Privacy Policy
MedEngine Limited (MedEngine, we or us) is committed to protecting the privacy of your personal information. We take our responsibility for handling sensitive personal information seriously and we have put measures in place to maintain the integrity of personal information and provide full transparency on conduct. We are bound by the South African Privacy Principles under the Privacy Act 1988 (Cth) (Privacy Act) about how we handle your personal information.
This Privacy Policy sets out how and why MedEngine collects, stores, uses and discloses your personal information, and how to contact us if you have any questions about how we handle your personal information or would like to access the personal information we hold about you.
MedEngine provides a range of services that are primarily offered through our website and associated bookings mobile applications (MedEngine Network) or through our customers’ websites and mobile applications (Health Professional Network) and include:
a booking system for appointments with health professionals, including but not limited to general practitioners, dentists, allied health professionals, telehealth providers and pharmacies (health professionals);
new patient forms to assist with the registration of patients booking appointments with health professionals and/or provision of health-related services;
a secure video conferencing solution to facilitate telehealth consultations between you and health professionals;
a pre-vaccination screening service to facilitate the administration of vaccinations;
an online prescription service, to request repeat prescriptions from health professionals;
a prescription fulfilment and medication delivery service delivered in partnership Kushesh logistics
a place for patients to store and access relevant health details and records;
a task manager whereby patients can store, access and manage to do list activity;
an online directory of health professionals and practices; and
referral services to assist you in connecting with providers of other products and services which may be of interest to you
We are constantly evolving our services, and new services may be offered from time to time.
MedEngine also provides services that are offered through the clicks booking system for vaccinations.
What information does MedEngine collect?
The personal information we collect depends on which of our services you use and the information you choose to provide.
When you use our services, you may choose to provide to MedEngine, and we may collect personal information such as:
your name;
your date of birth;
your contact details (e.g. address, email address, phone number);
your gender and/or birth sex;
your marital status;
occupation;
cultural background;
your emergency contact details;
your next of kin details;
advance health directive;
the type of appointment you are requesting;
the reason you are seeking that type of appointment;
health information as defined under the Privacy Act which includes but is not limited to information about your health, illness or disability, a health service you have had or will receive, your medical records and your medications;
to do list activity;
health interests;
information about your private health insurance fund, including your
membership number;
your Medicare, Pension, Health Care Card and Veteran Affairs number and details;
your photograph or image;
financial information;
transaction information;
de-identified technical data such as internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access the MedEngine Network; and
web analytics data which we may collect directly or use third party analytics tools, to help us measure traffic and usage trends for our products and services. These tools collect information sent by your browser or mobile device, including the pages you visit and other information that assists us in improving our products and services. We collect and use this analytics information in aggregate form such that it cannot reasonably be manipulated to identify any particular individual user.
If you choose to use our booking system for appointments through telehealth providers, we may collect medical information from you which is reasonably required to deliver this service. Where you book an appointment with a telehealth provider who facilitates health appointments with third party healthcare professionals, your personal information will be collected by that telehealth provider for the purpose of booking that appointment with a healthcare professional. You should review the privacy policy for that telehealth provider for information on how the telehealth provider will collect, hold, use and disclose your personal information.
If you choose to use our booking system for appointments with medical specialists, we may collect information from you as provided by your referring health professional regarding your treatment such as copies of referral letters which may include relevant medical history, symptoms, investigation results, medication and management, and other health information.
If you choose to use our online pre-vaccination screening service, we may collect information about your health and other information you may provide when using the service for the purposes of facilitating the administration of your vaccination.
If you choose to use our online prescription service, we may collect information about your prescriptions, symptoms, treating health professional and other information you may provide when using the service.
If you are applying for employment with us, we will collect information about you for recruitment purposes (including possible future recruitment opportunities) and human resources activities. Information collected may include but not be limited to your occupation, qualifications, citizenship, information contained in your resume, medical or health related information, employee records and other human resources personal information. We may also conduct and collect psychometric, technical skills or behavioural analysis type assessments.
If you are a health professional using our online directory, we will collect information about you and your practice (for the online directory).
If you are a referring health practitioner, we may collect information about you and your practice such as name, contact details, provider number and information relevant to providing services to referred patients.
Usually we collect your personal information directly from you. MedEngine may collect your personal information from you in various ways, including via the MedEngine Network, telephone and email.
We may also collect information from third parties, such as:
family members, legal guardian/s and/or a person you have authorised to provide your personal information to us;
health professionals and their practices (often via their practice management software systems), in relation to the management of appointments you have made, your requested health services, and the associated fees; and
platforms such as Facebook, Google and Apple with your consent for the purposes of logging in or creating a MedEngine account, and to enable this, we will collect your name and e-mail from these services for this purpose..
We use cookies and similar technologies (such as web beacons and proprietary measurement software) on the MedEngine Network to analyse trends, administer our services, diagnose problems, improve the quality of our products and services, track users’ movements around the MedEngine Network, and to gather demographic information about our user base as a whole.
A cookie is a small text file that the MedEngine Network may place on your device to store information. We may use persistent cookies (which remain on your computer even after you close your browser) to store information that may speed up your use of the MedEngine Network for any of your future visits to the MedEngine Network. We may also use session cookies (which no longer remain after you end your browsing session) to help manage the display and presentation of information on the MedEngine Network. You may refuse to use cookies, web beacons or some of the proprietary measurement software features by selecting the appropriate settings on your browser or the settings section of your mobile or tablet device. However, please note that if you do this, you may not be able to use the full functionality of the MedEngine Network.
You do not have to use our services, and you may choose which of our services you wish to use. Some of our services, such as our online directory of health professionals and practices, do not require you to provide us with personal information. However the majority of our services do, and when you use such services we require you to provide accurate details and do not permit you to use a pseudonym or remain anonymous. For some services, certain information is designated as mandatory (which is required to use the service) and some is optional (which you may choose not to provide, but your failure to provide that information may limit your use of the service). If you do not provide personal information to MedEngine that is designated as mandatory, we will be unable to provide you with that service.
MedEngine uses social networking services such as Facebook, Twitter and Instagram to communicate with the public about its activities. MedEngine may collect your personal information when you communicate with us by using these social networking services, and the social networking services will also handle your personal information for their own activities. These social networking sites have their own privacy policies.
Why does MedEngine collect and use your personal information?
The primary reason MedEngine uses your personal information is to provide the services you have elected to receive.
Health Professional Networks: MedEngine may also collect and use your personal information and sensitive information if you interact with Health Professional Networks that have incorporated MedEngine technology in the course of the health professional providing health services to you.
Where MedEngine has collected personal and sensitive information through the Health Professional Network that incorporate MedEngine’s technology, it will:
handle your personal information in accordance with MedEngine’s privacy commitments outlined in our agreements with such health professionals (Health Professional Agreement);
disclose your personal information and sensitive information to the relevant health professional (or their affiliates and service providers), and will not otherwise have effective control or use your personal and sensitive information as detailed below unless permitted under the Health Professional Agreement;
seek assurances from health professionals that use our services that they will handle information in accordance with applicable laws, but we have no control over and are not responsible for any health professional’s use of information (including information used by their affiliates and service providers) for which it has effective control.
The protections that apply to such personal information will be described in the individual privacy policies of those health professionals, and not in this Privacy Policy. To learn more about the privacy and data security of those health professionals, you should read the respective health professional’s privacy policy carefully.
Subject to the above in relation to Health Professional Networks that utilise MedEngine’s technology, MedEngine may use your personal information:
to contact you about your use of the MedEngine Network;
to facilitate communications between you and health professionals and their practices such as to remind you of an upcoming appointment, to confirm a booking, or to request feedback or participate in a survey or questionnaire;
if you decide to create a personal profile on the Network, we will store that information securely on the Network for the purpose of making your future interactions with MedEngine more convenient;
on a de-identified basis for analysis, research and quality assurance purposes;
when you have provided prior agreement, for communicating with you about our products and services and those of third parties or about general or health information which you have indicated or we believe may be of interest to you. You will be able to stop receiving these communications at any time by:
clicking on the “Unsubscribe” link on email correspondence;
replying “Stop” to SMS correspondence; or
emailing privacyofficer@MedEngine.co.za;
to promote and drive engagement with our products and services, including the use of targeted online advertising;
to send push notifications to your mobile device. You can use the settings on your mobile device to enable or turn off mobile push notifications from MedEngine;
to pre-fill forms;
for human resources activities including but not limited to recruitment purposes and possible future recruitment opportunities;
to report to health professionals and their practices about the use and functionality of our services, including associated financial benefits;
for de-identified data analytics to help us improve our service and products, and our users’ experience, including by monitoring aggregate metrics such as total number of visitors, traffic, and demographic patterns;
for security measures to implement access controls, monitor activity that we think is suspicious or potentially fraudulent, and to identify violations of this Privacy Policy or our Terms of Use;
for payment processing; and
for other purposes that are notified to you at the time we collect your information, which you give your consent to, or which are authorised or required by law.
Who does MedEngine disclose personal information to?
When you use our booking system for appointments with health professionals or the repeat prescription service, or complete new patient forms on the MedEngine Network, we will disclose your personal information to the health professionals that you have selected and their practices for the purpose of arranging such appointments, prescriptions or provision of services. Each health professional has to comply with applicable privacy laws with regards to their use of your personal information. However, we have no control over, and are not responsible for how the health professional uses your information. To learn more about how a health professional may use your information, you should review their privacy policy.
If you are a health professional using our online directory, we will make the information you provide publicly available including on the MedEngine Network.
MedEngine may also disclose your personal information to other persons, such as:
its related bodies corporate for business purposes. MedEngine will require these entities to comply with the terms of this Privacy Policy regarding their use of your information;
third party service providers (such as IT and software service providers such as First Focus IT and MedAdvisor International, providers of research services, payment processing service providers, and our professional advisers such as lawyers and auditors), but only for the purpose of providing goods or services to us. Some of these software services allow us to advise you of certain services and benefits available to you, facilitate the provision of products and services to you or provide you with functionality associated with the MedEngine Network. We require our third party service providers to agree to appropriate privacy restrictions, and only permit them to access personal information to the extent needed to provide goods or services to us;
upon your request, to your representatives and/or providers of other services and products which may be of interest to you, such as private health insurance companies and comparison services, providers of finance credit for cosmetic, medical and dental procedures, providers of audiology services, and providers of prescription fulfilment and medication delivery services;
courts, tribunals, regulatory authorities and law enforcement officers, as required by law, in connection with any actual or prospective legal proceedings, or in order to establish, exercise or defend our legal rights; and
other persons notified to you at the time we collect your personal information, who you give your consent to, or to whom we are authorised or required by law to make such disclosure.
We may also disclose de-identified information of our users to third parties that collect and process data for analysis, research and quality assurance purposes, such as:
third parties who provide data analytics (such as Google Analytics and Hotjar) to help us improve our service and products, and our users’ experience, including by monitoring aggregate metrics such as total number of visitors, traffic, and demographic patterns;
third party security entities to prevent various types of data processing abuse attempts and block suspicious behaviour (such as Google reCAPTCHA);
third party service providers to manage our advertising on other websites. Our ad network providers use cookies and web beacons to collect information about your activities on the MedEngine Network to serve you with advertisements regarding our products and services, and to help determine the effectiveness of our promotional or advertising campaigns. This type of online, targeted advertising — known as “retargeting” — is used to re-engage consumers who previously visited the MedEngine Network. The website www.youronlinechoices.com.au allows you to opt-out of some online behavioural advertising and provides further information about how online behavioural advertising works. Please note this does not opt you out of being served advertising. You will continue to receive generic ads; and
research and measurement companies which record internet usage across the MedEngine Network. The MedEngine Network may feature Nielsen proprietary measurement software, which will allow you to contribute to market research, like Digital Content Ratings. To learn more about the information that Nielsen software may collect and your choices with regard to it, please see the Nielsen Digital Measurement Privacy Policy at http://www.nielsen.com/digitalprivacy.
Some third party service providers used by MedEngine may store your personal information on servers located overseas. However, they must also meet our requirements for privacy and data security.
Data quality and security
MedEngine will take reasonable steps to ensure that your personal information which we may collect, use or disclose is accurate, complete and up-to-date. However, we rely on the accuracy of the personal information as entered by you or provided to us by third parties.
MedEngine will take reasonable steps to protect your personal information from misuse, interference and loss and from unauthorised access, modification or disclosure. MedEngine implements security measures including:
physical security such as security procedures for access to our business premises; and
IT security procedures including password protection, network firewalls, encryption, intrusion detection and site monitoring.
We store your personal information on secure servers located in South Africa in an encrypted, electronic format.
Before disclosing personal information to an entity or person located overseas, MedEngine takes steps to ensure that the recipients of such information do not breach the APPs in relation to the information, by including relevant contractual provisions.
We will only retain your personal information for as long as reasonably necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal information for a longer period in the event of a complaint or for legal purposes.
To determine the appropriate retention period for personal information, we consider the amount, nature and sensitivity of the personal information, the potential risk of harm from unauthorised use or disclosure of your personal information, the purposes for which we handle your personal information and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.
Access to, deletion of and correction of your personal information
You have a right to request:
access to your personal information;
that your personal information be deleted or de-identified; or
that we correct inaccuracies relating to your information.
In some circumstances, we may not be able to comply with a request that you make in respect of your personal information. For example, we may be required to retain certain information that you ask us to delete for various reasons, such as where there is a legal requirement to do so. Where these reasons to refuse a request in respect of your personal information exist, we will advise you of those reasons at the time you make your request.
If we do agree to your request for the deletion or de-identification of your personal information, we will delete or de-identify your data but will generally assume that you would prefer us to keep a note of your phone number on a register of individuals who would prefer not to be contacted. That way, we will minimise the chances of you being contacted in the future where your data is collect in unconnected circumstances. If you would prefer us not to do this, you are free to say so.
If you request that your personal information is changed, and if MedEngine does not agree to change your personal information, we will enclose your statement of the requested changes with your personal information.
If you would like to obtain access to, delete or request changes to your personal information you can ask our Privacy Officer (details below).
MedEngine can charge a reasonable fee for the time and cost of collating, preparing, and photocopying material for you if you request access to your personal information.
Where we have obtained your consent to handle your personal information, or consent to send you information, you may withdraw your consent at any time and we will cease to carry out the particular activity that you previously consented to, unless we consider that there is an alternative reason to justify our continued handling of your personal information for this purpose, in which case we will inform you of this condition.
Where MedEngine provides services directly to health professionals, this may involve MedEngine receiving and handling information separately on behalf of the health professional, for the purpose of providing those services. In these circumstances, MedEngine will return, retain or destroy any personal information that we have collected in delivering our services to a health professional in accordance with our end user terms and conditions that we agree with that health professional and/or the Health Professional Agreement.
Complaints
If you have questions about this Privacy Policy, if MedEngine does not agree to provide you with access to your personal information; or if you have a complaint about our information handling practices, you can contact our Privacy Officer on the details below.
In particular, if you wish to make a complaint about how we have handled your personal information, you should forward a written complaint to our Privacy Officer.
We will respond in writing within 30 days of receipt of a complaint. If you are not satisfied with our decision, you can contact us to discuss your concerns.
If the complaint remains unresolved, you have the option of notifying the Office of the South African Information Commissioner (OAIC). Contact details can be found at OAIC’s website: www.oaic.gov.au
How to contact us
By letter: Privacy Officer, MedEngine Limited, Unit 2a, 26 Vrede Park, Bellville, Cape Town, 7530