Privacy Statement

Data & Patient Privacy Statement | The Grove Chinese Medicine Clinic

(Victoria, Australia)

Effective Date: 28th March, 2026

Clinic Name: The Grove Chinese Medicine Clinic

Jurisdiction: Victoria, Australia

1. Introduction & Legal Compliance

This Privacy Statement sets out how our Traditional Chinese Medicine Clinic collects, stores, uses, discloses, and protects your personal data and patient health information, including all electronic data submitted or captured via our website, online booking systems, email communications, digital patient portals, and in-clinic electronic record platforms. This document is designed as a transparent, compliant privacy disclosure for site users and regulatory adherence, and does not contain search engine optimisation keyword optimisation.

This statement fully complies with all applicable Victorian privacy and health legislation, including the Health Records Act 2001 (Vic) (incorporating mandatory Health Privacy Principles (HPPs)) and the Privacy and Data Protection Act 2014 (Vic) (PDP Act). As a Victorian healthcare provider, we uphold strict privacy and data security standards to protect patient confidentiality, supporting website trust, transparency, and compliance with Google’s E-E-A-T framework for trustworthy website content.

This policy applies to all website visitors, prospective patients, current patients, and former patients. It covers all electronic data collected through digital channels and all patient health records held in electronic or physical form in connection with our clinic services, including TCM consultations, acupuncture, remedial therapy, herbal medicine prescribing, and ongoing patient care.

2. Types of Information We Collect

We only collect information that is reasonably necessary to deliver our clinical services and conduct legitimate clinic administrative operations. All collected data is categorised as either general electronic personal data or sensitive patient health information, consistent with Victorian legal definitions.

2.1 General Electronic Personal Data

We collect standard personal data submitted voluntarily by users via our website enquiry forms, online booking portals, email correspondence, and service transactions. This includes your full name, contact phone number, email address, residential contact details, form submission data, and service payment information. All such data is collected electronically and stored on secure, privacy-compliant digital systems operated by the clinic or authorised Victorian-based service providers.

2.2 Sensitive Patient Health Information (Protected Under HPPs)

All health-related patient data collected and stored electronically is classified as sensitive health information under the Health Records Act 2001 (Vic) and is subject to full Health Privacy Principle protections. This includes your medical history, TCM clinical assessments, syndrome differentiation notes, treatment plans, acupuncture and remedial treatment records, herbal prescription details, symptom and diagnostic observations, and all other personal information directly relating to your health and the clinical care we provide.

3. Legal Basis for Data Collection & Use

We collect and process your electronic personal and health information only on lawful bases permitted under Victorian law, including your explicit informed consent, the necessity of data processing to deliver healthcare services, compliance with statutory and regulatory obligations, and legitimate operational interests that do not override your privacy rights. All data handling practices adhere to core Health Privacy Principles applicable to private Victorian healthcare providers.

4. How We Use Your Electronic & Patient Information

Your information is used solely for the primary purposes for which it is collected. No unauthorised secondary use of your personal or health data will occur without additional specific consent. Authorised uses include:

• Providing personalised TCM clinical care, including consultations, treatment planning, herbal medicine dispensing, and patient follow-up;
• Administering online appointments, patient enquiries, service reminders, and digital patient communications;
• Maintaining accurate, secure electronic patient records to support consistent and safe ongoing care;
• Processing service payments, invoicing, and standard clinic administration;
• Meeting Victorian healthcare record-keeping, reporting, and regulatory compliance obligations;
• Responding to user and patient requests relating to data access, corrections, and privacy enquiries;
• Conducting de-identified, anonymous service quality improvement activities in line with Victorian privacy requirements.

5. Data Disclosure & Information Sharing Rules

We do not sell, rent, or trade your personal or patient health data for commercial purposes. Disclosure of your protected health information is strictly limited to circumstances permitted under the Health Records Act 2001 (Vic) and the Privacy and Data Protection Act 2014 (Vic), including:

• Specific, informed consent provided by you for an individual disclosure;
• Disclosure to authorised healthcare practitioners involved in your direct care for clinical safety and treatment purposes;
• Compliance with mandatory legal obligations, including court orders, statutory reporting, and public health requirements under Victorian law;
• Disclosure to accredited third-party service providers who support clinic operations, subject to binding privacy agreements.

All third-party processors are vetted for Victorian privacy compliance and contractually prohibited from unauthorised data use, handling, or disclosure.

6. Electronic Data Security & Storage

We maintain robust technical, administrative, and physical security safeguards to protect all electronic personal and patient health data against unauthorised access, alteration, disclosure, loss, or misuse, in line with Victorian health data security standards. All electronic patient records are stored on encrypted, password-protected systems with role-based restricted staff access. Only clinic practitioners and authorised administrative personnel with operational clinical duties may access patient health information.

We conduct regular security system updates, compliance audits, and staff privacy training to mitigate data breach risks. In the event of a confirmed or suspected data breach involving protected patient information, we will comply with all Victorian mandatory breach notification requirements, including notifying affected individuals and relevant regulatory authorities as required by law.

Electronic patient records are retained for the minimum mandatory retention period required under Victorian healthcare legislation. Upon expiry, records are securely deleted, archived, or de-identified in full compliance with state regulatory rules.

7. Patient Rights Under Victorian Privacy Law

Consistent with the Health Privacy Principles and the Privacy and Data Protection Act 2014 (Vic), you hold enforceable legal rights in relation to your personal and health information:

• Right of Access: You may request full access to your electronic and physical patient records held by our clinic, with standard access requests provided free of charge.
• Right of Correction: You may request amendment or correction of any inaccurate, incomplete, or outdated personal or health data we hold.
• Right to Withdraw Consent: You may withdraw any previously provided processing consent at any time, applying to future data use only.
• Right to Deletion: You may request secure deletion of your personal electronic data where no legal, administrative, or clinical retention obligation applies.
• Right to Complain: You may lodge a formal privacy complaint with the Victorian Health Complaints Commissioner or the Office of the Victorian Information Commissioner if you consider we have breached your privacy rights or applicable privacy legislation.

8. Website Cookies, Tracking & Third-Party Google Services

Our website uses standard cookie and anonymous tracking technologies to support basic website functionality, user experience analysis, and website performance monitoring. This website utilises Google Analytics and Google Ads, third-party analytics and advertising services provided by Google.

Google uses cookies to collect anonymous website browsing data, including user website interaction, traffic source information, and site usage patterns. These cookies do not collect or store your name, contact details, or sensitive patient health information. Data collected via Google services is processed by Google in accordance with its own privacy policy and applicable Australian and international data protection standards.

You may disable cookie collection at any time via your individual browser settings. Disabling cookies will not impact core website browsing functionality or your ability to enquire about or book clinic services.

9. Policy Updates & Amendments

We may update this Privacy Statement periodically to reflect changes to Victorian privacy legislation, regulatory requirements, website functionality, or clinic operational practices. All updates will be published on our website with a revised effective date. Material changes affecting how we collect, use, or protect your personal or health data will be clearly notified via website update notice.

10. Privacy Contact & Enquiries

For all privacy-related enquiries, data access requests, correction applications, or privacy concerns, please contact our appointed Clinic Privacy Officer using the details below:

Privacy Officer: Michael Lingham

Clinic Address: 143 Auburn Road, Hawthorn, 3122

Contact Email: contact@thegroveclinic.com.au

Contact Phone: (03) 9654 7181

If you are not satisfied with our response, you may contact the Health Complaints Commissioner or the Office of the Victorian Information Commissioner to escalate your complaint.

11. Governing Law

This Privacy Statement and all data handling practices of the clinic are governed exclusively by the laws of Victoria, Australia, including the Health Records Act 2001 (Vic) and Privacy and Data Protection Act 2014 (Vic).