Privacy policy

CELLA Medical is the medical practice of Dr Chloe Carew MD FRACP (Ahpra MED0002229014). Dr Carew practises at Shop 6, 480 Riversdale Rd, Hawthorn East. In this policy, "we", "us" and "our" mean CELLA Medical and Dr Carew.

We handle your information in line with the Privacy Act 1988 (Cth), including the Australian Privacy Principles, and the Health Records Act 2001 (Vic), including the Health Privacy Principles.

We collect the information we need to care for you well. This includes:

• Your details: name, date of birth, contact details, emergency contact and GP details.
• Health information: medical history, medications, allergies, examination findings, consultation notes, screening questionnaires, treatment plans, the medication and batch used, and your outcomes.
• Photographs: clinical photographs taken before and after treatment.
• Billing details: records of costs and payments. We do not store full card numbers.
• Correspondence: emails, messages and notes of phone calls.

Health information is sensitive information and has extra protection under privacy law.

Your name. If the name you use differs from the name on your identity documents, please tell us. We will use your name and pronouns, and record other details only where the law requires them.

Anonymity. You can make a general enquiry without giving your name. We cannot treat you anonymously or under a different name, because prescribing and accurate records require us to identify you.

We collect most information directly from you, through your forms, your consultation, photographs, emails and our booking system. With your consent, or where the law allows, we may also collect information from your GP or other practitioners involved in your care.

Please do not send health information or photographs through social media messages. If you contact us that way, we will move the conversation to a secure channel.

We use your information to:

• Assess you, agree a plan with you, and provide and review your care.
• Prescribe medication and keep accurate medication records.
• Contact you about appointments, reviews and aftercare.
• Communicate with other practitioners involved in your care.
• Manage costs, payments and practice administration.
• Meet our legal, professional and insurance obligations, including clinical audit, quality improvement and managing complaints.

If you do not give us information we need, we may not be able to provide the care you are seeking.

Enquiry form. When you send an enquiry, your name, email address, phone number (if you give it) and message reach us through Formspree, a form service based in the United States, which holds your message there and passes it to our email. We use these details only to reply to you. Please do not include health details.

Online appointments. When you request an appointment online, you do so on Halaxy's booking page, not on this website. Your details and card are entered with Halaxy, which stores them in Australia.

Hosting. This website is hosted by Cloudflare. To deliver pages and protect the site, Cloudflare processes technical information such as your device's IP address.

Cookies. This website does not use advertising or tracking cookies. We count visits with Cloudflare Web Analytics, which does not use cookies and does not identify you. A cookie is set only where the site needs one to work, such as remembering access to a page that is open by invitation.

Other websites. This website links to other sites, such as Halaxy and Instagram, which have their own privacy policies.

With your consent, recorded on your consent form, Dr Carew may use an AI scribe during your consultation. We use Heidi Health, an Australian AI scribe. It listens to the consultation and drafts a clinical note. Heidi stores information in Australia and does not keep audio recordings. Dr Carew reviews and corrects every note before it is saved to your record.

You can say no, or change your mind at any time, including during a consultation. This will not affect your care.

Automated decisions. We do not use computer programs to make decisions about you. Every decision about your care is made by your doctor, together with you.

Clinical photographs are part of your health record. We use them to plan your treatment and assess your results. They are stored securely with your record and are not kept in personal photo libraries.

We only use photographs for education or marketing if you give separate written consent. You can withdraw that consent at any time. We will then stop using your photographs in new material and remove them from our own channels where we can, but we may not be able to recall material already published.

We only share your information for the purpose we collected it, for a directly related purpose you would reasonably expect, with your consent, or where the law requires or allows it. This may include:

• Your GP and other practitioners involved in your care. You can ask us not to send information to your GP.
• Other practitioners at the clinic where Dr Carew practises, for shared facilities, medication stock and clinic records.
• A registered nurse who assists with your treatment.
• Service providers who help us run the practice, such as clinical record, booking, AI scribe, email, website, IT, payment and accounting services. They may only use your information to provide their service to us.
• Our medical indemnity insurer and legal advisers, if needed to manage an incident, complaint or claim.
• Regulators and authorities where the law requires it, such as Ahpra, the Department of Health or a court.
• Your emergency contact or emergency services, if there is a serious threat to your life, health or safety.

We never sell your information.

Our records are held in secure cloud systems. Your clinical record and bookings are kept in Halaxy, a practice management system that stores information in Australia, encrypted both when stored and when sent. Our AI scribe, Heidi Health, also stores information in Australia.

Some other services we use, such as email, our website host and enquiry form, payment processing and accounting, may store or access information outside Australia, for example in New Zealand, the United Kingdom, the European Union or the United States. Before using a provider, we take reasonable steps to make sure it protects your information to the standard Australian privacy law requires.

Your records are kept in secure systems with restricted access, strong passwords and two factor authentication. Paper forms are scanned to your record and then stored securely or securely destroyed. Everyone who works with us is bound by confidentiality.

We keep health records for at least seven years after your last visit. We may keep records longer where they are needed for a legal matter. Records are then securely destroyed, and we keep a note of whose records were destroyed and when.

If the practice closes or moves, we will tell you how to access your records, as Victorian law requires.

You can ask for a copy of your health record at any time by contacting us in writing. We may need to confirm your identity first. We will respond within 30 days. There is no charge to ask, but we may charge a reasonable fee for copies, within the limits set under Victorian law, and we will tell you the fee beforehand. If we cannot give you access, we will explain why in writing and tell you how to complain.

If you believe your information is inaccurate, incomplete or out of date, please tell us and we will correct it. If we do not agree a change is needed, you can ask us to add a statement to your record.

We only send you news from CELLA if you have agreed to receive it, and every message lets you unsubscribe. Appointment, review and aftercare reminders are part of your care and are not marketing.

If your information is involved in a data breach that is likely to cause serious harm, we will notify you and the Office of the Australian Information Commissioner, as required by the Notifiable Data Breaches scheme, and tell you what you can do to protect yourself.

If you have a concern about your privacy, please contact Dr Carew first using the details below. We will acknowledge your complaint within seven days and aim to resolve it within 30 days. If you are not satisfied with our response, you can contact:

• The Office of the Australian Information Commissioner: oaic.gov.au, 1300 363 992
• The Health Complaints Commissioner (Victoria): hcc.vic.gov.au, 1300 582 113