Privacy Policy
1. Scope of TMS Plus Privacy Policy
TMS PLUS Pty Ltd ACN 616 219 222 (TMS Plus, We, Our, Us) provides an advanced, multidisciplinary healthcare ecosystem spanning psychiatry, radiology and neurology, delivering person-centred interventional programs supported by digital infrastructure.
This Privacy Policy explains how We collect, hold, use, disclose and protect personal information, including sensitive information.
We handle personal information in accordance with the Privacy Act 1988 (Cth) (Privacy Act), including the Australian Privacy Principles (APPs), and health information in accordance with the Health Records and Information Privacy Act 2002 (NSW) (HRIP Act), including the Health Privacy Principles (HPPs).
For the purposes of this Privacy Policy, personal information and sensitive information have the meanings given to those terms in section 6(1) of the Privacy Act.
Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable:
- whether the information or opinion is true or not; and
- whether the information or opinion is recorded in a material form or not.
Sensitive information is a subset of personal information and includes information about an individual's racial or ethnic origin, political opinions, religious or philosophical beliefs, certain memberships or affiliations, sexual orientation or practices, criminal record, health information, certain genetic information and biometric information.
For the purposes of this Privacy Policy, Health Information has the meaning given to that term in section 6 of the HRIP Act.
Health Information includes information or an opinion about an individual's physical or mental health, medical history, clinical assessments, treatment and other health services provided or to be provided.
It also includes other personal information collected in connection with the provision of health services, including patient identification, contact, appointment and billing information.
2. Types of Personal Information Collected
We collect personal information reasonably necessary for the delivery of person-centred interventional psychiatry programs and other activities.
The information We collect may include identification and contact details, demographic information, medical histories, clinical assessments, treatment records, Medicare details, healthcare identifiers, health and biometric information, and information relating to appointments, payments and communications.
We collect personal information directly from individuals and, where appropriate, from referring practitioners, other healthcare providers, carers and authorised representatives, through consultations, referrals, clinical assessments, digital platforms and other communications.
3. How We Use and Disclose Personal Information
We use and disclose personal information for the primary purposes of providing, managing and improving Our clinical services, including patient assessment, treatment, monitoring, care coordination, administration, billing and communication with patients and healthcare providers.
We do not use or disclose personal information for direct marketing purposes. Communications relating to appointment reminders, treatment instructions, billing and clinically relevant follow-up are undertaken in connection with the provision and administration of Our Clinical Services and do not constitute direct marketing.
In accordance with Australian Privacy Principle 6 (APP 6), We may also use or disclose personal information for a secondary purpose where the individual has consented, where the individual would reasonably expect the use or disclosure and the secondary purpose is related to the primary purpose (or directly related in the case of sensitive information), or where otherwise permitted or required by law.
4. Research and De-identification of Health Information
We undertake research and development activities with financial support from Dr Egg Pty Ltd, trading as MindSkiller.com (Dr Egg), an R&D entity for the purposes of the Australian Government's Research and Development Tax Incentive.
Clinical and other health information collected in providing Our Clinical Services may be used for research and development activities, including research approved by a Human Research Ethics Committee (HREC).
Where clinical information is used to derive de-identified research data, We take reasonable steps to ensure that individuals are no longer identified or reasonably identifiable.
We may disclose limited information to Dr Egg for the administration, invoicing, cost allocation and verification of research and development activities. Wherever practicable and/or considered reasonably necessary, patient identification details are replaced with coded identifiers to minimise the disclosure of identifiable personal information.
The collection, use and disclosure of personal information for research and development purposes are subject to applicable privacy laws, relevant HREC approvals and consent requirements. Consent to participate in research is obtained separately where required.
5. Consent to the Handling of Personal Information
Where required by the Privacy Act, We obtain an individual's consent to collect, use or disclose their personal information, including sensitive information.
In connection with Our services and activities, We distinguish between three forms of consent:
- Informed Consent to Receive Clinical Services
- Consent to receive Clinical Services, including the collection, use and disclosure of personal information reasonably necessary for the provision of those services, subject to applicable privacy laws.
- Informed Consent to Participate in Research
- Separate consent to participate in research activities, including the use of clinical and other health information to create de-identified research data for research approved by a Human Research Ethics Committee (HREC).
- Financial consent
- Includes consent to the collection, use and disclosure of personal information reasonably necessary to administer fees and payments, including credit card and other payment information, in accordance with applicable privacy laws.
Consent to one of these matters does not, of itself, constitute consent to the others.
Individuals may withdraw consent, subject to applicable laws and the terms governing the relevant Clinical Services or research activities. Withdrawal of consent to participate in research does not affect access to otherwise available Clinical Services.
6. Storage, Security and Retention of Personal Information
We take reasonable steps to protect personal information, including sensitive information, from misuse, interference, loss and unauthorised access, modification or disclosure.
Clinical and Research Information
Clinical information is collected, held, processed and stored on MindSkiller.com, a purpose-built, Australian-hosted digital platform supporting Our clinical services and research activities. De-identified research data is derived from clinical information and is also held, processed and stored on MindSkiller.com. The platform is owned by Australian interests associated with TMS Plus.
Administrative and Operational Information
We use third-party digital platforms to support Our business operations, including staff communications, appointment scheduling and patient administration. Personal information handled through these platforms is limited to information reasonably necessary for the relevant operational purposes.
Security of Personal Information
We implement reasonable technical and organisational safeguards to protect personal information, including access controls, restrictions on authorised users and security measures appropriate to the nature and sensitivity of the information. These safeguards apply to personal information held on Our own systems and information handled through third-party service providers.
Retention and Disposal of Personal Information
We retain personal information for as long as required by law or needed for purposes permitted under applicable privacy laws, including the provision of Clinical Services, administration and research activities. When personal information is no longer required to be retained, We take reasonable steps to securely destroy or de-identify it, subject to applicable legal and regulatory obligations.
7. Disclosure of Personal Information to Overseas Recipients
Clinical information and de-identified research data are stored in Australia on the MindSkiller.com platform.
We also use third-party digital platforms for certain operational purposes. Personal information handled through these platforms may be stored, processed or accessed outside Australia and, depending on the arrangements with the relevant service providers, may be disclosed to overseas recipients.
These overseas recipients may be located in countries including the United States, Canada, the United Kingdom, India, Ireland, Singapore, Japan, Germany and Switzerland where Our service providers and their subcontractors operate.
Where personal information is disclosed to overseas recipients, We take reasonable steps to protect that information and comply with Our obligations under the Privacy Act and the HRIP Act, including applicable requirements concerning overseas disclosures and transfers of health information outside New South Wales.
8. Access to and Correction of Personal Information
Individuals may request access to personal information We hold about them, including their health information, and may request correction of information they believe is inaccurate, out of date, incomplete, irrelevant or misleading.
Requests for access may be made using the contact details provided in this Privacy Policy. We may require reasonable verification of an individual's identity or authority to make the request before providing access or making corrections.
We respond to requests within a reasonable period and take reasonable steps to correct the relevant personal information in accordance with applicable privacy laws. Access may be restricted or refused where permitted or required by law, in which case We will explain the reasons and available complaint procedures, subject to applicable legal requirements.
We do not charge for making an access or correction request or for correcting personal information. Where permitted by law, a reasonable fee may apply for providing access to personal information, including copies of clinical records.
Where We decline to correct information, individuals may request that a statement identifying the disputed information be associated with their records, in accordance with applicable law.
9. Privacy Complaints
Individuals who have concerns or complaints about how We handle their personal information, including health information, may contact Us using the details provided in this Privacy Policy.
We will review and respond to complaints within a reasonable period, generally within 30 days of receipt, and take appropriate steps to resolve any identified issues.
If a complaint is not resolved satisfactorily, individuals may contact the Office of the Australian Information Commissioner (OAIC) or, for matters concerning health information, the NSW Privacy Commissioner through the Information and Privacy Commission NSW (IPC).
10. Changes to Our Privacy Policy
We may amend this Privacy Policy from time to time to reflect changes to Our services, information-handling practices or applicable laws.
The current version will be published on Our website, together with the date of its most recent update.
11. Contact Us
For enquiries, requests for access to or correction of personal information, or privacy complaints, please contact:
TMS PLUS Pty Ltd
Privacy Officer
Email: info@tmsplus.com.au
Telephone: +61 2 8073 4776
Address: 32 Adelaide Street Woollahra NSW 2025
TMS Plus Collection Notice
1. About This Collection Notice
TMS PLUS Pty Ltd ACN 616 219 222 (TMS Plus, We, Our, Us) collects personal information, including sensitive information and health information, in connection with the provision of Our Clinical Services and other activities.
This Collection Notice explains what personal information We collect, how and why We collect it, and how that information may be used or disclosed.
This Notice is provided in accordance with the Privacy Act 1988 (Cth) (Privacy Act), including the Australian Privacy Principles (APPs), and the Health Records and Information Privacy Act 2002 (NSW) (HRIP Act), including the Health Privacy Principles (HPPs).
This Notice should be read together with Our Privacy Policy, which provides further information about how We handle personal information, including access, correction and privacy complaints.
2. Types of Personal Information Collected
We collect personal information reasonably necessary for the provision of Our Clinical Services and other activities.
The information We collect may include identification and contact details, demographic information, medical histories, clinical assessments, treatment records, Medicare details, healthcare identifiers, health and biometric information, and information relating to appointments, payments and communications.
3. How We Collect Personal Information
We collect personal information directly from individuals through consultations, clinical assessments, referrals, forms, digital platforms and other communications.
Where appropriate, We may also collect personal information from referring practitioners, other healthcare providers, carers, family members and authorised representatives, where permitted or required by law.
4. Purposes of Collection
We collect personal information for the primary purposes of providing, managing and improving Our Clinical Services, including patient assessment, treatment, monitoring, care coordination, appointment scheduling, administration, billing and communication with patients and healthcare providers.
We may also collect personal information specifically for research and development activities, including research approved by a Human Research Ethics Committee (HREC).
Clinical and other health information originally collected for the provision of Clinical Services may subsequently be used to create de-identified research data, subject to applicable privacy laws, relevant HREC approvals and any applicable consent requirements.
5. Collection Required or Authorised by Law
We collect personal information in the ordinary course of providing Our Clinical Services and conducting related business activities, in accordance with the Privacy Act and the HRIP Act.
In certain circumstances, We may also be required or authorised to collect personal information under other Australian laws, including the Health Insurance Act 1973 (Cth), the Healthcare Identifiers Act 2010 (Cth), and applicable legislation governing taxation, public health and healthcare services.
6. Consequences of Not Providing Personal Information
Individuals may choose not to provide certain personal information requested by Us.
However, where information is reasonably necessary for the provision of Clinical Services, failure to provide that information may affect Our ability to assess suitability for treatment, provide services safely and effectively, or meet applicable legal and regulatory obligations.
In some circumstances, We may be unable to provide, continue or arrange particular Clinical Services without the necessary information.
Declining to provide information solely for research purposes, or declining to participate in research, will not affect access to otherwise available Clinical Services.
7. Use and Disclosure of Personal Information
We use and disclose personal information for the purposes of providing, managing and improving Our Clinical Services, including patient assessment, treatment, monitoring, care coordination, administration, billing and communication.
Personal information may be disclosed to treating and referring practitioners, other healthcare providers, authorised representatives, Medicare and other government agencies, and third-party service providers where reasonably necessary for these purposes or otherwise permitted or required by law.
We may also use or disclose personal information for secondary purposes in accordance with applicable privacy laws, including where the individual has consented or another lawful basis applies.
The use of clinical and other health information for research and development activities is addressed separately below.
8. Research and De-identification of Health Information
TMS Plus undertakes research and development activities on behalf of Dr Egg Pty Ltd trading as MindSkiller.com (Dr Egg), under a Services Deed between the parties.
Clinical and other health information collected in providing Our Clinical Services may subsequently be used to derive de-identified data for research and development activities, including research approved by a Human Research Ethics Committee (HREC).
We may disclose limited information to Dr Egg for the administration, invoicing, cost allocation and verification of research and development activities, including coded patient identifiers and related financial information. Wherever practicable and/or reasonably necessary, patient names and other direct identifiers are excluded from these disclosures, subject to applicable privacy laws.
The use and disclosure of personal information for these purposes are subject to applicable privacy laws, relevant HREC approvals and consent requirements. Consent to participate in research is obtained separately where required, and declining to participate does not affect access to otherwise available Clinical Services.
9. Enhanced Privacy and Confidentiality Safeguards
Where TMS Plus reasonably considers that a patient's age, circumstances, public profile or other factors create a heightened risk of harm, privacy intrusion, safety concern or reputational impact arising from unauthorised access to, use or disclosure of personal or health information, TMS Plus may collect additional information reasonably necessary to implement enhanced privacy and confidentiality safeguards.
This may include information concerning authorised representatives, nominated contacts, communication preferences, identity-verification requirements or other arrangements relevant to protecting the patient's privacy, confidentiality or safety. This information will be used and disclosed only as reasonably necessary to implement and administer those safeguards, provide Clinical Services, and otherwise in accordance with applicable privacy and health-records laws.
10. Disclosure to Overseas Recipients
We use third-party digital platforms for administrative and operational purposes. Personal information handled through these platforms may be stored, processed or accessed outside Australia and, depending on the arrangements with the relevant service providers, may be disclosed to overseas recipients.
These recipients may be located in countries including the United States, Canada, the United Kingdom, India, Ireland, Singapore, Japan, Germany and Switzerland where Our service providers and their subcontractors operate.
Further information about overseas disclosures and the protection of personal information is provided in Our Privacy Policy.
11. Access to and Correction of Personal Information
Individuals may request access to personal information We hold about them, including health information, and request correction of information they believe is inaccurate, out of date, incomplete, irrelevant or misleading.
Requests may be made using the contact details provided in this Collection Notice.
Further information about access and correction procedures, including any applicable fees, restrictions and complaint rights, is provided in Our Privacy Policy.
12. Our Privacy Policy and Privacy Complaints
Our Privacy Policy provides further information about how We collect, hold, use, disclose and protect personal information, including sensitive information and health information.
Individuals who have concerns or complaints about how We handle their personal information may contact Us using the details provided in this Collection Notice.
Our Privacy Policy explains how We manage privacy complaints and how individuals may refer unresolved complaints to the Office of the Australian Information Commissioner (OAIC) or the NSW Privacy Commissioner.