Does Prime Medic comply with Australian privacy laws?

Absolutely. We strictly adhere to the Privacy Act 1988 and the Australian Privacy Principles (APPs). All patient data is handled with the highest level of confidentiality and legal compliance.

Where is my health data stored?

Your health information is stored securely on encrypted servers located within Australia. We ensure data sovereignty, meaning your personal medical records never leave Australian jurisdiction.

Is the video consultation recorded?

For quality and legal purposes, consultations may be securely logged, but they are protected by strict doctor-patient confidentiality rules. No unauthorized person, including employers, can access these records.

Do you share my details with third parties?

No. We do not sell or share patient data with marketing agencies or unauthorized third parties. Information is only shared with other healthcare providers if necessary for your treatment (e.g., prescriptions) and only with your consent.

Prime Medic Ensures Compliance and Privacy

Introduction

Trust in the digital healthcare industry is not established through advertising but through strict adherence to laws and ethical standards. When a patient requests a medical certificate online, they are not only sharing their confidential health information with the provider but also expect the certificate to be legally valid.

At Prime Medic, we base our vision on compliance and privacy principles. In addition to being a technology platform, we are a health service provider and comply with the same stringent Australian laws as any other medical centre.

In this booklet, we describe Prime Medic's compliance structure, outlining how we apply AHPRA, OAIC, and TGA guidelines to support privacy, safety, and legal compliance for medical certificates.

This system is behind all our offerings. For instance, if you want to learn how we verify a document's authenticity, visit our page on Digital Signature Verification.

Commitment to Patient Safety and Transparency

We consider patient safety our top priority. It implies that telehealth should be reserved for appropriate cases, such as non-emergency, administrative, or low-risk conditions, and that patients should always have adequate information about the type of service they are receiving.

Ethical Telehealth

We have the Medical Board of Australia's Guidelines for Technology-Based Patient Consultations as our ethical standard. Besides the following requirements:

Clinical Independence: Our doctors can exercise their clinical judgement to deny a certificate if they deem it medically unjustified.
No "Pay for Paper": Patients get charged for the consultation and assessment, not for the medical certification. The subtlety of this is critical for legal compliance.
Transparency: Different treatment some presentations may be suitable for telehealth, while others require in person or emergency care, depending on clinical judgement.

Our clinical governance practices are detailed in our Quality Compliance framework and Legal Compliance overview.

Compliance with AHPRA and OAIC Regulations

Prime Medic is a company that integrates healthcare and data, resulting in several government agencies overseeing our operations.

AHPRA (Practitioner Regulation)

AHPRA governs the registration of doctors in Australia.

Our Standard of Practice for Doctors on Our Platform Ensures They Hold Current, Unrestricted Medical Registration in Australia. To Eliminate the Possibility of Temporary Suspension or Deregistration Affecting Access to Patient Files, Doctors' Registrations Are Checked in Real-Time Against the National Register.

OAIC (Privacy Regulation)

The Privacy Act 1988 is administered by the OAIC (Office of the Australian Information Commissioner).

Our commitment: We handle all user information as "Sensitive Personal Information" according to the Australian Privacy Principles (APPs). Consequently, we may collect, use, and store data only if it is not used for any secondary purpose (e.g., marketing) without the user's informed consent.

You have certain rights under these laws. Discover more through our Data Privacy and Access Rights guide or have a look at our Privacy Policy.

Privacy-First Digital Infrastructure

Policy alone is futile if it lacks technical enforcement. "Security by Design" principles have been utilised in the design of our digital infrastructure.

Data Sovereignty: Patient health records stay in Australian data centres. We do not send sensitive medical data to jurisdictions with lower privacy standards.
Encryption: Data is encrypted not only in transit (using TLS 1.2+ protocols) but also at rest (AES-256 on servers).
Access Control: Clinical records are kept separate. Unless there is a requirement for a medico-legal query, administrative staff cannot view clinical notes, and all accesses are logged.

Our system serves as a safeguard against scams. Check out our Fraud Prevention and Data Protection Measures guide for more information.

Telehealth Verification and Practitioner Oversight

It is equally important to verify the authenticity of the healthcare professional and ensure data security.

Practitioner Verification

Doctors intending to consult through Prime Medic have to be credentialed first, which involves the following:

Identity Check: Matching one's Government-issued ID (Passport/Driver's License) with the right person.
Registration Check: Confirmation of AHPRA number and scope of practice.
Insurance: Submission of a valid medical indemnity insurance certificate.

Audit Trails

There is an everlasting, incorruptible record of every certificate that has been issued. This helps us clearly show who signed the certificate and when it was completed, which provides strong protection against fraud or disputes.

Employers trust the system. Refer to Who Can Validate an Online Medical Certificate to get a perspective of the external side of the process.

Educational and Ethical Responsibility to Patients

Being compliant also means bringing the patient on board with the process. We strongly support the principle of Informed Consent.

Explicit Disclaimers: Patients will receive the necessary information to understand what telehealth can and cannot do before making a booking.
Rights to Access: We give patients complete control over their medical records, including the right to correct inaccuracies and to understand how their data is shared.
Communication of Respect: Staff who are exposed to offensive behaviour will be protected under the zero-tolerance policy, while patients can expect respectful and professional communication.

Want to get a record? Find out more in Record Keeping and Patient Control. For general inquiries, visit our Help Centre.