Privacy Policy

1. Who we are and this policy

CareWise Nurse Practitioners is a registered business name of HOME WITH HELP CARE SOLUTIONS PTY LTD (ABN 50 682 244 382), as listed on the Australian Business Register. The company provides Nurse Practitioner-led phone and video telehealth consultations from Melbourne, Victoria. In this policy, “we”, “us” and “the practice” refer to HOME WITH HELP CARE SOLUTIONS PTY LTD trading as CareWise Nurse Practitioners.

This policy explains how we may collect, use, store and disclose personal information, including sensitive health information, when you contact us, book or receive care, or use this website. Our handling of information is subject to applicable privacy and health-records laws, including the Privacy Act 1988 (Cth) and Australian Privacy Principles, and the Health Records Act 2001 (Vic) and Health Privacy Principles where they apply.

2. Information we collect and how we collect it

Depending on how you interact with us, information may include your name and contact details, date of birth, identity or representative details, appointment and payment information, health concerns and history, medicines and allergies, clinical assessments, treatment and follow-up notes, referrals, and relevant pathology or imaging results. Health information is sensitive information.

CareWise telehealth consultations are for adults aged 18 years and over. We collect information directly from you during a phone or video consultation, by telephone, or through Halaxy, which we use for online bookings, appointment reminders, telehealth consultations, patient records and payments. Halaxy AI Scribe, powered by Heidi, is available for all telehealth consultations. Before each consultation starts, we seek your informed consent and document your acceptance or refusal in your clinical notes. If you decline, the practitioner types the clinical notes manually and the AI Scribe is not used. According to Heidi’s published information, audio recordings are deleted immediately after notes are transcribed, and data is encrypted in transit and at rest and stored in Australia. The practice confirms that AI processing for its setup occurs in Melbourne, Australia; vendor statements are subject to Heidi’s and Halaxy’s terms and privacy information. Only the practitioner and authorised people can access transcripts. The practice has configured both transcripts and generated summaries to be deleted within seven days of the transcription date. If deleted sooner, the transcript’s status changes to “Deleted” in Halaxy, remains visible in the menu with a bin icon and audit record showing who deleted it and when, and cannot be edited. The practice has configured deleted transcripts and their audit records in underlying systems and backups to be deleted within 30 days. This describes the configured deletion process, not immediate permanent erasure. Clinically relevant information from the consultation is entered into your Halaxy clinical history and forms part of your medical record. Clinical notes, including your AI Scribe consent or refusal entry, are retained for seven years from when you book an appointment and complete the new-patient intake form.

Website health screening form: The form on this website is for on-screen review only. Its answers are not submitted to CareWise, stored on this website, or transferred to Halaxy. Information entered remains in the open browser page and may be lost when you leave or refresh. Please do not enter health details there expecting us to receive them. Call 03 4421 6384 to ask how to share information appropriately.

3. Why we collect and use information

We use information where reasonably necessary to respond to enquiries, arrange and provide healthcare, assess your needs, support clinical decision-making, coordinate care you request, communicate with you, manage appointments and payments, maintain clinical records, and meet applicable professional, safety and legal responsibilities. This may relate to general consultations, prescription or script-refill requests, medical certificates, pathology or imaging requests, specialist referrals, and weight management. Services and documents are subject to individual assessment and clinical suitability.

CareWise telehealth consultations are available to adults only (aged 18 years or over); this is a condition of booking. If you choose not to provide information needed for a particular request, we may be unable to assess or provide that service. We will explain this where practicable and discuss alternatives.

4. When we may share information

We may share information, with your consent or another permitted basis, where reasonably necessary for your care or practice operations. We use Sonic Labs through Halaxy for pathology, Tyro for payment processing, eRx for online prescriptions, and HealthLink for secure messaging. Information relevant to the service you request may be handled by these providers. We may also share information with authorised practice personnel and healthcare providers involved in your care, such as your GP, specialist or allied health professional, a person you authorise, or where required or authorised by law.

Halaxy Telehealth is a built-in phone and video consultation feature integrated directly into the Halaxy practice management software. Halaxy and Heidi provide third-party services and have their own privacy information and terms. Information entered or generated through Halaxy may be handled by Halaxy and the connected providers named above to provide their services, and by the practice for your care and administration. The practice confirms that its configured workflow stores patient data in Australia, that AI processing for its setup occurs in Melbourne, Australia, and that it does not involve overseas sharing of patient data. Halaxy and Heidi state that Australian AI Scribe data is stored in Australia using AWS; Heidi also states that AI Scribe data is encrypted in transit and at rest. These are vendor claims and are subject to their terms and privacy information. CareWise does not integrate Halaxy with Xero. Halaxy’s Australian Privacy Policy describes possible overseas disclosures through optional integrations; the practice will review any optional integrations before enabling them. For platform enquiries, Halaxy’s phone number is 1800 984 334. Please review Halaxy’s policy before entering details.

The practice reviews its vendors’ published information and account settings every 30 days and will update this policy if its service providers or information-sharing practices change.

5. Storage, security and retention

We use Halaxy as the source clinical record and for online bookings, reminders, telehealth consultations, patient record storage and payments. Halaxy AI Scribe is built into the platform and powered by Heidi. According to Heidi’s published information, audio recordings are deleted immediately after notes are transcribed, information is encrypted in transit and at rest, and data is stored in Australia. Halaxy describes its encryption as bank-grade 256-bit encryption, and states that patient data is hosted in Australia on AWS and backed up daily. The practice confirms that AI processing for its setup occurs in Melbourne, Australia. Only the practitioner and authorised people have access to transcripts. The practice reviews vendor information and account settings every 30 days. Halaxy user accounts require two-factor authentication. When you use Halaxy, it uses browser cookies to manage user sessions and maintain login authentication. Clearing browser cookies signs you out of Halaxy and other websites in that browser; signing back in requires a two-factor authentication code.

The practice’s Halaxy settings delete AI Scribe transcripts and generated summaries within seven days of the transcription date. The practice has also configured deleted items in underlying systems and backups to be deleted within 30 days. A deletion changes the transcript’s status to “Deleted” and leaves the item and an audit record visible in Halaxy; this does not establish immediate or permanent erasure from all systems or backups. A deleted transcript cannot be edited. Clinical notes, including the AI Scribe consent or refusal entry, are part of the patient’s medical record and are retained for seven years from when the patient books an appointment and completes the new-patient intake form.

6. Website information, cookies and analytics

GoDaddy and Google Analytics: the website’s domain and analytics monitoring are handled through GoDaddy (domain and cPanel), with Google Analytics integrated via GoDaddy. Google Analytics uses first-party cookies and anonymous client and session identifiers to measure user, session, event, traffic and device information, and coarse location metrics. For GA4, Google’s system uses the IP address at a server near the user to derive coarse geographic location, anonymises it at that point, and does not log or store the individual IP address, according to the information provided by the practice. Direct personal identifiers and health information are not intentionally sent to Google Analytics. Google Analytics uses a global cloud-hosting architecture; analytics data may be transferred, accessed or processed globally, primarily in the United States. The practice’s GA4 property is set to retain individual user and event data for two months. Aggregated reports may be retained longer.

Google Analytics is the website’s only analytics tracking service. GoDaddy hosts the website domain and provides built-in cPanel, which the practice does not use for tracking. Its cPanel can generate raw server access logs, visitor metrics, error logs and bandwidth-usage statistics through tools such as AWStats or cPanel Metrics; these are not used by CareWise for website analytics. CareWise confirms that it does not use web beacons, email tracking, advertising identifiers, personalised advertising, shopping-cart identifiers or fraud-prevention identifiers. GoDaddy’s general privacy policy describes products and purposes across its services and does not describe all CareWise practices. Do not submit clinical details through general website browsing or email unless the practice has confirmed that channel is appropriate.

7. Access and correction

You may ask to access personal or health information we hold about you, or request correction if you believe it is inaccurate, out of date, incomplete, irrelevant or misleading. We may need to verify your identity and may be permitted to refuse or limit access in specific circumstances. If so, we will explain the reason and any available review process as required by law. Contact Beatrice using the details below. Requests will be handled within applicable statutory timeframes.

8. Privacy concerns, complaints and data breaches

Please contact Beatrice, Nurse Practitioner and Clinical Lead, so we can understand and respond to your concern. We will assess your complaint and explain the outcome or next steps. If a privacy incident occurs, the practice will assess it and take steps required under applicable privacy and health-records laws, including notifying affected people and regulators where required.

If you are not satisfied with our response, you may be able to contact the Office of the Australian Information Commissioner (OAIC) about a matter under Commonwealth privacy law, or the Victorian Health Complaints Commissioner about a health-service or Victorian health-records matter. See oaic.gov.au and hcc.vic.gov.au.

9. Contact and updates

For privacy enquiries, requests or complaints, contact Beatrice, Nurse Practitioner and Clinical Lead, at CareWise Nurse Practitioners, HOME WITH HELP CARE SOLUTIONS PTY LTD (ABN 50 682 244 382), at 9 Old Hume Hwy, Beveridge VIC 3753, beatrice@carewisenursepractitioners.com.au or 03 4421 6384. We may update this policy when our information-handling practices change.