Privacy Policy – Warrnambool Acupuncture and Chinese Medicine

Last updated: 3/4/2026

Warrnambool Acupuncture and Chinese Medicine is committed to protecting your privacy and the confidentiality of your personal and health information. This Privacy Policy explains how we collect, use, store, disclose and protect your information when you interact with our clinic, our website, our online booking page, and our clinic management and payment systems.

This policy is prepared in line with the Privacy Act 1988 (Cth), the Australian Privacy Principles, the Notifiable Data Breaches scheme, and the Health Records Act 2001 (Vic) and Health Privacy Principles.

1. Collection and security of information

We collect personal and health information that is necessary to provide safe, appropriate and effective health care.

Your information is stored securely in electronic and, where applicable, paper-based formats. We take reasonable steps to protect it from misuse, interference, loss, unauthorised access, modification or disclosure.

Access to your information is limited to the practitioner and any authorised staff who need it to perform their duties and who are bound by confidentiality obligations.

If a data breach occurs that is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner as required by law.

2. What information we collect

The information we collect may include:

your name, address, date of birth and contact details
Medicare, Department of Veterans' Affairs or private health insurance details (where relevant)
health information, including medical history, symptoms, diagnoses, treatment notes and care plans
appointment and billing information
payment card details, where you provide them to secure an online booking (see section 5)
correspondence relating to your care

We collect this information directly from you, from referral sources with your consent, or through your interactions with our clinic, website and booking systems.

3. Anonymity

You can make general enquiries without identifying yourself. Because we provide health care, it isn't practicable to provide treatment without knowing who you are.

4. How we use your information

We use DaoBook as our clinic management software to manage appointments, clinical notes, billing and patient records. Your records are stored within DaoBook on secure servers in Australia (Sydney). Information is encrypted both when it is sent and when it is stored, and access is restricted to authorised users.

We use your information to:

provide and manage your care
manage bookings and send appointment confirmations and reminders
handle billing and payments, including cancellation fees under our Cancellation Policy
respond to your enquiries
meet our legal and professional obligations

5. Payments and card details

Why we collect card details. When you book an appointment online, we ask you to provide a valid payment card. Your card is held on file to secure your booking. It will be charged only for:

non-attendance, including a late arrival treated as non-attendance under our Cancellation Policy, or
a cancellation or reschedule made with less than 24 hours' notice,

at the fees set out in our Cancellation Policy, available at [link], which you are asked to accept when booking. We will not charge your card for any other purpose without your separate consent. When a fee is charged, a receipt will be sent to you.

How your card details are stored. Card details entered on our booking page are collected through our booking platform, DaoBook, and securely processed and stored by its payment provider, Stripe. They are not stored on our own systems, and we do not see or keep your full card number or security code. Stripe is certified to the Payment Card Industry Data Security Standard (PCI DSS) Level 1. Your card details are also covered by Stripe's privacy policy at stripe.com/privacy. Stripe may process and store information outside Australia, including in the United States.

Payments at the clinic. Payments made in person, and private health fund claims, are processed through our HICAPS/EFTPOS terminal. Card details used for these payments are not stored by us or used for cancellation fees.

Your choices. You can ask us at any time to remove your card details by contacting us using the details below. If you do, we may not be able to hold online bookings for you, but you can still book by phone or email. Card details are removed if you have had no appointments booked for 12 months, or on request, subject to any fees already owing.

Disputed charges. If you think a fee has been charged in error, or an exception under our Cancellation Policy applies, contact us and we will review it promptly. If a fee is waived, it will be refunded.

6. Website and booking page information

When you visit our website or booking page, some information may be collected automatically, such as your IP address, browser type, the date and time of your visit, and the pages you view. This information is used to operate, secure and improve the website and booking system. We do not use it to identify you unless required by law.

7. Cookies

Our website and booking page use cookies to make them work properly and to keep payments secure. Our payment provider, Stripe, uses cookies to help detect and prevent fraud. [If applicable: We also use [Google Analytics / other tool] to understand how visitors use our website.]

You can manage or disable cookies in your browser settings, but some features, including online booking, may not work without them.

8. Emails and online enquiries

If you contact us by email, phone or an online enquiry form, we may collect your name, contact details and the content of your enquiry. This information is used only to respond to your enquiry or provide the information you asked for. It will not be added to mailing lists or disclosed to third parties without your consent, unless required or authorised by law.

9. Disclosure of information

Your personal and health information may be disclosed:

to other health practitioners involved in your care (with your consent or where permitted by law)
to pathology or diagnostic services (where relevant)
for billing purposes, including to private health insurers via HICAPS where you choose to claim on the spot
to our clinic management and booking provider (DaoBook) and the service providers it uses to process payments and send appointment SMS and emails
to our insurers, accountants or legal advisers where necessary
to the Chinese Medicine Board of Australia or Ahpra where required
where otherwise required or authorised by law

We do not disclose health information for marketing purposes.

Overseas disclosure. Your clinical records are stored in Australia. Some service providers used by our booking system process limited information outside Australia:

in the United States, for card payments (Stripe), SMS appointment reminders and confirmations (Twilio), and system monitoring
in India, for sending emails such as receipts and appointment notifications

We take reasonable steps to ensure these providers protect your information in line with the Australian Privacy Principles.

10. Storage, retention and disposal

Health records are kept for at least 7 years after your last appointment, or if you were under 18 at the time, until you turn 25, as required by the Health Records Act 2001 (Vic). After that, they are securely destroyed or de-identified.

Other information is kept only as long as necessary and then securely destroyed or de-identified. Card details are kept as described in section 5.

11. Access to and correction of information

You have the right to ask for access to your personal and health information, and to ask for it to be corrected if you believe it is inaccurate, out of date or incomplete.

To make a request, contact us using the details below. We may need to verify your identity first. We will respond within 30 days. There is no charge to make a request. A fee may apply for providing copies, within the limits set by Victorian law.

12. Privacy concerns and complaints

If you have a concern or complaint about how your information has been handled, please contact us first. We will respond within 30 days and work with you to resolve it.

If you are not satisfied with our response, you can contact:

Office of the Australian Information Commissioner – www.oaic.gov.au, 1300 363 992
Health Complaints Commissioner (Victoria), for health information matters – hcc.vic.gov.au, 1300 582 113

13. Changes to this policy

We may update this Privacy Policy from time to time. The current version will always be available on our website.

Warrnambool Acupuncture and Chinese Medicine
admin@warrnambooolacupuncture.com | 0478 412 123|