Clinic Privacy Policy

Last updated: July 2026

At Dr Maree Lee’s practice, we recognise that fertility, reproductive and gynaecological care involves highly sensitive and personal information. Protecting your privacy and maintaining the confidentiality of your health information are fundamental to the care we provide.

We handle personal and health information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles, the Health Records and Information Privacy Act 2002 (NSW), the NSW Health Privacy Principles and other applicable healthcare laws and professional requirements.

What Personal and Health Information We Collect

We collect and hold information that is reasonably necessary to provide fertility, reproductive health and gynaecological care. Depending on the services you receive, this may include:

Your name, date of birth, address, contact details and preferred method of communication.
Your Medicare, Department of Veterans’ Affairs or private health insurance details.
Your medical, surgical, reproductive, menstrual, pregnancy and family history.
Information about your sexual and reproductive health.
Symptoms, diagnoses, medications, allergies, treatment plans and clinical notes.
Referral letters, pathology, imaging, genetic testing and other investigation results.
Fertility assessments, ovarian reserve testing, semen analysis and information about previous fertility treatment.
Information about your partner or family members where relevant to your care.
Genetic, carrier-screening or family-history information.
Information relating to fertility preservation, assisted reproductive treatment, gametes, embryos, donors, recipients or surrogacy arrangements, where applicable.
Consent forms, treatment decisions and communication preferences.
Appointment, billing, payment and administrative information.
Correspondence with other healthcare providers involved in your care.

We only collect information that is relevant to providing healthcare, managing the practice or meeting our legal and professional obligations.

Patients Receiving Fertility Care as a Couple

Where two people receive fertility care together, each person remains an individual patient with separate privacy rights.

We generally maintain a separate medical record for each patient. Records may be linked within our practice software where this is necessary to coordinate joint fertility treatment.

Information provided by one patient will not automatically be disclosed to their partner. We will not provide one person with access to their partner’s medical history, results, clinical notes or correspondence unless:

The other person has given consent.
The information is necessarily shared as part of an agreed joint consultation or treatment process.
Disclosure is otherwise authorised or required by law.

Certain information relating to joint treatment may be relevant to both patients. This may include treatment plans, consent decisions, fertility-cycle information, the use or storage of gametes or embryos and treatment outcomes. Relevant joint-treatment information may be recorded in both patients’ records.

During a joint consultation, information discussed in the presence of both patients may be understood to have been shared with both people. Patients may request a private discussion with their treating practitioner at any time.

Patients should tell us promptly if:

They do not consent to particular information being shared with their partner.
Their relationship or family circumstances change.
They wish to change their contact person, authorised representative or communication preferences.
There are safety, coercion, family violence or confidentiality concerns.

Where joint treatment is affected by a separation, disagreement or withdrawal of consent, the practice will manage each person’s information separately and in accordance with applicable consent, clinical and legal requirements.

How We Collect Information

We may collect personal and health information:

Directly from you through registration forms, patient questionnaires, consultations, telephone calls, electronic communications and our patient portal.
From your partner, where you have authorised this or where the information is provided during an agreed joint consultation.
From your referring doctor, general practitioner or another healthcare provider.
From pathology laboratories, imaging providers, hospitals, day surgery facilities, fertility laboratories or genetic testing services.
From fertility nurses, counsellors, psychologists, genetic counsellors or other clinicians involved in your care.
From Medicare, private health insurers or other organisations involved in funding or administering your healthcare.
From a parent, guardian, substitute decision-maker or authorised representative.
Where authorised or required by law.

Whenever practicable, we collect information directly from you.

How We Store and Protect Information

We use Xestro Practice Software to manage electronic medical records.

We do not routinely maintain paper medical records. Documents received in paper form may be scanned into the electronic record. Temporary printed documents containing personal or health information are securely destroyed when they are no longer required.

We use reasonable administrative, physical and technical safeguards to protect information from loss, misuse, interference, unauthorised access, alteration or disclosure. These safeguards include:

Individual user accounts and access controls.
Access based on staff roles and responsibilities.
Password and authentication requirements.
Secure backups and system monitoring.
Encryption and secure transmission methods where available.
Confidentiality obligations for clinicians, staff and contractors.
Staff privacy and cybersecurity training.
Secure destruction of information when permitted and appropriate.

Access to medical records is limited to authorised clinicians, staff, contractors and service providers who require access to perform their duties.

Why We Collect, Use and Disclose Information

We may collect, use and disclose your information to:

Assess, diagnose and treat you.
Provide fertility, reproductive health and gynaecological care.
Coordinate care with other healthcare professionals and facilities.
Obtain and review pathology, imaging, genetic and other investigation results.
Arrange procedures, hospital admissions or fertility treatment.
Communicate with you about appointments, treatment, results, accounts and follow-up care.
Process Medicare, private health insurance and other healthcare claims.
Manage billing, payments and debt recovery.
Operate, administer and improve the practice.
Undertake clinical audit, accreditation, quality assurance and staff training.
Investigate incidents, complaints or concerns.
Comply with legal, regulatory, professional, accreditation and insurance requirements.
Participate in authorised clinical registries or statutory reporting, where applicable.
Conduct approved research where consent, ethics approval or another lawful authority has been obtained.
Use de-identified information for service planning, quality improvement, reporting or research.

We will not use or disclose your information for an unrelated purpose unless you have consented or the use or disclosure is otherwise permitted or required by law.

Who We May Share Information With

Where reasonably necessary for your care or the operation of the practice, information may be disclosed to:

Your general practitioner, referring doctor or another treating practitioner.
Pathology, imaging, genetic testing and other diagnostic providers.
Hospitals, day surgery facilities, anaesthetists and surgical assistants.
Fertility laboratories, assisted reproductive treatment providers and fertility nurses.
Counsellors, psychologists, genetic counsellors and allied health providers.
Pharmacies and medication providers.
Medicare, the Department of Veterans’ Affairs and private health insurers.
Accreditation bodies, healthcare regulators and authorised clinical registries.
Professional advisers, insurers, auditors and legal representatives.
Information technology, communications, billing and document-management providers that support the practice.
Government agencies, courts, tribunals or law-enforcement bodies where authorised or required by law.
Another person you have nominated or authorised.

We take reasonable steps to limit disclosure to the information required for the particular purpose.

Genetic and Family Information

Fertility and gynaecological care may involve genetic, carrier-screening and family-history information. This information can sometimes also be relevant to biological relatives.

We handle genetic information with additional care. Genetic information will only be used or disclosed with consent or where its use or disclosure is otherwise permitted or required by law.

Providing information about a family member does not normally give that person access to your medical record.

Donor, Gamete and Embryo Information

Where applicable, information relating to donors, recipients, gametes, embryos, donor-conceived people or surrogacy arrangements will be handled in accordance with applicable assisted reproductive technology legislation, consent requirements, accreditation standards and record-keeping obligations.

Some fertility-treatment information may be subject to extended retention periods or mandatory reporting and registry requirements.

Communications With You

You may tell us how you prefer to receive appointment reminders, correspondence and other communications.

We may communicate with you by telephone, voicemail, SMS, email, post, secure patient portal or another method you have authorised. Electronic communications may carry privacy and security risks, particularly where devices, email accounts or telephone numbers are shared with another person.

We will take reasonable steps to verify your identity before discussing sensitive information. Highly sensitive or clinically significant information may be communicated directly by a clinician or through a more secure method.

Please notify us promptly if your contact details, communication preferences or personal circumstances change.

Accessing Your Information

You have a right to request access to the personal and health information we hold about you.

A request may be made in writing by email or post. We may ask you to:

Verify your identity.
Clarify the information you are seeking.
Provide written authority where someone is acting on your behalf.

We aim to respond within 30 days and will respond within applicable legal timeframes.

Access may be provided by:

Supplying an electronic or paper copy.
Allowing you to inspect the information.
Providing a clinical summary.
Arranging for the information to be explained by a healthcare practitioner.
Transferring relevant information to another healthcare provider at your request.

We may charge a reasonable fee to cover the cost of preparing and providing access, including administration, clinical review, copying or postage. We will tell you about any proposed fee before providing access. We do not charge a fee merely for making an access request.

Access may be refused or limited in circumstances permitted by law, including where access would:

Pose a serious threat to the life, health or safety of any person.
Unreasonably affect another person’s privacy.
Disclose information that cannot lawfully be provided.
Prejudice legal proceedings, an investigation or law-enforcement activity.

Where access is refused or limited, we will generally provide written reasons and explain the available complaint options.

A patient is not automatically entitled to access information contained in another patient’s record, including the record of a spouse or partner.

Correcting Your Information

You may ask us to correct information that you believe is inaccurate, incomplete, out of date, irrelevant or misleading.

We may retain the original clinical entry where required for medico-legal and record-integrity purposes. Where appropriate, we may add a correction, clarification or patient statement to the record rather than deleting or overwriting the original entry.

There is no fee for requesting a correction or for adding an appropriate correction or statement to your record.

Authorised Representatives

You may authorise another person to communicate with us or receive specified information on your behalf.

We may require written authority identifying:

The person being authorised.
The information they may receive.
The purposes for which they may act.
How long the authority remains valid.

An authority may be withdrawn by notifying the practice. Withdrawal will not affect disclosures already made while the authority was valid.

Overseas Disclosure

We do not routinely disclose personal or health information to recipients outside Australia. Some technology providers may use overseas-based technical support or infrastructure. We take reasonable steps to ensure that any such handling is consistent with applicable Australian privacy requirements.

Privacy Complaints

If you believe your privacy has been breached or you have concerns about how your information has been handled, please contact:

The Admin Team
Dr Maree Lee
Suite 101, 10 Norbrik Drive
Bella Vista NSW 2153

Email:
admin@drmareelee.com.au

Telephone:
(02) 8531 4000

Please provide enough information for us to understand and investigate your concern.

We will acknowledge your complaint, investigate it fairly and respond within a reasonable period. We will generally aim to provide a written response within 30 days.

Where you are not satisfied with our response, you may contact:

The Office of the Australian Information Commissioner.
The Information and Privacy Commission NSW.
The NSW Health Care Complaints Commission, where the complaint concerns the conduct of a healthcare practitioner or health service.

Data Breaches

We maintain procedures for identifying, containing, investigating and responding to suspected privacy and cybersecurity incidents.

Where a data breach is likely to result in serious harm and the requirements of the Notifiable Data Breaches scheme are met, we will notify affected individuals and the Office of the Australian Information Commissioner.

We will also comply with any other applicable notification obligations.

Retention and Secure Disposal of Records

We retain health records for at least the periods required by NSW law.

Generally:

Where the patient was aged 18 years or over when the information was collected, the record will be retained for at least seven years from the last occasion on which a health service was provided.
Where the patient was under 18 years when the information was collected, the record will generally be retained until the patient reaches, or would have reached, 25 years of age.

Some fertility, assisted reproductive treatment, donor, gamete, embryo, pregnancy, surgical, research or regulatory records may need to be retained for longer.

Records will not be destroyed while they remain clinically, legally or administratively necessary. Once the applicable retention period has expired, records may be securely destroyed or permanently de-identified in accordance with legal and professional requirements.

Changes to This Policy

We may update this policy when our services, systems or legal obligations change. The current version will be available from the practice or published on our website.

Questions about this policy may be directed to our admin team.