Privacy Policy

Your privacy is important to Hader Clinic Queensland. Our respect for our customers' right to privacy of their personal information is paramount.

This Privacy Policy establishes the framework for the collection, holding, use, disclosure, and management of personal information by Hader Clinic Queensland in accordance with the Australian Privacy Principles under the Privacy Act 1988 (Cth). The Policy describes the kinds of personal information HCQ collects, how that information is managed, and the rights of individuals to access, correct, and complain about the handling of their personal information.

1. Introduction

Hader Clinic Queensland and its related bodies corporate (‘HCQ’) are committed to protecting the privacy and confidentiality of personal information collected in the course of providing drug and alcohol treatment, rehabilitation, and related health services. HCQ recognises that deficiencies in the management of personal information can lead to breaches of individual privacy, loss of community trust, regulatory sanctions, and harm to the therapeutic relationship between clients and treatment providers.

This Privacy Policy (‘the Policy’) describes how HCQ manages personal information and is intended to be read by clients, prospective clients, family members, referrers, employees, contractors, and members of the public.

This Policy is HCQ’s APP Privacy Policy for the purposes of APP 1.3 of the Privacy Act 1988 (Cth) (‘the Privacy Act’) and is publicly available via HCQ’s website in accordance with APP 1.5.

2. Purpose

The purpose of this Policy is to:

Describe the kinds of personal information that HCQ collects and holds;
Explain how HCQ collects, holds, uses, and discloses personal information;
Inform individuals of how they may access and request correction of personal information held by HCQ;
Explain how individuals may make a complaint about HCQ’s handling of their personal information;
State whether HCQ is likely to disclose personal information to overseas recipients and, where practicable, identify the countries in which those recipients are located; and
Comply with HCQ’s obligations under APP 1 (Open and transparent management of personal information) of the Privacy Act.

3. Scope

This Policy applies to all personal information collected, held, used, or disclosed by HCQ in the course of its functions and activities, regardless of the form in which that information is held (whether electronic, paper, audio, or visual).

This Policy applies to all individuals whose personal information HCQ handles, including but not limited to: –

Current and former clients (including residential rehabilitation clients, outpatient clients, and detoxification clients);
Prospective clients and persons making enquiries;
Family members, carers, and nominated third parties of clients;
Referrers, including general practitioners, psychiatrists, psychologists, and other health professionals;
Employees, contractors, volunteers, and students;
Visitors to HCQ premises; and
Visitors to HCQ’s website and users of HCQ digital applications.

3.1 Exclusions

This Policy does not apply to: –

Employee records held by HCQ in its capacity as an employer, to the extent those records are exempt under section 7B(3) of the Privacy Act 1988; or
Personal information that is otherwise exempt under the Privacy Act.

4. Definitions

In this Policy –

Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not and whether the information or opinion is recorded in a material form or not.

Sensitive information means information or an opinion about an individual’s racial or ethnic origin, political opinions, membership of a political association, religious beliefs or affiliations, philosophical beliefs, membership of a professional or trade association, membership of a trade union, sexual orientation or practices, or criminal record, that is also personal information. Sensitive information also includes health information and genetic information.

Health information means information or an opinion about the health (including illness, disability, or injury) of an individual; an individual’s expressed wishes about the future provision of health services; or a health service provided or to be provided to an individual, that is also personal information. Health information also includes other personal information collected to provide, or in providing, a health service, and genetic information in a form that is or could be predictive of health.

Australian Privacy Principles (‘APPs’) means the Australian Privacy Principles set out in Schedule 1 to the Privacy Act.

Consent means express consent or implied consent.

Primary purpose means the specific function or activity for which personal information is collected.

Secondary purpose means a purpose other than the primary purpose for which the information was collected.

Notifiable data breach means an eligible data breach as defined in Part IIIC of the Privacy Act 1988 (Cth), being an unauthorised access to, unauthorised disclosure of, or loss of personal information that is likely to result in serious harm to any of the individuals to whom the information relates.

Nominated third party means a person nominated by a client to receive information about the client’s treatment, health, or personal circumstances.

OAIC means the independent agency known as the Office of the Australian Information Commissioner within Attorney-General’s Department.

5. Kinds of Personal Information Collected and Held

The kinds of personal information HCQ collects and holds will depend on the nature of the individual’s relationship with HCQ. HCQ collects the following categories of personal information: –

5.1 Clients

Name, date of birth, gender, and contact details (address, telephone number, email address);
Health information, including medical history, psychiatric and psychological history, substance use history, current medications, allergies, and treatment notes;
Medicare number, private health insurance details, and Department of Veterans’ Affairs (DVA) details and other government related identifiers;
Emergency contact details and nominated third party details;
Next of kin details;
Financial information (to the extent required for billing and payment processing);
Photographs (for identification purposes);
Information provided by referrers, general practitioners, or other health professionals; and
Information collected in the course of treatment, including but not limited to clinical observations, progress notes, and discharge summaries.

5.2 Prospective Clients and Enquirers

Name and contact details;
Nature of the enquiry; and
Information voluntarily provided during the enquiry (which may include health information).

5.3 Family Members and Nominated Third Parties

Name and contact details; and
Relationship to the client.

5.4 Employees, Contractors, and Volunteers

Name, date of birth, and contact details;
Qualifications, professional registration, and employment history;
Tax file number and superannuation details;
Health information (to the extent required for workplace health and safety purposes); and
Bank account details (for payroll purposes).

5.5 Website Visitors and Digital Application Users

IP address, browser type, and device information;
Pages accessed and time of access;
Information submitted via online enquiry forms; and
Information submitted via the HaderCare application.

6 How HCQ Collects Personal Information

6.1 Direct Collection

HCQ will, where reasonable and practicable, collect personal information directly from the individual to whom it relates. Direct collection may occur through: –

Admission and intake processes;
Clinical assessments and consultations;
Enquiry forms submitted via the HCQ website or by telephone;
Employment applications and onboarding processes; and
The HaderCare application.

6.2 Collection from Third Parties

HCQ may collect personal information about an individual from a third party where: –

The individual has consented to the collection (e.g., by nominating a referrer or authorising a general practitioner to provide a referral);
It is unreasonable or impracticable to collect the information directly from the individual (e.g., in a medical emergency); or
The collection is required or authorised by law.

Example – A general practitioner provides a referral letter containing the client’s medical history and current medications to facilitate the client’s admission to HCQ.

6.3 Anonymity and Pseudonymity

Individuals have the option of dealing with HCQ anonymously or by using a pseudonym where it is lawful and practicable. However, HCQ may not be able to provide health services to an individual who does not identify themselves, as it is generally impracticable to provide drug and alcohol treatment without knowing the identity of the client.

Example – A person making a general enquiry about HCQ’s services may do so without providing their name. However, a person seeking admission to a residential rehabilitation program must provide their identity.

6.4 Unsolicited Personal Information

Where HCQ receives personal information that it did not solicit, HCQ will, within a reasonable period, determine whether HCQ could have collected the information under the APPs. Where HCQ determines that it could not have collected the information, HCQ will destroy or de-identify the information as soon as practicable, unless retention is required by law.

6.5 Website Collection

When an individual visits the HCQ website, HCQ does not attempt to identify the individual. HCQ’s website uses analytics tools to record non-identifying information such as IP address, browser type, pages accessed, and time of access. This information is used for the purposes of website administration and improvement.

HCQ’s website may use cookies. A cookie is a small data file that a website transfers to an individual’s device. Cookies do not identify individuals but may identify the individual’s browser and internet service provider. Individuals may configure their browser to reject cookies, however this may limit the functionality of the website.

7 How HCQ Holds Personal Information

HCQ holds personal information in both electronic and physical (paper) form. HCQ takes reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure, including through: –

Access controls and password protection on electronic systems;
Physical security measures for paper records, including locked storage and secure waste disposal;
Staff training on privacy obligations and information security;
Restricting access to personal information to those staff who require it to perform their duties; and
Contractual obligations imposed on third-party service providers who handle personal information on behalf of HCQ.

Where personal information is no longer required for the purpose for which it was collected, and HCQ is not required by law to retain it, HCQ will destroy or de-identify the information in a secure manner.

8 How HCQ Uses and Discloses Personal Information

HCQ will use and disclose personal information only for the primary purpose for which it was collected, unless one of the following exceptions applies: –

The secondary purpose is related to the primary purpose (or, in the case of sensitive information, directly related to the primary purpose) and the individual would reasonably expect HCQ to use or disclose the information for that secondary purpose;
The individual has consented to the use or disclosure;
The use or disclosure is required or authorised by Australian law or a court or tribunal order;
HCQ reasonably believes that the use or disclosure is necessary to lessen or prevent a serious threat to the life, health, or safety of any individual or to public health or public safety;
HCQ reasonably believes that the use or disclosure is reasonably necessary for the enforcement of a criminal law, a law imposing a pecuniary penalty, or for the protection of public revenue; or
The use or disclosure is reasonably necessary for the establishment, exercise, or defence of a legal or equitable claim.

8.1 Common Uses and Disclosures

HCQ commonly uses and discloses personal information for the following purposes: –

8.1.1 Treatment and Care

HCQ will use and disclose personal information among treating health professionals to provide, coordinate, and manage a client’s treatment. This routinely includes sharing information within the multidisciplinary treatment team, referring clients to external health service providers, and providing discharge summaries to the client’s general practitioner or nominated medical practitioner.

8.1.2 Nominated Third Parties

Where a client has provided consent and nominated a third party, HCQ will disclose information to the nominated third party relating to: treatment options for the client’s substance use and any comorbid mental health conditions; information relating to the client’s health and medical conditions; and the client’s current personal circumstances. This contact may be made via telephone, email, or both.

A client is not required to nominate a third party. Where a client declines to nominate a third party, HCQ will only communicate directly with the client regarding their treatment. A client may withdraw consent to third party disclosure at any time by advising HCQ in writing.

8.1.3 Billing and Administration

HCQ will use and disclose personal information as necessary for billing, payment processing, and liaison with private health insurers, Medicare, and the Department of Veterans’ Affairs.

8.1.4 Legal and Regulatory Obligations

HCQ will use and disclose personal information where required or authorised by law, including in response to a subpoena, court order, or lawful request from a government agency or regulatory body.

8.1.5 Quality and Accreditation

HCQ may use personal information (in de-identified or aggregated form where practicable) for the purposes of quality assurance, clinical governance, accreditation, and internal auditing.

8.1.6 Direct Marketing

HCQ will not use personal information for the purpose of direct marketing unless the individual has provided consent. Where consent has been provided, individuals may opt out of receiving marketing communications at any time by contacting HCQ or using the unsubscribe mechanism provided in the communication.

8.1.7 Government Related Identifiers

HCQ collects government related identifiers (including Medicare numbers and Department of Veterans’ Affairs file numbers) where necessary for billing, administration, and the provision of health services. HCQ will not adopt a government related identifier as its own identifier for an individual. HCQ will not use or disclose a government related identifier unless the use or disclosure is reasonably necessary to verify the identity of the individual, to fulfil its obligations to the relevant government agency, or is otherwise required or authorised by Australian law.

9 Access to and Correction of Personal Information

9.1 Access to Personal Information

Individuals may request access to the personal information HCQ holds about them. Access requests should be submitted in writing to the Quality Manager via the contact details stated in clause 14 (Contact). HCQ will ordinarily respond to access requests within thirty (30) days of receipt.

HCQ may refuse to provide access where: –

HCQ reasonably believes that providing access would pose a serious threat to the life, health, or safety of any individual;
Providing access would have an unreasonable impact on the privacy of other individuals;
The request is frivolous or vexatious;
The information relates to existing or anticipated legal proceedings and would not be accessible through the discovery process; or
Providing access would be unlawful or would prejudice an enforcement activity.

Where HCQ refuses access, HCQ will provide written reasons for the refusal and advise the individual of their right to make a complaint.

HCQ may charge a reasonable fee for providing access to personal information. No fee will be charged for making the request itself.

9.2 Correction of Personal Information

Individuals may request that HCQ correct personal information that the individual believes to be inaccurate, out of date, incomplete, irrelevant, or misleading. Correction requests must be submitted in writing to the HCQ Quality Manager. HCQ will ordinarily respond to correction requests within thirty (30) days of receipt.

Where HCQ does not agree with the requested correction, HCQ will permit the individual to attach a statement to the record setting out the correction sought. HCQ will provide written reasons for any refusal to correct personal information.

10 Data Breaches

HCQ takes data breaches seriously. Where HCQ becomes aware of an eligible data breach (or has reasonable grounds to suspect that an eligible data breach has occurred), HCQ will: –

Take immediate steps to contain the breach and mitigate any harm;
Conduct an assessment of the breach in accordance with Part IIIC of the Privacy Act;
Where the assessment determines that the breach is an eligible data breach, notify the Office of the Australian Information Commissioner and affected individuals as soon as practicable; and
Review and implement measures to prevent future breaches.

11 Overseas Disclosure of Personal Information

HCQ does not, as a matter of routine practice, disclose personal information to overseas recipients. Where HCQ engages a third-party service provider that stores or processes data outside Australia (e.g., cloud-based software providers), HCQ will take reasonable steps to ensure that the overseas recipient does not breach the APPs, including by requiring contractual commitments to privacy protection obligations that are at least substantially similar to the APPs.

Where HCQ becomes aware that personal information will be stored or processed in a specific country, HCQ will update this Policy to identify that country.

12 Links to Third Party Websites

The HCQ website may contain links to third party websites. HCQ is not responsible for the privacy practices or content of those websites. Individuals are encouraged to review the privacy policies of any third-party websites they visit.

13 Changes to this Policy

HCQ may amend this Policy from time to time to reflect changes in HCQ’s information handling practices, legislative requirements, or regulatory guidance. The most current version of this Policy will be published on the HCQ website. Where material changes are made, HCQ will take reasonable steps to notify affected individuals.

14 Contact

For enquiries about this Policy or about HCQ’s handling of personal information, individuals may contact:

Attention: Quality Manager

Hader Clinic Queensland, Level 4/87 Wickham Terrace, Spring Hill QLD 4000

Email: re*******@****************om.au Phone: 1300 856 847

Last updated April 20, 2026