Privacy
Policy

The Microbiome Clinic (we, us or our) knows how important it is to protect your personal information. This Privacy Policy explains our commitment to protecting the personal information you give us, or that we collect when we deal with you.

We are a medical practice providing telehealth consultations, microbiome testing and treatment to patients across Australia. Much of the information we hold is health information, which Australian law protects strictly. This policy explains how we collect, use, store and protect personal information under the Privacy Act 1988 (Cth), the Australian Privacy Principles, and the Health Records Act 2001 (Vic), which applies because our records are held in Victoria.

Your health records are held by the clinic. This policy also applies to the doctors who provide consultations through our clinic. It covers our patients, people who buy our tests, and visitors to our website. We only provide consultations and treatment to people while they are in Australia.

Personal information means information or an opinion about an individual who is identified or reasonably identifiable, whether or not it is true and whether or not it is recorded.

The personal information we may collect about you includes:

• Your name, date of birth, email, phone number, address and Medicare details.
• Details of payments between you and us, and the products and services you have bought from us.
• Information you give us through forms, questionnaires, surveys or feedback.
• Your marketing and communication preferences.
• Recordings of phone calls with us. We tell you at the start of the call if it is being recorded.
• If you use our website, information about how you use it, such as your IP address and browsing behaviour (including through cookies and analytics tools).

Sensitive information is a category of personal information that receives extra protection. It includes information about a person's racial or ethnic origin, political opinions, religious or philosophical beliefs, membership of a trade union or professional association, sexual orientation or practices, criminal record, and health, genetic or biometric information.

The sensitive information we collect includes:

• Health information you give us or that your other practitioners provide, such as your symptoms, medical history, medications, allergies and family history.
• Pathology and microbiome test results.
• Consultation notes, treatment plans and prescriptions.
• Your answers to follow-up questionnaires and treatment check-in forms.
• Your appointment history and records.
• Information about your sexual health, sexual orientation or practices, where it is relevant to your care.

We collect personal information in several ways, including:

• When you give it to us directly, including by phone, email, video consultation or online.
• When you fill in a form, such as a booking, intake or follow-up form.
• When you buy a test from us. If you then book a consultation, we access your test results from the laboratory.
• When you use our website (including through analytics and cookie providers; see "Cookies and analytics" below).
• From third parties, with your consent or where the law allows, such as a doctor who refers you, other practitioners involved in your care, the pathology laboratory, Medicare, or a parent or guardian acting for you.

We collect and use your personal information to provide our services and run the clinic, as set out below.

Providing your care

• To assess, test, diagnose and treat you, and follow up on how your treatment is going.
• To arrange pathology tests and receive the results.
• To bill you and process Medicare claims.

Communication and support

• To answer your questions and requests.
• To send you appointment reminders, results, follow-up questionnaires and important updates about your care.

Service improvement

• To review and improve the quality and safety of our care, including by looking at follow-up answers across patients without identifying anyone.
• To understand how our website and services are used, and improve them.

Marketing

• To send you information about our services, where you have agreed to receive it.
• To manage your marketing preferences.

Legal and compliance

• To comply with our legal obligations, including keeping health records and reporting notifiable conditions.
• To respond to court orders and legal processes.
• To meet regulatory and professional requirements.
• To protect our legal rights, or as otherwise authorised by law.

We never use your follow-up questionnaire answers or other health information in advertising, reviews or social media.

We may disclose personal information to:

People involved in your care

• Pathology laboratories
• The doctors who provide consultations through our clinic, who may be independent contractors
• Your other doctors and practitioners, with your consent

Service providers

• IT service providers
• Data storage providers
• Web hosting and server providers
• Practice management and booking software providers
• Email and phone providers
• Payment processors
• Marketing, advertising and analytics providers (who never receive health information)
• AI technology providers
• Our other contractors, where they need the information to provide services to us

Professional advisers

• Accountants and auditors
• Insurers
• Legal advisers

Corporate transactions

If the clinic is sold or merges with another practice, your information may be disclosed to the advisers involved and may be transferred with the business. We would give notice as the Health Records Act 2001 (Vic) requires.

Legal and regulatory bodies

• Courts and tribunals
• Regulators, including for reporting obligations
• Law enforcement

Other parties

• Medicare, when we make a claim for you
• Anyone you have authorised
• Emergency services, where necessary
• Anyone else, where required or permitted by law

We may store and disclose personal information overseas in some circumstances, for example when our service providers, or their sub-processors, store or access it outside Australia. These providers may be located in countries including the United States, Canada and New Zealand. This includes the third-party AI tools we use.

Where personal information is stored or accessed overseas, we take reasonable steps to make sure it is protected.

Your choice: Please read this policy carefully. By giving us personal information, you understand that we will collect, hold, use and disclose it as this policy describes. You don't have to give us personal information, but if you don't, we may not be able to provide our services to you.

Information from third parties: If we receive your personal information from someone else, we will protect it as this policy describes. If you give us information about someone else, such as your child, you confirm that you are entitled to do so.

Restrict and unsubscribe: Every marketing email we send includes a working unsubscribe link, and we action opt-outs within 5 business days. You can also contact us to opt out.

Access: You can ask to see the personal information we hold about you. We may charge a reasonable fee for providing it. In some situations the law allows us to refuse access. If we do, we will tell you why and how you can complain.

Correction: If you think information we hold is wrong, out of date, incomplete, irrelevant or misleading, please contact us and we will take reasonable steps to correct it. If we can't, we will tell you why and how you can complain.

Deletion: You can ask us to delete personal information we no longer need, such as marketing details or website enquiries. We will confirm your identity, check whether we are allowed to delete it, and let you know in writing, usually within 30 days. We cannot delete health records during the retention period set out under "Data retention" below, because the Health Records Act 2001 (Vic) requires us to keep them. Where we can only delete part of what you ask, we will tell you what we have kept and why.

Step 1: Contact us

• Email: reception@themicrobiomeclinic.com.au

Please include your full name, contact details and a clear description of your request or complaint.

Step 2: Our response

We will:

• Confirm your identity before acting on your request.
• Look into your complaint or process your request.
• Respond to you in writing within 30 days.
• Explain what we will do and keep you updated.
• Not charge you for making a request (other than any reasonable access fee).

Step 3: If you're not satisfied

You can ask for your complaint to be reviewed by our senior management, or you can contact:

• the Office of the Australian Information Commissioner (oaic.gov.au, 1300 363 992); or
• for health information, the Victorian Health Complaints Commissioner (hcc.vic.gov.au, 1300 582 113).

We are committed to keeping the personal information we collect secure. We use appropriate physical, electronic and managerial measures to protect it from misuse, interference, loss, and unauthorised access, change or disclosure.

No method of sending information over the internet, including email, is completely secure. We cannot guarantee the security of information while it is being sent to us, and you send it at your own risk. Once we receive it, we take reasonable steps to protect it.

We use cookies and similar technologies on our website to make it work and to understand how it is used. You can block or delete cookies in your browser settings or our cookie preferences, although blocking all cookies may affect how the website works.

Google Analytics

We use Google Analytics to understand how people use our website. You can opt out through your Google account settings or a browser add-on.

We never share health information with analytics or advertising providers, and we never target advertising based on a health condition.

Our website may link to other websites. We don't control those websites, and this policy doesn't cover them. We are not responsible for how they handle any personal information you give them.

We keep personal information for as long as we need it for the purpose we collected it, including to meet legal and regulatory obligations. As a general guide:

Health records are kept for at least 7 years from your last consultation with us or, if you were under 18 when we collected the information, until you turn 25, whichever is later. We may keep them longer where it is clinically necessary for your ongoing care.

Billing and transaction records are kept for 7 years, as required by Australian tax law.

Marketing contact details are kept while you remain subscribed. If you unsubscribe, we keep your email address on a suppression list so we can honour your opt-out.

Website and enquiry information from people who don't become patients is kept for no more than 3 years, then deleted or de-identified.

Overview: We may use AI technologies provided by third parties in running the clinic. We only use them where the law allows and where they help us provide our services.

How we use AI: We may use AI technologies to:

• draft documents, and conduct analysis and processing;
• automate certain processes and communications;
• respond to general enquiries about our services, pricing and availability;
• improve the efficiency of our customer service team;
• generate and modify content and code to improve and optimise our services and operations; and
• support quality assurance.

Data protection and security: We take reasonable steps to protect your personal information when we use AI providers. We have switched off the settings that would let our AI provider use our information to train its models. Our AI provider may process information in the United States.

De-identification: Where practical, we remove identifying details before using AI tools. Even so, we treat all information processed by AI tools as personal information.

Your rights and our commitments: Anything AI tools generate about you is treated as your personal information, and all your rights under this policy still apply. A doctor or staff member reviews all AI output before it is used or sent, and AI does not make decisions about your care. We do not make decisions about you by automated means.

We may change this Privacy Policy at any time by publishing the updated version on our website. Please check our website regularly for the current version.

For any questions or notices, please contact us at:

The Microbiome Clinic, operated by FitGut Pty Ltd (ACN 673 059 786)

Level 2, 1 Hobson Street, South Yarra VIC 3141

Phone: 03 9007 2630

Email: reception@themicrobiomeclinic.com.au