Privacy Policy

1. Introduction

1.1This Privacy Policy explains how GP Culture & Care Pty Ltd (ABN 86 674 209 397), trading as Heart Bridge Health (“we”, “us”, “our”, or the “Operator”), collects, uses, stores, discloses, and protects personal information in connection with the Heart Bridge Health platform, mobile application, and website (collectively, the “Platform”).

1.2We are committed to protecting the privacy of all users of the Platform, including Doctors (GPs) and Clinics. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (“APPs”).

1.3By registering for, accessing, or using the Platform, you consent to the collection, use, storage, and disclosure of your personal information as described in this Privacy Policy.

1.4We may update this Privacy Policy from time to time. We will notify you of any material changes through the Platform. Your continued use of the Platform following such notification constitutes acceptance of the updated Privacy Policy.

1.5This Privacy Policy should be read in conjunction with our Terms of Business for Clinics and our Terms of Business for Doctors, as applicable.

2. Who We Are

2.1Heart Bridge Health is operated by:

• Entity: GP Culture & Care Pty Ltd
• Trading as: Heart Bridge Health
• Email: team@heartbridgehealth.com.au

2.2For all privacy-related enquiries, requests, or complaints, please contact us at team@heartbridgehealth.com.au.

3. Information We Collect

Information Provided by Doctors

3.1When a Doctor registers on the Platform, we collect:

1. full legal name;
2. email address;
3. phone number;
4. AHPRA registration number and registration status;
5. medical qualifications and fellowship details (e.g. FRACGP, FACRRM);
6. professional indemnity insurance details;
7. visa status and type (where applicable);
8. Medicare provider number eligibility;
9. any other information the Doctor voluntarily provides in their profile or communications on the Platform;
10. information relevant to eligibility for, or participation in, government workforce programs, incentives or grants (including rural or regional placement programs); and
11. placement preferences, availability, and location information, including willingness to work in rural or regional areas.

Information Provided by Clinics

3.2When a Clinic registers on the Platform, we collect:

1. practice or business name;
2. ABN;
3. practice address and location details;
4. contact person name, email address, and phone number;
5. insurance details;
6. payment and billing information (processed through Stripe); and
7. any other information the Clinic voluntarily provides in vacancy listings, profiles, or communications on the Platform.

Information Collected Automatically

3.3When you use the Platform, we may automatically collect:

1. device information, including device type, operating system, and unique device identifiers;
2. usage data, including pages visited, features used, actions taken, and time spent on the Platform;
3. IP address and approximate geographic location;
4. browser type and version (for website access);
5. app version and crash reports; and
6. cookie and tracking data as described in clause 10.

Information from Third Parties

3.4We may receive information about you from third parties, including:

1. AHPRA and other relevant registration bodies, for the purposes of verifying Doctor registration status and credentials;
2. Stripe, in connection with payment processing; and
3. other users of the Platform, including ratings, reviews, and feedback.

Purpose of Collection

3.5We collect this information to operate the Platform, facilitate placements between Doctors and Clinics, verify credentials, and comply with legal, regulatory, and government program requirements, including reporting obligations relating to workforce distribution and placement activity.

4. How We Use Your Information

4.1We use the personal information we collect for the following purposes:

Platform Operations

1. to create and manage your account on the Platform;
2. to verify Doctor eligibility, qualifications, AHPRA registration, and insurance;
3. to facilitate the matching of Doctors with Clinics for Shift bookings;
4. to process payments, Escrow transactions, and refunds through Stripe;
5. to administer the ratings and review system;
6. to facilitate communication between users and with our administration team;
7. to provide customer support and respond to enquiries; and
8. to enforce our Terms of Business, including investigating potential breaches.

Platform Improvement and Analytics

9. to analyse usage patterns and improve the Platform’s functionality, features, and user experience;
10. to generate de-identified and aggregated data for trend analysis and reporting (see clause 7); and
11. to monitor the performance, security, and stability of the Platform.

Government Programs and Workforce Reporting

12. to assess eligibility for, administer, and support participation in government-funded programs, incentives, or grants (including rural and regional workforce initiatives);
13. to report on Doctor placements, including location, duration, and engagement details, to relevant government departments, agencies, or authorised bodies;
14. to support healthcare workforce planning, distribution analysis, and policy development, including in rural and regional areas; and
15. to provide de-identified or aggregated placement data to government bodies and other stakeholders for statistical and reporting purposes.

Communications and Marketing

16. to send you service-related communications, including booking confirmations, reminders, payment notifications, and Platform updates;
17. to send you marketing communications, including newsletters, promotional offers, and information about new features (see clause 8); and
18. to send you push notifications related to bookings, messages, and other Platform activity (see clause 8).

Legal and Regulatory

19. to comply with applicable laws, regulations, and legal processes;
20. to protect our rights, property, and safety, and the rights, property, and safety of our users and the public;
21. to disclose information to government authorities, regulators, or authorised bodies where required or permitted by law, or where necessary to comply with funding conditions, program requirements, or workforce reporting obligations; and
22. to respond to lawful requests from government authorities and law enforcement agencies.

We only use personal information for purposes that are reasonably necessary for our functions and activities, including facilitating placements and complying with applicable legal and government program requirements.

5. Disclosure of Your Information

5.1We may disclose your personal information to the following categories of recipients. These disclosures may occur on a periodic or ongoing basis as part of our participation in healthcare workforce programs:

Other Platform Users

5.2Your information is disclosed to other users of the Platform in accordance with our privacy-first framework:

1. Clinic information (suburb, ratings, payment terms, travel and accommodation options, and description) is visible to Doctors browsing the Platform. The Clinic’s name and identifying details are disclosed to a Doctor only after a Shift booking has been confirmed.
2. Doctor information (ratings and general profile details) is visible to Clinics. The Doctor’s name and identifying details are disclosed to a Clinic only after the Clinic has accepted the Doctor’s application for a Shift.
3. Ratings and reviews provided by either party are published on the Platform and are visible to other users.

Third-Party Service Providers

5.3We share personal information with the following third-party service providers who assist us in operating the Platform:

1. Stripe, Inc. and its affiliates, for payment processing, Escrow management, and related financial services. Stripe’s handling of your information is governed by Stripe’s own privacy policy;
2. push notification service providers, for delivering notifications to your mobile device; and
3. analytics providers, for understanding how the Platform is used and improving our services.

5.4We require all third-party service providers to handle personal information in accordance with applicable privacy laws and only for the purposes for which it was disclosed.

Government and Regulatory Bodies

5.5We may disclose personal information to Commonwealth, State, or Territory government departments, agencies, or authorised bodies:

1. where required or authorised by law, regulation, or legal process;
2. in response to a lawful request from a government authority or law enforcement agency;
3. where necessary to comply with funding conditions, contractual obligations, or participation in government programs, including rural and regional workforce initiatives;
4. to report on Doctor placements, including location, duration, and engagement details, for workforce planning, distribution analysis, and program administration; or
5. where we reasonably believe disclosure is necessary to prevent serious harm to a person or to public safety.

Data Minimisation

5.6We limit disclosures to government bodies to the information reasonably necessary for the relevant purpose and, where practicable, provide information in de-identified or aggregated form.

No Sale of Personal Information

5.7We do not sell, rent, or trade your personal information to third parties for their own marketing or commercial purposes. We do not share your personal information with advertisers or data brokers.

6. Data Storage and Security

6.1All personal information collected through the Platform is stored on servers located in Australia.

6.2We take reasonable steps to protect your personal information from misuse, interference, loss, unauthorised access, modification, and disclosure. Our security measures include:

1. encryption of data in transit and at rest;
2. access controls limiting who within our organisation can access personal information;
3. regular security reviews and updates; and
4. use of reputable and secure third-party service providers.

6.3While we take reasonable precautions, no method of electronic storage or transmission is completely secure. We cannot guarantee the absolute security of your personal information.

6.4If we become aware of a data breach that is likely to result in serious harm to any individual, we will notify the affected individuals and the Office of the Australian Information Commissioner (“OAIC”) in accordance with the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth).

6.5We take reasonable steps to ensure that any personal information disclosed to third parties, including government bodies and service providers, is transmitted securely and handled in accordance with applicable privacy laws and contractual confidentiality obligations.

6.6We retain personal information only for as long as it is reasonably necessary to fulfil the purposes for which it was collected, including facilitating placements and complying with legal and government reporting obligations. When personal information is no longer required, we take reasonable steps to securely destroy or de-identify it.

7. De-Identified Data and Trend Analysis

7.1We use de-identified and aggregated data derived from Platform activity to:

1. identify trends and patterns in the locum and general practice workforce market;
2. provide Clinics with insights and recommendations on how to improve their offerings and better attract Doctors;
3. generate reports on workforce supply and demand, remuneration trends, and regional distribution;
4. contribute to policy discussions and workforce planning; and
5. support analysis of rural and regional workforce distribution and access to healthcare services.

7.2De-identified data means information that has been processed so that it no longer relates to an identifiable individual, and cannot reasonably be re-identified, having regard to the available data, technology, and other relevant factors.

7.3We may share de-identified and aggregated data with:

1. Clinics registered on the Platform, for the purpose of improving their practices and attracting Doctors;
2. Australian federal, state, and territory government bodies, including but not limited to the Department of Health and Aged Care, for workforce planning and policy purposes; and
3. industry bodies and research organisations, for the purpose of improving the healthcare workforce.

7.4No individual Doctor, Clinic, or user will be identifiable in any de-identified data shared under this clause.

7.5We take reasonable steps to ensure that de-identified data is not re-identified and is only shared in a manner that minimises the risk of re-identification.

8. Marketing and Communications

Service Communications

8.1We will send you service-related communications that are necessary for the operation of the Platform, including booking confirmations, payment notifications, security alerts, and important Platform updates. These communications are necessary for the operation of the Platform and are not marketing. If you do not wish to receive them, you may close your account.

Marketing Communications

8.2We may send you marketing communications, including newsletters, promotional offers, and feature announcements, where you have consented to receive such communications or where otherwise permitted by applicable law. Where you create an account or engage with the Platform, we may send you marketing communications related to our services where permitted by law, and you will always have the option to opt out. All marketing communications will clearly identify us as the sender and include our contact details.

8.3You can opt out of marketing communications at any time by:

1. using the unsubscribe link in any marketing email;
2. adjusting your communication preferences in your account settings on the Platform; or
3. contacting us at team@heartbridgehealth.com.au.

8.4If you opt out of marketing communications, we will action your request promptly and in any event within 5 Business Days. Opting out of marketing communications does not affect service-related communications.

Push Notifications

8.5If you have enabled push notifications on your device, we may send you notifications related to:

1. new Shift opportunities matching your preferences;
2. booking confirmations, updates, and reminders;
3. messages from Clinics or the administration team;
4. ratings and review activity; and
5. promotional or marketing information, where permitted by applicable law.

8.6You can disable push notifications at any time through your device settings or your account settings on the Platform.

9. Data Retention

9.1We retain your personal information for as long as your account is active on the Platform, and for a period of 7 years following account deactivation or termination, unless a longer retention period is required or permitted by law.

9.2The 7-year retention period is maintained to:

1. comply with applicable legal, taxation, financial reporting, and regulatory obligations;
2. comply with obligations relating to government programs, grants, and workforce reporting requirements (including rural and regional initiatives);
3. resolve any disputes that may arise after account closure;
4. enforce our Terms of Business; and
5. maintain the integrity of ratings, reviews, and transaction records on the Platform.

9.3After the retention period has expired we will take reasonable steps to securely delete or permanently de-identify your personal information, unless we are required by law to retain it for a longer period.

9.4De-identified and aggregated data derived from your use of the Platform may be retained indefinitely for the purposes described in clause 7.

10. Cookies and Tracking Technologies

10.1We use cookies and similar tracking technologies on the Platform to enhance your experience and to collect information about how the Platform is used. Non-essential cookies (including analytics and marketing cookies) are only used with your consent, which you can manage at any time.

Types of Cookies We Use

10.2We use the following categories of cookies:

1. Essential cookies: These are necessary for the Platform to function correctly, including session management, authentication, and security. While they can be disabled through your browser settings, doing so may affect the functionality of the Platform.
2. Analytics cookies: These help us understand how users interact with the Platform, including which pages are visited, how long users spend on the Platform, and which features are most popular. We use this information to improve the Platform.
3. Marketing cookies: These are used to deliver relevant advertising and promotional content to you, and to measure the effectiveness of our marketing campaigns. These cookies may be set by us or by third-party advertising or analytics providers and may track your activity across different websites and services.

Information collected through cookies may constitute personal information and will be handled in accordance with this Privacy Policy, including the sections relating to use and disclosure of personal information.

Managing Cookies

10.3You can manage your cookie preferences as follows:

1. through the cookie consent banner displayed when you first access the Platform;
2. through your browser settings, where you can block or delete cookies; and
3. by contacting us at team@heartbridgehealth.com.au.

10.4Please note that disabling certain cookies may affect the functionality of the Platform.

11. Your Rights

11.1Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, you have the following rights in relation to your personal information:

Right of Access

11.2You have the right to request access to the personal information we hold about you. We will respond to your request within a reasonable period (usually within 30 days). In some circumstances permitted by law, we may refuse to provide access, in which case we will provide written reasons. We do not charge a fee for making a request, but may charge a reasonable administrative fee for providing access in certain circumstances.

Right of Correction

11.3You have the right to request that we correct any personal information we hold about you that is inaccurate, incomplete, out of date, or misleading. We will respond to your request within a reasonable period (usually within 30 days). If we refuse to correct your information, we will provide written reasons and, where required by law, take reasonable steps to associate a statement with the information.

Account Deletion

11.4You may request that we delete your account and personal information by contacting us at team@heartbridgehealth.com.au. We will take reasonable steps to comply with your request, subject to our legal obligations, including retention requirements and obligations relating to government programs and workforce reporting. Please note that:

1. we may retain certain information for the period specified in clause 9 to comply with our legal obligations;
2. de-identified and aggregated data derived from your information may be retained as described in clause 7;
3. ratings and reviews you have provided may remain on the Platform in an anonymised form; and
4. we may also retain information where necessary to resolve disputes or enforce our agreements.

Privacy Complaints

11.5If you believe we have breached applicable privacy laws, you may contact us using the details above. We will investigate your complaint and respond within a reasonable period. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC).

How to Exercise Your Rights

11.6To exercise any of your rights under this clause, please contact us at team@heartbridgehealth.com.au. We may require you to verify your identity before processing your request.

12. Age Restriction

12.1The Platform is not directed to individuals under the age of 18 and is intended for use by persons aged 18 years and over only. We do not knowingly collect personal information from individuals under the age of 18.

12.2If we become aware that we have collected personal information from a person under the age of 18, we will take steps to delete that information promptly. If you believe that we may have collected such information, please contact us using the details below.

13. Overseas Disclosure of Personal Information

13.1All primary data storage is on servers located in Australia.

13.2Some of our third-party service providers may store or process data in countries outside Australia. In particular:

1. Stripe, Inc. is headquartered in the United States and may process payment-related data in the United States or other jurisdictions in which it operates;
2. push notification services may process data in jurisdictions outside Australia; and
3. other service providers who assist us in operating the Platform may process data outside Australia.

13.3Where personal information is disclosed to an overseas recipient, we take reasonable steps to ensure that the recipient handles the information in accordance with applicable privacy laws and implements appropriate safeguards to protect the information.

13.4By using the Platform, you acknowledge that your personal information may be disclosed to overseas recipients as described in this clause.

14. Complaints

14.1If you believe that we have breached applicable privacy laws or otherwise mishandled your personal information, you may lodge a complaint with us by contacting team@heartbridgehealth.com.au.

14.2We will acknowledge receipt of your complaint within 5 Business Days and will investigate and respond to your complaint within a reasonable period (usually within 30 days). We may request additional information from you to assist in investigating your complaint.

14.3If you are not satisfied with our response, you may lodge a complaint to the Office of the Australian Information Commissioner (OAIC):

• Website: www.oaic.gov.au
• Phone: 1300 363 992
• Email: enquiries@oaic.gov.au
• Post: GPO Box 5218, Sydney NSW 2001

15. Contact Us

15.1For any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal information, please contact us:

• Entity: GP Culture & Care Pty Ltd trading as Heart Bridge Health
• Email: team@heartbridgehealth.com.au