CogniFlow HealthHow we handle your information
CogniFlow Health provides data analysis to allied health and medical practices. Health service providers are covered by the Privacy Act 1988 (Cth) regardless of size, and we handle all information in line with the Australian Privacy Principles (APPs).
1. Who we are
CogniFlow Health is a practice analytics business based in South East Queensland, Australia. In this policy, "we", "us" and "our" mean CogniFlow Health.
2. Information we collect
From people who contact us. When you use our website enquiry form, email us or speak with us, we collect your name, clinic name, work email, phone number (if you give it), the practice software you use and anything you choose to tell us about your clinic.
From clinics we work with. To complete an audit, a clinic provides an export of appointment data. We ask only for:
- client identification numbers generated by the clinic's own software
- postcode
- appointment dates, times, types, discipline and status (for example attended, did not attend, cancelled)
- the date each appointment was booked
- funding source and fee
We do not ask for, and ask clinics not to send, names, dates of birth, street addresses, phone numbers, email addresses, Medicare or health fund numbers, clinical notes or diagnoses. If we receive information we did not ask for, we delete it as soon as practicable.
Although this data does not include names, appointment history is still treated as health information. We handle it with the higher level of care the APPs require for sensitive information.
3. Why we collect it and how we use it
- to respond to enquiries and arrange calls
- to carry out the audit a clinic has engaged us for, including building prediction models from that clinic's own data
- to prepare and deliver reports, recall lists and recommendations to that clinic
- to issue invoices and keep business records required by law
We do not use a clinic's data for any other purpose, combine it with other clinics' data in a way that could identify a clinic or its clients, sell it, or use it for marketing.
4. Our role when working with clinics
The clinic remains responsible for the information it holds about its clients. We act as a service provider to the clinic under a written data handling agreement that sets out what we receive, how it is protected and when it is deleted. Our recall lists refer to client identification numbers only, so the clinic's own staff match them to clients inside the clinic's software.
5. Storage and security
- Clinic data is transferred through a secure, encrypted upload method and stored encrypted.
- Analysis is carried out in an offline environment. We never connect to or log in to a clinic's practice software.
- Access is limited to the CogniFlow Health analyst working on the audit.
- Clinic appointment data is securely deleted within 30 days of delivering the final report, unless the clinic asks us in writing to keep it longer for a follow-up audit.
- Enquiry details are kept for as long as needed to respond and for our business records, and for no longer than two years after our last contact unless you become a client.
6. Who we share information with
We do not sell or rent personal information. We use a small number of service providers to run our business, such as website hosting, the service that delivers our website enquiry form to our inbox, and email. These providers may store information on servers outside Australia. Where that happens, we take reasonable steps to make sure they protect it in a way consistent with the APPs. Clinic appointment data is never sent to these providers.
We may disclose information where required or authorised by law.
7. Our website
Our website does not use advertising or tracking cookies. Our hosting provider may record basic technical information, such as IP addresses, to keep the site secure and working. Please don't include client names or health details in the enquiry form.
8. Accessing or correcting your information
You can ask to see or correct the personal information we hold about you by contacting us. We will respond within 30 days. Clients of a clinic should contact that clinic directly, because we do not hold information that identifies them.
9. Complaints
If you are concerned about how we have handled your information, please contact us first and we will respond within 30 days. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.
10. Contact us
Use the enquiry form on our website and mark your message "Privacy". We may update this policy from time to time, and the latest version will always be on this page.