Montu Group Privacy Policy

Types of Personal Information

Examples of what personal information this may include

Identity information and contact details

• Full and preferred name
• Date of birth 
• Mailing and residential address 
• Phone number 
• Email
• Next of kin
• Emergency contact

Demographic information

• Age
• Gender
• Relationship status and family circumstances
• Whether you have dependents (including children) 
• Carer status

Health information (sensitive information) 

Includes:

• Symptoms and diagnoses
• Health history, including family health history
• Diagnostic assessment results (physical and psychological)
• Diagnostic imaging reports
• Information in health summaries, discharge summaries, specialist letters and reports
• Information in pathology reports 
• Drug and alcohol test results 
• Information in correspondence with other healthcare practitioners involved in your care
• Medical therapies, for example, medications, supplements, and information about allied health service engagement such physiotherapy or counselling
• Information from prescriptions, including those issued by non-Alternaleaf health practitioners 
• Disability information
• Pregnancy status 
• Social and lifestyle factors related to health, for example, diet, exercise, smoking, and recreational activities 
• Your status as a patient, including whether you have been discharged and the reason for being discharged  

Other sensitive information

Information may include: 

• Racial or ethnic origin, or cultural background, such as Aboriginal or Torres Strait Islander status
• Sexual orientation
• Criminal record or supervision requirements. For example, if you are incarcerated or have a Community Corrections Officer assigned to manage your matter

Support information

• Family violence
• Financial distress
• Legal matters, such as, insurance claims, or court matters

Financial information

• Bank account details
• Bankruptcy check*
• Chargeback requests
• Credit/debit card details

*Note: For job candidates only

Australian Government related identifiers

• Australian Health Practitioner Regulation Agency (AHPRA) Registration Number
• Copy of Australian Birth Certificate
• Copy of Australian Citizenship Certificate
• Copy of Australian Passport
• Department of Veterans' Affairs (DVA) number, also known as your Veteran File Number (VFN)
• Driver’s Licence details
• Individual Healthcare Identifier (IHI) 
• Medicare Card details
• Pensioner/Healthcare Concession Card details

Employment information 

• If you are an Alternaleaf patient, your employment information may be captured in health consultations, including employment status, role, workplace injuries, and any other information you may provide us
• For healthcare practitioners, we may collect the details of the health organisation you work at, including name, address and provider number
• For job applicants, we collect any information you provide to us in the course of recruitment activities, including details of insurance required for your position 

Photographs, video or audio recordings and transcripts

Audio or video recordings, photographs, and screenshots you may send us.

Interaction and behavioural information

• Call quality
• Facial expression
• How you communicate from video and audio recordings and transcripts
• Mouse movements
• Voice tone
• Words used 

Also see Website and App tracking.

Website and app tracking

• Browser type
• Details of sites visited before visiting our website
• Details of visits to our website or use of our apps and the browsers used
• Device location
• Documents viewed and downloaded
• Links clicked
• Operating system
• Pages visited and the time spent on these pages
• Preferences
• Referring URL
• Search terms
• Server address/IP address

Personal information we create from data analytics activities

• Purchase behaviours (what you are purchasing)
• Order volume (how much you are purchasing)
• Consultation frequency 
• Fraud check information. For example, volume of chargebacks

Purpose

Examples of why we collect your personal information

To provide healthcare products and services

• Assessing your eligibility for a service, or to participate in any of our programs including the Alternaleaf Concession Program
• Scheduling consultations with Alternaleaf healthcare practitioners 
• Contacting you with appointment confirmations, reminders, rescheduling notifications, and in relation to missed consultations
• Conducting audio-visual consultations through our online platform to provide personalised healthcare tailored to individual needs, including issuing you a prescription if appropriate
• Creating a patient file to store your health information
• Corresponding with your GP, specialists, and other treating healthcare providers as necessary to coordinate your medical treatment  
• Receiving clinical records, including referrals and health summaries from your GP, specialists, and other treating healthcare providers to ensure continuity and safety of your care
• Providing you with supporting documentation in relation to your treatment, such as a treatment plan, or letters from your prescriber outlining your care
• Conducting wellbeing calls or outreach as necessary to assess the health and safety of individuals
• Contacting emergency services to report serious concerns for the immediate safety or welfare of any person
• Issuing you with an optional digital Alternaleaf Patient Card

To invite you to participate in research studies 

Montu conducts research to improve healthcare, and contribute to public health policy discussions

We may inform you of, and invite you to participate in research studies 

To facilitate the supply of medication

• Receiving prescriptions issued by external health practitioners 
• Check whether the medication on your prescription is in stock
• Recommending a pharmacy where your medicine can be dispensed from based on your location
• Providing your script to a preferred pharmacy for dispensing
• Processing your medication orders
• Facilitating the delivery medicine to you, including providing tracking details for your order

To enable our products and services

• Verifying your identity
• Creating and maintaining accurate records of the services we provide
• Summarising and recording notes about your interactions with us
• Processing payments for services, issue refunds, issue invoices, and provide you with receipts and electronic confirmation of payments for services
• Communicating information to provide services to you by phone, email, SMS, and the Alternaleaf patient and uMeds customer portals. For example, communicating updates on the availability of our services.
• Displaying relevant notifications in our Alternaleaf patient and UMeds customer portals.
• Responding to your queries, addressing your comments, complaints and feedback. For example, responding to your queries relating to costs, missed consultations, medication administration, or order status
• Providing product information and education 
• Troubleshooting technology issues to help you access our service platforms, including our Alternaleaf patient and uMeds customer portals. For example, assessing your connection to our our platform, and assisting when there are issues during your video consultation

To evaluate and improve the quality of our services 

• Evaluating patient/customer experience on our platform and service delivery
• Evaluating treatment outcomes to improve the healthcare services provided to you
• Reviewing recordings and transcripts to evaluate the quality of service provided to you, and to improve training for our practitioners and staff to improve their provision of services to you

To manage dispute resolution and complaints

• Accessing and reviewing personal information subject to the matter to complete our investigation and provide you with a response
• Responding to information requests from regulators or Government authorities in relation to the complaint
• Conducting reviews and generating reports about our complaint management performance 

To monitor and investigate fraud, criminal activity, or any other incidents  

We monitor and investigate matters where we suspect there is fraudulent or criminal activity. For example:

• We collect information from individuals that allege their payment details have been used to make purchases without their knowledge.
• We may review your interactions with us including purchase history and chargeback requests you have made.
• When you provide a document from another practitioner we may to contact them to verify the validity of the document and the information 

To comply with legal and regulatory obligations

To satisfy our reporting, auditing, and record retention obligations 

To obtain legal advice or engage in litigation

We may seek legal advice to manage, establish, or defend legal claims 

To obtain information about an incident or injury involving staff

In the event you are a witness to an incident or injury involving a person employed by us, your contact information and statement of the incident may be collected for workplace health and safety reporting purposes

To conduct recruitment activities

• Responding to job application or employment opportunity queries
• Identifying and assessing the suitability of applicants for a position
• Contacting applicants to provide progress updates on an application
• Contacting past applicants about new employment opportunities 

To assess potential supplier relationships

• Verifying the identity, professional qualifications, credentials, and legal standing of personnel or representatives
• Evaluating and assess suitability before entering into a commercial agreement, contract, or partnership
• Managing the administrative, financial, and legal aspects of any potential or actual contractual relationship with your organisation

Business administration

• Billing and financial auditing
• Conducting internal audits
• Staff training 

Purpose

Examples of why we may use and/or disclose your information

Providing access to our staff onshore working remotely, or our offshore service provider in the Philippines 

We may seek support from offshore partners to support our business activities including:

• Answering and directing your queries
• Assisting you with booking an appointment
• Checking your order status
• Accounts receivable

Preparing medical reports for third parties

If you are an Alternaleaf patient, we may prepare medical reports for third parties, with your explicit consent. For example, a medical report may be requested when you have matters with insurance companies, motor accident authorities, workers’ compensation, and solicitors for other personal matters.

Responding to regulatory inquiries or consultations

We may disclose personal information as part of patient stories when we respond to Government inquiries or consultations.

Conducting research

We conduct research to help evaluate and improve patient outcomes and treatment strategies, and enable future research and trend analysis.

Low risk research conducted by Montu is overseen by the Montu Research Governance Committee, and adheres to the National Health and Medical Research Code for the Responsible Conduct of Research. In the event we conduct high risk research, it will always be referred to an external nationally registered Human Research Ethics Committee (HREC). 

We may use your contact details to invite you to participate in research projects from time to time. Consent is specific to each project, and will be obtained prior to enrollment. All projects are approved via the ethical pathways above prior to any invitation.

The OAIC guidance: Research for further information outlines the permitted use of personal information under the Privacy Act for research purposes.

Quality assurance

To check our products and services meet regulatory and internal policy requirements. For example, checking that your identity was verified before disclosing personal information to you.

Direct marketing

We engage in direct marketing using personal information. We may perform data matching exercises of personal information we hold with marketing and advertising service providers deliver marketing across specific online or digital channels, such as social media and other digital platforms such as Google.

Marketing

We may publish reviews you leave on platforms, pages or websites managed by us, such as Google, on our websites.

Obtaining legal advice or engaging in litigation

We may seek legal advice to manage, establish, or defend legal claims 

Product development and improving the performance of our services

To guide the development and enhancement of products, services, and features. Examples may include:

• Analysing the performance of our systems, websites, patient/customer portals
• Analysing interactions with features on our websites and portals to enhance functionality and performance

• Personalising individuals’ experiences
• Automating routine tasks
• Analysing behaviour to better understand needs
• Reviewing and updating algorithms or machine learning models. For example, machine learning algorithms help recommend the closest pharmacy to you or check that the medication on your prescription is in stock.
• Sending you a reward for providing feedback as part of piloting services.

Who we may disclose your information to

Examples of why we may disclose your personal information

Within the Montu Group of companies

We may share your personal information within the Montu group or related companies for the purposes outlined in this policy.

A person or entity authorised by you 

You may authorise us to disclose personal information we hold about you to an individual or entity as deemed necessary by you. For example, your legal representative.

Your treating healthcare providers

We may disclose your personal information to your treating healthcare providers to ensure continuity and safety of your care. For example, your community GP, specialist practitioner, or treating doctor at a hospital.

Pharmacies

We share your personal information with pharmacies in our trusted network, and as appointed by you, to dispense your prescribed medicine

Parcel delivery services

We share your personal information with parcel delivery services to facilitate the delivery of your order to your nominated address and provide you with parcel tracking information

Federal or state regulatory authorities, law enforcement, and other government entities

We may disclose personal information where we are required or authorised by or under Australian law to do so. For example when we respond to a subpoena, Notice to produce information, or court order, to comply with a regulatory requirement, or to report fraudulent activity. 

Government entities could include:

• Australian Digital Health Agency (ADHA)
• Australian Health Practitioner Regulation Agency (AHPRA)
• Australian Legislative Inquiry Bodies
• Federal and State Law Enforcement agencies
• Therapeutic Goods Administration (TGA)
• State Child Protection Services
• State Corrective Services
• State Health Departments
• State Public Guardian

Dispute resolution organisations

We may be required to produce personal information to complaint resolution entities, such as:

• State Fair Trading authorities
• NSW Health Care Complaints Commission (HCCC)
• Information and Privacy Commission NSW
• Office of the Australian Information Commissioner (OAIC)
• Office of the Victorian Information Commissioner (OVIC)
• Victorian Health Complaints Commissioner (HCC)

Public policy organisations

We may share personal information in patient stories with industry associations or patient advocacy groups.

Emergency services

We may call emergency services when we interact with a person and consider disclosure necessary to ensure the safety of an individual or other members of the public.

Social media services, language models, browsers

We use social media services. Comments on public posts, direct messages sent to us, or interactions on our website(s) or portals may be disclosed to social media companies. Any public information may be collected by organisations with language learning models. Your personal information can also be collected by browsers, including AI-powered browsers if you use these when interacting with us.

Social media services have their own privacy policies that you can access below.

• Facebook
• Instagram
• LinkedIn 
• Twitter (X)
• TikTok 
• YouTube (Google)

Australian Digital Health Agency (My Health Record) 

When an Alternaleaf clinician accesses your My Health Record (MHR) in the course of providing clinical care, details of when and what pages the clinician accessed will be recorded automatically by the MHR system. 

Technology and IT infrastructure providers 

To enable us to provide our services

• Cloud computing service providers
• Consultation scheduling service platform to book consultations with Alternaleaf healthcare practitioners
• Customer communication service platforms
• Order management platforms, for example, Shopify
• Recruitment platform to manage our talent recruitment activities
• Reward and survey service providers
• Your selected wallet provider for your digital Alternaleaf Patient Card

Type of information

Retention period

Health Information

7 years from the date of last entry in your record, unless legally required to be held for longer. 

Recordings and transcripts of telehealth consultations (Audio and Video calls)

Recordings:  14 days from the date of the consultation

Transcript: 7 years from the date of your last consultation, unless legally required to be held for longer.

We store the transcript in split and de-identified form for seven years after you have been discharged, and for as long as you are a patient of ours. Split form means a new record is created every time you or our clinician speak and means your transcript is not readily available in its full form.