PRIVACY POLICY

Respiratory & Sleep Service including SleepOnTheGo

August 2026

1. About this policy

Respiratory & Sleep Service is operated by Eastern Respiratory Service Pty Ltd, ABN 27 105 357 828.

This Privacy Policy also applies to the SleepOnTheGo service and brand, including our clinics, mobile testing services, home sleep testing services, online store, websites and related services.

In this policy, references to RSS, Respiratory & Sleep Service, SleepOnTheGo, we, us and our mean Eastern Respiratory Service Pty Ltd and the services it operates.

We recognise that health information is highly personal and sensitive. We are committed to handling personal and health information carefully, transparently and in accordance with applicable privacy laws.

These laws include the Privacy Act 1988, the Australian Privacy Principles and, where applicable, state and territory health privacy laws, including the Health Records Act 2001 in Victoria.

This policy applies to patients, customers, carers, parents, guardians, authorised representatives, healthcare professionals, referring practitioners, website visitors, suppliers, contractors and job applicants.

2. Privacy at a glance

We collect personal and health information that is reasonably necessary to provide respiratory, sleep, diagnostic, clinical, retail and support services.

We use and disclose information primarily to provide care, undertake testing, prepare reports, communicate with healthcare professionals, process orders, manage payments and operate our services.

We do not sell or rent personal or health information.

You can ask to access or correct information we hold about you and can make a complaint if you are concerned about how your information has been handled.

3. What personal information we collect

The information we collect depends on your relationship with us and the service you receive.

Identification and contact information

This can include:

·   your name

·   date of birth

·   residential, postal and delivery addresses

·   telephone number and email address

·   sex or gender where relevant to your care or testing

·   emergency contact information

·   details of a parent, guardian, carer or authorised representative

·   information used to confirm your identity.

Health and clinical information

This can include:

·   your symptoms, medical history and relevant family history

·   current and previous medical conditions

·   medications and treatment information

·   respiratory, sleep and general health information

·   referrals, clinical notes and correspondence

·   sleep questionnaires and respiratory questionnaires

·   physiological recordings and device data

·   lung function, sleep study and other diagnostic results

·   diagnostic images, graphs, measurements and reports

·   information about CPAP therapy, treatment response, compliance and equipment use

·   information received from your referring practitioner, treating practitioner or another healthcare provider

·   information about allergies, disabilities, communication needs or other matters relevant to providing safe and appropriate services.

Health information is sensitive information. We collect it only where it is reasonably necessary for our services and where the collection is permitted or required by law. Where consent is required, we will seek it separately and in clear terms.

Funding, billing and payment information

This can include:

·   Medicare details

·   Department of Veterans’ Affairs details

·   private health insurance information

·   workers compensation, employer or insurer information where relevant

·   billing and account information

·   payment and transaction information

·   information required to process a refund, return or reimbursement.

Payment information can be handled by us or by a payment service provider, depending on the payment method used.

SleepOnTheGo order and service information

This can include:

·   products or services ordered

·   hire or rental information

·   delivery and return addresses

·   delivery tracking information

·   device identification and serial numbers

·   product support and warranty information

·   customer service communications

·   information about returned or damaged equipment

·   information required to arrange a home sleep test or provide a sleep monitoring service.

Communications

We can collect information contained in:

·   emails, letters and text messages

·   website enquiries

·   telephone conversations

·   appointment requests

·   complaints, feedback and reviews

·   communications with healthcare professionals, carers and authorised representatives.

Website and technical information

When you use our websites, we can collect:

·   your Internet Protocol address

·   browser and device information

·   pages viewed and features used

·   the date and time of your visit

·   the website or service that referred you to us

·   cookie and website analytics information

·   shopping cart, checkout and transaction activity.

Business, supplier and employment information

We can also collect professional contact information, supplier information, employment history, qualifications, references and other information relating to contractors, suppliers and job applicants.

4. How we collect personal information

We usually collect personal information directly from you when you:

·   book or attend an appointment

·   complete a referral form, questionnaire or consent form

·   undergo a respiratory or sleep test

·   use a monitoring device or diagnostic platform

·   purchase or hire a product through SleepOnTheGo

·   contact us by telephone, email, website form or in person

·   create an account or use an online service

·   make a payment

·   request support, provide feedback or make a complaint

·   apply for employment or contract work.

We can also collect information from:

·   your referring doctor, specialist or other healthcare provider

·   a hospital, clinic, laboratory, pharmacy or allied health provider

·   a parent, guardian, carer or authorised representative

·   Medicare, the Department of Veterans’ Affairs, an insurer or another funding body

·   an employer or workplace health provider where you have authorised workplace testing or where collection is otherwise permitted by law

·   our related companies and service providers

·   publicly available sources, generally in connection with business contacts or recruitment.

Where reasonable and practicable, we collect personal information directly from you. When information is collected from another person or organisation, we take reasonable steps to make you aware of the collection and its purpose.

If we receive personal information that we did not request, we will determine whether we are permitted to retain it. Information that we are not permitted or required to retain will be securely destroyed or made anonymous where lawful and practicable.

5. Why we collect, hold, use and disclose information

We collect, hold, use and disclose information to:

·   identify you and maintain an accurate patient or customer record

·   assess whether a service is suitable for you

·   provide respiratory, sleep, diagnostic and related healthcare services

·   arrange appointments, testing and consultations

·   conduct and analyse respiratory and sleep tests

·   operate diagnostic and monitoring equipment

·   prepare, review and deliver clinical reports

·   communicate results to you and your referring or treating healthcare professionals

·   provide CPAP therapy services, equipment support and treatment monitoring

·   process SleepOnTheGo purchases, rentals, deliveries, returns and support requests

·   process payments, Medicare claims, insurance claims and other funding arrangements

·   communicate with parents, guardians, carers and authorised representatives

·   respond to enquiries, requests, complaints and feedback

·   maintain clinical, financial and administrative records

·   manage product safety, complaints, adverse events and regulatory reporting

·   undertake quality assurance, clinical review, auditing, accreditation and staff training

·   prevent or investigate fraud, misuse, security incidents or unlawful activity

·   improve our services, systems and websites

·   manage relationships with suppliers, contractors and healthcare professionals

·   assess job and contractor applications

·   comply with legal, professional, regulatory, insurance and reporting obligations

·   protect the life, health, safety, rights or property of a person where permitted by law.

We can also use information that has been made anonymous for service planning, statistics, quality improvement and business analysis.

We will not use health information for an unrelated purpose unless you have consented or the use is otherwise permitted or required by law.

6. What happens if you do not provide information

You do not have to provide personal information unless it is required by law.

However, if you do not provide information that is reasonably necessary, we might not be able to:

·   safely provide a clinical or diagnostic service

·   complete or interpret a test

·   prepare or deliver a report

·   communicate with your referring practitioner

·   process a Medicare, insurance or funding claim

·   process or deliver a SleepOnTheGo order

·   provide product support

·   respond properly to your enquiry or complaint.

7. Who we disclose information to

We disclose personal information only where reasonably necessary for our services, where you would reasonably expect the disclosure, where you have consented, or where disclosure is permitted or required by law.

Recipients can include:

Healthcare and clinical recipients

·   referring and treating doctors

·   respiratory and sleep physicians

·   respiratory scientists, sleep scientists and technicians

·   nurses, pharmacists and allied health professionals

·   clinical reporting and diagnostic service providers

·   hospitals, clinics and laboratories

·   another healthcare provider nominated by you.

Government, funding and workplace recipients

·   Medicare

·   the Department of Veterans’ Affairs

·   private health insurers

·   workers compensation authorities and insurers

·   employers or workplace health providers where you have authorised the disclosure or it is otherwise permitted by law

·   public health, regulatory and professional bodies.

Operational service providers

·   diagnostic platform and medical software providers

·   information technology, cloud storage and data hosting providers

·   website, ecommerce and communication providers

·   payment processors and financial institutions

·   couriers, delivery companies and logistics providers

·   document storage, scanning and secure destruction providers

·   equipment manufacturers and technical support providers

·   accountants, auditors, insurers, lawyers and other professional advisers

·   debt recovery providers where reasonably necessary and lawful.

We require service providers to handle personal information only for the work they perform for us and to apply appropriate privacy and security protections.

We can also disclose information to a related company where reasonably necessary to operate our services, manage shared systems or provide support, subject to applicable privacy laws.

We do not sell or rent personal or health information to marketing companies or data brokers.

8. Overseas access and disclosure

Some of our technology, cloud, diagnostic analysis and clinical support providers can store or access information outside Australia.

Countries in which recipients are currently likely to be located include:

·   the United States of America

·   New Zealand.

Information can be disclosed or made accessible overseas when, for example, we use an international diagnostic platform, cloud service, software provider or suitably qualified clinical support provider.

Before disclosing personal information overseas, we take reasonable steps required by Australian privacy law to ensure that the recipient handles the information appropriately. Overseas recipients can also be subject to the laws of the country in which they operate.

Where another overseas country becomes relevant to a particular service, we will provide further information at the time of collection where reasonable and practicable, or update this policy.

9. Computer assisted analysis and clinical software

Some respiratory and sleep devices and software systems use computer assisted analysis.

These systems can use:

·   identifying and demographic information

·   symptoms and clinical history

·   physiological signals and recordings

·   respiratory and sleep measurements

·   device information

·   questionnaire responses

·   previous test results.

The software can calculate measurements, identify or flag possible respiratory or sleep events, generate scores, organise test data and assist in preparing a report.

These outputs support clinical interpretation and report preparation. They do not replace professional clinical judgement. Where a diagnosis, treatment recommendation or other significant clinical decision is provided, results are reviewed or interpreted by a suitably qualified healthcare professional as appropriate to the service.

We do not rely solely on a computer generated result to make a final diagnosis or treatment recommendation.

10. Website information, cookies and analytics

Our websites use cookies and similar technologies.

A cookie is a small data file stored on your device. Cookies can be used to:

·   operate website functions

·   maintain shopping cart or session information

·   remember preferences

·   support website security

·   process online transactions

·   understand how visitors use our websites

·   identify technical problems

·   improve website content and performance.

We can use website analytics services to collect information about website activity. This information is generally used in aggregated form.

We do not intentionally provide clinical form content, health test results or medical reports to advertising services.

Most browsers automatically accept cookies. You can change your browser settings to reject or delete cookies. Some website features might not operate properly if cookies are disabled.

Our servers and service providers can also record Internet Protocol addresses for security, system administration, fraud prevention and website analysis.

11. How we hold and protect information

We can hold personal information in:

·   electronic patient and practice management systems

·   diagnostic and medical software platforms

·   secure cloud systems

·   accounting, ordering and customer management systems

·   email and communication systems

·   paper records and secure physical storage.

We take reasonable technical, organisational and physical steps to protect information from misuse, interference, loss, unauthorised access, unauthorised modification and unauthorised disclosure.

Depending on the information and system involved, these measures can include:

·   access controls and authentication

·   limiting access according to work responsibilities

·   secure transmission and storage controls

·   system monitoring, backups and recovery processes

·   physical security

·   staff confidentiality obligations

·   privacy and security training

·   review of service providers

·   secure destruction processes.

No internet, email, storage or transmission system can be guaranteed to be completely secure. We regularly review our safeguards and respond to identified privacy and security risks.

If a data breach is likely to cause serious harm and is an eligible data breach under Australian law, we will notify affected individuals and the Office of the Australian Information Commissioner as required.

12. How long we retain information

We retain health information for the period required by applicable laws, professional obligations and legitimate clinical needs.

In Victoria, private health service providers are generally required to retain an adult patient’s health information for at least seven years after the last occasion on which a health service was provided.

Where health information was collected while a patient was under 18 years of age, it is generally retained until the patient turns 25.

Different or longer periods can apply under another state or territory law, a funding arrangement, a legal claim, a complaint, an investigation or another legal requirement.

Financial, transaction, employment and business records are retained for the periods required by applicable law and our legitimate business needs.

When information is no longer required, we take reasonable steps to securely destroy it or make it anonymous, unless its continued retention is required or permitted by law.

13. Accessing your information

You can ask for access to personal and health information that we hold about you.

Your request should identify:

·   your full name and date of birth

·   the information you are requesting

·   your preferred form of access

·   your contact details.

We can ask you to verify your identity before providing access.

An authorised representative can request access on your behalf, but we will require evidence of their identity and authority.

We aim to respond within 30 days. Some health record access requests can take longer where permitted by law. In Victoria, the maximum period for certain private health record access requests is generally 45 days.

Access can be provided by allowing you to inspect the information, providing a copy, giving you a summary, explaining the information or transferring it to another healthcare provider.

We can charge a reasonable fee where permitted by law. Any fee will reflect the cost of locating, reviewing, copying and providing the information and will not exceed applicable legal limits.

In limited circumstances, we can refuse access. Where we refuse access, we will provide written reasons where required and explain how you can make a complaint.

14. Correcting your information

We take reasonable steps to ensure that personal information is accurate, complete, relevant and up to date.

You can ask us to correct information that you believe is inaccurate, incomplete, misleading or out of date.

Clinical records will generally be corrected by adding an amendment or explanatory note rather than deleting the original clinical entry. This protects the integrity and history of the health record.

If we do not agree to make a requested correction, you can ask us to attach a statement to the record explaining the correction you requested.

15. Anonymous and pseudonymous dealings

You can browse our websites without identifying yourself.

You can also make some general enquiries anonymously or using a different name.

We will generally need your correct identity when providing clinical services, conducting diagnostic testing, preparing medical reports, processing Medicare or insurance claims, delivering products, managing equipment rentals or meeting legal and patient safety obligations.

16. Children, capacity and authorised representatives

We provide some services to children and people who require assistance to make or communicate decisions.

Depending on the person’s age, maturity, capacity and circumstances, information can be collected from or disclosed to:

·   the person receiving the service

·   a parent or legal guardian

·   a medical treatment decision maker

·   a carer

·   another person with lawful authority.

We will take reasonable steps to confirm a representative’s authority and will respect the privacy rights and capacity of the person receiving the service.

17. Direct marketing

We can send information about our services or products where you have consented or where direct marketing is otherwise permitted by law.

We do not use sensitive health information for direct marketing without express consent.

Every electronic marketing message will provide a way to unsubscribe. You can also ask us at any time to stop sending marketing communications.

Appointment reminders, test instructions, safety notices, account communications, order updates and other service messages are not marketing communications.

18. Privacy complaints

You can make a privacy complaint if you believe that we have mishandled your personal or health information.

Please send your complaint to our Privacy Officer and include:

·   your name and contact details

·   a description of your concern

·   any relevant dates, people or documents

·   the outcome you are seeking.

We will acknowledge your complaint promptly, investigate it fairly and aim to provide a response within 30 days.

Making a privacy complaint will not adversely affect the care or services you receive from us.

If you are not satisfied with our response, you can contact:

·   the Office of the Australian Information Commissioner

·   the Victorian Health Complaints Commissioner for Victorian health information matters

·   the relevant health or privacy regulator in another state or territory.

19. Other websites and services

Our websites can contain links to websites or services operated by other organisations.

We are not responsible for the privacy practices or content of those organisations. You should review their privacy policies before providing personal information to them.

20. Changes to this policy

We can update this Privacy Policy when our services, systems, providers or legal obligations change.

The current version will be published on the Respiratory & Sleep Service and SleepOnTheGo websites and will show the date of the latest update.

Where a change materially affects how we handle personal or health information, we will take reasonable steps to provide additional notice.

21. Contact us

Questions, access requests, correction requests and privacy complaints can be directed to:

A copy of this Privacy Policy can also be provided in another reasonable format on request.