Privacy Policy

Last Updated: September 2026

1. About this Privacy Policy

Grove Health is committed to protecting the privacy and confidentiality of the personal and health information entrusted to us.

This Privacy Policy explains how Grove Health (“Grove Health”, “Grove”, “we”, “us” or “our”) collects, holds, uses and discloses personal information in connection with the healthcare, clinical, administrative and support services we provide.

We manage personal information in accordance with the Privacy Act 1988 (Cth), including the Australian Privacy Principles (APPs), and other applicable privacy, health records and healthcare laws.

This Privacy Policy applies to information collected through our healthcare services, consultations, websites, patient portals, telephone and electronic communications, referrals, forms and other interactions with Grove Health.

2. Personal information we collect

The types of personal information we may collect and hold depend on the nature of our relationship with you and may include:

your name, date of birth, gender, address, telephone number, email address and other contact details;
identity and demographic information;
Medicare, concession, healthcare and other government-related information;
emergency contact and authorised representative details;
appointment, consultation and communication records;
billing, payment and administrative information;
information about referrals to or from other healthcare providers or services;
correspondence, enquiries, feedback and complaints; and
information relating to your use of our websites, portals and digital services.

As a healthcare provider, we also collect sensitive information, including health information. This may include:

medical history and current health conditions;
symptoms, diagnoses and clinical assessments;
medications and treatment history;
allergies and adverse reactions;
consultation and treatment notes;
prescriptions and dispensing information;
pathology, imaging and other clinical results;
information provided by your general practitioner, specialist, pharmacist or other healthcare provider;
information relevant to assessing your suitability for healthcare or treatment; and
other information reasonably necessary to provide, coordinate or facilitate your healthcare.

We only collect sensitive information where permitted by law, including where you have consented or where collection is otherwise authorised or required.

3. How we collect your information

We may collect personal information:

directly from you;
through registration, screening, consent or intake forms;
during consultations and other interactions with our clinicians or staff;
through our patient portal, website, email, telephone, SMS or other communication channels;
from your nominated representative, carer or responsible person where appropriate;
from doctors, specialists, pharmacists, hospitals, pathology providers and other healthcare providers involved in your care;
from Medicare, Services Australia or other government bodies where authorised;
from My Health Record and other authorised electronic health systems where applicable;
from pharmacies and dispensing providers;
from affiliated or related healthcare services where appropriate and permitted;
from organisations to which you have been referred or which have referred you to us;
from service providers assisting us to deliver or administer our services; and
from other third parties where you have authorised the collection or where collection is otherwise permitted by law.

Where reasonably practicable, we will collect personal information directly from you.

4. Why we collect, hold, use and disclose personal information

We may collect, hold, use and disclose personal information where reasonably necessary to provide, administer, coordinate and support our services and your healthcare.

This may include:

assessing your suitability for healthcare or treatment, including whether a particular service or treatment pathway may be appropriate;
providing clinical assessments, consultations, treatment and ongoing care;
prescribing and managing medications;
arranging or facilitating dispensing and pharmacy services;
reviewing medication and dispensing history;
monitoring treatment, safety and clinical outcomes;
communicating with you about your healthcare;
arranging appointments, follow-ups and reminders;
facilitating referrals to other healthcare practitioners, specialists or healthcare services;
coordinating care between healthcare providers;
facilitating access to additional healthcare, support or treatment services that may be relevant to your care;
preparing, submitting and administering Medicare, regulatory or other healthcare applications, claims and approvals;
processing payments, rebates, claims and accounts;
maintaining clinical and administrative records;
responding to enquiries, requests, feedback and complaints;
undertaking clinical governance, quality assurance, auditing, risk management and patient safety activities;
investigating incidents, adverse events or concerns;
managing our operations and improving our services;
complying with legal, professional, regulatory, insurance and reporting obligations;
preventing or investigating suspected fraud, unlawful activity or threats to safety; and
any other purpose for which you have provided consent or which is otherwise permitted or required by law.

5. Sharing information with healthcare providers and services

Providing healthcare frequently requires information to be shared between the people and organisations involved in a patient's care.

Where appropriate and permitted by law, we may disclose relevant personal or health information to:

general practitioners;
medical specialists;
nurse practitioners and nurses;
pharmacists and pharmacies, including affiliated pharmacy services involved in dispensing or supplying your prescribed medication;
allied health practitioners;
hospitals and healthcare facilities;
pathology, imaging and diagnostic providers;
other treating healthcare practitioners;
healthcare services to which you are referred;
healthcare providers or organisations from which you have been referred; and
other persons or organisations involved in providing, coordinating or facilitating your healthcare.

We seek to limit disclosures to information reasonably necessary for the relevant purpose.

Where specific consent is required for a disclosure, we will obtain that consent before the information is disclosed.

6. Referrals and additional healthcare services

As part of your care, a Grove Health clinician may identify another healthcare provider, treatment pathway, support service or healthcare organisation that may be relevant to your circumstances.

Where appropriate, we may discuss these services with you and, with your consent where required, facilitate a referral or introduction.

This may involve providing information to the receiving healthcare provider or organisation so that it can contact you, assess your needs, arrange an appointment or provide the relevant healthcare service.

The information disclosed will depend on the nature and purpose of the referral and may include your contact information and, where appropriate and authorised, relevant health or clinical information.

The receiving healthcare provider or organisation is responsible for its own privacy practices and for explaining how it will collect, use and manage any information it subsequently obtains directly from you.

7. Affiliated, related and associated services

Grove Health may work with affiliated, related or associated entities and healthcare services as part of providing, coordinating and facilitating healthcare and patient support.

Where permitted by law, personal information may be disclosed to or received from an affiliated, related or associated organisation where this is reasonably necessary, including to:

provide or facilitate a healthcare or related service requested by you;
coordinate your healthcare;
facilitate a referral or introduction;
provide clinical, administrative or patient support;
arrange pharmacy or dispensing services;
administer healthcare programs;
respond to your request or enquiry;
support the operation of services provided to you; or
otherwise carry out a purpose for which you have consented or which is permitted or required by law.

Where consent or another legal basis is required for a particular disclosure, we will ensure that requirement is met.

Consent may be obtained verbally, in writing or electronically, depending on the nature and circumstances of the disclosure and any applicable legal requirements. Where appropriate, we may ask you to complete an information release or consent form identifying the organisation, the purpose of the disclosure and the information that may be disclosed.

8. Service providers and contractors

We use third-party providers to assist us in operating our healthcare services and business.

Subject to applicable privacy requirements, information may be disclosed to service providers including:

medical and practice-management software providers;
telehealth platforms;
patient portal providers;
electronic prescribing services;
secure communications providers;
IT, hosting, cloud storage and cybersecurity providers;
payment processors;
telecommunications providers;
document and records-management providers;
professional advisers, including legal, accounting, insurance and compliance advisers;
auditors and accreditation providers;
logistics and delivery providers where relevant; and
other contractors who provide services to Grove Health.

We take reasonable steps to ensure service providers handling personal information are subject to appropriate privacy, confidentiality and security requirements.

9. Medicare, My Health Record and government bodies

Where relevant to your care or eligibility for services, we may collect information from or disclose information to Medicare, Services Australia, My Health Record, regulatory bodies and other government agencies or authorised healthcare systems.

This may include information necessary to:

verify your identity or eligibility;
process Medicare claims, rebates or other funding;
administer healthcare services;
access or contribute information to authorised electronic health records;
meet reporting requirements;
manage regulatory applications or approvals; or
comply with legal or regulatory obligations.

We will only use or disclose government-related identifiers where permitted by law.

10. Consent and information sharing

Where consent is required for the collection, use or disclosure of personal information, we will obtain consent in a manner appropriate to the circumstances and in accordance with applicable legal requirements.

Consent may be verbal, written or provided electronically. The form of consent we seek may depend on the nature of the information, the purpose for which it will be collected, used or disclosed, the recipient of the information and any applicable legal or regulatory requirements.

Where appropriate, we may document consent in our records or ask you to complete a consent or information release form. For disclosures to external, affiliated or related organisations, this may include a third-party information release or other consent form identifying the organisation, the purpose of the disclosure and the information that may be disclosed.

Any consent you provide applies to the purposes and information described or explained when consent is obtained.

You may withdraw consent you have previously provided by contacting us, subject to any applicable legal or practical limitations. Withdrawal will generally apply to future uses or disclosures and will not affect actions already taken in reliance on consent that was validly provided.

Withdrawing consent may affect our ability to provide, coordinate or facilitate certain healthcare or related services where the relevant information is necessary for those services.

11. Direct marketing and communications

We may communicate with you about Grove Health services, patient information, service updates and other matters where permitted by law.

We will only use or disclose personal information for direct marketing in accordance with applicable privacy and communications laws.

We will not use or disclose sensitive information, including your health information, for direct marketing unless you have provided the consent required by law.

Where required, marketing communications will provide a means for you to opt out of receiving further marketing communications.

Clinical, appointment, safety, service and administrative communications may not constitute marketing and may still be sent where necessary to provide or administer your healthcare.

12. Disclosure outside Australia

Some technology or service providers we use may store, process or access information outside Australia.

Where personal information is likely to be disclosed to an overseas recipient, we will take reasonable steps required by applicable privacy law in relation to that disclosure.

Where practicable, this Privacy Policy or a relevant collection notice will identify the countries in which overseas recipients are likely to be located.

Where our information-handling arrangements change, we may update this section accordingly.

13. My Health Record and electronic health information

Where applicable, Grove Health clinicians may access, use or contribute information to My Health Record and other authorised electronic health systems in accordance with applicable legislation, patient permissions and system requirements.

Information accessed through these systems will only be handled for authorised healthcare purposes.

14. Recording and communications

Grove Health does not ordinarily audio or video record consultations. If we propose to record a consultation or communication, we will notify you and obtain any consent required by law.

We may retain clinical notes, correspondence, telephone records, electronic messages and other records of interactions where required or appropriate for clinical, administrative, governance or legal purposes.

If we propose to record a communication or consultation, we will obtain any consent required and comply with applicable legal requirements.

15. Security of personal information

We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure.

These measures may include:

access controls;
authentication and account-security measures;
secure clinical and administrative systems;
encryption and secure communications where appropriate;
staff confidentiality and privacy obligations;
cybersecurity controls;
access monitoring;
staff education and training; and
incident and data-breach response procedures.

No information system is completely secure. If a suspected privacy or data-security incident occurs, we will assess and respond to it in accordance with applicable legal requirements, including the Notifiable Data Breaches scheme where applicable.

16. Retention of information

We retain personal and health information for as long as reasonably necessary to provide our services and meet our clinical, legal, regulatory, insurance and record-keeping obligations.

When information is no longer required to be retained, we will take reasonable steps to securely destroy or de-identify it where required by law.

17. Accuracy and correction

We take reasonable steps to ensure that personal information we collect, use and disclose is accurate, up to date, complete and relevant.

If you believe information we hold about you is inaccurate, incomplete or out of date, you may request correction by contacting us.

We will consider correction requests in accordance with applicable privacy laws and will notify you of the outcome.

18. Access to your information

You may request access to personal information we hold about you.

We will respond to requests within a reasonable period and provide access in the manner requested where reasonable and practicable, subject to any lawful exceptions.

In some circumstances, we may be permitted or required to refuse access to some information. If this occurs, we will provide reasons where required by law.

19. Authorised representatives

You may authorise another person to communicate with us or access information on your behalf.

Before disclosing personal or health information to a representative, family member, partner, carer or other person, we may require evidence of your authority or another lawful basis for the disclosure.

20. Privacy complaints

If you believe Grove Health has mishandled your personal information or breached your privacy, please contact us.

We will:

acknowledge and review your complaint;
investigate the circumstances;
seek any further information reasonably required;
communicate the outcome to you; and
take appropriate corrective action where necessary.

We will respond to privacy complaints within a reasonable period and will keep you informed of the progress and outcome of our review, where appropriate.

If you are dissatisfied with our response, you may be entitled to lodge a complaint with the Office of the Australian Information Commissioner (OAIC).

21. Cookies and website information

When you use our website or digital services, certain technical information may be collected automatically, such as your IP address, browser type, device information, pages visited and the date and time of access.

We may use cookies and similar technologies to:

operate and secure our website;
remember preferences;
understand how our website and digital services are used;
improve website performance and user experience; and
support analytics and other functions permitted by law.

You may be able to manage cookies through your browser settings. Disabling certain cookies may affect the functionality of our website or digital services.

Where information collected through cookies or similar technologies constitutes personal information, we will handle that information in accordance with this Privacy Policy.

22. Third-party websites

Our websites and digital services may contain links to websites or services operated by third parties.

Grove Health is not responsible for the privacy practices of independent third-party websites or services. We encourage you to review the privacy information provided by those organisations before providing personal information to them.

23. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our healthcare services, information-handling practices, technology, corporate structure, legal obligations or regulatory requirements.

The current version will be made available on the Grove Health website and will display the date on which it was last updated.

Where a change materially affects how we handle personal information, we may take additional reasonable steps to bring the change to the attention of affected individuals.

24. Contact us

For privacy enquiries, requests for access or correction, consent withdrawals or privacy complaints, please contact:

Grove Health

Email: info@grovehealth.com.au