TCI Health - Privacy Policy

TCI Health Privacy Policy

Who are we and what do we do?

TCI Health Pty Ltd (ABN 18 656 230 278) ("TCI Health", "we") is a private company which is registered in Australia.

TCI Health offers secure cloud-based services ("Services") to :

Streamline and automate the billing of patients for medical practitioners ("practitioner clients"), including by facilitating payment of billings by third party payers (such as Medicare Australia, private health funds, or other regulatory payers);
Provide patients of practitioner clients ("patients") a secure platform to pay any gap fees incurred from medical services provided by their practitioners; and
Provide practitioner clients with statistical analysis of their invoices, billings and practices, including with respect to their individual patients.

TCI Health is committed to managing personal information (including sensitive information) in accordance with the Australian Privacy Principles ("APPs") under the Privacy Act 1988 (Cth) and in accordance with other applicable privacy laws (including the Health Records Act 2001(Vic) and equivalent State and Territory legislation). This policy sets out how we manage your personal information. In this Privacy Policy, "we", "us" and "our" refers to TCI Health and "you" or "your" refers to any individual about whom we collect personal information. This Privacy Policy tells you how we collect, store, use and disclose your personal information.

Why do we collect, hold and disclose personal information?

We collect personal information:

If you are our practitioner client, to provide the Services to you and others and to manage our client relationship;
To identify and correspond with patients who use our application, practitioner clients, and their representatives;
To carry out administrative tasks such as billing, entering into contracts, debt recovery activities;
To carry out our quality assurance and complaint handling activities in a professional and efficient manner; and
For marketing to you in accordance with the APPs.

What personal information do we collect and hold?

For all users

When you use TCI Health's applications , a record may be made which may include some of your personal information. The type of personal information that we collect will vary depending on the circumstances of collection and the kinds of services which we are providing to our practitioner clients.

Whenever users visit or interact with our website or application ("Platforms"), we and our third party providers may automatically or passively record their metadata information about how the Platform is accessed and used ("Usage Information"). Usage Information helps us keep our Platforms relevant to users and allows us to tailor our content. Usage Information is generally non-identifying, but if any aspect of it may identify you, we will treat it as personal information.

Patients' personal information

In addition to the above, we will also collect patients' personal information (some of which is considered sensitive information within the meaning of the APPs.) This includes but is not limited to patient names, dates of birth, patient identifiers, contact information, emergency contact details, financial and payment information, Medicare and/or health insurance information, information about patients' health, episodes of care (including information such as their surgical procedure, comorbidities and weight, and any notes made by our practitioner clients), scheduled surgeries and information about a health service that may be provide to the patient, patient medical records and information about medications; additional information considered by a health service provider necessary to facilitate the provision of health appointments or health-related services.

Our practitioner clients are solely responsible for ensuring that all necessary consents have been obtained from patients prior to the uploading of any of their information to our servers, and we endeavour not to collect patients' personal information if we have reason to believe that they have not provided their consent to the practitioner, to such collection. We will take all reasonable steps to ensure that patients are notified that their personal information has been collected to provide billing services. Where patients do not agree to our collection of their personal information or they wish to withdraw their consent to such collection, they may contact us to request deletion of their information in accordance with our policy below.

Personal information about practitioner clients and other medical professionals

We may collect and use personal information about individuals at our practitioner clients and other medical professionals to the extent necessary to provide the Services. This may include obtaining some personal information about surgeons who refer their patients to our practitioner clients (e.g anaesthetists), their personnel as well as hospital staff, most typically in the context of providing our Services in relation to, for, or for the benefit of a patient.

How do we collect patient personal information?

We generally collect patient personal information directly from the uploads of our client practitioners or their representatives, including via Optical Character Recognition (OCR) from image uploads and PDF or sticker submissions from our practitioner clients (where they have obtained or arranged for the obtaining of the patient's consent).

We may also collect certain ancillary information directly from patients, by electronic messages (including email and SMS, or any of our integrated messaging services), and via their usage of our Platforms (including via mobile Usage Information).

How do we hold, store and secure your personal information?

We are committed to providing secure and reliable Platforms. In order to protect the personal information which we hold, we use industry-standard physical, procedural and technical security measures in accordance with our obligations under the APPs, including encryption as appropriate. Our security model and controls align with industry best practices, and are based on (but not accredited to) standards such as ISO 27001, ISO 27018 and OWASP Top 10.

Our systems are hosted on Amazon Web Services, located in Australia. This allows us to provide a reliable service and keeps your data readily available. This data centre employs leading physical and environmental security measures, resulting in highly resilient infrastructure. We take reasonable steps to protect your personal information from misuse, interference and loss and from unauthorised access, modification or disclosure.

How do we use and disclose your personal information?

1. Patients

If you are an individual whose personal information has been uploaded to the TCI Health database (whether by yourself or by our practitioner client with your express informed consent) for the purpose of us providing the Services, we will use and disclose your personal information where this is reasonably necessary for, and relevant to, our delivery of the Services, including disclosures to the relevant practitioner client and other third parties (such as Medicare Australia, third party insurers, or other regulatory payers) for the purposes of delivering and enabling the Services. We may also use and disclose this information where required or permitted by law.

2. Contractors and other service providers

We may disclose personal information to third parties who need to know it, to the extent only that they need to know it, in order to assist us in providing the Services, including contractors and service providers used for payment processing, data processing or storage, technology providers, information technology services and support, Platform maintenance/development, and email and SMS distribution services who help us supply our products and services. Those third parties are typically bound by privacy obligations in respect of that information, including under privacy laws and in some cases, additionally through agreements with us.

3. Administration and management

We will also use and disclose personal information for a range of administrative, management and operational purposes to the extent that such use and disclosure is reasonably required. This includes:

administering billing, payments and debt recovery;
statistical analysis and reporting back to practitioner clients, and to others in an anonymised way;
risk management and management of legal liabilities and claims (for example, liaising with insurers and legal representatives);
responding to enquiries and complaints regarding our services;
obtaining advice from professional advisers; and
responding to subpoenas and other legal orders and obligations.

4. Marketing

We may send our practitioner clients direct marketing to inform them about products or services, special offers, promotions and events that may be of interest.

Practitioner clients' consent to receive direct marketing communications from us in the above ways will be deemed to have taken place if they do not opt out when offered the opportunity to do so, and will remain current on an ongoing basis unless and until they advise otherwise. If you are a practitioner client and do not want to receive such offers from us, you can opt out at any time by contacting us using our contact details provided below or by utilising the "unsubscribe" function in electronic communications.

5. Other uses and disclosures

In addition to the uses and disclosures set out in this policy, we may also use or disclose your personal information where:

You have consented to the use and disclosure (including to our practitioner clients);
The disclosure is pursuant to a sale or transfer of all or part of our assets and business;
The disclosure is permitted, required or authorised by or under law or ordered by a Court or Tribunal;
We are involved in a merger, acquisition, financing due diligence, reorganisation, bankruptcy, receivership, sale of company assets, or transition of service to another provider, and your information may be disclosed in connection with the negotiation of such transaction, and/or transferred as part of such a transaction as permitted by law and/or contract.

Do we transfer your personal information overseas?

We only store your personal information within Australia, and will not disclose your personal information to any overseas third parties without your prior consent.

Links to Third-Party Websites

Our Platforms may contain links and integrations to third party websites and platforms. This Privacy Policy does not apply to the practices of those third parties, and we are not responsible or otherwise liable for the actions, information, representations and privacy policies of the third parties that operate or interact with those other websites.

In order to use our Services, you may be required to provide those third parties with additional information, such as your credit card information. Any information which you provide to those third parties will not be shared with us and we will not collect or hold that information.

Your Privacy Rights

Certain jurisdictions have specific legal requirements and grant privacy rights with respect to personal information, and we will comply with restrictions and any requests you submit as required by applicable law. You may contact us to access and update any of your information that we hold.

How can you access or seek correction or deletion of your personal information?

We will take reasonable steps to ensure that the personal information we collect, use or disclose is accurate, complete and up to date in accordance with our obligations under applicable privacy regulation.

In instances where we hold your personal information in our database, you may contact us directly to seek an update, amendment or request deletion of your personal information. We will meet this request within a reasonable timeframe.

After receiving a request from you, we will take reasonable steps to correct your information however we are not liable for the accuracy, completeness or veracity of such information which we have collected from you and any third parties.

To request access to or update your personal information please contact our privacy officer using the contact details set out below. We will respond to your request within a reasonable time in accordance with the Privacy Act 1988 (Cth) and other applicable privacy laws depending on the jurisdiction.

You will not be charged for making a request to access your personal information, but you may be charged a reasonable fee for our costs and any expenses involved in compiling information in response to your request.

Changes to our Privacy Policy

We may amend this Privacy Policy from time to time, with or without notice to you, with prospective effect only. We recommend that you visit our Platforms regularly to keep up to date with any changes. By continuing to use our Services, you agree to be bound by the Privacy Policy as amended.

Complaints

If you have any concerns or would like to make a complaint, please contact the Privacy Officer (details below). Please include your full name, email address and/or telephone number and clearly describe your concerns or complaint. We will endeavour to investigate your matter and respond to your complaint within 14 days after it is made. If you are unhappy with our response, you may refer the issue to the Office of the Australian Information Commissioner (see www.oaic.gov.au)