Privacy Policy

How we collect, use, store and protect your personal and health information

Blue Mountains Tinnitus Clinic (BMTC) is run by Gabrielle Bray (ABN 36 996 521 210). This Policy explains how BMTC handles your personal information, including health and other sensitive information. Because BMTC provides a health service, it is bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and by the Health Records and Information Privacy Act 2002 (NSW) (HRIP Act) and the Health Privacy Principles (HPPs). These obligations apply regardless of the size or turnover of the practice.

Part A is our Privacy Policy. Part B is a short Collection Notice we provide when we collect your information. By using BMTC's services you agree to your information being handled as described here.

Part A — Privacy Policy

1  What information we collect

We collect only what we reasonably need to provide safe, effective care and to run the practice. This includes:

•      Personal information: your name, date of birth, contact details, address, your physical location during telehealth sessions, and your emergency contact.

•      Health and other sensitive information: your tinnitus history, hearing history, medical and mental-health history, medications, risk and safety information, assessment results, session and progress notes, messages and activity responses in the Quenza app, and correspondence with your GP or other practitioners.

•      Administrative information: appointment records, communications with you, and payment information.

Sensitive information (which includes health information) is given extra protection under the law. We collect it only with your consent, or where we are otherwise permitted or required by law, and only for purposes directly related to your care.

2  How we collect information

We collect information:

•      directly from you, through the intake form, consent forms, sessions and messages;

•      from your GP or other practitioners, with your consent (see the Consent for Release of Information); and

•      through the platforms we use to deliver care (the video platform and the Quenza app).

Where it is reasonable and practicable, we collect information directly from you. If someone else gives us information about you (for example a referrer), we take reasonable steps to make sure you are aware of this Policy.

3  Why we collect and use it

We collect, hold and use your information to:

•      assess whether the service is appropriate for you and plan and provide your care;

•      communicate with you and manage appointments and payments;

•      keep accurate clinical records and meet our professional and legal obligations;

•      respond to risk and keep you safe (see our approach to serious threats below); and

•      improve the quality of our service.

We will not use your information for an unrelated purpose without your consent, unless the law permits or requires it.

4  When we disclose information

We treat your information as confidential. We disclose it only:

•      with your consent — for example, sending reports to or receiving information from your GP or other practitioners, as set out in the Consent for Release of Information;

•      to lessen or prevent a serious threat to the life, health or safety of you or another person, where it is unreasonable or impracticable to get consent;

•      where required or authorised by law — for example a court order or subpoena, or a mandatory-reporting or child-protection obligation; and

•      to our service providers (such as the platforms we use), who are bound to protect your information.

We do not sell your information, and we do not use it for third-party advertising.

5  Storage overseas

Some of the platforms we use to deliver care and hold records may store or process data on servers located outside Australia. Where your information is disclosed to an overseas recipient, this is a cross-border disclosure under Australian Privacy Principle 8, and we take reasonable steps to ensure it is handled consistently with Australian privacy law.

We use the following third party providers in relation your data collection and storage:

(i)             Quenza: Data is stored in the U.S., Netherlands, and/or Germany with appropriate safeguards such as SCCs for cross-border transfers. If you are located outside the U.S. or EEA, your use of Quenza may result in international data transfers necessary for contract fulfillment.

(ii)            Flodesk email marketing software: Flodesk stores and processes Personal Data in data centers located outside the European Union. All other Personal Data may be transferred and processed in the United States and anywhere in the world where Flodesk and/or its Sub-processors maintain data processing operations. Flodesk shall implement appropriate safeguards to protect the Personal Data, wherever it is processed, in accordance with the requirements of Data Protection Laws.

(iii)          Cliniko: Data is stored and processed in Australia for Australian users.

(iv)          Squarespace: Squarespace, and its affiliated products, store your data in Tier III data centers across the United States. We serve images and other static assets via multiple geographically distributed content delivery networks (CDNs). This system ensures that the data in each page view is served from the data center closest to the visitor’s location.

Please review each third party service’s individual terms on their websites for more detail around collection and storage of your information.

6  How we store and protect your information

We take reasonable steps to protect your information from misuse, loss, and unauthorised access or disclosure. These include secure, access-controlled electronic systems, reputable platforms with their own security measures, private delivery of telehealth, and limiting who can access records. No system is completely secure, and some risk remains, particularly at your end (for example, the security of your own device and login).

7  Keeping information accurate

We take reasonable steps to keep your information accurate, up to date and complete. Please tell us if your details or circumstances change so we can update your records.

8  How long we keep it

We keep health records for the minimum periods required by law. In general this is seven years from your last appointment for an adult, and for a client who was under 18 when last seen, until they turn 25. When records are no longer required, we destroy or de-identify them securely.

9  Accessing and correcting your information

You have the right to ask for access to the personal and health information we hold about you, and to ask us to correct it if it is wrong. These rights are set out in the APPs and the HRIP Act. To make a request, contact us using the details in section 13. We will respond within a reasonable time. In limited situations the law allows us to refuse access or provide it in another way (for example where access would pose a serious threat to someone's life, health or safety); if so, we will explain why and how you can respond.

10  Direct marketing

We do not use your health information for marketing. If we ever send you practice updates or newsletters, we will only do so where permitted, and every message will include a simple way to opt out.

11  Data breaches

We have processes to identify and respond to data breaches. If a breach of your personal information is likely to result in serious harm, we will notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme, and take steps to contain and remedy the breach.

12  Our website

Our website may collect limited technical information (for example through cookies or analytics) and will collect the details you give us when you contact us or buy a digital product.

13  Contact us, and how to complain

If you have a question, an access or correction request, or a privacy concern, please contact us first so we can help:

Privacy contact

Gabrielle Bray

Post

PO Box 151, Springwood NSW 2777

Email

gabrielle@bluemountainstinnitusclinic.com.au

If you are not satisfied with our response, you can complain to:

•      Office of the Australian Information Commissioner (OAIC) — 1300 363 992 · oaic.gov.au

•      NSW Information and Privacy Commission (IPC) — 1800 472 679 · email: ipcinfo@ipc.nsw.gov.au

For concerns about your care more broadly, the complaint options in the Clinical Services Agreement (including the health complaints body in your state or territory) also apply.

14  Changes to this Policy

We may update this Policy from time to time. The current version will be made available to you and, once we have a website, published there.

Last updated: July 2026

Part B — Collection Notice

We give you this short notice when we collect your information, as required by Australian Privacy Principle 5. It works with the full Privacy Policy in Part A.

Collection Notice — Blue Mountains Tinnitus Clinic

Who we are. Gabrielle Bray trading as Blue Mountains Tinnitus Clinic (ABN 36 996 521 210), PO Box 151, Springwood NSW 2777. Contact: gabrielle@bluemountainstinnitusclinic.com.au

What we collect and why. We collect your personal information and health information (a type of sensitive information) so we can assess whether our service suits you, plan and provide your tinnitus care, keep proper clinical records, keep you safe, and manage appointments and payments. We collect health and sensitive information only with your consent or as the law allows.

If you don't provide it. You don't have to give us your information, but if you don't, we may not be able to provide the service safely or at all.

Who we may share it with. With your consent, your GP and other treating practitioners. Without consent only where the law permits or requires it, including to lessen a serious threat to someone's safety, or under a legal or mandatory-reporting obligation. We also use trusted platforms (for telehealth video session, we use Cliniko and the Quenza app) to deliver care.

Storage and overseas. We store your information securely. Some platforms may store data overseas; see the Privacy Policy for details.

Access, correction and complaints. You can ask to see or correct your information, and raise any privacy concern, by contacting us. Our Privacy Policy explains your rights and how to complain to the OAIC or NSW IPC.