Privacy Policy

Current as of: 18 July 2026

This policy explains how Tony Gianduzzo Medical Pty Ltd (“the practice”, “we”, “us”) collects, uses, stores and discloses your personal information, in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). It also explains how you can access or correct your information, and how to make a complaint.

This policy applies to the urology services provided by Dr Tony Gianduzzo, including consultations, diagnostic procedures and day-case surgery performed under general anaesthetic in a private hospital setting.

1. Who can I contact about this policy?

For any questions about this policy, or to access, correct, or raise a concern about your personal information, contact:

  • Practice Manager
  • 2/12 Elsa Wilson Drive, Buderim QLD 4556
  • 07 5444 0672
  • admin@buderimprostateclinic.com.au

2. When and why is your consent necessary?

When you are referred to, or register with, the practice, you provide consent for Dr Gianduzzo and his staff to collect, access and use your personal and health information to provide urological care to you, including diagnosis, treatment planning, day-case surgical procedures, and related administrative and billing functions. Access to your information is limited to those involved in your care or the practice's administrative functions.

We will seek your specific, express consent before using your information for any purpose not directly related to your healthcare — for example, research, or if identifiable information is proposed to be shared with a third party outside the ordinary course of your care.

3. Why do we collect, use, store and share your personal information?

We collect, use, store and share your personal information to:

  • provide safe and effective urological care, including consultation, investigation, diagnosis, day-case surgery and post-operative follow-up
  • communicate with your GP, referring specialist, and other treating practitioners involved in your care
  • arrange and coordinate hospital admission, anaesthetic and theatre bookings for procedures such as transperineal prostate biopsy
  • manage billing and claiming, including Medicare, ECLIPSE, and private health fund gap arrangements
  • comply with legal and professional obligations, including mandatory notification requirements
  • undertake internal clinical audit and quality improvement.

4. What personal information do we collect?

The information we collect about you may include:

  • your name, date of birth, address, and contact details
  • Medicare number, health fund details, and other government identifiers
  • your medical history, symptoms, examination findings, and treatment
  • results of investigations, including pathology (e.g. biopsy histopathology), imaging, and PSA or other blood tests
  • clinical notes and correspondence relating to your hospital admission, anaesthetic assessment, and surgical procedure
  • your prescriptions and other pharmaceutical information
  • appointment and billing records, including gap payment arrangements with your health fund
  • records generated through AI-assisted clinical documentation tools used in the practice (see section 7).

We collect government identifiers such as your Medicare number for identification and claiming purposes only. We do not adopt, use or disclose a government identifier (such as your Medicare number) as our own identifier for you within the practice.

5. Can you deal with us anonymously?

The Privacy Act gives you the option of not identifying yourself, or of using a pseudonym, unless it is impracticable for us to do so, or we are required or authorised by law to deal with identified individuals. Given the nature of urological diagnosis and surgical care, and our obligations around Medicare, hospital admission, and medical record-keeping, it is generally impracticable for us to provide care anonymously or under a pseudonym. If you wish to discuss this, please contact us.

6. How is your personal information collected?

We generally collect your personal information directly from you — for example, at your first consultation, or via forms you complete and return by email. We may also collect information from:

  • your referring GP or other treating practitioners
  • the private hospital where your procedure is performed, including admissions and anaesthetic staff
  • pathology and radiology providers
  • Medicare, your private health fund, or the Department of Veterans' Affairs, where relevant
  • our practice management software (Gentu), including any patient intake or consent forms completed online.

7. How is Artificial Intelligence (AI) used in the practice?

The practice uses an AI-assisted clinical documentation (“scribe”) tool, i-scribe, to support the preparation of consultation notes and correspondence. i-scribe records and transcribes the audio of your consultation to help generate a clinical note or letter, which is reviewed and finalised by Dr Gianduzzo before it is placed in your record.

i-scribe is provided by Akuru Pty Ltd, an Australian company holding ISO 27001:2022 certification with regular independent security audits. All platform data, including backups, is stored and maintained exclusively within Australia, and is encrypted both at rest and in transit. Access to patient data within the platform is restricted to authorised users of the practice; no Akuru staff, in Australia or elsewhere, access or handle patient data, and the platform does not permit overseas-based practice staff to be added to our account, consistent with APP 8 cross-border disclosure requirements. Patient audio and transcripts are retained on the platform only for a period we configure (from 1 to 60 days), after which they are deleted. Akuru maintains incident response procedures for security events affecting its platform, including notifying affected customers, affected individuals, and, where required, relevant regulators.

Akuru does not use identifiable patient data to train its AI models, and patient data is not shared with third parties. The system may improve over time based on de-identified, aggregated documentation patterns (such as terminology corrections), but this does not involve patient-identifiable content.

The practice does not currently use any AI tool for clinical decision-making, diagnosis, or triage. No automated decision-making tool is used to make decisions about your care. i-scribe is a clinical documentation support tool only — it does not analyse patient data for clinical decision-making or provide diagnostic or therapeutic recommendations, and is accordingly not regulated by the TGA as a medical device.

Governance of AI use in the practice:

  • AI transcription is used only to assist with documentation; all outputs are reviewed by Dr Gianduzzo before being relied upon or filed.
  • Your information is not used to train or develop AI models.
  • You may opt out of the use of the AI scribe for your consultation at any time — please let us know and your consultation will be documented manually instead.

8. When, why and with whom do we share your personal information?

We communicate with you about appointments and your care using SMS and email reminders, which may include your name and appointment details. Let us know if you would prefer not to receive these.

We may share your personal information with:

  • your GP and other treating practitioners involved in your care (e.g. via referral letters and reports)
  • the private hospital, anaesthetist, and theatre staff involved in your procedure
  • other specialists (e.g. urologists, medical and radiation oncologists, radiologists, and pathologists) as part of a uro-oncology multidisciplinary team (MDT) meeting, where discussion of your case supports decisions on diagnosis, treatment, or follow-up
  • pathology and radiology providers
  • Medicare, and your private health fund, for billing and claiming purposes (including via ECLIPSE)
  • our external accountant, where relevant to the administrative operation of the practice — this does not include access to your clinical record
  • regulatory or government bodies where required or authorised by law (e.g. mandatory notification, court subpoena)
  • any other party, only with your consent, or where necessary to lessen or prevent a serious threat to health or safety.

Only staff and practitioners who need access to your information for your care, or for the administrative operation of the practice, are able to access it. We do not sell or use your information for purposes unrelated to your healthcare without your express consent.

9. Will your information be used for marketing purposes?

The practice does not use your personal information for direct marketing.

10. Use for quality improvement, audit and research

We may use your information for internal clinical audit, quality improvement and accreditation purposes, using de-identified information wherever practicable. If the practice were to contribute de-identified data to a clinical registry or similar quality initiative, you may let us know if you do not want your information included. If the practice were to participate in research requiring identifiable information, we would seek your specific, express consent, and any such research would require appropriate ethics approval.

11. How is your information stored, protected and retained?

Your clinical information is held electronically in our practice management system (Gentu), with access restricted to authorised staff. We take reasonable technical and administrative steps to protect your information from misuse, loss, unauthorised access, modification or disclosure, including secure system access controls and staff confidentiality obligations.

Information that is no longer required, and for which the minimum retention period has passed — generally seven years from your last consultation, or until age 25 if you were under 18 at that time — is destroyed securely.

12. How can you access and correct your personal information?

You have a right to request access to, and correction of, the personal information we hold about you. To make a request, please contact us using the details in section 1, in writing.

We will normally respond within 30 calendar days. A reasonable fee may apply to cover the administrative cost of providing access, but you will not be charged for making the request.

13. How can you make a privacy complaint?

If you have concerns about how your personal information has been handled, please contact us using the details in section 1. We take privacy complaints seriously and will aim to resolve your concern promptly.

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC):

  • Website: www.oaic.gov.au
  • Phone: 1300 363 992
  • Email: enquiries@oaic.gov.au

14. Overseas disclosure

We do not currently disclose your personal information to any recipient located outside Australia. If this changes, we will update this policy to name the likely countries involved, where it is practicable to do so, and will seek your consent before any such disclosure where required.

15. Website and online forms

If you visit our website, we may collect limited information about your use of the site, such as the pages you visit, the date and time of your visit, and technical information such as your browser type and device information. This information helps us operate, maintain and improve the website.

If you choose to complete a contact form, online patient intake form, consent form, or other form made available through our website or practice systems, we will collect the personal information you provide in that form and use it for the purpose for which it was submitted, including contacting you, arranging appointments, managing referrals, obtaining consent, or providing healthcare and related administrative services.

Where online forms are provided through our practice management or consent systems, the information submitted may be collected and stored within those systems and handled in accordance with this Privacy Policy.

Our website or online services may use cookies or similar technologies that are reasonably necessary for the operation of the site. If we introduce analytics, tracking, online booking, or other additional website functions in future, this Privacy Policy will be updated to reflect those changes and how your information is handled.

We do not use information submitted through our website for direct marketing.

16. Policy review

This policy is reviewed at least annually, or sooner if there are changes to how the practice handles personal information, changes in the law, or the adoption of new technologies (e.g. AI tools, online booking or website changes). Significant changes will be made available at the practice and, once available, on our website.