Admission.com.au Pty Ltd (Admission.com.au, we, us or our) provides software and support services to Australian hospitals and healthcare organisations. Our platform enables those organisations to manage patient information and deliver their services.
This policy explains how we handle personal information in providing our services and conducting our business. We comply with the Privacy Act 1988 (Cth), the Australian Privacy Principles and applicable state and territory privacy and health records laws. We collect information by lawful and fair means and only where reasonably necessary for the relevant service or activity.
We collect personal information about hospital and healthcare organisation contacts, authorised platform users and people who contact us through our website or business dealings. This may include names, business contact details, professional roles, account details and enquiry or support correspondence.
We use this information to manage user access and customer accounts, provide our services and support, respond to enquiries, administer business relationships and meet legal obligations.
We also collect technical information, including connection details and access records. Event logs help us monitor service reliability and security and investigate technical issues. General enquiries may be made anonymously where lawful and practicable.
We hold patient information on behalf of the hospital or healthcare organisation using our platform. Information may be supplied by that organisation and its authorised systems, or entered by patients and their representatives through forms and services it makes available.
Depending on the services provided, patient records may include:
The healthcare organisation determines the information required for its services, manages access to its patient records and directs the patient communications facilitated through the platform. Its privacy policy and collection notices explain how it handles information for healthcare and related purposes.
We handle patient records to deliver and support the agreed services, including forms, admissions, document management and communications on the organisation's behalf. Where consent is required for the collection of health information, it is obtained through the healthcare organisation or platform unless a lawful exception applies. Government-related identifiers are handled only as permitted by law.
Identifying information is usually required for patient services. If required information is not provided, the healthcare organisation may be unable to provide the relevant service.
We disclose personal information where needed to provide the agreed services, with appropriate authority, or as otherwise permitted or required by law. Recipients may include:
We limit the information shared to what is needed for the relevant purpose and require appropriate privacy, confidentiality and security safeguards from our service providers.
Patient records are stored in Australia. We use trusted third-party providers to deliver SMS and email messages on behalf of healthcare organisations. These providers may process messages outside Australia, including in the United States. We share only the information needed to deliver each message, and health information held in the platform is not shared with these providers.
We take reasonable steps, including contractual commitments, to ensure these providers protect personal information in accordance with the Australian Privacy Principles.
We hold information electronically. Our platform and all patient records are hosted and stored in Australia, in secure, certified infrastructure.
We are certified to ISO/IEC 27001, the international standard for information security management. Personal information is encrypted in transit and at rest, and data is backed up regularly so it can be recovered if needed.
We take reasonable technical and organisational steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. Access is limited to authorised people who need the information for their role. Our personnel access patient records only as needed to deliver and support the agreed services, subject to confidentiality and security requirements.
We assess and respond to suspected privacy incidents, coordinating with the relevant healthcare organisation where appropriate. We notify the Office of the Australian Information Commissioner and affected individuals where required under the Notifiable Data Breaches scheme.
Patient information is retained in accordance with the arrangements agreed with the relevant healthcare organisation and applicable legal requirements. These arrangements may vary between customers and services.
Other personal information is retained for as long as needed for the purposes described in this policy or to meet legal obligations. When information is no longer required for a lawful purpose, we take reasonable steps to securely destroy or de-identify it.
You have the right to request access to personal information held about you and to request its correction.
For access to or correction of patient records, please contact the hospital or healthcare organisation that provided your services. That organisation manages patient-record requests, and we support it in responding. If a patient-record request reaches us, we will coordinate with the relevant organisation to facilitate a response while meeting our own legal obligations.
For other personal information we hold about you, such as business contact or account information, please contact our Privacy Officer below.
We take reasonable steps to maintain accurate, up-to-date and complete information. We may verify your identity or authority before responding to a request and will respond within 30 days. If a request is refused, we will explain the reasons and available complaint options as required by law.
For questions about this policy or concerns about our handling of personal information, please contact:
Privacy Officer
Admission.com.au Pty Ltd
Level 12, 64 York Street, Sydney NSW 2000
Phone: 02 7252 2022
Email: [email protected]
Website: www.admission.com.au
We will acknowledge and investigate your complaint and provide a response within 30 days. If more time is needed, we will let you know why and when to expect a response.
If you are dissatisfied with our response, or do not receive a response within a reasonable time, you may contact the Office of the Australian Information Commissioner. A relevant state or territory privacy or health complaints body may also be able to assist.
You can also contact us to request a copy of this policy in another accessible format.
We may update this policy to reflect changes to our services, practices or legal requirements. The current version will be available on our website, with additional notice or consent sought where required by law.