Privacy Policy

Our Commitment

MH Health Connect is committed to protecting the privacy, confidentiality and security of the personal and health information entrusted to us.

As a clinician-founded Australian healthcare technology company, we understand that trust is fundamental to the delivery of healthcare. Every aspect of our Platform has been designed with privacy, security and clinician oversight in mind.

This Privacy Policy explains how MH Health Connect collects, uses, stores, protects and discloses personal information in accordance with applicable Australian privacy laws.

MH Health Connect Pty Ltd
Privacy Policy · Version 1.0
© MH Health Connect Pty Ltd. All rights reserved.

1. Our Commitment to Privacy

At MH Health Connect, protecting the privacy, confidentiality and security of personal and health information is fundamental to everything we do.

MH Health Connect was founded by Australian clinicians with the goal of reducing the administrative burden associated with healthcare while maintaining the highest standards of patient privacy, information security and clinical governance.

We recognise that healthcare information is among the most sensitive information entrusted to any organisation. Patients, clinicians and healthcare organisations expect that information to be handled responsibly, securely and transparently. We are committed to maintaining that trust.

This Privacy Policy explains how MH Health Connect collects, uses, stores, protects and discloses personal information when providing our Platform and related services.

2. About MH Health Connect

MH Health Connect Pty Ltd ("MH Health Connect", "we", "our" or "us") develops and operates a secure clinical workflow platform designed for Australian healthcare providers.

The Platform assists healthcare organisations with administrative and clinical workflows including including patient management, clinical workflow support, document generation, communications, reporting and related healthcare administration functionality.

MH Health Connect is intended to support healthcare professionals by reducing repetitive administrative tasks and improving workflow efficiency.

The Platform is not intended to replace professional clinical judgement, establish diagnoses or make treatment decisions.

Healthcare professionals remain responsible for reviewing all information, documents, prescriptions, referrals, pathology requests, PBS applications and communications generated by the Platform before they are relied upon, printed, transmitted or submitted.

4. Who This Policy Applies To

This policy applies to healthcare organisations, authorised users, patients whose information is processed through the platform, website visitors, suppliers and prospective customers.

5. Applicable Legislation

MH Health Connect seeks to comply with applicable Australian privacy laws, including:

• Privacy Act 1988 (Cth)
• Australian Privacy Principles
• Notifiable Data Breaches Scheme
• Relevant State and Territory health records legislation
• Spam Act 2003 (Cth)

6. Definitions

For the purposes of this Privacy Policy:

Authorised User means an individual who has been granted permission by a healthcare organisation to access the Platform.

De-identified Information means information from which personal identifiers have been removed so that an individual cannot reasonably be identified.

Healthcare Organisation means a hospital, private practice, specialist clinic, health service, medical practice or other organisation authorised to use the Platform.

Health Information has the meaning given under applicable Australian privacy legislation and includes information relating to an individual's health, disability, healthcare, medical history or treatment.

Personal Information has the meaning given in the Privacy Act 1988 (Cth).

Platform means the MH Health Connect software platform, associated applications, websites, APIs, integrations and related services.

Sensitive Information has the meaning given in the Privacy Act 1988 (Cth).

7. What Information We Collect

The information we collect depends on how our Platform is used and the services provided to a healthcare organisation.

We collect personal information, health information and other information reasonably required to provide our Platform, support healthcare workflows, maintain security, meet legal obligations and improve our services.

The types of information we may collect include the following.

7.1 Healthcare Organisation Information

We may collect information about healthcare organisations that use the Platform, including:

• organisation and trading names;
• business and billing information;
• contact details;
• configuration and account settings;
• document templates and branding information; and
• information required to establish, manage and support an organisation's use of the Platform.

7.2 Healthcare Professional Information

We may collect information relating to authorised users of the Platform, including:

• name and contact details;
• professional role and workplace information;
• professional registration and provider identifiers;
• account credentials and authentication information;
• user preferences and permissions;
• audit and activity records; and
• information required to provide, secure and support access to the Platform.

Where authorised by a healthcare organisation, we may also store authentication tokens or credentials required for approved integrations with third-party systems.

7.3 Patient Information

Healthcare organisations may enter, import or synchronise patient information into the Platform. Depending on the services used, patient information may include:

• demographic and contact information;
• healthcare identifiers and funding information;
• medical history, diagnoses, medications and allergies;
• clinical notes and correspondence;
• pathology and radiology information;
• prescriptions and PBS-related information;
• appointment and monitoring information;
• documents uploaded to or generated through the Platform; and
• other information entered by authorised users for the purpose of providing healthcare services.

MH Health Connect processes patient information on behalf of healthcare organisations to provide the services requested by those organisations and their authorised users.

7.4 Technical and Usage Information

To maintain the security, performance and reliability of the Platform, we may collect information such as:

• IP addresses;
• browser and device information;
• login and authentication records;
• audit logs;
• access times and usage information;
• system performance data;
• security events; and
• diagnostic and error information.

7.5 Website Information

When you visit our website, we may collect information such as:

• browser and device information;
• pages viewed;
• referring websites;
• approximate location information derived from IP address;
• cookie and analytics data; and
• information relating to website performance and usage.

Website analytics information is generally collected in a manner that does not directly identify individual patients.

8. How We Collect Information

MH Health Connect collects information in a lawful, fair and transparent manner.

We may collect information:

• directly from healthcare organisations during onboarding, account setup and ongoing use of the Platform;
• directly from authorised users who enter, upload or manage information within the Platform;
• from patients where information is provided directly to us through approved workflows;
• from healthcare organisations acting on behalf of their patients;
• through authorised imports, synchronisation or integrations with third-party healthcare and business systems;
• through documents, correspondence and files uploaded to the Platform;
• through customer support, training and onboarding activities;
• through our website and other communications with us; and
• automatically through the operation of the Platform, including security monitoring, audit logging, authentication processes and website analytics.

Information may also be collected from third parties where authorised by a healthcare organisation, permitted by law, or reasonably necessary to provide our services.

8.1 Information from Integrated Systems

Where authorised by a healthcare organisation, MH Health Connect may import or receive information from third-party systems and services, including electronic medical records, practice management systems, pathology and radiology providers, secure messaging platforms, government healthcare services and other approved software solutions.

We collect only the information reasonably required to perform the requested function and support the services being used.

8.2 Automatically Collected Information

To maintain the security, availability and performance of the Platform, certain information is collected automatically when users access or interact with the Platform. This may include login activity, authentication records, audit logs, device and browser information, usage data, security events, performance metrics and diagnostic information.

This information helps us protect the Platform, investigate incidents, troubleshoot issues and improve the reliability of our services.

9. Why We Collect Information

MH Health Connect collects, holds and uses information for purposes directly related to providing and improving the Platform.

We collect information to:

• provide the platform;
• generate clinical documents;
• support healthcare workflows;
• communicate with users;
• maintain security;
• comply with legal obligations;
• improve our services.

10. Workspace Security and Access

MH Health Connect is designed to help healthcare organisations manage information securely and ensure that access is limited to authorised users.

Access to the Platform is controlled through role-based permissions, allowing healthcare organisations to determine the level of access granted to individual users based on their responsibilities. Access rights may differ for clinicians, nurses, administrative staff, managers and other authorised personnel.

Healthcare organisations are responsible for managing user accounts, assigning appropriate permissions and removing access when it is no longer required.

MH Health Connect maintains audit logs of significant activity within the Platform to support security monitoring, accountability, troubleshooting and compliance obligations.

We regularly review our access controls and security practices to help protect personal and health information from unauthorised access, use or disclosure.

11. How We Share Information

MH Health Connect respects the confidentiality of personal and health information.

We do not sell identifiable patient information.

We will only disclose personal information where:

• it is necessary to provide the Platform or requested services;
• the disclosure has been authorised by the relevant healthcare organisation or authorised user;
• the disclosure is required or permitted by law; or
• the individual has otherwise consented to the disclosure.

Depending on how the Platform is configured, information may be shared with:

• authorised users within the same healthcare organisation;
• approved third-party technology providers supporting the Platform;
• secure messaging providers;
• pathology providers;
• radiology providers;
• Microsoft 365 or other authorised communication providers;
• government agencies and healthcare systems including Services Australia, HPOS and PRODA where initiated and authorised by the healthcare professional;
• software systems integrated by the healthcare organisation;
• regulatory bodies where required by law; and
• professional advisers assisting MH Health Connect in operating its business.

We require third-party service providers who process information on our behalf to maintain appropriate privacy, confidentiality and security standards.

MH Health Connect does not permit third parties to use identifiable patient information for their own marketing purposes.

11.1 Healthcare Organisation Responsibilities

Healthcare organisations remain responsible for their clinical records, privacy obligations and user access management. MH Health Connect acts as a technology provider and processes information on their behalf.

12. Third-Party Integrations

MH Health Connect may integrate with third-party systems and services to support healthcare workflows and reduce duplicate data entry.

Depending on the services used by a healthcare organisation, integrations may include electronic medical records, practice management systems, pathology and radiology providers, secure messaging platforms, government healthcare services, communication providers and other approved software applications.

Healthcare organisations determine which integrations are enabled within their workspace. MH Health Connect accesses and processes only the information reasonably required to provide the requested functionality and support the services being used.

Where third-party providers process information on our behalf, we take reasonable steps to ensure they maintain appropriate privacy, confidentiality and security standards.

12.1 Third-Party Websites

Our Platform or website may contain links to third-party websites or services. These websites operate independently of MH Health Connect, and we are not responsible for their privacy practices or content. We encourage users to review the privacy policies of any third-party websites they visit.

13. International Data Transfers

MH Health Connect is designed primarily for use within Australia.

Where reasonably practicable, personal information is stored and processed using infrastructure located within Australia.

Some authorised third-party technology providers may process limited information outside Australia where necessary to provide specific services or functionality. We will take reasonable steps to ensure compliance with APP 8 regarding overseas disclosures.

Examples may include:

• identity and authentication services;
• email delivery services;
• software monitoring;
• customer support systems;
• cloud infrastructure; and
• cybersecurity services.

Where personal information is processed outside Australia, MH Health Connect will take reasonable steps to ensure that appropriate contractual, technical and organisational safeguards are in place and that applicable Australian privacy laws are complied with.

We regularly review our technology providers to ensure they continue to meet our privacy and security expectations.

14. Information Security

MH Health Connect is committed to protecting the security, confidentiality and integrity of the personal and health information processed through the Platform.

We maintain administrative, technical and organisational safeguards that are designed to protect information from unauthorised access, disclosure, alteration, misuse, loss and other security risks.

These safeguards may include:

• user authentication and access controls;
• role-based permissions;
• encryption of information during transmission and, where appropriate, at rest;
• security monitoring and audit logging;
• backup and recovery processes;
• secure software development and maintenance practices; and
• policies and procedures governing the handling of personal information.

Access to information is restricted to authorised personnel who require that access to perform their responsibilities.

We regularly review and update our security practices to respond to changes in technology, emerging threats and regulatory requirements.

While no system can guarantee absolute security, MH Health Connect takes reasonable steps to protect the information entrusted to us and to maintain security measures appropriate to the sensitivity of the information we process.

15. Data Retention

MH Health Connect retains personal and health information only for as long as reasonably necessary to provide the Platform, fulfil contractual obligations, comply with legal and regulatory requirements, resolve disputes and protect the integrity and security of our services.

Healthcare organisations remain responsible for determining the retention requirements that apply to their clinical records and for complying with applicable healthcare recordkeeping obligations.

When personal information is no longer required, we will take reasonable steps to securely delete, destroy or permanently de-identify the information, unless retention is required by law or for a legitimate business purpose.

Backup copies of information may be retained for a limited period as part of our security, business continuity and disaster recovery processes before being securely removed.

Where a healthcare organisation ceases using the Platform, information will be retained, returned or securely deleted in accordance with applicable contractual arrangements, legal requirements and our data management practices.

16. Use of De-identified and Aggregated Information

MH Health Connect may create and use information that has been de-identified and aggregated so that individuals cannot reasonably be identified.

Subject to applicable laws and appropriate governance arrangements, de-identified and aggregated information may be used to:

• improve and enhance the Platform;
• develop new products, features and services;
• evaluate and improve healthcare workflows;
• support quality improvement initiatives;
• perform analytics and statistical reporting;
• support healthcare, clinical or health services research; and
• contribute to healthcare planning, innovation and service improvement.

MH Health Connect may, subject to applicable law and appropriate governance arrangements, share de-identified and aggregated information with healthcare organisations, research institutions, universities, government agencies and organisations operating within the healthcare, pharmaceutical, biotechnology and life sciences sectors for research, quality improvement, healthcare planning, healthcare innovation and service development purposes.

Any information shared for these purposes will be managed to minimise the risk of re-identification and will not include information that directly identifies individual patients.

We do not disclose information that identifies individual patients through these activities.

Where benchmarking, comparative reporting or population-level analytics services are developed, information will be presented in a manner designed to prevent the identification of individual patients and, where applicable, individual healthcare organisations unless the relevant healthcare organisation has agreed otherwise.

MH Health Connect does not sell or disclose identifiable patient information to third parties without lawful authority, contractual authority or consent where required by law.

Any use of de-identified information for research, analytics or healthcare improvement activities will be undertaken in accordance with applicable privacy laws and appropriate governance requirements.

17. Artificial Intelligence

MH Health Connect may use artificial intelligence (AI), machine learning and other automated technologies to support clinical and administrative workflows within the Platform.

Any AI-enabled functionality is intended to assist healthcare professionals and improve efficiency. AI features are designed to support, and not replace, professional clinical judgement, decision-making or responsibility.

At the time of publication of this Privacy Policy, MH Health Connect does not use identifiable patient information to train publicly available AI models.

Where AI services are provided by third-party technology providers, MH Health Connect will take reasonable steps to ensure personal information is handled in accordance with applicable privacy laws, contractual obligations and appropriate security standards.

MH Health Connect may use de-identified and aggregated information to evaluate, improve and develop AI-enabled features, analytics capabilities and other Platform functionality, subject to applicable law and appropriate governance arrangements.

Healthcare professionals remain responsible for reviewing and approving information, documents, recommendations or other outputs generated with the assistance of AI before they are relied upon for clinical or administrative purposes.

Where the introduction of new AI functionality materially changes how personal information is collected, used, disclosed or processed, we will update this Privacy Policy and provide additional information where required by law.

18. Marketing Communications

MH Health Connect may send communications relating to the operation and use of the Platform, including:

• account and billing information;
• service updates and maintenance notifications;
• security and system alerts;
• customer support communications;
• product updates and new features;
• educational resources, webinars and training opportunities; and
• other information relevant to our products and services.

Where required by law, marketing communications will only be sent with consent or another lawful basis for communication.

Recipients may opt out of marketing communications at any time by following the unsubscribe instructions in the communication or by contacting us directly.

Operational, security, billing and account-related communications may continue to be sent where reasonably necessary to provide the Platform and manage customer accounts.

MH Health Connect does not use patient health information for direct marketing purposes.

19. Cookies and Website Analytics

MH Health Connect uses cookies and similar technologies on its website to support functionality, improve user experience, maintain security and better understand how our website is used.

Cookies and analytics technologies may be used to:

• maintain secure sessions;
• remember user preferences;
• improve website performance and functionality;
• analyse website traffic and usage patterns;
• support security and fraud prevention activities; and
• improve our products, services and website content.

Information collected through cookies and analytics tools may include browser type, device information, pages visited, referring websites, approximate location information derived from IP addresses and other website usage information.

Where analytics services are used, information is generally collected and reported in an aggregated manner and is not intended to identify individual patients.

Users can configure their browser settings to refuse or remove cookies. However, doing so may affect the functionality of some parts of our website.

Patient health records and clinical information are not intentionally collected through website analytics tools.

20. Accessing and Correcting Your Information

MH Health Connect aims to ensure that the personal information we hold is accurate, complete, relevant and up to date.

Individuals may request access to, or correction of, personal information held by MH Health Connect where permitted by applicable law.

Where MH Health Connect processes information on behalf of a healthcare organisation, requests relating to patient medical records, clinical information or healthcare services should generally be directed to the relevant healthcare organisation, which remains responsible for those records.

Before providing access to or correcting personal information, we may take reasonable steps to verify the identity of the person making the request.

We aim to respond to requests for access, correction or other privacy-related enquiries within a reasonable timeframe and, where practicable, within 30 days.

In some circumstances, access may be refused where permitted by law. Where this occurs, we will provide reasons for the refusal and information about any available complaint or review process, where required.

Privacy Complaints

If you believe MH Health Connect has not handled your personal information in accordance with applicable privacy laws, you may submit a privacy complaint to our Privacy Officer using the contact details provided in this Privacy Policy.

We aim to acknowledge privacy complaints promptly and to investigate and respond within a reasonable timeframe.

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) or another relevant privacy regulator.

21. Data Breaches

MH Health Connect maintains policies, procedures and technical measures designed to identify, investigate and respond to actual or suspected privacy and security incidents.

Where a data breach or security incident is suspected, we will take reasonable steps to:

• investigate the incident;
• contain and mitigate potential impacts;
• assess whether personal information has been affected;
• determine whether notification obligations apply; and
• implement measures aimed at reducing the risk of similar incidents occurring in the future.

Where required by applicable law, MH Health Connect will notify affected healthcare organisations, individuals and relevant regulators, including under the Australian Notifiable Data Breaches Scheme.

Healthcare organisations may have separate legal and regulatory obligations in relation to incidents affecting information under their control. Where appropriate, MH Health Connect will work collaboratively with affected healthcare organisations in responding to incidents involving the Platform.

We regularly review our incident response and security practices to support the ongoing protection of personal and health information.

22. Children's Information

MH Health Connect maintains policies, procedures and technical measures designed to identify, investigate and respond to actual or suspected privacy and security incidents.

Where a data breach or security incident is suspected, we will take reasonable steps to:

• investigate the incident;
• contain and mitigate potential impacts;
• assess whether personal information has been affected;
• determine whether notification obligations apply; and
• implement measures aimed at reducing the risk of similar incidents occurring in the future.

Where required by applicable law, MH Health Connect will notify affected healthcare organisations, individuals and relevant regulators, including under the Australian Notifiable Data Breaches Scheme.

Healthcare organisations may have separate legal and regulatory obligations in relation to incidents affecting information under their control. Where appropriate, MH Health Connect will work collaboratively with affected healthcare organisations in responding to incidents involving the Platform.

We regularly review our incident response and security practices to support the ongoing protection of personal and health information.

23. Changes to this Privacy Policy

MH Health Connect may update this Privacy Policy from time to time to reflect changes in:

• applicable laws and regulatory requirements;
• our products, services and functionality;
• our information handling practices;
• security measures and technology; or
• operational and business requirements.

The current version of this Privacy Policy will be made available on our website and will take effect from the date it is published.

Where changes materially affect how personal information is collected, used, disclosed or otherwise handled, we will take reasonable steps to notify affected users or healthcare organisations through appropriate channels.

We encourage users to review this Privacy Policy periodically to remain informed about how we handle personal information.

24. Contact Us

Questions, requests or concerns regarding this Privacy Policy or the handling of personal information may be directed to:

Privacy Officer
MH Health Connect Pty Ltd
Email: privacy@mhhealthconnect.com.au

We will take reasonable steps to investigate and respond to privacy enquiries and complaints within a reasonable timeframe.

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC):

Office of the Australian Information Commissioner
Website: https://www.oaic.gov.au
Telephone: 1300 363 992