Privacy Policy

1. PURPOSE OF POLICY

1.1 The purpose of this Privacy Policy is to communicate to you how PRP Diagnostic Imaging (ABN 18 416 389 099) (PRP, we, us) manage, collect, deal with, protect and allow access to personal information in accordance with the Privacy Act 1988 (Cth) (the Privacy Act),the Australian Privacy Principles included as Schedule 1 to the Privacy Act (the APPs), the Health Records Act 2001 (Vic), the Health Records and Information Privacy Act 2002 (NSW) and the Health Records (Privacy and Access) Act 1997 (ACT) (together with the Privacy Act and the APPs, Privacy Laws). It also describes your rights in relation to the personal information we hold about you.

1.2 This Privacy Policy is available on our website at www.prpimaging.com.au/privacy.  We set out below how we comply with Australian law (including the Privacy Laws) when managing your personal and sensitive information. We may change this Privacy Policy from time to time by publishing changes to this policy on our website. We encourage you to check our website periodically to ensure that you are aware of our current Privacy Policy.

2. SCOPE

2.1 We understand the importance placed on the privacy of your personal information. This Privacy Policy applies to the management of the personal information of our patients, clients and suppliers.

2.2 This Privacy Policy does not apply to our acts and practices in relation to employee records.

3. DEFINITIONS

In this Policy, the following terms are defined as:

3.1 “PRP” refers to PRP Diagnostic Imaging.

3.2 “Privacy Officer” refers to PRP Diagnostic Imaging’s appointed Privacy Officer

3.3 “Patient Advocate” refers to PRP Diagnostic Imaging’s appointed Patient Advocate.

3.4 “OAIC” refers to the Office of the Australian Information Commissioner.

3.5 “NDB” refers to the Notifiable Data Breach.

4. POLICY

4.1 WHY DO WE COLLECT, HOLD, USE AND DISCLOSE PERSONAL INFORMATION?

The types of information we collect is set out below. The information you may have provided to us is ‘personal information’ as defined by the Privacy Act. If you are a patient or client of ours, the information we collect may include ‘health information’ as defined by the Privacy Act. We may collect, hold, use and disclose your personal information (and health information, if applicable) where it is reasonably necessary in order to provide health care services to you and for the other purposes set out in this Privacy Policy including:

to provide you with our services (including scans and reports);

enabling third-party service providers to provide us with services, such as accounting and auditing services, legal advice, information technology,

complying with our legal obligations (including our legal obligations as an accredited healthcare provider);

maintaining and updating our records.

Where we need to collect health information about you, we will seek your consent before doing so, subject to any exceptions under applicable Privacy Laws.

Where required by law, we will not collect, hold, use or disclose personal information without your consent.

You do not have to supply us with your personal information, but if you choose not to do so we may be unable to provide the health care services required or sought by you or otherwise deal with you.

If you would like to access any of our services or deal with us on an anonymous basis or by using a pseudonym, please tell us. However, we will require you to identify yourself if:

we are required by law to deal with individuals who have identified themselves; or

it is impracticable for us to deal with you if you do not identify yourself or elect to use a pseudonym.

Please be aware that your request to be anonymous or to use a pseudonym may affect our ability to provide you with the requested services.

4.2 WHAT KIND OF PERSONAL INFORMATION DO WE COLLECT?

The nature and extent of personal information that we collect varies depending on your particular interaction with us and the nature of our functions and activities.

If you are a patient or client of ours, personal information that we commonly collect, hold, use and disclose may include your:

name, gender, date of birth and contact details (including your preferred means of contact) and proof of identity documents;

next of kin;

medical history and health services provided (which we collect with your consent only);

Clinical photography where relevant to your diagnosis

government identifiers (including Medicare, pension and/or health care card information);

insurance identifiers including private health insurance membership details;

education and employment details;

billing information (including your bank details);

driver’s licence number;

hobbies and interests;

lifestyle information needed to provide healthcare products and services to you including dietary and exercise information and information about smoking, alcohol and drug use;

when you visit our premises, we may collect information such as images from CCTV cameras located in our clinics;

information about how you engage with us, survey responses and other feedback given;

profile information such as details of your religion or ethnicity that is relevant in the services we provide to you.

If you are a supplier of ours, personal information that we commonly collect, hold, use and disclose may include your:

name and contact details (including your preferred means of contact); and

billing information (including your bank details).

If you visit our website, use our apps or receive our electronic communications:

online activity information through your interaction with our websites, apps, advertisements, social media profiles and electronic communications, including what you click on including via the use of cookies, tags and tracking pixels;

We may collect online activity information, such as pages visited, links clicked, device and browser type, IP address, whether you open our emails, and whether you click links in our emails or SMS messages.

We collect this using cookies, tags, pixels and similar technologies, some of which are provided by third parties, such as analytics and advertising providers, who may receive this information.

On our online booking site, we use analytics only to understand and improve the booking experience. These tools do not record personally identifiable information. You can manage or disable cookies through your browser settings

4.3 HOW DO WE COLLECT YOUR PERSONAL INFORMATION?

Where possible, we will collect personal information directly from you. This information may be collected through interviews, appointments, forms and questionnaires (whether in hard copy or electronic format, including information submitted via our website or other electronic means).

If you are uncomfortable sharing particular aspects of your personal information with us, please let us know.

Where it is unreasonable or impracticable to collect personal information directly from you, we may also obtain personal information about you from a third party source, such as from your next of kin or other family member or from other health professionals (including general practitioners, specialists and allied health workers) who are treating you or who have referred you to us. If we collect information about you in this way, we will take reasonable steps to contact you and ensure that you are aware of the purposes for which we are collecting your personal information and the organisations to which we may disclose your information, subject to any exceptions under applicable Privacy Laws. We will not collect any information regarding your medical history and health services provided from a third party source unless we have received your consent or you have agreed to this information being provided to us.

If we receive unsolicited personal information about you that we could not have collected in accordance with this Privacy Policy and applicable Privacy Laws, we will within a reasonable period, destroy or de-identify such information received.

Our internet service provider may record details of your visits to our website. This information will only be used by us internally for statistical and research purposes.

Information through the use of digital technologies like cookies, tags and pixels (“CTP’s”) may also be collected when you use our websites, apps or social media platforms. CTP’s may also come from third-party services (for example, LinkedIn) for the purposes of collecting data to enable website or app security, performance measurement, advertising and analytics. Generally, this information will not identify you and we do not link it back to your identity or other information that you have provided to us.

4.4 HOW DO WE STORE AND SECURE YOUR PERSONAL INFORMATION?

We hold your personal information in a number of forms, including electronic or digital images, and hard copy paper based documents. We employ a range of physical and electronic security measures to ensure your personal information is adequately protected. These measures include:

storing your personal information in a secure facility;

using anti-virus software to protect electronic information; and

limiting access to your personal information to those persons who are required to access it for the purpose of providing services to you or us.

We will take reasonable steps to protect personal information from misuse, interference and loss, unauthorised access, modification or disclosure. We cannot ensure or warrant that your personal information will always be protected from unauthorised access during storage therefore you provide your personal information to us at your own risk. Please contact us immediately if you become aware or have reason to believe there has been any unauthorised use of your personal information.

Should personal information be subject to misuse, interference, loss or unauthorised access, modification or disclosure, we will respond in accordance with our policies and procedures and the requirements of applicable Privacy Laws.

4.5 WHEN DO WE USE AND DISCLOSE YOUR PERSONAL INFORMATION?

We will only use and disclose your personal information (and health information, if applicable):

if you are a patient or client, to provide our health care services to you (which is the primary purpose that we collect patient information for);

to deal with you or manage our relationship with you;

if we get your consent to use or disclose this information for another purpose;

for secondary purposes which are related (or directly related, in the case of health information) to the primary purpose for which the information was collected; or

in accordance with this Privacy Policy and applicable Privacy Laws; or

as required by law or court or tribunal order.

If you are a patient or client, we may disclose your personal information and health information to other parties including:

your referring healthcare professional and other healthcare and medical professionals. These other healthcare and medical professions may be:

involved in, or consulted in relation to, your treatment, the provision of medical services to you and consideration of the best treatment options available to you;

involved in broader patient-related discussions (as part of a team of healthcare and medical professionals); and/or

practising at external healthcare facilities (including, but not limited to, public and private hospitals), including emergency departments;

where your referring healthcare professional requests for us to do so, third parties for the purposes of surgical planning, treatment planning or additional health management;

Medicare and/or health funds for payment of fees;

State and Federal Government agencies where required by law or court or tribunal order;

our professional advisors, including our accountants, auditors and lawyers, for the purpose of obtaining advice with respect to our obligations;

our Related Entities and Related Bodies Corporate (as those terms are defined in the Corporations Act 2001 (Cth)); and

our contractors and suppliers for the purpose of ensuring we provide quality health care services to you, including external service providers involved in the installation, maintenance and repair of hardware and software for the purpose of maintaining and improving the functionality of our systems and practices.

We may also collect, use, store and disclose your personal information and health information for:

the training of healthcare professionals, including registrars;

medical research undertaken and published by both internal PRP Diagnostic Imaging staff and external healthcare professionals and their research teams; and

inclusion in computerised systems designed to link health records held by different organisations, such as My Health Record, as you would reasonably expect or have otherwise consented to.

Periodically, we may disclose data to other organisations undertaking research (such as universities, medical research institutes, pharmaceutical companies and cancer councils) that has been aggregated/de-identified. We will only disclose identified data if it is necessary for the purposes of the research and disclosure is permitted under the Privacy Act 1988 (Cth).

My Health Record

We may access the personal information your My Health record contains if you participate in this. We may also disclose your personal information by uploading your health information electronically to the My Health Record system if requested, or required by law, to do so.

If you do not want us to access personal information stored in your My Health Record or upload health information to it, you may opt out or choose to modify access controls within the My Health Record system.

Your personal information and health information may also be disclosed by us for use in teaching medical students and medical research projects, and shared with our third party AI providers (including as provided for below) in a secure environment to provide healthcare services to you in a de-identified form.

In the event that we disclose your medical history and / or details of health services provided to a third party and we do not continue to hold a copy of such information ourselves, we will retain a record of the name and address of the third party to whom that information was transferred.

Use of Data for Artificial Intelligence and Machine Learning

What does this mean?

Artificial intelligence (AI) and machine learning (ML) technologies are increasingly used in radiology to help detect conditions in medical images – for example, identifying potential fractures, cancers, or other abnormalities. These AI tools are developed by training computer algorithms on large collections of medical images so that they can learn to recognise patterns.

How might your data be used?

We may share patient imaging data – including de-identified imaging data – in a secure environment with third party AI technology partners for the purpose of:

testing the accuracy of our AI algorithms; and

improving AI-assisted diagnostic tools for use in healthcare.

Who are our AI technology partners?

Our third-party AI technology partners may include healthcare AI companies such as:

diagnostic imaging AI companies developing tools for the detection of conditions in medical images; and

academic or research institutions working on AI in healthcare.

We will maintain a register of current AI technology partners, which you may request from our Privacy Officer at any time.

What is de-identification?

De-identification means removing or altering information that could reasonably identify you – such as your name, date of birth, address and Medicare number so that the data can no longer be linked back to you as an individual. However, whilst de-identification significantly reduces the risk that you could be re-identified from your imaging data, it cannot eliminate that risk entirely. Medical images may contain unique anatomical features, and advances in technology could potentially enable re-identification in the future. We require our AI technology partners to implement strong data governance and security safeguards to minimise this risk.

Disclosure to Third Parties (Including Technology Partners)

In addition to the disclosures described above, we may disclose your personal or health information to the following categories of third parties:

IT service providers who maintain our radiology information systems and picture archiving systems (PACS);

cloud storage and data hosting providers;

debt collection agencies (where you have an outstanding account);

professional indemnity insurers;

government agencies and regulators where required or authorised by law (e.g., mandatory reporting obligations, court orders, subpoenas); and

accreditation bodies for quality assurance purposes.

4.6 DO WE SEND YOUR PERSONAL INFORMATION OVERSEAS?

In order to provide services to you, we may be required to disclose your personal information to overseas recipients, including third party software providers and contracted radiologists who we engage to provide reporting services. These overseas recipients are typically located in Canada, India, New Zealand, the Philippines, South Africa, the United Kingdom, and the United States of America. We will take reasonable steps to ensure that overseas recipients comply with their privacy obligations.

4.7 ACCESS AND AMENDMENT OF YOUR PERSONAL INFORMATION

We will take reasonable steps to ensure that the personal information held by us is accurate, up-to-date, complete, relevant and not misleading.

You have a right to access your personal information, subject to some exceptions. Such access may be granted or refused by us in accordance with applicable Privacy Laws. If we are not required to provide you with access to any or all of your personal information, we will tell you why.

To request access to personal information, please contact us using the details below or complete the Request to Access Medical Records form which is available from our practices. We will respond to your request within a reasonable period, and in any event within any required timeframes set out in applicable Privacy Laws.

If you believe that your personal information is inaccurate, incorrect or incomplete, please contact us and we will take reasonable steps to ensure that it is corrected.

If you make a request for access to or correction of personal information, we will:

respond to your request within a reasonable period, and in any event within any required timeframes set out in applicable Privacy Laws; and

if reasonable and practicable, give access to or correct the information in the manner requested.

If we refuse your request, we will provide you with written reasons for doing so.

4.8 INTEGRITY OF YOUR PERSONAL INFORMATION

In accordance with applicable Privacy Laws, we will take reasonable steps to:

ensure that the personal information that we collect is accurate, up to date and complete;

ensure that the personal information we hold, use or disclose is, with regard to the relevant purpose, accurate, up to date, complete and relevant; and

secure your personal information.

We will also take reasonable steps to destroy or de-identify personal information that we hold if we no longer need the information for the primary purpose for which the information was collected and we are not otherwise required by law to retain the information.

4.9 EMAILING OF PERSONAL INFORMATION AND RECORDS

It is a policy of PRP Diagnostic Imaging that a report is not emailed to patients. Patients are encouraged to request personal copies of reports from their referring health care practitioner, or access their report via the PRP patient portal, myPRP. If a patient requests their report directly from PRP, a hard copy may be printed and handed to the patient, or mailed to their postal address.

5. COMPLAINTS

We take our privacy obligations very seriously. If you have any concerns about the manner in which your personal information is handled by us, please contact our Privacy Oﬃcer on (02) 9981 4500 or privacy@prpimaging.com.au. Formal complaints regarding breach of privacy should be made to our Privacy Oﬃcer in writing.

We will reasonably endeavour to respond to your complaint within 30 days of receipt.

If you think that we have failed to resolve your complaint satisfactorily, we will provide you with information about the further steps you can take.

6. HOW TO CONTACT US

If you have any questions or would like further information regarding your privacy please contact our Privacy Oﬃcer on (02) 9981 4500 or privacy@prpimaging.com.au.

7. FURTHER DETAILS

PRP Imaging reserves the right to update and review this policy at any time.

Updated November 2026