Privacy Policy

Privacy Policy

The Endocrine & Wellbeing Clinic

Last updated: 24 September 2026

The Endocrine & Wellbeing Clinic (the Clinic, we, us or our) respects your privacy and is committed to handling your personal information responsibly.

This policy explains how we collect, hold, use and disclose personal information, including health information. It also explains how you may access or correct your information, make a privacy enquiry or lodge a complaint.

We handle personal information in accordance with applicable Australian privacy laws, including the Privacy Act 1988 (Cth), the Australian Privacy Principles and the Health Records and Information Privacy Act 2002 (NSW).

1. Who we are

The Endocrine & Wellbeing Clinic provides specialist medical and allied-health services from Balmain, New South Wales, and by Telehealth where appropriate.

Address: Shop 2R, 100 Elliott Street, Balmain NSW 2041
Phone: (02) 9870 3256
Email: admin@endocrinewell.com.au
Website: https://endocrinewell.com.au

2. What information we collect

Depending on how you interact with us, we may collect:

• your name, date of birth, address, email address and telephone number;
• emergency-contact and next-of-kin details;
• Medicare, Department of Veterans’ Affairs and private-health-insurance details;
• details about your GP, referring practitioner and other healthcare providers;
• appointment, referral, billing and payment information;
• health information, including your medical history, symptoms, diagnoses, medications, allergies, investigation results, treatment plans and clinical correspondence;
• information required to provide Exercise Physiology, dietetics or other allied-health services;
• communications with the Clinic, including telephone calls, emails, SMS messages and online enquiries;
• information submitted through our website, online booking page, Meta lead forms or other enquiry forms, including referral documents you upload;
• website and advertising information such as device, browser, IP address, pages viewed and campaign interactions; and
• feedback, complaints and other information you choose to provide.

We only collect information that is reasonably necessary for our functions and activities. We generally collect health information with your consent or where collection is otherwise permitted or required by law.

3. How we collect information

We may collect personal information:

• directly from you, including in person, by telephone, by email, by SMS, through our online booking page or through an online form;
• from a parent, guardian, carer or authorised representative;
• from your GP, referring practitioner, specialist, allied-health practitioner, pathology provider, imaging provider, hospital, pharmacy or other healthcare provider;
• from Medicare, your private health insurer or another payer where relevant;
• through our website, appointment systems, social-media pages and advertising lead forms; and
• from another source where you have consented or where collection is permitted or required by law.

If we receive information about you that we did not request, we will determine whether we could lawfully have collected it. If not, and where lawful and practicable, we will destroy or de-identify it.

4. Why we collect, use and disclose information

We may collect, use and disclose personal information to:

• assess your healthcare needs and provide safe, appropriate and coordinated care;
• arrange, confirm and manage your appointments, including bookings made online;
• communicate with you about appointments, referrals, results, treatment, accounts and follow-up;
• communicate with your GP, referring practitioner and other members of your healthcare team;
• process Medicare, private-health-insurance and other eligible claims;
• manage billing, payments, debt recovery and financial records;
• respond to enquiries and requests for information;
• manage our practitioners, staff, contractors, systems and clinical operations;
• meet professional, accreditation, insurance, legal and regulatory obligations;
• improve our services, systems, training, quality assurance and patient experience;
• investigate incidents, concerns or complaints;
• protect patients, staff and the public from a serious threat to health or safety; and
• send educational or service information where you have consented or where otherwise permitted by law.

We will not use or disclose your personal information for an unrelated purpose unless you consent or the use or disclosure is authorised or required by law.

5. Who we may disclose information to

Where reasonably necessary, we may disclose personal information to:

• practitioners, staff and contractors working with the Clinic;
• your GP, referring practitioner and other healthcare providers involved in your care;
• pathology, imaging, pharmacy, hospital and allied-health providers;
• Medicare, the Department of Veterans’ Affairs, private health insurers and claims-processing services;
• our professional advisers, auditors, insurers and accreditation bodies;
• technology, communications, records-management, payment and administrative service providers;
• government, regulatory, law-enforcement or other bodies where authorised or required by law; and
• another person or organisation with your consent.

We do not sell patient information.

6. Online booking, enquiries, advertising and lead forms

If you book an appointment through our online booking page, we collect your name, date of birth, contact details, Medicare or DVA details where provided, and any referral document you choose to upload. We use this information to identify or create your patient record, book the appointment and send you a confirmation and reminders by SMS or email. Where your details cannot be matched to an existing record with confidence, our reception team will review the booking before it is confirmed.

If you submit an enquiry through our website, a Meta lead form or another advertising platform, we may collect your name, email address, telephone number and the information you choose to provide. We use this information to respond to your enquiry, explain relevant Clinic services and arrange follow-up. Our reception team may contact you by telephone, email or SMS.

Please do not submit detailed clinical information through advertising lead forms, social-media messages or other channels that are not designed for clinical communication. Clinical information should be discussed with the Clinic through an appropriate secure channel.

Submission of a booking or enquiry does not, by itself, create a practitioner–patient relationship and is not suitable for urgent or emergency medical assistance.

7. Communications and marketing

We may send appointment confirmations, reminders, service messages, educational information and follow-up communications relevant to your enquiry or care. If we are missing details needed to register your referral or booking, we may contact you by SMS, email or telephone to request them.

We will only send direct marketing where we have the necessary consent or are otherwise permitted by law. Marketing emails and SMS messages will identify the sender and provide a way to unsubscribe. You may opt out at any time by using the unsubscribe function or contacting us.

Opting out of marketing will not prevent us from sending necessary clinical, appointment, account or administrative communications.

8. Website cookies, analytics and advertising technologies

Our website and service providers may use cookies, pixels and similar technologies to operate the website, remember preferences, understand website use, measure advertising performance and improve our communications.

These technologies may collect information such as your IP address, browser, device, pages viewed, referring page and interactions with advertisements. We do not intentionally send clinical records or detailed health information to advertising platforms through these technologies.

Our online booking page uses a bot-protection service (Cloudflare Turnstile) to prevent automated misuse. It does not collect clinical information.

You may restrict cookies through your browser settings. Some website functions may not work as intended if cookies are disabled.

9. Service providers and overseas processing

We use third-party systems to support clinical records, appointments, online booking, communications, online forms, automation, accounting, payments, website hosting and other operations. These include our practice-management software (Zedmed), Microsoft 365 and Microsoft Azure, ClickSend, Cloudflare, Meta, Google and other contracted providers.

Referral letters sent to the Clinic may be read by an automated document-processing service (Anthropic) to extract administrative details such as your name, date of birth, contact details and referring practitioner, so that reception can register your referral promptly. Information is processed transiently for this purpose and is not retained by that provider. Clinical decisions are always made by our practitioners, not by automated systems.

Some providers may store or process information outside Australia, or use personnel or subcontractors located overseas. Depending on the provider and service, these locations may include the United States, countries in the European Union and other jurisdictions in which the provider or its subprocessors operate. Our clinical records and booking systems are hosted in Australia.

Where required, we take reasonable steps to ensure overseas recipients handle personal information in a manner consistent with applicable Australian privacy requirements. However, privacy protections in another country may differ from those in Australia.

10. Storage, security and retention

We may hold information electronically and, where applicable, in paper records. We take reasonable administrative, physical and technical steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure.

These measures may include access controls, authentication, staff confidentiality requirements, system security, encryption, secure premises, backups and contracted service-provider safeguards.

No storage or transmission method is completely secure. If an eligible data breach occurs, we will assess and respond to it in accordance with applicable notification requirements.

We retain health records and other personal information for the periods required by law and for as long as reasonably necessary for clinical, administrative, insurance and legal purposes. When information is no longer required, we take reasonable steps to destroy or de-identify it, unless retention is required by law.

11. Accessing and correcting your information

You may request access to personal information we hold about you or ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading.

Please contact us using the details below. We may need to verify your identity and clarify the scope of your request. In some circumstances, the law permits or requires us to refuse access or correction. If that occurs, we will generally provide written reasons and explain available complaint options.

We may charge a reasonable fee for the administrative cost of providing access, but we will not charge you merely for making a request.

12. Anonymity and pseudonyms

You may interact with us anonymously or using a pseudonym where this is lawful and practicable. In many circumstances, however, we need accurate identifying information to provide healthcare, maintain clinical records, process claims, arrange appointments or meet legal and professional obligations.

13. Privacy enquiries and complaints

If you have a privacy question, wish to make a request, or believe your information has not been handled appropriately, please contact:

Privacy Officer
The Endocrine & Wellbeing Clinic
Shop 2R, 100 Elliott Street
Balmain NSW 2041
Email: admin@endocrinewell.com.au
Phone: (02) 9870 3256

Please provide enough information for us to understand and investigate the matter. We will acknowledge and respond to complaints within a reasonable period.

If you are not satisfied with our response, you may contact:

• the Office of the Australian Information Commissioner at https://www.oaic.gov.au; or
• the Information and Privacy Commission NSW at https://www.ipc.nsw.gov.au, where the NSW health-privacy legislation applies.

14. Changes to this policy

We may update this policy when our practices, systems or legal obligations change. The current version will be published on our website with its effective date.