Our Privacy Policy

INTRODUCTION

At Dr Finn Ghent Neurosurgery, protecting the privacy of our patients and the integrity of their health information is a fundamental obligation of our practice. We are a specialist neurosurgical consulting practice based in Newcastle, New South Wales, providing neurosurgical assessment, management and care.

This Privacy Policy explains how we collect, hold, use, disclose and protect your personal information, including sensitive health information, in the course of providing our services (Services). It applies to all patients, referrers, and other individuals whose personal information we handle in the ordinary course of our practice.

We are bound by the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs) contained in Schedule 1 to that Act.

Unless context otherwise requires, words importing the singular include the plural and vice versa.

WHAT IS PERSONAL INFORMATION?

Personal information is information or an opinion, whether true or not, about an identified individual or an individual who is reasonably identifiable from that information, either alone or in combination with other information to which we have or are likely to have access.

Sensitive information is a subset of personal information that is afforded a higher degree of protection under the Privacy Act. Health information is a form of sensitive information and includes information or an opinion about the health or disability of an individual, information collected in the course of providing a health service, or information that is predictive of an individual’s health. Given the nature of our neurosurgical practice, the vast majority of information we collect and hold is health information, and we apply the highest standard of care to its protection.

WHAT PERSONAL INFORMATION DO WE COLLECT?

Personal and Demographic Information

We collect the following categories of personal information:

• Your full name, residential and postal address, telephone number(s) and email address;
• Date of birth and gender;
• Medicare number and card details;
• Department of Veterans’ Affairs (DVA) file number and entitlement details, where applicable;
• Private health insurance details and membership numbers;
• Financial and billing information, including payment card details (processed through secure payment systems) and account information required to facilitate invoicing and health fund claiming; and
• Emergency contact and next of kin details.

Health and Medical Information

As a neurosurgical specialist practice, we collect and hold a comprehensive range of sensitive health information, including:

• Medical history, including past surgical procedures, prior diagnoses and presenting complaints;
• Current and previous diagnoses relevant to your neurosurgical care;
• Current medications, including dosage and prescribing practitioners;
• Known allergies and adverse drug reactions;
• Disability-related information where relevant to your assessment and management;
• Treatment plans, care recommendations and post-operative instructions;
• Clinical assessments and examination findings recorded during consultations;
• Wound photographs and clinical images taken for the purpose of clinical documentation and monitoring of surgical outcomes; and
• Referral letters and clinical correspondence received from general practitioners, specialists, hospitals, pharmacies, pathology services, insurance companies and legal representatives.

Demographic Information — Racial and Ethnic Origin

We may collect information about your racial or ethnic origin for demographic purposes. This information is used solely to assist us in understanding the demographic composition of our patient population and to support quality improvement and service planning activities. It is not used for any clinical, diagnostic or treatment purpose, and its provision is entirely voluntary. If you choose not to provide this information, it will have no effect whatsoever on the care you receive from our practice.

Racial and ethnic origin information is sensitive information under the Privacy Act, and we apply the same heightened standard of protection to it as we apply to all sensitive health information.

Information We Do Not Collect

We do not collect biometric identifiers (such as fingerprints or voice recordings), NDIS participant numbers, MyAgedCare identifiers or political opinions.

HOW DO WE COLLECT YOUR PERSONAL INFORMATION?

We collect personal information through a number of means. In most cases, we collect information directly from you. We also receive information from third parties involved in your healthcare, as described below.

Direct Collection

We collect information directly from you when you:

• Complete our new patient intake form
• Attend a consultation, during which clinical observations and examination findings are recorded;
• Contact our practice by telephone, email or other means; or
• Provide information in the course of receiving, or enquiring about, our services.

Your consent to the collection of personal information may be express (for example, by signing a consent form or completing an intake form acknowledging this Privacy Policy) or implied by your conduct in seeking and receiving our Services.

Collection from Third Parties

We frequently receive personal and health information about you from third parties who are involved in your care or have a legitimate role in your health management. Such third parties include:

• General practitioners, who provide referral letters, medical histories, current treatment plans and clinical summaries;
• Specialist medical practitioners, including other surgeons, who provide diagnostic reports, procedural records and treatment recommendations;
• Hospitals and day surgery facilities, which provide discharge summaries, intraoperative records, anaesthetic reports and pathology results;
• Pharmacies, which may provide dispensing histories relevant to your medication management;
• Pathology and radiology services, which provide investigation results essential to your neurosurgical assessment;
• Insurance companies, including workers compensation and personal injury insurers, where you are a claimant or insured person; and
• Legal representatives, where your care is the subject of legal or compensation proceedings.

We collect information from these third parties either with your express consent, or in circumstances where collection without consent is necessary for the provision of a health service and where it is impracticable to obtain your consent at that time, in accordance with APP 3.4.

WHY DO WE COLLECT AND USE YOUR PERSONAL INFORMATION?

We collect and use your personal information for the following primary and secondary purposes.

Primary Purposes

• To provide neurosurgical consulting services, including assessment, diagnosis, management, referral and surgical planning;
• To develop, implement and monitor treatment and care plans tailored to your clinical needs;
• To communicate with your referring practitioners and other treating health professionals to ensure coordinated and continuous care;
• To process billing, invoicing, Medicare and DVA claims, and facilitate payment; and
• To maintain accurate and complete clinical records as required by law and professional standards.

Secondary Purposes

We may also use your information, in de-identified form where practicable, for the following secondary purposes:

• Quality improvement activities, including clinical audit and review of patient outcomes;
• Medical education and training of clinical staff and trainees within our practice;
• Academic research and case studies, subject to appropriate ethical and privacy protections and, where identifiable information is used, your separate consent; and
• Administrative purposes necessary to the effective management of our practice.

We do not use your personal information for marketing purposes and we do not sell, transfer or otherwise deal with your personal information for any commercial benefit, service or advantage.

ARTIFICIAL INTELLIGENCE AND TECHNOLOGY-ASSISTED SERVICES

I use an artificial intelligence scribe service that listens to our consultation and takes notes for me. This allows me to focus on you and understanding your problem, without having to take notes on paper or computer. This is integrated into the Xestro practice software I use.

Practice Management Automation

We use automated functions within our practice management system, Xestro, for scheduling, appointment reminders, invoicing, payment processing, health fund claiming and administrative communications. These automated communications are generated through Xestro and are subject to the same security and privacy protections as all other personal information we hold. You may opt out of non-essential automated communications by notifying us.

No Automated Clinical Decision-Making

We do not use automated systems for clinical decision-making, diagnosis or the formulation of treatment recommendations. All clinical judgements, diagnoses and treatment decisions are made by Dr Finn Ghent, FRACS, exercising independent professional clinical judgment, informed by evidence-based neurosurgical principles.

WHEN AND HOW DO WE DISCLOSE YOUR PERSONAL INFORMATION?

We handle your health information with the utmost discretion. As a general principle, we do not disclose your personal information to external parties without your consent, save in the limited circumstances described below.

Disclosure With Your Consent

Where we share information with third parties in the course of coordinating your care, we do so with your consent, which is documented in your patient record. Consent may be given expressly in writing or verbally, in which case it is noted in your clinical record. Disclosures made with your consent may be to:

• Your referring general practitioner and other members of your treating team, including specialist medical practitioners, anaesthetists, allied health professionals and hospital clinical staff;
• Hospitals and day surgery facilities at which your procedure is to be performed;
• Pathology and radiology providers requested to carry out investigations;
• Insurance companies, case managers and legal representatives acting in connection with a workers compensation, personal injury or other insurance claim, to the extent authorised by you; and
• Other persons specifically authorised by you in writing.

Disclosure Without Consent

In limited circumstances, we may be required or permitted to disclose your personal information without your consent. These include:

• Where disclosure is necessary to prevent or lessen a serious and imminent threat to your life, health or safety, or to that of another person, and you are unwilling or unable to provide consent;
• Where disclosure is required by or under Australian law, including in response to a subpoena, court order or other compulsory legal process; and
• Where disclosure is otherwise permitted under the Privacy Act or applicable health records legislation.

We do not routinely report to mandatory government agencies and have no current mandatory reporting obligations relevant to our practice. If such obligations arise in a specific clinical context, we will, where practicable, inform you before making such a disclosure.

No Sale or Commercial Transfer of Information

We do not sell, rent, exchange or otherwise transfer your personal information for any commercial purpose or benefit. We do not disclose your personal information to third parties for marketing or advertising purposes.

HOW DO WE STORE AND PROTECT YOUR PERSONAL INFORMATION?

We are committed to ensuring that your personal information is stored securely and protected against misuse, interference, loss, and unauthorised access, modification or disclosure. We implement a comprehensive suite of technical and organisational security measures.

Electronic Records – Xestro Practice Management System

All electronic clinical records are stored within Xestro, a cloud-based specialist practice management system operated by Xestro Pty Ltd and certified to the ISO 27001 information security standard. Xestro stores data exclusively in Australian data centres, ensuring full data sovereignty. The platform employs multiple layers of security, including physical security of server infrastructure, network security, and encryption of data both in transit and at rest.

Technical Security Measures

Our technical security framework includes:

• Password protection and encryption for all digital systems;
• Secure Sockets Layer (SSL) protocols for all data transmission;
• Multi-factor authentication for access to practice management and clinical systems;
• Encryption of sensitive information in both transit and at rest;
• Secure server infrastructure provided through certified cloud service providers with Australian data sovereignty protections;
• Regular security monitoring, software updates and threat assessments; and
• Automated backup systems with encrypted data recovery capabilities.

Organisational Security Measures

Our organisational security measures include:

• Role-based access controls ensuring that staff access only the information necessary for the performance of their duties;
• Immediate account deactivation and access removal processes upon the departure of personnel from the practice;
• Staff induction training covering privacy obligations, data handling procedures and confidentiality requirements, with ongoing professional development;
• Documented incident response and data breach notification procedures in accordance with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act; and
• Ongoing evaluation of our technology platforms and third-party service providers to ensure continued compliance with applicable privacy and security standards.

Paper Records

Where personal information is held in paper form, it is stored in secure areas with restricted access. Paper records containing personal information are securely destroyed when no longer required.

Limitations

Whilst we take all reasonable precautions to protect your personal information, no method of data transmission or electronic storage is completely secure. We cannot guarantee the absolute security of information transmitted over the internet, and such transmission occurs at your own risk. Should we become aware of a data breach that is likely to result in serious harm to any affected individual, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.

HOW LONG DO WE RETAIN YOUR PERSONAL INFORMATION?

We retain clinical records and associated personal information for a minimum period of ten (10) years from the date of your last attendance or discharge from our practice. This period reflects our obligations under applicable professional standards, the Health Records and Information Privacy Act 2002 (NSW), and the requirements of our professional indemnity insurer.

At the expiry of the applicable retention period, personal information is securely deleted from our cloud-based systems. Where information cannot practicably be deleted at that time (for example, because it forms part of records the subject of ongoing legal proceedings), it will be retained only for as long as necessary to fulfil the purpose for which extended retention is required.

We may retain de-identified information beyond the standard retention period for quality improvement, training or research purposes.

YOUR RIGHTS IN RELATION TO YOUR PERSONAL INFORMATION

Right of Access

You have the right under APP 12 to request access to the personal information we hold about you. Requests for access should be directed to us via email to admin@drghent.com.au. We will respond to access requests within 30 days of receipt.

We may refuse access in the limited circumstances permitted by the Privacy Act, including where providing access would pose a serious threat to the life or health of any person, would have an unreasonable impact on the privacy of other individuals, where the request is frivolous or vexatious, or where denial of access is required or authorised by law. If we refuse access, we will provide written reasons and information about how you may complain about our decision.

Right to Correction

Under APP 13, you have the right to request correction of personal information we hold that you believe is inaccurate, out of date, incomplete, irrelevant or misleading. Upon receipt of a correction request, we will confirm the proposed amendment with you and, upon verification, update the relevant information in Xestro. We will confirm completion of any correction in writing.

Right to Request Deletion or Restriction

You may request the deletion or restriction of use of your personal information by written request. We will comply with deletion requests to the extent permitted by law. However, we are required to retain clinical records for the minimum period described in section 10 above, and cannot delete records within that period where retention is required by law or professional obligation. We will advise you in writing of any grounds on which we are unable to comply with a deletion request.

Anonymity and Pseudonymity

Given the nature of neurosurgical care and the clinical risks associated with anonymous treatment, it is not practicable for our practice to provide services anonymously or under a pseudonym. Accurate identification is essential to safe clinical management, including the accurate correlation of investigation results, the verification of Medicare and health fund entitlements, and the prevention of clinical error. Accordingly, we do not offer anonymous or pseudonymous access to our Services.

Communications Format

We provide communications in both electronic and hard copy formats. You may indicate your preferred mode of communication. Clinical information of significance will generally be communicated in writing, with follow-up by telephone where clinically appropriate.

SPECIAL CLINICAL CONSIDERATIONS

DVA Patients

Patients holding Department of Veterans’ Affairs (DVA) entitlements are managed in accordance with the DVA’s applicable guidelines and our obligations as a DVA-accredited provider. DVA file numbers and entitlement information are collected and held for the purpose of facilitating claims and ensuring appropriate care coordination.

Patients Who Lack Decision-Making Capacity

Where a patient lacks the decision-making capacity to consent to the collection, use or disclosure of their personal information, we will have recourse to the relevant substitute decision-maker in accordance with the Guardianship Act 1987 (NSW) and, where applicable, orders of the NSW Civil and Administrative Tribunal (Guardianship Division). We will take reasonable steps to verify the authority of any person purporting to act as a substitute decision-maker before relying upon their consent.

Insurance and Medico-Legal Contexts

Where a patient’s care is the subject of workers compensation, personal injury, or other insurance or medico-legal proceedings, we handle information disclosed to or from insurers and legal representatives with particular care. We will only disclose personal information in such contexts with the patient’s express written consent, or as required by law.

CHANGES TO THIS PRIVACY POLICY

We will review and update this Privacy Policy periodically, and no less frequently than every five years, to reflect changes in our practice, applicable law, or technology. The current version of this Privacy Policy will be maintained on our website and is available in hard copy from our practice upon request.

When material changes are made to this Privacy Policy, we will notify patients by updating the Date of Current Version at the head of this document and, where practicable, by posting a notice on our website and making updated copies available at our practice. Your continued attendance at our practice following notification of material changes will constitute acceptance of the updated Privacy Policy, save in respect of any changes that require your separate consent by law.

THIRD PARTY SERVICES AND WEBSITES

This Privacy Policy does not apply to third-party websites, services or platforms to which we may link or refer. We are not responsible for the privacy practices of any third party, including payment processors, health technology platforms or other health providers involved in your care. We encourage you to review the privacy policies of any third-party service you interact with in the course of receiving our Services.

COMPLAINTS, ENQUIRIES AND CONTACT

Our Complaint Handling Process

If you have concerns about how we handle your personal information, or believe that we have breached the APPs or applicable health records legislation, you are entitled to lodge a complaint. We take all privacy complaints seriously and will investigate them promptly and impartially.

Our complaint handling process is as follows:

• Upon receipt of your complaint, we will acknowledge it within 7 business days;
• We will investigate the matter with appropriate personnel and, where necessary, our external privacy advisers;
• We will provide you with a substantive written response, including our findings and any corrective action taken, within 30 days of receipt of your complaint; and
• If further time is required due to the complexity of the matter, we will notify you of the expected timeframe and keep you informed of progress.

External Complaints – OAIC

If you are not satisfied with our response to your complaint, or if you prefer to raise your concern directly with the privacy regulator, you may contact the Office of the Australian Information Commissioner (OAIC):

Practice Contact Details

For all privacy-related enquiries, access requests, correction requests, complaints or concerns, please contact us:

Dr Finn Ghent Neurosurgery | ABN 93 420 468 251
Privacy Policy | Date of Current Version: June 2026