Privacy Policy
How this practice collects, uses, stores and protects your personal & health information.
Last reviewed: 22 August 2026 | Next review: 22 August 2027
About this policy
Bondi Junction Private Practice respects your privacy. This policy explains what information we collect about you, why we collect it, who we share it with, and what rights you have over it.
We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and by the Health Records and Information Privacy Act 2002 (NSW) and the Health Privacy Principles. Health information is treated as sensitive information under both, which means it carries a higher level of protection than ordinary personal information.
This policy covers Dr Stuart Morris and any staff, contractors and service providers working with the practice. A printed copy is available at reception at no charge, and we can provide it in another format if that would help.
What we collect
We collect two broad categories of information.
Personal information
- Your name, date of birth, gender and pronouns
- Address, phone number and email address
- Emergency contact and next of kin details
- Medicare number, DVA number, healthcare card or concession card details, and private health insurance details
- Your Individual Healthcare Identifier
- Payment and billing information
Health information, which is sensitive
- Your medical history and your family medical history
- Notes made during your consultations
- Medicines you take, allergies and adverse reactions
- Pathology and imaging results
- Letters and reports from specialists, hospitals and other health practitioners
- Immunisation records
- Care plans, referrals and prescriptions
- Information you give us about your lifestyle, occupation, living situation and supports, where it is relevant to your care
We only collect what we need to look after you properly. If we ask for something and you would rather not tell us, say so. In most cases that is fine. Occasionally it will limit what care we can safely provide, and if that is the case we will explain why.
How we collect it
Wherever we can, we collect information directly from you: on your registration form, during consultations, by phone, by email, or through HotDoc when you book.
Sometimes we collect information about you from other people. This happens when:
- Another health practitioner sends us a referral, a report or a transfer of care letter
- A pathology or imaging provider sends us your results
- A hospital sends us a discharge summary
- We access your My Health Record, where you have one and have not restricted access
- We check NSW SafeScript before prescribing certain medicines, which we explain in section 6
- A parent, carer, guardian or family member gives us information on your behalf, where that is appropriate
Why we collect it
Our main purpose, which the law calls the primary purpose, is to manage your health and provide you with care.
We also use your information for purposes directly related to that, which you would reasonably expect. These include:
- Sending you appointment reminders, recalls and results notifications
- Billing, and claiming Medicare and DVA rebates on your behalf
- Following up on tests, referrals and treatments
- Meeting our legal, accreditation and professional obligations
- Managing complaints, insurance matters and legal claims
- Quality improvement activities and clinical audit within the practice, which are usually done using de-identified information
- Teaching, where a medical student is present. See section 15.
When you register as a patient, you consent to Dr Morris and practice staff accessing and using your information for these purposes. Only people who need to see your information in order to do their job have access to it. If we ever want to use your information for something outside these purposes, we will ask you first.
Who we share it with
We share your information only where it is necessary for your care, where you have consented, or where the law requires or authorises it.
For your care
- Specialists, hospitals and other doctors we refer you to
- Allied health practitioners involved in your care, such as physiotherapists, psychologists and dietitians
- Pathology and diagnostic imaging providers
- Pharmacists, when we send a prescription electronically
- Sydney Sexual Health Centre and other services where you are under a shared care arrangement
- Other GPs and after-hours services covering the practice, so they can treat you safely
- Your My Health Record, where you have one and have not opted out
For administration and billing
- Services Australia, for Medicare, PBS and DVA claims
- The Australian Immunisation Register, for vaccinations we give you
- HotDoc, our booking and patient communication provider. See section 8.
- Our practice management software provider and IT support providers, who may access records in the course of maintaining our systems and are bound by confidentiality obligations
- Secure clinical messaging services used to transmit referrals and reports
- Electronic prescribing services
- Our medical indemnity insurer and our lawyers, where a claim or complaint arises
We do not
- Sell your information
- Trade or rent your information
- Provide it to insurers, employers, solicitors or family members without your written consent, unless the law requires it
- Use it for marketing
When we must share it, with or without your consent
There are situations where the law requires or permits us to disclose your information even if you would prefer we did not. We tell you about these upfront rather than leaving you to discover them.
Notifiable conditions
- Under the Public Health Act 2010 (NSW), doctors and laboratories must notify NSW Health of certain diagnoses. These include HIV, hepatitis B, hepatitis C, syphilis, gonorrhoea, tuberculosis and a number of other conditions. Notification is a legal obligation and it applies whether or not you consent.
- This system exists to support public health, not to identify individuals. Some conditions are notified without your name. Dr Morris will explain what applies in your situation before testing, and you are welcome to ask.
Real-time prescription monitoring
- Before prescribing certain medicines, including Schedule 8 medicines such as ADHD stimulants and strong pain medicines, Dr Morris is required to check NSW SafeScript. SafeScript records prescriptions for monitored medicines across all prescribers and pharmacies in NSW.
- This means Dr Morris can see monitored medicines prescribed to you by other doctors, and other prescribers and pharmacists can see what he has prescribed to you. The purpose is safety, particularly to prevent dangerous combinations and duplicate prescribing.
Other legal requirements
- Court orders, subpoenas, warrants and search notices
- Mandatory reporting where we have reasonable grounds to suspect a child or young person is at risk of significant harm
- Cancer and other statutory registries
- Reporting obligations to Services Australia, AHPRA or other regulators where these arise
Serious threats
- We may disclose information without your consent where we reasonably believe it is necessary to lessen or prevent a serious threat to your life, health or safety, or to the life, health or safety of someone else, or to public health or safety.
- We disclose only what is necessary, only to those who need it, and we record what we disclosed and why
Whether your information goes overseas
We do not routinely disclose your personal or health information to recipients outside Australia. Our clinical records, our booking system and our communication systems are hosted in Australia.
HotDoc and online booking
We use HotDoc for online bookings, appointment reminders, recall messages, results notifications and, for telehealth, payments. HotDoc is an Australian company and is bound by the Privacy Act and the Australian Privacy Principles.
When you book through HotDoc:
- HotDoc collects the information you enter, such as your name, contact details and the appointment type you have chosen
- That information is passed to our practice management system
- HotDoc does not hold your medical records. Where clinical information is collected as part of a booking or registration, HotDoc transmits it to our system and then deletes it
- HotDoc can see your appointment type and recall type, so it can pass that to us, but it cannot see your medical record or anything discussed in your consultation
- HotDoc’s platform is hosted in Australia and information is encrypted
- If you save a card for telehealth payments, your card details go directly to a secure payment provider. Neither we nor HotDoc store your card number
You can ask us to stop sending you HotDoc reminders and recalls at any time. Please think carefully before you do: if you opt out of recalls, it becomes your responsibility to follow up your own results, including abnormal ones.
HotDoc has its own privacy policy covering the information it holds, available at hotdoc.com.au. This policy covers what we do with your information. The two are separate.
How we keep it safe
Your records are held electronically in clinical software with access controls, and any paper records are kept in secure storage.
- Every staff member has their own login. Accounts are not shared
- Access is limited to what each person needs to do their job
- Systems are password protected and use multi-factor authentication where available
- Data is encrypted in transit and backed up regularly
- Devices are protected by up-to-date security software
- All staff sign confidentiality agreements and receive privacy training
- Screens are positioned so they cannot be read from the waiting area, and conversations at reception are kept as discreet as the room allows
Email is convenient but it is not a secure channel. We use it for administrative matters and we will use it for clinical matters if you ask us to, but you should know the risk. If you would prefer we did not email you about health matters, tell us and we will note it on your file.
If something goes wrong
If there is unauthorised access to or disclosure of your information, or information is lost, we will investigate immediately and take steps to contain it.
Where a breach is likely to result in serious harm to you, we are required under the Notifiable Data Breaches scheme to notify you and the Office of the Australian Information Commissioner. We will tell you what happened, what information was involved, and what you can do about it.
How long we keep your records
The Health Records and Information Privacy Act 2002 (NSW) sets minimum retention periods, and we follow them.
- If your information was collected while you were an adult, we keep it for at least seven years from the last time we provided you with a health service
- If your information was collected while you were under 18, we keep it until you turn 25
These are minimums. We may keep records longer where there is a clinical reason, or where a legal claim is possible. When records are destroyed, it is done securely. If the practice is sold or closes, we will tell you what is happening to your records and how to obtain a copy.
Seeing your own records
You have a right to access the health information we hold about you. You do not have to give a reason. To request access, email specialisedmedical@bondimed.com.au or ask at reception for a records access form. We may ask you for proof of identity.
- We aim to respond within 30 days
- There is no charge for the request itself. A reasonable fee may apply for the cost of copying, postage or the time involved in preparing a large file. We will tell you the cost before we do the work
- You can ask for a copy, or you can ask to view your records with Dr Morris, which is often more useful because he can explain what you are reading
- If you are moving to another GP, we can transfer a health summary or your full record directly. Just tell us where to send it.
There are limited circumstances where we can refuse access or provide it in a different form. The main one is where releasing the information would pose a serious threat to your life or health, or would unreasonably affect another person’s privacy. If we refuse, we will tell you why in writing and explain how to have that decision reviewed.
Correcting your records
If information we hold about you is wrong, out of date, incomplete or misleading, tell us and we will correct it.
Clinical notes record what was thought and observed at the time, so they are not always altered. Where we do not agree that a correction should be made, you can ask us to add a note recording your view, and that note stays attached to the record.
Family, partners and carers
We will not discuss your health with your partner, your parents, your adult children or anyone else without your consent, even if they are worried about you and even if they are calling on your behalf.
If you would like someone to be able to speak to us about your care, tell us and we will record that on your file. You can change it or withdraw it whenever you like.
If you have a legally appointed guardian or attorney, or if you are unable to make decisions for yourself, different arrangements apply and we will discuss them with you and the people involved.
Young people
Young people have privacy rights too. From around 14, a young person can generally see a doctor on their own and their consultation is confidential, provided they understand what is being discussed and are able to make their own decisions about it. That includes confidentiality from parents.
There are limits. We will break confidence if there is a serious risk to the young person’s safety or to someone else’s, or where the law requires it. Dr Morris will explain these limits at the start rather than after the fact.
For younger children, a parent or guardian usually accesses the record on their behalf. Where parents are separated, both parents generally retain the right to information about their child unless a court order says otherwise.
Sexual health, HIV and other sensitive care
Everything in your record is confidential. Some of it is more sensitive than the rest, and people accessing sexual health, HIV, PrEP, mental health and ADHD care are often, reasonably, more concerned about who can see what.
- Your results are not disclosed to partners, family or employers. Where a diagnosis means partners should be told, Dr Morris will talk you through the options, including anonymous partner notification services
- The notification obligations in section 6 apply, and they exist for public health surveillance rather than to identify you. Dr Morris will explain what is notified before you are tested
- If you have a My Health Record and you would prefer some information stayed out of it, you can set restrictions on individual documents, or on your record as a whole. We can show you how
- You can ask us not to send results by SMS or through the HotDoc app, and to contact you a different way instead
If any of this is on your mind, please raise it. It is a normal conversation to have and it is better had before testing than after.
Teaching and learning
Dr Morris is a Conjoint Lecturer at UNSW and teaches senior medical students. From time to time a student may be present in the practice.
You will always be told in advance and asked whether you are comfortable with it. Saying no is completely fine, it will not affect your care in any way, and you will not be asked to explain.
Anonymity, and why it is difficult here
You have a right to deal with us anonymously or under a pseudonym where that is lawful and practicable.
In general practice it is usually not practicable. We need to identify you to keep an accurate record, to claim Medicare rebates, to prescribe safely and to check SafeScript. If anonymity matters to you for a particular reason, talk to Dr Morris and he will explain what is and is not possible.
Our website
Our website collects only what is needed to run it. We may use cookies and basic analytics to understand how the site is used, in aggregate. You can disable cookies in your browser, though parts of the site may not work as well.
If you send us a message through the website, we use that information only to respond to you.
Please do not send us clinical details or test results through website forms or email. Book an appointment instead. It is safer and it means Dr Morris can actually help.
Our website links to other sites, including HotDoc and health information services. Those sites have their own privacy policies and we are not responsible for them.
Making a complaint
If you think we have mishandled your information, we want to hear about it.
Start with us. Email our Privacy Officer at specialisedmedical@bondimed.com.au, or mark a letter to the Privacy Officer at Ground Floor, 1 Newland Street, BONDI JUNCTION NSW 2022.
- We will acknowledge your complaint within five business days
- We will investigate and respond in writing, normally within 30 days
- If it will take longer, we will tell you why and keep you updated
- Complaining will not affect your care
If you are not satisfied
You can take a privacy complaint to either of these bodies. Time limits may apply, so it is worth contacting them promptly.
- Information and Privacy Commission NSW, for complaints under the Health Records and Information Privacy Act. Freecall 1800 472 679, ipcinfo@ipc.nsw.gov.au, ipc.nsw.gov.au
- Office of the Australian Information Commissioner, for complaints under the Privacy Act. 1300 363 992, oaic.gov.au
Changes to this policy
We review this policy at least once a year, and whenever our systems or the law change. The current version is always on this page. A printed copy is available at reception.
Contact us
Privacy Officer, Bondi Junction Private Practice
Ground Floor, 1 Newland Street, Bondi Junction NSW 2022
