Sunnybank Cardiopulmonary — Privacy Policy
Last updated: 14 October 2026
About this policy
Sunnybank Cardiopulmonary Diagnostic Service respects your privacy. This policy explains how we collect, hold, use and disclose personal information, including health information, when providing our services and operating our website.
We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
Information we collect
Depending on the services you receive, we may collect:
- Your name, date of birth, address and contact details.
- Medicare, health insurance and billing details where relevant.
- Referrals, medical history, medications, symptoms and other information relevant to your care.
- Test results, reports and clinical correspondence.
- Details of your referring doctor and other treating healthcare providers.
- Information provided through appointment requests, referral forms, enquiries or feedback.
- Technical information associated with use of our website, as described below.
We collect information reasonably necessary to provide our services and operate our practice.
How we collect information
We usually collect information directly from you through appointments, telephone calls, written communications and website forms.
We may also collect relevant information from your referring doctor, other treating healthcare providers or an authorised representative. We obtain consent where required by law.
If you provide information about another person, please ensure you are authorised to do so and, where appropriate, make them aware of this policy.
Why we collect and use information
We collect and use personal information to:
- Arrange appointments and communicate with you.
- Provide investigations and related clinical care.
- Prepare reports and communicate relevant findings to your treating healthcare providers.
- Manage billing and payments.
- Maintain clinical and administrative records.
- Respond to enquiries, feedback and complaints.
- Maintain the operation and security of our website and systems.
- Meet applicable legal and professional obligations.
If you do not provide information we reasonably need, we may be unable to arrange an appointment or provide some services. We will explain this where relevant.
Website appointment requests and referrals
Information submitted through our website forms is sent by email to reception for processing.
Reception transfers relevant information into our practice management system, Genie, and deletes the submission email after processing. Uploaded referrals and relevant clinical documents are saved into the patient record.
Deleting an email does not necessarily immediately remove copies held in deleted-item folders, backups or systems subject to retention arrangements.
Our website uses HTTPS to encrypt information transmitted between your browser and the website. Email delivery and storage are separate parts of the process; HTTPS does not provide end-to-end encryption of email sent to reception.
Please provide only information relevant to your request. Contact reception if you prefer to discuss another way to arrange an appointment or provide documents.
Website forms are not monitored for emergencies. For a medical emergency, call 000.
When we disclose information
Where appropriate and permitted by law, we may disclose relevant information to:
- Your referring doctor and other healthcare providers involved in your care.
- Medicare, insurers and other payment organisations where relevant.
- Service providers supporting our clinical systems, website, email, IT, billing, backups or records management.
- An authorised representative, where you consent or disclosure is otherwise permitted by law.
- Other recipients where you consent, or where disclosure is required or authorised by law.
Authorised practice staff and clinicians may access information as necessary for their duties.
We limit information sharing to what is relevant to its purpose. We do not use health information for direct marketing without your specific consent.
Storage, security and retention
We hold personal information in clinical and practice management systems, email systems and, where applicable, paper records.
We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification and disclosure. We review access arrangements, system security, backups and disposal practices as part of managing these risks.
No electronic transmission or storage system can be guaranteed completely secure. This does not limit our responsibility to take reasonable steps to protect your information.
We retain information for as long as required for its purpose and applicable legal or professional obligations. When information is no longer required and may lawfully be disposed of, we take reasonable steps to securely destroy or de-identify it.
Backup copies and records subject to system-retention arrangements may remain until those arrangements expire.
Website technology and Cloudflare Turnstile
Our hosting provider, Conetix, may record technical information in server logs, including IP addresses, browser details, requested pages and access times, for website operation, troubleshooting and security.
We use Cloudflare Turnstile on our website forms to help distinguish genuine visitors from automated bots and reduce spam.
Turnstile processes technical signals about your browser and connection, including your IP address, browser characteristics and the website on which the check occurs. Cloudflare uses these signals to provide bot protection and improve its bot-detection capabilities.
For further information, see:
Our use of Turnstile is for bot protection, rather than advertising or measuring general website usage.
External websites linked from our website have their own privacy policies.
Overseas processing and disclosures
Some service providers operate internationally and may process personal information outside Australia.
In particular, technical information processed through Cloudflare Turnstile may be handled overseas, including in the United States and other countries where Cloudflare and its service providers operate. This technical processing is separate from our storage of clinical records in Genie.
We take reasonable steps, where required by applicable privacy law, to assess overseas arrangements and protect personal information handled by our service providers.
Please contact us if you would like further information about the providers we use and their handling of your information.
Accessing and correcting your information
You may request access to personal information we hold about you or ask us to correct information you believe is inaccurate, out of date, incomplete, irrelevant or misleading.
Please contact reception using the details below. We may verify your identity before responding.
We will respond within a reasonable period. If we cannot provide access or make a requested correction, we will explain our reasons and the available complaint options, unless the law permits otherwise.
We do not charge for making a request. If a reasonable charge applies to providing access, we will explain it before proceeding.
Privacy enquiries and complaints
If you have a privacy question or concern, please contact our Practice Manager:
Sunnybank Cardiopulmonary Diagnostic Service
Telephone: (07) 33457189
Email: reception@sunnybankcardiopulmonary.com.au
Address: Suite 11, Level 2, Sunnybank Private Hospital, 245 McCullough Street, Sunnybank, 4109
We will investigate privacy complaints and aim to respond within 30 days. If more time is needed, we will let you know.
If you are dissatisfied with our response, you may contact the Office of the Australian Information Commissioner:
Website: www.oaic.gov.au
Telephone: 1300 363 992
Changes to this policy
We may update this policy when our services, systems or information-handling practices change. The current version will be available on our website, with its revision date shown above.