Privacy Policy

Dr Sarah Anthony (ABN 82 515 429 653) Shop 20 Yorktown Square, Launceston TAS 7250

We are committed to protecting the privacy of the information we collect and to handling your personal information responsibly, in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), cyber security legislation, and relevant state and territory privacy legislation. Health service providers are covered by the APPs regardless of business size, so this policy applies to every patient and website visitor, whatever the size of our practice.

This Privacy Policy explains how we collect, use and disclose your personal information, how you may access that information, and how you may seek correction of any information. It also explains how you may make a complaint if you are concerned there has been a breach of privacy legislation. This policy also addresses the responsible use of Artificial Intelligence (AI) technologies within our practice.

From time to time we may make changes to this policy, and to our processes and systems relating to how we handle your personal information. We will update this Privacy Policy to reflect any changes, and the current version will always be available on our website and in the practice.

When and why we ask for your consent

Under the Privacy Act, all health information is sensitive information, and we need your consent to collect it (unless an exception applies). When you first attend Dr Sarah Anthony, we will ask you to provide information (for example, contact details) and ask you to confirm your consent to the collection of that information. This means you are providing consent for us to gather, access and use your personal health information to provide healthcare to you. Your personal information is only accessed by practitioners and staff who need it to provide your care.

We will seek your express consent separately before using your information for any purpose not directly related to your healthcare — for example, research, or sharing identifiable information with a third party for a reason unrelated to your treatment.

The kinds of personal information we collect and hold

Depending on how you interact with us, we may collect:

  • Identity and contact details — your name, date of birth, address, phone number and email address.

  • Health information — your medical history, current medications, skin and health assessments, treatment records, consultation notes, and any information you provide about your goals or concerns. Health information is treated as sensitive information under the Privacy Act and is given a higher level of protection.

  • Clinical images — photographs taken for skin assessment and to track treatment over time, where you have consented to this. These images may be analysed using AI-assisted tools (via Clinical Imaging Australia's Consult platform) to support your assessment.

  • Consultation transcripts and notes — during your consultation, we may use Halaxy's AI-assisted transcription feature to convert the conversation into clinical notes in real time. No audio recording is stored — only the final transcript and the clinical notes generated from it are kept, securely, as part of your patient record. This lets your doctor stay focused on you during the consultation, rather than on manual note-taking, while still producing an accurate clinical record. You will be told about this at the start of your consultation, and you can opt out at any time.

  • Appointment and billing details — booking history, appointment reminders, and payment information processed through our booking platform.

  • CCTV — we use live CCTV monitoring on our premises for security and safety purposes. Footage is not recorded or stored.

  • Website usage information — general analytics data (such as pages visited and browser type) collected automatically when you visit our website.

We do not collect more information than we need to provide safe, appropriate care and to run the practice. We primarily collect information directly from you. In certain circumstances, and with appropriate authority, we may also obtain information from third parties such as other treating practitioners, hospitals, or diagnostic service providers. In limited situations, we may collect information from other people, such as your relatives or friends — for example, in an emergency.

How we collect your personal information

We collect personal information:

  • directly from you, during consultations, on intake and consent forms, and through our online booking system;

  • through Halaxy, our practice management and online booking platform, when you book, manage or attend an appointment — including through its AI-assisted transcription feature, which we use during consultations to support accurate clinical note-taking;

  • through Clinical Imaging Australia, the platform we use to capture and store clinical photographs, where relevant to your treatment (all data is stored within Australia). Clinical Imaging Australia's Consult platform uses AI to assist with analysing clinical images and supporting diagnosis;

  • through SkinXS, a French skincare and skin-assessment platform that uses AI to assist with skin analysis and diagnostic support — where your skin assessment data may be stored overseas, this only occurs with your consent, captured through a SkinXS onboarding form you complete ahead of your first appointment;

  • through CCTV on our premises, monitored live for security and safety purposes only — no footage is recorded or stored; and

  • automatically through our website, via standard analytics tools. Signage is displayed on our premises wherever CCTV is in operation.

Why we collect, use and disclose your information

We collect, hold, use and disclose your personal and health information to:

  • provide clinical assessment, diagnosis, treatment planning and treatment;

  • manage bookings, reminders, and billing;

  • maintain accurate clinical records, as required by our professional and regulatory obligations (including those set by AHPRA), including through AI-assisted transcription of consultations;

  • communicate with you about your care, including appointment reminders and necessary follow-up, using methods such as SMS, email, or our online booking platform; and

  • meet our legal, regulatory and professional indemnity obligations.

Marketing: With your consent, we may send you marketing communications, such as blog updates and other content from the practice. You can give this consent when you provide your details to us (for example, when booking an appointment or subscribing to updates). Every marketing email includes a clear way to unsubscribe or opt out at any time, and you can also opt out by contacting us directly using the details below. Opting out of marketing communications will not affect appointment-related messages, such as booking confirmations and reminders, which we send as part of providing your care.

We will never sell your personal information.

Quality improvement, education and research

We are committed to continuously improving the quality of our services and supporting clinical education. We may use your information in the following ways:

Quality improvement and staff education: We may use patient information for internal audits, staff training, clinical review, and accreditation activities, de-identified where practicable.

Research: We do not currently participate in research using identifiable patient data. If this changes, we will seek your express consent before sharing identifiable data, and any research project will require appropriate ethics approval and will meet applicable legal and privacy requirements.

Use of Artificial Intelligence (AI)

We use AI technologies in a few areas of the practice:

  • Clinical documentation — AI-assisted transcription of consultations, via Halaxy (see above).

  • Skin assessment and diagnostic support — AI-assisted analysis of your skin and clinical images, via SkinXS and Clinical Imaging Australia's Consult platform, to help inform your assessment.

We do not use AI for chatbots, appointment triage, or any purpose beyond supporting clinical documentation and assessment as described above.

Governance of our AI use:

  • We use AI tools in a manner consistent with the Australian Privacy Principles and relevant ethical standards.

  • Your personal information is not used to train or develop any AI model unless we have obtained your express consent.

  • All outputs generated by AI tools (such as consultation transcripts, and skin or image analysis from SkinXS and Clinical Imaging Australia) are subject to human review and clinical oversight by your doctor.

  • AI tools assist with assessment and diagnostic support, but they do not make clinical decisions on their own. Every diagnosis and treatment decision is made by Dr Sarah Anthony, who reviews all AI-generated output as part of her own clinical judgement.

Who we may disclose your information to

We disclose personal and health information only where necessary to provide your care or run the practice, including to:

  • Halaxy, our practice management and booking provider, which stores data in Australia but may use overseas sub-processors for functions such as payments, accounting, communications, and AI-assisted transcription (see Overseas disclosure below);

  • Clinical Imaging Australia, for the capture and secure storage of clinical photographs (stored via Microsoft OneDrive, in an Australian storage region — no data stored overseas);

  • SkinXS, for skin assessment (see Overseas disclosure below);

  • other healthcare providers, where you are referred for further care, or where it is clinically necessary (for example, a specialist, your GP, or a pathology service); and

  • regulatory bodies, insurers or legal advisers, where required by law or professional obligation.

We do not disclose your information to any other third party for their own marketing purposes. We do not disclose personal information to overseas recipients unless it is necessary for the provision of your care and appropriate safeguards are in place, in accordance with Australian Privacy Principle 8.

Overseas disclosure

Some of the platforms we use may store or process data outside Australia as part of their own service delivery:

  • Clinical Imaging Australia stores all clinical images within Australia — no data is stored overseas.

  • Halaxy stores general practice data in Australia, and this extends to its AI-assisted transcription feature: your consultation is transcribed live and no audio recording is kept — only the resulting transcript and clinical notes are stored, on Halaxy's AWS cloud infrastructure, and for Australian practices, that data is stored within Australia (Halaxy stores EU users' data within the EU, to comply with GDPR). Halaxy has separately disclosed that it uses some overseas sub-processors for other functions, such as payment processing and accounting. More detail is available on Halaxy's security page.

  • SkinXS is a French skincare and skin-assessment platform. Before your first appointment, you complete a SkinXS onboarding form as part of your pre-appointment tasks, which includes your consent for your skin assessment data to be stored overseas (including in France) where applicable.

Where information is disclosed overseas, we take reasonable steps to ensure the overseas recipient handles it consistently with the Australian Privacy Principles.

Anonymity and pseudonymity

Where possible, you have the right to interact with us anonymously or under a pseudonym. However, given the nature of medical and aesthetic healthcare, and our legal obligations regarding medical records and billing, it is generally impractical for us to provide care without knowing your identity. Please raise this with us if you wish to remain anonymous or use a pseudonym, and we will consider your request — but if it is impractical or required by law, we will need you to be identified.

How we store and protect your information

We take reasonable steps to ensure your personal information is accurate, complete, up to date and relevant, and to protect it from misuse, interference, loss, and unauthorised access, modification or disclosure. This includes:

  • storing clinical images via Clinical Imaging Australia, with underlying storage in an Australian Microsoft OneDrive region;

  • using a secure electronic medical record system with role-based access controls, restricting access to patient records to those staff who need it to provide your care;

  • relying on the security measures of our practice management and clinical platforms (Halaxy, Clinical Imaging Australia, SkinXS), each of which is subject to its own privacy and security obligations. Halaxy stores data, including AI-assisted transcription data, on secure AWS cloud infrastructure meeting industry security standards — see Halaxy's security page for detail; and

  • CCTV used for live monitoring only, for security and safety purposes — no footage is recorded or stored, and signage is displayed on our premises.

No method of electronic storage is completely secure, but we take reasonable, proportionate steps to protect your information.

How long we keep your information, and how we dispose of it

We retain health records for as long as required by our professional and legal obligations. Following medical indemnity guidance, we keep the complete medical record of a patient aged 18 or over at the date of the last entry in their record for at least seven years from that date (generally your last consultation with us, but this can also include other entries such as a follow-up phone call or the date test results were received and added to your file). If you were under 18 years of age at the date of the last entry in your record, we retain your record until you turn, or would have turned, 25 years old.

Information that is no longer required for the purpose it was collected, and where the minimum retention period has passed, is destroyed or de-identified in a safe and responsible manner, as required under privacy legislation.

Accessing and correcting your information

You have a right to request access to the personal information we hold about you, and to ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading. To make a request, please contact us in writing using the details below. We will respond within 90 days. A small fee may apply to cover the administrative cost of retrieving and providing copies of records, but you will not be charged for making the request itself. In some limited circumstances permitted by law, we may need to refuse a request — if so, we will explain why.

Website data and cookies

Our website uses standard analytics tools (such as cookies and tracking technologies) to understand how visitors use the site — for example, which pages are viewed. This information is generally anonymous or de-identified and is not linked to your identity unless you have also provided identifying information to us directly (for example, by booking an appointment or emailing us).

How to make a complaint

If you believe we have breached the Australian Privacy Principles or mishandled your personal information, please contact us first, using the details below, so we can investigate and respond.

Privacy contact: Name: Dr Sarah Anthony Role: Privacy Officer Postal address: Shop 20 Yorktown Square, Launceston TAS 7250 Phone: 0461 362 503 Email: info@drsarahanthony.com.au

If you are not satisfied with our response, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

Website: www.oaic.gov.au Phone: 1300 363 992

Policy review statement

This document was updated on 21 August 2026. We review this Privacy Policy at least annually, or sooner where there are changes to our operations, the law, or the technology we use (including AI or online tools). Significant changes will be communicated to patients via email, in the practice, or on our website.