MTHC Enquiry Form Privacy Collection Notice

Current as of: July 2026

At a glance

We collect your information so we can provide safe, high-quality healthcare. We only use it for your care, to meet our legal obligations, or for purposes you would reasonably expect. We keep your information secure and only share it when necessary for your treatment or required by law.

What we collect

Information collected at the enquiry stage:

You will only be asked to provide necessary personal information relevant for your stage of the journey. For example, you will not be asked to disclose sensitive information at the appointment enquiry stage. Information you submit through our website forms is collected and securely stored, with access limited to clinical staff who need it.

Additional information collected if you attend an MTHC service:

We may collect personal and health information needed to provide care, including name, contact details, date of birth, medical history, medications, test results, consultation notes, and where clinically necessary, photographs, scans or recordings. We may also collect limited administrative information such as billing or referral details.

Why we collect it

We collect and use your information to:

• assess, support, advise, diagnose, treat and provide clinical services to you
• make and change appointments
• support administrative tasks like record‑keeping, referrals and billing
• meet our legal and regulatory obligations
• inform business analysis, quality assurance, reporting and planning.

How we collect it

We collect information directly from you whenever possible. We may also collect information from:

• your guardian or authorised representative
• other healthcare providers involved in your care (for example, specialists, allied health professionals, hospitals, community health services, pathology and diagnostic services)
• electronic transfer of prescriptions (eTP) and My Health Record
• government or administrative sources such as your health fund, Medicare, the Department of Veterans’ Affairs or the NDIS.

You will have opportunities to opt in to provide additional information when you visit our website, email or SMS us, call or make an online appointment.

When information is collected during a clinical encounter it may be recorded:

• verbally
• in writing
• visually (photos, videos, scans or xrays)
• via AI transcription tools.

You may withdraw consent for specific recording methods where practicable.

How we use and process information

Processing means collecting, using, storing, disclosing and securely disposing of information. We process your information only when it is needed for the purpose it was collected, it is for a related purpose you would reasonably expect, you have consented, or we are required or permitted to do so by law.

If you choose to opt in for marketing communication, we may send you promotional emails about MTHC services. We only do this with your explicit consent and we only use the minimum information required (usually your name and email address). You can withdraw consent or unsubscribe at any time. Marketing lists are not used for clinical care and do not include your clinical records.

Who we share information with

We may share your information with:

• other healthcare providers involved in your care
• third-party service providers who help us run our services (for example IT or accreditation providers)
• students on placement
• when required by law (for example court orders, mandatory disease notifications, or other legal processes).

We may also share information in specific circumstances like to lessen or prevent a serious threat to a person’s life or public health, to assist in locating a missing person, or to establish, exercise or defend legal claims. During clinical care we may share information via eTP and My Health Record.

We require third parties to meet appropriate privacy and security standards and, where practicable, to comply with the Australian Privacy Principles and our contractual privacy obligations.

Overseas storage

Your clinical records and other sensitive information are stored in Australia. The only personal information we store outside Australia is the limited information you provide when you opt in to receive marketing emails (typically your name and email address). We take reasonable steps to ensure any overseas providers meet appropriate privacy and security standards.

Research and de-identified data

We may provide de-identified data to researchers to improve population health and service quality. De-identified data cannot be used to identify you. It is stored in Australia. Please contact the clinic by phone or email if you do not want your de-identified data included.

How long we keep your information

We keep sensitive personal information for the period required by the Health Records Act 2001 (Vic) or the University’s retention and disposal rules. After that, we securely destroy or permanently deidentify your information.

Your choices and rights

You can ask to access or correct the personal information we hold about you, subject to legal limits and the privacy of others. You may also exercise other rights available under privacy law (for example, to request restrictions on use or disclosure).

If our collection or use of your information is based on consent, you can withdraw that consent at any time. Withdrawing consent will not affect any processing we lawfully carried out before you withdrew it, but it may impact our ability to provide ongoing healthcare services.

Where it is practical and lawful to do so, you may choose to be anonymous or use a pseudonym. If you do not provide information we reasonably require, we may be unable to provide certain services.

Further privacy information

For more detail about how we handle personal information, please see the:

• MTHC Privacy Policy
• MTHC Privacy and Confidentiality of Consumer and Staff Information
• University of Melbourne’s General Privacy Statement.

These documents explain:

• our legal basis for handling information
• how we collect, use and share information
• how we keep information accurate and secure
• how long we keep records
• your rights
• and the laws that apply.

For information about automatic data collection (for example, cookies on University websites) see the University’s Online Privacy Statement.

Questions or complaints

We take privacy concerns seriously. If you have a privacy question or complaint, email our Privacy Officer at mthc-privacy@unimelb.edu.au. We will acknowledge your email within 48 hours and respond within 30 days.

You can also contact the independent national regulator for privacy and freedom of information, the OAIC. For further information visit their website or call 1300 363 992.

Last updated: July 2026