Privacy, data security, and Australian compliance

Last updated: 2 April 2026

Introduction

Personal information is any information that identifies you and all personal information collected in the course of providing a health service is considered health information under the Privacy Act 1988 (Cth) (Privacy Act). Health information is ‘sensitive information’ under the Privacy Act, which means that stricter requirements apply when handling such information.

VEMSA (we, are or us) is committed to protecting your privacy and handling your personal information in accordance with all privacy laws, which includes, the Privacy Act, the Australian Privacy Principles (APPs), and such other privacy principles or legislative requirements relevant to the privacy of the personal and health information collected and stored by VEMSA from time to time. This Privacy Policy explains how we collect, use, store and disclose your personal information when you use our website or access our services. By using VEMSA’s services or otherwise providing us with any personal and health information, you consent to our collection, use, holding and disclosure of such information outlined in this Privacy Policy.

1. Who We Are

VEMSA provides Australia-wide virtual emergency medical consultations delivered by AHPRA-registered clinicians, including emergency specialist doctors (FACEM), nurse practitioners, general practitioners, and emergency career medical officers, who all operate as independent practitioners. Separately, VEMSA also has a referral network of non-emergency specialists.

2. What Personal Information We Collect

We collect personal information that is reasonably necessary to provide our services and to operate our website. The type of information we collect depends on how you interact with us.

A. Information Collected via Our Website

If you submit an enquiry or complete an online form on our website, we may collect:

Your full name
Email address
Phone number
The details of your enquiry or message

We may also collect limited technical information such as your IP address, browser type, and device information through cookies and analytics tools. Refer to section 8 below.

B. Information Collected When You Access Our Medical Services (Including via Halaxy)

When you commence a consultation or access VEMSA’s telehealth services, we collect additional personal and health information through our secure clinical systems, including Halaxy, and through telehealth consultation platforms such as Coviu.

This may include:

Identity and contact information

Full name
Date of birth
Residential address
Phone number
Email address
Medicare number
Private health insurance details (if applicable)

Health information

Presenting symptoms and medical history
Current medications
Mental health information where clinically relevant
Test results, imaging and specialist reports
Consultation notes and clinical documentation
Treatment plans and clinical correspondence
Referral letters and escalation documentation
other personal information (such as information about your gender, race, sexuality or religion), collected for the purpose of providing our health service.

Health information is considered sensitive information under Australian privacy law.

Billing and payment information

Payment details for the VEMSA administration fee where applicable.
Information required for Medicare billing and bulk billing.

VEMSA stores your information in our systems and in Halaxy, which provides infrastructure and data storage services to us. In some cases, this information may be stored or processed on servers located outside Australia. Also see section 5 below for further information. For more information about how Halaxy handles personal information, please refer to its privacy policy at: Privacy at Halaxy

C. Information from Other Healthcare Providers

With your consent, we may also collect relevant information from:

Your general practitioner
Referring doctors
Hospitals
Pathology or imaging providers
Other specialists involved in your care

This supports safe escalation, continuity of care, and clinical decision-making.

3. How We Collect Your Information

We collect personal information:

Directly from you via website forms
Through the Halaxy intake process and consultation platform
During telehealth consultations with VEMSA clinicians (including recordings of your consultation unless you expressly decline consent)
Through communications by phone or email
From healthcare providers involved in your care (with consent where required)
Through Medicare billing systems (where applicable)

4. How We Use Your Information

We use your personal information to:

Provide virtual emergency medical care and telehealth consultations
Assess symptoms and provide clinical recommendations
Escalate care where clinically required (including hospital referral)
Arrange specialist referrals and follow-up consultations
Issue prescriptions and medical certificates (where appropriate)
Process payments and administration fees
Process Medicare claims and bulk billing
Communicate with you regarding your care and appointments
Communicate with your GP or treating doctor (with your consent)
Maintain accurate clinical records and documentation
Meet legal and regulatory obligations

5. Telehealth Consultations and Third-Party Platforms

VEMSA delivers telehealth consultations through secure platforms, including Halaxy and Coviu.

Where third-party systems are used, VEMSA takes reasonable steps to ensure that service providers manage personal information in a manner consistent with Australian privacy obligations.

5.1 Overseas Disclosure

In some circumstances, VEMSA may disclose personal information to third party service providers that assist us in operating our business and delivering our services. These providers may include cloud hosting, data storage, email communication, and technology service providers. Some of these service providers may store or process personal information on servers located outside Australia. For example, certain cloud-based platforms we use may store data on servers located in other jurisdictions including the United States.

6. My Health Record

With your consent, VEMSA may upload relevant consultation summaries or clinical notes to your My Health Record (if you have one) to support continuity of care.

You may decline or withdraw consent at any time.

7. Disclosure of Personal Information

We do not sell your personal information.

We may disclose personal information where necessary for your care, including to:

VEMSA clinicians involved in your treatment
Independent specialists within the VEMSA referral network
Your nominated GP or treating healthcare provider (with your consent)
Hospitals, ambulance services, or emergency services where escalation is required
Medicare for billing purposes
Professional advisers or service providers assisting us to operate our business (where appropriate)

We may also disclose personal information where required or authorised by law, including where necessary to prevent or lessen a serious threat to life, health or safety.

8. Website Cookies and Analytics

Our website may use cookies and analytics tools to help us:

Understand website traffic and usage patterns
Improve website functionality and user experience
Monitor advertising performance (where applicable)

This data is generally collected in a de-identified form. You may disable cookies via your browser settings. Cookies may also be purged from your browser after every use. This is generally a very simple procedure. Please refer to your browser’s help file for more information.

8.1 Links to third party websites

VEMSA may provide links on our web pages and policies to external parties. The content and views expressed on these third-party websites are not the responsibility of VEMSA. Further, these third-party websites are not subject to our privacy standards, policies and procedures. You will need to contact or review those websites directly to ascertain their privacy standards, policies and procedures.

9. Data Security

We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification or disclosure.

These steps may include:

Secure electronic medical record systems
Encrypted communications and platforms (including Halaxy and Coviu)
Virus scanning tools
Staff training
Restricted access to authorised staff and clinicians
Confidentiality obligations for staff and contractors

While we take reasonable precautions, no online system can be guaranteed as completely secure. VEMSA will take reasonable steps to destroy or de-identify the personal information we hold once it is no longer needed for any purpose for which it may be used or disclosed.

10. Data Retention

We retain medical records and related personal information for the period required under Australian law and relevant state or territory health records legislation.

11. Data Breach Response

Should any unforeseeable event occur which results in the loss, or unauthorised access or disclosure of your personal and health information, VEMSA has processes and mechanisms in place to contain any breach, determine any impact and comply with any applicable notification laws. In the event that it is likely to result in serious harm to you, we will investigate the matter and notify you and the Office of the Australian Information Commissioner pursuant to our obligations under the Privacy Act.

12. Access and Correction

Generally, you may request access to the personal information we hold about you, at any time subject to limited exceptions or required by law. The following factors will be considered:

the information is related to a commercially sensitive decision making process;
access would be unlawful;
denying access is required or authorised by or under law;
providing access would be likely to prejudice an investigation of possible unlawful activity;
if your request is frivolous or vexatious; and
if providing access would have an unreasonable impact on the privacy of others.

To access the information, you will need to contact the Privacy Officer as detailed in this policy.

You may be charged a small fee applicable to the collection and provision of your personal and health information but will be notified of this fee prior to processing their request. VEMSA’s Privacy Officer will be able to advise you how long it will take to provide the information. Generally however, you will receive the requested information within 14 days of the request.

You have the right to and request corrections if you believe that the personal and health information we hold about you is inaccurate, incomplete, or out of date

Requests should be made using the contact details below. We may require proof of identity before releasing information. Where we are unable to provide you with the information you have requested or correct your information, we will inform you and explain the reasons why.

12.1 Anonymity and pseudonymity

You may remain anonymous or use a pseudonym when dealing with us. However, it may not be possible for us to assist you with your request if you wish to use a pseudonym or remain anonymous.

13. Complaints

VEMSA has a Privacy Officer to handle any queries or issues related to privacy. We take your privacy seriously. If you believe we have breached your privacy or mishandled your personal information, you may write to us directly, by writing to VEMSA’s Privacy Officer by emailing admin@vemsa.com.au and your email will be addressed through our complaints handling process.

All complaints will be given fair consideration and we will aim to resolve them within 30 days of receipt of your complaint. Where it is found that we are unable to finalise the investigation of your complaint within 30 days, we will contact you to request an extension

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC). You are able to do so by:

Visiting www.oaic.gov.au and submitting an online form;
Obtaining a hard copy form at www.oaic.gov.au/about-us/contact-us-page;
Phone: 1300 363 992;
Fax: 02 9284 9666; or
Email: enquiries@oaic.gov.au.

You may also contact the NSW Health Care Complaints Commission by:

Phone: 1800 043 159;
Email: hccc@hccc.nsw.gov.au
Address: Level 13, 323 Castlereagh Street, Sydney NSW 2000

14. Contact Us

Privacy Officer VEMSA
Virtual Emergency Medicine Services Australia

Email: admin@vemsa.com.au
Phone: 13 000 VEMSA

VEMSA reviews its policies, statements and procedures to keep up-to-date with changes in the law, technology and market practice. As a result, we may update and change this Privacy Policy from time to time. Please check this Privacy Policy from time to time so you are aware of any changes or updates to the Privacy Policy.