Practice Privacy Policy

Dr Simon Zilko - Orthopaedic Foot and Ankle Surgery · ABN 35 192 898 398

Wexford Medical Centre, Suite 64, Level 4, 3 Barry Marshall Parade, Murdoch WA 6150

1. About this policy

We protect your personal and health information and handle it in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). These are the privacy laws that apply to private medical practices in Western Australia. We also meet our professional obligations as a registered medical practitioner, as well as other laws that apply to us. These include the Notifiable Data Breaches scheme, the My Health Records Act 2012 (Cth), the Healthcare Identifiers Act 2010 (Cth) and Western Australian laws such as the Public Health Act 2016 (WA) and the Surveillance Devices Act 1998 (WA).

This policy explains:

• what information we collect, how we collect it and why
• how we use, store and share that information
• how we use digital and artificial intelligence (AI) tools
• how you can access or correct your information
• how you can make a privacy complaint and how we will deal with it.

In this policy, "we", "us" and "the practice" mean Dr Simon Zilko and the staff and contractors who work in his practice. "Your information" means personal information and health information about you.

This policy is free. You can find it on our website at www.drsimonzilko.com.au/privacy.html. If you would like it in another format, such as a document emailed to you or a printed hard copy, please ask us.

2. Who to contact

For questions about this policy or about your information, contact our Privacy Officer:

• Privacy Officer: Practice Manager
• Post: Suite 64 Wexford Medical Centre, 3 Barry Marshall Parade, Murdoch WA 6150
• Phone: (08) 6166 3779
• Email: admin@drsimonzilko.com.au
• Fax: (08) 6316 3316

3. Your consent

When you first see us, we ask you to complete a registration form and confirm your consent. By doing so, you agree that Dr Zilko and practice staff may collect, use and share your information to give you healthcare as this policy describes. Only people who need your information to care for you or run the practice can see it.

We will ask for your separate, express consent before using your information for anything not directly related to your care, unless the law permits otherwise (see section 7). You can withdraw an optional consent at any time by telling us. Withdrawal applies to future use only. It does not undo use that has already lawfully happened, and material already published cannot be recalled.

If you choose not to give us information we need, we may not be able to treat you or claim rebates for you.

4. What information we collect

We only collect information we need to provide and manage your care. This may include:

• Identity and contact details: name, date of birth, gender, address, phone numbers, email and emergency contact or next of kin.
• Health information: medical history, medications, allergies, symptoms, examination findings, clinical notes, imaging, pathology and other test results, operation and hospital records, and treatment plans.
• Clinical photographs and video: for example, of your foot, ankle, wounds, deformity or gait, taken to document your condition and progress.
• Outcome information: patient-reported outcome measures (PROMs), meaning questionnaires about your symptoms and function before and after treatment.
• Identifiers and funding details: Medicare number, Department of Veterans' Affairs (DVA) number, Individual Healthcare Identifier (IHI), and private health insurance details.
• Claim details if your care is funded by someone else: workers' compensation claim number and insurer, Insurance Commission of WA (motor vehicle) claim, employer, case manager or lawyer.
• Referral details: referring doctor, GP and other treating practitioners.
• Billing and payment information.
• Information created by AI tools we use: for example, a draft clinical note produced by our AI scribe, or a summary of your referral (see section 8).

5. How we collect your information

We usually collect information directly from you. This can happen through your registration form (paper or online), during consultations, including telehealth, and by phone, email, SMS or our website.

If you start our online registration form and stop before signing the consent at its end, nothing you have typed is kept: your answers stay on your own device until you sign.

We may also collect information from other people when it is needed for your care or you have agreed. These include:

• your referring doctor, GP, other specialists, physiotherapists, podiatrists and other treating practitioners
• hospitals and day surgeries, radiology and pathology providers
• your My Health Record, where you have one and access is relevant to your care
• Medicare, DVA, your health fund, or a workers' compensation or motor vehicle insurer, for funding and claims
• a parent, guardian, carer or other person responsible for you, and in an emergency, family or friends.

When we receive information about you from someone else, we handle it under this policy. We will make you aware we have it where reasonable.

If we receive information about you that we did not ask for, we check whether we could lawfully have collected it. If we could not, we securely destroy or de-identify it, where it is lawful and reasonable to do so.

Clinical photographs. With your consent, Dr Zilko may photograph or film parts of your body to document your condition and treatment. These are usually taken on Dr Zilko's own mobile device, which is protected by a passcode, biometric lock and encryption. When an image is needed for your care or for correspondence, it is added to your medical record. Images that stay on the device are still part of the health information we hold about you. They are protected, kept and destroyed in the same way as the rest of your record, and you can ask to see them. Using photos for teaching, publication or research needs your separate consent (see section 7).

Card photos. When you complete your registration form online, you can photograph your Medicare, DVA or health fund card instead of typing the details. The image is read within Australia, used to fill in the fields on your form, and then discarded. We do not keep it and it does not become part of your record. You can type the details in yourself if you prefer.

Our website. Our website (www.drsimonzilko.com.au) uses Google Analytics. Analytics places cookies on your device to collect information about how visitors use the site, such as pages viewed, time on site, browser, device type and approximate location. We use this to improve the website. Some of this information could identify you, so we treat it as personal information. You can refuse cookies in your browser settings, although some features of the site may then not work. To prevent spam, our online forms use Google reCAPTCHA, which collects hardware and software information about your device and sends it to Google. Google handles that information under its own privacy policy. If you send us details through a website form or by email, such as your name, phone number or a question about your care, we handle them under this policy. We may need a phone number or address to reply to you. Please don't send urgent or detailed clinical information through a website form. Call us instead. We do not intentionally send clinical information to Google Analytics or reCAPTCHA.

6. Dealing with us anonymously

You can ask to deal with us anonymously or under a pseudonym, and we will consider your request. In most cases, though, it is not practical to treat you, keep accurate records or claim rebates without identifying you. Medical record-keeping and billing laws also require us to identify our patients. We can usually answer general enquiries, such as about fees or services, without your name.

7. How we use and share your information

We use and share your information mainly to assess, diagnose and treat you, including surgery and follow-up care. We also use it for purposes you would reasonably expect.

Your care and the people involved in it. We share relevant information with:

• your referring doctor and GP, through reports and letters after consultations and surgery
• other practitioners involved in your care, such as anaesthetists, surgical assistants, physiotherapists, podiatrists, orthotists, and other specialists, doctors and allied health care providers
• hospitals and day surgeries where you are admitted, and radiology and pathology providers
• your My Health Record, if you have one, unless you ask us not to upload a document
• a parent, guardian, carer or other person responsible for you, where appropriate.

Running the practice. We use your information to book and confirm appointments, send reminders, bill, process Medicare, DVA and health fund claims, and manage our records. We also share it with service providers who help us run the practice. These include our practice management software provider, IT support, secure messaging and pathology/imaging result delivery services, our text-messaging service, transcription or AI scribe providers, website host, and our accountants. They may only use your information to provide their service to us, and we require them to protect it.

Third-party funded care. If your care is part of a workers' compensation, motor vehicle or other insurance claim, we share relevant information with the insurer, your employer's claims manager or the Insurance Commission of WA, as the claim requires and as you have authorised by making the claim. We provide medico-legal reports to lawyers or other third parties only with your written authority, or where the law requires.

Where the law requires or allows it. We may share information without your consent where the law requires or permits it. Examples:

• a subpoena, court order or other legal requirement
• mandatory notifications, such as notifiable diseases under the Public Health Act 2016 (WA)
• to lessen or prevent a serious threat to someone's life, health or safety, or to public health or safety
• to our medical indemnity insurer and lawyers, where needed to establish, exercise or defend a legal claim.

Quality improvement and professional obligations. Dr Zilko reviews his own clinical outcomes and keeps a surgical logbook and audit records, as required for professional development and accreditation. We use information for clinical audit, peer review and staff training, and we remove identifying details wherever practicable.

Clinical registries. We may contribute information to clinical quality registries. One example is the Australian Orthopaedic Association National Joint Replacement Registry (AOA NJRR), which records joint replacement surgery, including ankle replacements, to monitor implant performance and patient safety. The AOA NJRR operates under their own privacy policies, and you can opt out by calling the registry (1800 068 419).

Outcome measures (PROMs). We may ask you to complete questionnaires about your symptoms and function before and after treatment. This helps us track your progress and improve care. We collect them through a secure online platform (REDCap, hosted in Australia). Taking part is voluntary.

Research and teaching. Dr Zilko may take part in medical research and teaching to improve care for future patients.

• We use or disclose identifiable information for research only with your express consent or where another lawful authority applies, and only once any required ethics and privacy approvals are in place.
• We may use de-identified information, such as anonymised outcome data, for research, audit and publication. You can ask us not to include your information.
• Clinical photos are used for teaching, conference presentations or publication only if you have given separate consent. Even then, we will not identify you by name. We will make reasonable efforts to exclude identifying features such as your face, tattoos or jewellery. Some photos may still make you recognisable, and the consent form explains this.
• A member of our team may ask whether you would like to hear about a research study. Researchers will not contact you directly unless you agree.

Communicating with you. We contact you by phone, SMS, email and post, using the details you give us. This may include appointment reminders and, if you agree on your registration form, confidential clinical correspondence such as letters and results. Standard email and SMS are not fully secure. Tell us if you would prefer we don't send clinical information that way. When we send information to other health professionals, we use secure electronic messaging where it is available. Appointment reminders and messages about your care are part of your care, not marketing. We send text messages through an Australian text-messaging service, which handles your information within Australia. To send a message, the service receives your mobile number and the message itself. Our messages name Dr Simon Zilko's rooms and may include a link to a form on our website. The service keeps a record of each message we send, including your mobile number and the message, for as long as we hold an account with them. Tell us if you would prefer we did not text you and we will contact you another way.

Marketing. We do not use your information to market goods or services to you without your express consent. We never sell or rent your information, and we do not share your mobile number or email address with third parties for their marketing or promotional purposes. If you agree to receive information such as a newsletter, you can opt out at any time.

8. Use of artificial intelligence (AI) and digital tools

AI scribe. With your consent, Dr Zilko uses an AI scribe to help write clinical notes and letters from your consultation. It works like this:

• The software listens to the consultation and converts the conversation to text. It then produces a draft note or letter.
• Our provider states that audio recordings are not stored once the text has been produced.
• Your information is processed and stored in Australia.
• Our providers state that your information is not used to train their AI models. We will not allow your identifiable information to be used to train AI models without your express consent.
• AI output can be incomplete or inaccurate, so Dr Zilko reviews and edits every note and letter before it is finalised. The AI does not make clinical decisions.
• Your consent covers all future consultations unless you withdraw it. You can say no to the AI scribe at any time, including partway through a consultation. Your care will not be affected.

Referral processing. When we receive a referral for your care, an AI-assisted system reads the referral and any imaging or specialist reports sent with it, to prepare a structured summary for Dr Zilko and to identify information the referral has not provided. A member of our staff checks the result before anything is added to your record. Once your appointment is booked, we send you a text message with a link to your registration form on our website, so you can give us your details and history before your appointment. This processing takes place within Australia, and the content of your referral is not used to train AI models.

Card reading. If you photograph your Medicare, DVA or health fund card when completing your registration form, an AI-assisted system reads the details from the image to fill in the form. This takes place within Australia. The image is discarded once the fields are filled and is not used to train AI models (see section 5).

Document automation. Our practice management software, Genie (Magentus), uses your existing record to generate documents such as referrals, reports and letters. Each staff member has their own login and can only access the information their role requires.

Automated decisions. We do not use computer programs, including AI, to make decisions about you that significantly affect your rights or interests without a person being involved. All decisions about your care are made by Dr Zilko. If this changes, we will update this policy to say what decisions are made and what information is used.

9. Sending information overseas

We do not usually send your health information outside Australia. Our practice software, AI scribe, PROMs platform, text-messaging service, and our referral and registration-form system store information in Australia. Our website uses Google Analytics and Google reCAPTCHA, so information about website visits and your device is sent to Google, which may process it in the United States and other countries. It is used for security, not for advertising. Otherwise, we only send your information overseas with your consent or where the law permits. One example is when you ask us to send records to a doctor treating you overseas.

10. How we store and protect your information

We keep your information mainly in electronic form, in our practice management system. This includes clinical notes, letters, results, imaging reports and clinical photographs. Any paper records are scanned and then stored securely or destroyed.

Our referral and registration-form system. Referrals, the answers you give on our online registration form, your signed consents and the documents made from them are held in a secure system hosted within Australia, encrypted, and open only to our staff, each signing in with their own passkey. They are kept there only until they have been added to your medical record, and are then deleted (see section 11).

We take reasonable steps to protect your information from misuse, interference, loss, and unauthorised access, change or disclosure. These include:

• individual logins and passwords, multi-factor authentication where available, and access limited to each person's role
• secure, encrypted systems and regular, secure backups
• software and security updates, antivirus protection and firewalls
• confidentiality agreements for all staff and contractors, and regular privacy and cyber-security training
• locked storage for any paper records, and secure premises
• a policy on clinical photographs and mobile devices
• a data breach response plan.

We also take reasonable steps to keep your information accurate, complete and up to date. We may ask you to confirm your details at appointments.

11. How long we keep your information

We keep medical records for at least 7 years after your last contact with us. For patients under 18, we keep them at least until they turn 25. We may keep records longer where there is a reason to, for example a long-term implant or a legal claim. After that, we destroy or permanently de-identify them securely.

Our referral and registration form system holds what you give us only until it has been added to your medical record. Its own copies are then deleted, usually within 30 days and in every case within 12 months. The record that you gave a consent - who signed, what was agreed, and when - is kept permanently, as evidence of your consent. Anything we delete remains in our encrypted backups for a further seven days, until those backups are replaced.

12. Data breaches

We have a process for responding to suspected privacy and security incidents. We contain and assess the incident, fix what we can and record what happened. If a data breach involving your information is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner (OAIC), as the Notifiable Data Breaches scheme requires. Breaches involving My Health Record are also reported to the System Operator.

13. Accessing and correcting your information

You can ask for access to the information we hold about you. You can ask for a copy or to view it, and Dr Zilko or his staff can explain it to you.

• How to ask: contact the Privacy Officer in writing, by email or post (section 2). We will need to confirm your identity. Someone else, such as a lawyer or another doctor, can request your records with your written authority.
• Timeframe: we will respond within 30 days.
• Cost: it is free to make a request. We may charge a reasonable fee to cover the cost of providing access, such as copying or preparing records. We will tell you the fee before we proceed.
• Refusals: in limited situations the Privacy Act lets us refuse access. One example is where access would pose a serious threat to someone's life, health or safety. If we refuse, we will explain why in writing, tell you how to complain, and consider other ways to give you access, such as through another doctor.

If you believe any of your information is wrong, out of date, incomplete or misleading, ask us to correct it. There is no charge for correcting information. We will respond within 30 days. If we don't agree to change it, we will explain why in writing. You can then ask us to attach a statement to your record noting your view. A clinical opinion is not inaccurate just because you disagree with it, as long as it is recorded accurately as an opinion.

We assess requests about a child, or about an adult who cannot make their own decisions, with care. We consider the patient's capacity and interests, the legal authority of the person asking, any relevant court orders, and the privacy of other people.

Some records, such as hospital, imaging or pathology records, are held by other organisations. You may need to request those from them directly.

14. Privacy complaints

If you are concerned about how we have handled your information, please contact our Privacy Officer first (section 2). Complaints are best made in writing so we have the details. We will acknowledge your complaint promptly, investigate it and aim to give you a written response within 30 days.

If you are not satisfied with our response, you can complain to:

Office of the Australian Information Commissioner (OAIC), which regulates privacy

• Website: www.oaic.gov.au
• Phone: 1300 363 992
• Post: GPO Box 5288, Sydney NSW 2001

The OAIC will usually expect you to have raised the matter with us first and given us time to respond.

For complaints about a health service in Western Australia, you can also contact the Health and Disability Services Complaints Office (HaDSCO):

• Website: www.hadsco.wa.gov.au
• Phone: (08) 6551 7600 or 1800 813 583 (country callers)
• Email: mail@hadsco.wa.gov.au
• Post: PO Box B61, Perth WA 6838

15. Changes to this policy

We review this policy at least once a year, and sooner if the law, our technology or the way we handle information changes. The current version is always on our website and at reception. We will tell patients about significant changes, for example by email or a notice in the practice.

Current as of: 3 November 2026 · Next review due: 3 November 2027