This policy explains how MoleSpot Skin Cancer Clinic handles personal information and sensitive health information, including clinical photographs, dermoscopic images, appointment communications and information processed by approved artificial intelligence-assisted technologies.

 

Your key privacy rights

You may ask to access or correct the personal and health information we hold about you.

AI-assisted consultation note-taking is optional and will only be used after you are informed and consent is obtained.

Clinical imaging systems may use computer-assisted or AI-supported analysis. These systems support, but do not replace, your doctor’s clinical judgement.

You may contact our Privacy Officer if you have a question, request or complaint.

 

Privacy contact

Practice Manager / Privacy Officer
87 Dublin Road, Ringwood East VIC 3135
03 8813 0699  |  info@molespot.com.au
www.molespot.com.au

​

1. Purpose, scope and legal framework

 

MoleSpot Skin Cancer Clinic is committed to protecting privacy and managing personal information openly and transparently. This policy applies to personal information and health information handled by the clinic, its doctors, nurses, administrative staff, contractors and approved service providers in connection with the clinic’s services.

We handle information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles, the Health Records Act 2001 (Vic), the Health Privacy Principles and other applicable healthcare, professional and record-keeping obligations.

This policy is supported by more specific collection notices and consent processes. For example, we may provide specific information and seek consent for clinical photography, mole mapping, AI-assisted consultation documentation, procedures, research, education or marketing. Where the law or a specific consent form provides a higher standard, that requirement will apply.

​

2. Who can I contact about privacy?

 

For privacy enquiries, requests to access or correct information, or complaints, please contact:

• Privacy contact: Practice Manager / Privacy Officer

• Address: 87 Dublin Road, Ringwood East VIC 3135

• Telephone: 03 8813 0699

• Email: info@molespot.com.au

Please do not include highly sensitive clinical information in an ordinary email unless necessary. We may ask you to verify your identity or use a more secure communication method.

​

3. When and why is consent necessary?

 

When you register as a patient and request healthcare, you consent to the clinic collecting, holding, using and disclosing information reasonably necessary to provide and manage your care, communicate with you, maintain your medical record and meet legal and professional obligations.

We seek additional or specific consent when required, including for:

• AI-assisted consultation note-taking before it is activated during a consultation;

• clinical photography, total body photography, mole mapping and dermoscopic imaging;

• use of identifiable or de-identified images for education, training, publication or promotional purposes where separate consent is required;

• participation in research;

• direct marketing; and

• any use or disclosure that is not part of providing healthcare and is not otherwise permitted or required by law.

Consent must be voluntary, informed, current and specific. You may decline or withdraw consent prospectively without affecting your right to receive appropriate care, although we may be unable to provide a service where the information or imaging is essential to that service. Withdrawal does not require us to delete an existing medical record that we are legally required to retain.

In limited circumstances, information may be collected, used or disclosed without consent where permitted or required by law, including emergencies, serious threats to health or safety, mandatory notifications, court orders and other statutory obligations.

​

4. What personal and health information do we collect?

​

The information collected depends on the services you receive and may include:

• Identity and contact information: name, date of birth, address, telephone number, email address, gender or sex where clinically relevant, preferred language and emergency contact details.

• Healthcare identifiers and eligibility information: Medicare number, Individual Healthcare Identifier, DVA details, concession or pension information and health fund details where relevant.

• Clinical information: presenting concerns, medical and surgical history, medications, allergies, adverse reactions, family history, social history, occupation and risk factors where relevant to your care.

• Clinical records and results: consultation notes, diagnoses, management plans, referrals, prescriptions, certificates, pathology results, procedure records, correspondence and recall information.

• Clinical images: total body photographs, regional clinical photographs, dermoscopic images, before-and-after treatment images, reports, annotations and image-comparison data.

• AI-assisted outputs: draft consultation notes, transcriptions, consent logs and analytical outputs generated by approved documentation or imaging systems.

• Administrative and financial information: appointment history, billing details, Medicare or DVA claiming information, invoices, payment records and debt-recovery information where applicable.

• Communications: emails, SMS messages, online form responses, telephone notes, call recordings or transcripts where notified, feedback and complaints.

• Digital information: website and online service interactions, device or browser information, IP address, cookies and analytics data.

• Security information: CCTV images from entrances, reception and common areas. CCTV is not used in consulting or treatment rooms.

We aim to collect only information that is reasonably necessary for our functions and your healthcare. Clinicians and staff are expected to ensure that information entered into the medical record is accurate, relevant and appropriately limited to the clinical and administrative purpose.

​

5. Can you deal with us anonymously or under a pseudonym?

 

You may make a general enquiry anonymously or using a pseudonym where this is lawful and practical. It is usually impracticable to provide ongoing healthcare, maintain an accurate medical record, prescribe medicines, arrange pathology, perform clinical imaging, make Medicare or DVA claims, or safely coordinate care without confirming your identity.

​

6. How do we collect information?

 

We usually collect information directly from you or from an authorised representative. This may occur when you:

• complete our Microsoft Forms registration form, a consent form or another paper or electronic form;

• make or manage an appointment through reception, our website, an online booking provider or a telephone service;

• attend a consultation, procedure, skin check, mole mapping session or cosmetic treatment;

• communicate with us by telephone, email, SMS, website, social media or in person;

• provide clinical photographs or other records; or

• submit feedback, a complaint or a request to access or correct your information.

Some telephone interactions may be handled by an automated or AI-assisted receptionist. Where call recording or transcription is enabled, callers will be notified. Recordings or transcripts may be used for appointment management, service quality, staff training, safety and resolving disputes, and access is restricted to authorised persons.

We may also collect information from:

• your parent, guardian, carer, substitute decision-maker or another person authorised by you;

• other health professionals and organisations, including GPs, specialists, hospitals, allied health providers, pharmacies, pathology laboratories and diagnostic imaging providers;

• Medicare, the Department of Veterans’ Affairs, health funds and other payment or claiming organisations;

• My Health Record, electronic prescribing, secure messaging and other digital health services where applicable;

• insurers, legal representatives, regulatory bodies or government agencies where authorised; and

• technology and service providers acting on our behalf.

​

7. Why do we collect, use and hold information?

 

We collect, use and hold information primarily to provide safe, appropriate and continuous healthcare. Purposes may include:

• identifying you and confirming your contact and eligibility details;

• assessing, diagnosing, monitoring and treating skin conditions and other health concerns;

• conducting skin checks, dermoscopy, clinical photography, mole mapping, procedures and selected cosmetic treatments;

• comparing images and monitoring lesions or treatment outcomes over time;

• preparing and maintaining accurate medical records, reports, referrals, prescriptions and certificates;

• communicating results, follow-up plans, recalls, appointment reminders and clinically relevant information;

• coordinating care with other health professionals and organisations;

• billing, payment processing, Medicare and DVA claiming, accounting and debt recovery;

• clinical governance, incident management, complaint handling, accreditation, quality improvement and staff education;

• maintaining the safety and security of patients, staff, premises and information systems;

• meeting legal, regulatory, insurance, professional and record-retention obligations; and

• establishing, exercising or defending legal claims.

​

8. When and with whom do we share information?

 

We only disclose information where it is reasonably necessary for the purpose for which it was collected, for a directly related purpose you would reasonably expect, with your consent, or where authorised or required by law. Depending on your care, information may be shared with:

• doctors, nurses and staff within the clinic who require access to perform their role;

• referring or treating health professionals, hospitals, pathology laboratories, pharmacies and other healthcare providers;

• Medicare, DVA, health funds and payment or claiming organisations;

• secure messaging, electronic prescribing, My Health Record and other digital health services where applicable;

• accreditation bodies, auditors, insurers, our medical defence organisation, legal advisers, accountants and consultants where necessary;

• technology providers supporting our medical records, imaging, communications, online forms, website, backups, cybersecurity and business operations;

• government authorities, regulators, courts, tribunals or law-enforcement bodies where required or authorised; and

• a person or authority where disclosure is necessary to lessen or prevent a serious threat to life, health or safety.

We take reasonable steps to limit disclosure to the minimum information needed and to ensure service providers are subject to appropriate confidentiality, privacy and security obligations. We do not sell patient information.

Overseas processing and disclosure

Some technology and service providers used by MoleSpot Skin Cancer Clinic may store, process or provide technical support in relation to limited personal information from locations outside Australia. These providers may include services supporting our website, online forms, email, communications, analytics and information technology systems.

Where we are likely to disclose personal information to an overseas recipient, we take reasonable steps to ensure that the information is handled in accordance with applicable Australian privacy requirements. The countries in which overseas recipients are likely to be located will be identified where it is practicable for us to do so. Further information about the overseas handling of personal information by a particular service provider is available from the clinic on request.

​

9. How are digital health and document automation technologies used?

 

The clinic uses Bp Premier as its primary clinical information system. Approved integrations and digital health tools may assist with creating and transmitting referrals, prescriptions, pathology requests, certificates, reports, recalls and other healthcare documents. These documents are reviewed by the responsible clinician or authorised team member and contain information relevant to their purpose.

We may also use electronic prescribing, secure clinical messaging, Medicare and DVA claiming, My Health Record and other approved digital services where applicable. Access is restricted through individual user accounts, role-based permissions and other security controls.

​

10. How is an AI-assisted medical scribe used?

 

Some doctors at MoleSpot Skin Cancer Clinic use Lyrebird Health, an AI-assisted medical scribe accessed through an approved integration with Bp Premier on clinic-managed devices. Lyrebird listens to the consultation and prepares a draft clinical note. It is a documentation aid only and does not independently diagnose, recommend treatment or replace the treating doctor’s judgement.

Before Lyrebird is activated, the doctor will inform you and obtain your consent. You may decline or withdraw consent at any time without affecting your care. You may also tell reception in advance if you prefer that AI-assisted note-taking not be used. Consent or refusal is documented in the clinical record or consent log.

The treating doctor remains responsible for the content of the medical record and reviews and edits the draft before the final note is saved in Bp Premier. Draft content that is inaccurate, unnecessary or irrelevant should be removed or corrected before finalisation.

Under Lyrebird’s current Australian service arrangements:

• patient data is processed and stored in Australia;

• consultation audio is ordinarily transcribed in real time and deleted after processing rather than retained as a permanent recording;

• in a rare technical outage, encrypted audio may be retained temporarily for service recovery, depending on clinic configuration and the provider’s terms, and is then deleted;

• generated drafts may be held temporarily according to clinic settings before deletion; and

• clinic patient data is not used to train Lyrebird’s AI models.

The final clinical note retained in Bp Premier is part of your medical record and is subject to the same access, correction, security and retention requirements as notes prepared manually.

​

11. How are clinical imaging and AI-assisted image analysis used?

 

MoleSpot Skin Cancer Clinic uses dedicated clinical imaging systems, including FotoFinder technology, for total body photography, mole mapping, clinical photography and digital dermoscopy. Other dedicated imaging systems may be used for selected clinical or cosmetic services.

Depending on the service and system configuration, computer-assisted or AI-supported functions may:

• compare current images with earlier images;

• assist in identifying new or changed lesions;

• organise and display lesions for closer review;

• analyse features in dermoscopic images and provide an analytical score or decision-support information; and

• support monitoring of treatment progress or outcomes.

These functions are diagnostic aids. They do not provide a definitive diagnosis and do not replace clinical examination, medical history, dermoscopic assessment, biopsy where indicated or the professional judgement of the treating doctor. An AI-generated alert or score does not necessarily mean that a lesion is cancerous, and the absence of an alert does not guarantee that a lesion is harmless.

Before clinical or dermoscopic images are taken, the purpose of the imaging and its intended use will be explained and consent will be obtained. Images and associated reports form part of the medical record and may be retained for future comparison and continuity of care. If imaging is essential to a service such as mole mapping, we may be unable to provide that service if you do not consent to the required images.

Identifiable or de-identified clinical images will not be used for external education, publication, advertising or promotion unless we have obtained the consent required for that particular use. Consent for one purpose does not automatically authorise another purpose.

Clinical photographs and personal mobile devices

Clinical photographs are ordinarily taken using dedicated clinic-owned imaging equipment, including FotoFinder systems. Practitioners providing services at MoleSpot Skin Cancer Clinic are expected to obtain appropriate patient consent and comply with applicable privacy, professional and medical record-keeping obligations when taking, storing or transmitting clinical images.

Personal mobile devices should not ordinarily be used to capture or retain patient images. If a practitioner considers that use of a mobile device is clinically necessary in exceptional circumstances, the image must be handled securely, transferred promptly to the patient’s medical record, and removed from the device and any associated personal or automatic cloud-storage service.

Clinical images are primarily stored within our secure clinic imaging systems. Optional vendor cloud, remote-support or specialist functions may involve processing by an external provider, including possible overseas processing. Where such functions are used, we take reasonable steps to assess privacy and security arrangements and to limit access and disclosure.

​

12. Marketing, research, education and quality improvement

 

Appointment confirmations, recalls, results notifications and information directly related to your care are healthcare or administrative communications, not direct marketing. You may ask us to update your communication preferences, although we may still need to contact you about important clinical or administrative matters.

We will not use or disclose your health information for direct marketing without express consent. You may withdraw marketing consent at any time.

We may use information internally for clinical governance, audits, accreditation, quality improvement, safety and staff training. Wherever practical, information will be de-identified or access will be limited to those who need it.

Identifiable information will not be provided to researchers or used for a research project without the approvals and consent required by law. De-identified data may be used or disclosed where lawful and appropriately protected. Clinical images used for education or training will be handled in accordance with the specific consent provided by the patient.

​

13. How is information stored, protected and retained?

 

Information may be stored in electronic medical records, dedicated imaging databases, encrypted backups, secure cloud services, email and messaging systems, financial systems and, where necessary, paper records. Our principal clinical record is held in Bp Premier, and clinical images are held in approved clinical imaging systems and associated secure storage.

We take reasonable steps to protect information against misuse, interference, loss and unauthorised access, modification or disclosure. Measures include:

• individual user accounts, passwords and role-based access controls;

• staff confidentiality obligations and privacy training;

• secure clinic networks, firewalls, endpoint protection, monitoring and software updates;

• encryption and secure transmission where available;

• backups, disaster recovery and business continuity arrangements;

• physical security for premises, equipment and paper records;

• vendor due diligence and contractual privacy and security requirements; and

• audit logs, access reviews and incident-response processes where supported.

Email and ordinary SMS are convenient but may not always be fully secure. For sensitive records, we may use password-protected files, secure messaging, identity verification or another secure delivery method. Patients should avoid sending highly sensitive information through social media or unencrypted channels.

Health records are retained for at least the minimum period required under Victorian law: generally seven years after the last health service provided to an adult, or for a person treated while under 18, until the person reaches 25 years of age. Records may be kept longer where clinically, legally or professionally appropriate. Other business, financial, security and communication records are retained only for as long as reasonably necessary or legally required.

When information is no longer required and may lawfully be destroyed, we take reasonable steps to securely destroy or permanently de-identify it. Clinical records are not deleted merely because a patient changes provider or asks us to remove accurate historical information before the applicable retention period.

Data breaches

We maintain a data-breach response process. Suspected incidents are assessed, contained and investigated. Where a breach is likely to result in serious harm and the Notifiable Data Breaches scheme applies, we will notify affected individuals and the Office of the Australian Information Commissioner as required.

​

14. How can you access or correct your information?

 

You have the right to request access to, or correction of, personal and health information we hold about you. Requests should preferably be made in writing to the Privacy Officer at info@molespot.com.au and should identify the information requested. We will ask for evidence of identity and, where a request is made by another person, evidence of their authority to act for you.

Access may be provided by allowing inspection, providing an electronic or paper copy, supplying a summary, or arranging for a health professional to explain the information, depending on your request and any legal limitations.

We will respond without unreasonable delay and aim to comply within the applicable Victorian timeframes: no later than 45 days for an access request and generally within 30 days for a correction request. We do not charge for making an access or correction request or for correcting information. A reasonable fee, limited by applicable Victorian regulations, may be charged for the cost of providing access. We will tell you about any fee before proceeding.

Medical records must preserve an accurate history and audit trail. If information is inaccurate, incomplete, out of date, irrelevant or misleading, the usual approach is to add a dated correction, amendment or explanatory statement rather than silently deleting or overwriting the original entry. If we refuse access or correction, we will provide written reasons and information about complaint options. If requested, we will take reasonable steps to associate your written statement of disagreement with the record.

Where corrected information has previously been disclosed to another health service provider, we will take reasonable steps to notify that provider where required and appropriate.

​

15. How can you make a privacy complaint?

 

Please raise privacy concerns with us first so we have an opportunity to investigate and respond. Contact the Practice Manager / Privacy Officer using the details in section 2. Please describe what happened, the information involved, the outcome you are seeking and any relevant dates or documents.

We will acknowledge the complaint, investigate it fairly and aim to provide a written response within 30 days. If additional time is required because the matter is complex, we will explain the reason and provide an updated timeframe.

If you are not satisfied with our response, you may contact:

Health Complaints Commissioner Victoria

Telephone: 1300 582 113
hcc.vic.gov.au

Office of the Australian Information Commissioner

Telephone: 1300 363 992
oaic.gov.au

​

16. Website, online forms, cookies and digital communications

​

Our website is hosted using Wix and may contain online booking links, contact functions and links to third-party websites. Patient registration and some other forms may be provided using Microsoft Forms. Information submitted through these services is handled in accordance with this policy and the relevant provider arrangements.

Our website and service providers may use cookies, analytics, pixels or similar technologies to operate the site, understand how it is used, maintain security and improve services. This may involve collecting device, browser, IP address, location approximation and interaction information. You can control cookies through your browser, although some website functions may not work correctly if cookies are blocked.

Third-party websites and social media platforms have their own privacy practices. We are not responsible for their content or privacy handling. Please do not use website forms, social media or ordinary email for medical emergencies or urgent clinical concerns. Call 000 in an emergency or contact the clinic directly for time-sensitive matters.

​

17. Policy review and updates

 

We review this policy at least annually and when there are significant changes to our services, technology, data handling or legal obligations. The current version will be published on our website and is available in printed form from reception. Significant changes may also be communicated through registration forms, signage, email, SMS or consultation discussions where appropriate.

Previous versions are retained internally for governance and audit purposes.

​