.3 Access Controls
- Access to patient records is limited to clinical staff and authorised contractors who require access to perform their duties;
- Contractors and third-party staff who access patient data are subject to confidentiality obligations; and
- All staff and contractors are expected to handle patient information in accordance with this Policy and applicable law. We are formalising our privacy training programme.
9.4 Personal Devices (BYOD)
Some staff and contractors may access patient records on personal devices. We require that any such devices be password-protected and have appropriate security measures in place. We are developing a formal BYOD policy to govern this practice.
9.5 Paperless Practice
Dr Alan Cheng operates as a paperless practice. All records are stored electronically in our clinical management platforms. Secure shredding is used for any incidental paper documents no longer required.
9.6 Practice Changes
From time to time we engage new staff and contractors to support the Practice. All new staff and contractors are required to comply with this Policy from the date of their engagement.
10. How Long We Keep Your Information
We retain your personal and health information for as long as required by law. Under Victorian law, health records must be retained for a minimum of 7 years from the date of the last entry.
AI-generated transcripts and clinical notes are retained as part of your clinical record and are subject to the same retention obligations as other health records.
When your information is no longer required, it will be securely destroyed or de-identified. In the event that the practice closes or is transferred to another operator, we will take reasonable steps to ensure your records are transferred or disposed of in accordance with our legal obligations and with your privacy protected.
11. My Health Record and Healthcare Identifiers
11.1 My Health Record
dralancheng.com.au participates in the My Health Record system. We may access and upload clinical information – such as shared health summaries, discharge summaries, and prescription records – to your My Health Record, where you have one. You have the right to control what information is uploaded. For information about your My Health Record settings, please visit dralancheng.com.au
11.2 Individual Healthcare Identifiers (IHI)
We use Individual Healthcare Identifiers (IHIs) to manage your healthcare records and participate in the My Health Record system. IHIs are assigned by Services Australia and governed by the Healthcare Identifiers Act 2010 (Cth). We handle IHIs strictly in accordance with that Act.
12. Our Website and Digital Platforms
Our website is Dr Alan Cheng. We are developing a patient portal that will be subject to additional privacy terms upon launch.
Our website may use cookies and analytics tools (such as Google Analytics) to collect information about how visitors use our site. This information is generally collected in aggregate and not linked to individual patients. You may disable cookies through your browser settings.
We may maintain a social media presence. If we respond to online reviews or social media comments, we will not disclose any information that would identify you as a patient of the practice.
13. Patient Communications and Marketing
With your consent, we may send you:
- Appointment reminders;
- Health recall notices (for example, reminders for routine health checks or flu vaccinations); and
- Newsletters and health updates, where you have signed up through our intake form or questionnaire.
You may unsubscribe at any time by clicking the unsubscribe link in our emails or contacting us directly. Unsubscribing will not affect appointment reminders or clinically necessary communications. All electronic communications comply with the Spam Act 2003 (Cth).
14. Your Privacy Rights
14.1 Right to Access
You have the right to request access to the personal information and health records we hold about you. We will respond within 30 days. In limited circumstances, access may be refused – for example, where providing access would pose a serious threat to another person's life or health. If we refuse access, we will explain why in writing.
14.2 Right to Correction
If you believe information, we hold about you is inaccurate, incomplete, or out of date, you may ask us to correct it. We will correct or annotate your record as appropriate.
14.3 Right to Withdraw Consent
If you believe we have handled your personal or health information in a way that does not comply with the Privacy Act, applicable health privacy and confidentiality requirements, or this Policy, please contact us first.
If you are not satisfied with our response, you may make a complaint to:
- Office of the Australian Information Commissioner (OAIC) – www.oaic.gov.au
- Office of the Health Ombudsman (Queensland) – www.oho.qld.gov.au
15. Data Breaches
In the event of a data breach likely to cause serious harm, we will comply with our obligations under the Notifiable Data Breaches (NDB) scheme, including assessing the breach, notifying the OAIC, and notifying affected individuals as required. If you believe your information may have been compromised, please contact us immediately using the details in Section 17.
16. Changes to This Privacy Policy
We review and update this Privacy Policy from time to time to reflect changes in our practice, technology, or legal obligations. Given that our technology stack is actively evolving, this Policy is expected to be updated in the near future. The current version is always available at Dr Alan Cheng We will notify existing patients of any material changes by email or through our patient communications platform.
This Policy was last updated in June 2026 (Version 1.2).
17. Contact Us
If you have any questions about this Privacy Policy, wish to make a complaint, or want to access, correct, or withdraw consent in relation to your information, please contact our Privacy Officer:
Privacy Officer – Dr Alan Cheng
Dr Hon Chuen Cheng (Alan) Obstetrics & Gynaecology
Address 1187 Logan Road, Holland Park West, QLD 4121
Email:
We will respond to all privacy enquiries and complaints within 30 days of receipt.
18. Key Definitions
- Health information means information or an opinion about an individual’s health, disability, healthcare or related matters, as recognised under the Privacy Act 1988 (Cth) and any other applicable privacy, health and confidentiality requirements.
- Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, as defined in the Privacy Act 1988 (Cth).
- Sensitive information includes health information and other categories of sensitive information that attract additional protections under the Privacy Act 1988 (Cth).
- Australian Privacy Principles (APPs) are the privacy principles contained in Schedule 1 of the Privacy Act 1988 (Cth), which govern how APP entities handle personal information.
- Applicable privacy laws means the Privacy Act 1988 (Cth), the Australian Privacy Principles, and any other applicable Queensland or Commonwealth privacy, health, confidentiality and record-keeping requirements.
- Unsolicited information means personal information received by the Practice that was not actively sought or requested.