top of page

Privacy Policy

Dr Nicholas Cocco | ABN 43 218 374 376

www.drnicholascocco.com | info@drnicholascocco.com

Last updated: 12 November 2026. Next review due: 30 November 2027

1. Our commitment

We are committed to protecting the privacy of your information and handling it responsibly. We comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), the Health Records and Information Privacy Act 2002 (NSW) and its Health Privacy Principles, and applicable cyber security legislation (together, “privacy legislation”).

This policy explains how we collect, use, store and disclose your personal and health information, how you can access or correct it, and how to make a privacy complaint. It also explains how we use artificial intelligence (AI) tools. We update it when our practices change. The current version is on our website and available on request.

2. Consent

When you first attend the practice, we ask you to provide your contact details and to confirm your consent to our collecting your information. You are consenting to the practitioners and staff gathering, accessing and using your health information to deliver healthcare. Only practitioners and staff who need your information to provide your care will access your information.

We will seek your express consent before using your information for any purpose not directly related to your healthcare.

3. What we may collect

  • Your name, date of birth, address, phone number and email.

  • Medicare, Department of Veterans’ Affairs (DVA) and private health insurance details.

  • Clinical information: medical history, medications, test results, referral letters, and notes of consultations and procedures.

  • Information generated by AI-enabled tools used in clinical or administrative work (see section 9).

  • Billing and payment information.

  • Next of kin or emergency contact details.

  • Contact and provider details of referring doctors and other health professionals.

  • Clinical photographs, including intra-operative photographs. We take these only with your consent, obtained at the time. They may be taken on a personal device and are added to your record.

4. How your information may be collected

We collect information from you directly wherever possible: on forms, by phone, by email, through our website and at your appointment. With appropriate authority, we also receive information from:

  • your GP and other treating practitioners;

  • hospitals, and pathology and imaging providers;

  • your health fund, and government agencies such as Medicare and DVA;

  • My Health Record, to assist your care;

  • a relative or carer, where you cannot provide the information yourself.

5. Anonymity and pseudonymity

You may make a general enquiry without identifying yourself. If you wish to use a pseudonym, please tell us and we will consider your request. We cannot provide medical care, arrange a hospital admission or process rebates anonymously or under a pseudonym, because the law and the nature of healthcare require you to be identifiable.

6. How we use and share your information

We use your information to provide and coordinate your care, for billing and administration, and to meet our legal obligations. We may share it with:

  • your GP and other health professionals involved in your care, including dietitians, psychologists, anaesthetists and surgical assistants;

  • Westmead Private Hospital, Lakeview Private Hospital and Macquarie University Hospital, where you are treated;

  • staff within the consulting rooms and hospitals who help provide your care;

  • pathology and imaging providers;

  • Medicare, DVA, your health fund and workers compensation insurers, for billing and claims;

  • a relative, carer or person responsible for you, where you agree or the law allows;

  • our medical indemnity insurer and legal advisers, where needed;

  • others where the law requires or permits it, for example to prevent a serious threat to health or safety.

How we communicate with you. We may contact you by phone, SMS, email, secure messaging or telehealth. These messages may contain health information. Email and SMS are not fully secure, so documents sent to you will be password-protected.

7. Bariatric Surgery Registry

If you have weight loss surgery, your procedure details are provided to the Australia and Aotearoa New Zealand Bariatric Surgery Registry, a clinical quality registry administered by Monash University. Dr Cocco is the Principal Investigator for the registry at Macquarie University Hospital. The registry operates on an opt-out basis for adults. We will tell you about it at your consultation. You can decline at any time by telling us or contacting the registry. From time to time, you may be contacted by us or the registry to update your health information. You can opt-out at any stage.

8. Research, quality improvement, audit and teaching

We review outcomes to maintain the quality of our care. We may use patient information for internal audits, staff training, clinical review and accreditation, de-identified where practicable.

We will only use identifiable information for research with your express consent, and only where the project has appropriate ethics approval and meets legal and privacy requirements. You will not be contacted directly by researchers unless you have consented.

We may contribute de-identified data to health improvement initiatives or registries. If you do not want your data included, please tell us.

All clinicians and hospitals involved in your care will use information about your treatment episodes in accordance with best practice, clinical governance and legal requirements in accordance with their own privacy policies available from them.

9. Use of artificial intelligence

We may use AI tools to support clinical documentation and administration:

  • Heidi, an AI scribe, to transcribe and summarise some consultations or dictate letters. Data is stored on Australian servers.

  • Claude (Anthropic), to help draft documents. Patient identifiers are not entered into this tool.

Consent: we obtain your express consent before using Heidi in your consultation. You may decline, and your care will not be affected.

  • We use AI tools consistently with the APPs and relevant ethical standards.

  • Your information is not used by the practice to train AI models.

  • A clinician reviews all AI-generated outputs before they form part of your record.

  • No automated decision-making tool is used in this practice.

10. Service providers and staff

We use trusted providers to run the practice: practice management software, Gentu (by Magentus), Heidi, Claude, secure messaging, email, telephone and telehealth services, and our website host. Some practice staff are engaged through third-party staffing agencies. They access your information only to provide your care or run the practice. Providers and staff may access information only to deliver their service.

11. Storage and security

We take reasonable steps to keep your information accurate, complete, up to date and relevant, and to protect it from misuse, interference, loss, and unauthorised access, modification or disclosure. Measures include:

  • electronic records with password protection, role-based access controls and multi-factor authentication;

  • privacy training for staff, delivered through the agencies that engage them;
  • regular software updates; and
  • network access controlled through secure VPN software.

We keep health records for at least seven years after your last visit, or until you turn 25 if you were under 18 when treated, as NSW law requires. We then securely destroy or de-identify them. If a data breach is likely to cause serious harm, we will notify you and the Office of the Australian Information Commissioner (OAIC).

12. Overseas disclosure

Your clinical record is held by Magentus (Gentu) in Australia. Heidi uses Australian storage. Anthropic (Claude) processes data in the United States. Enquiries sent through our website forms are stored by our website provider, Wix, on servers outside Australia, including in the United States and Europe. Google Analytics and Google Ads measurement data are processed by Google, including in the United States. Some other providers, such as email services, may also store data overseas.

13. Our website

Our website uses cookies and analytics tools, including Google Analytics and Google Ads measurement, to understand how the site is used. These record information such as pages visited, device type and approximate location. This data is used in aggregate, is not linked to your health record, and is retained by Google only for the period set in our analytics settings. You can block cookies in your browser settings. Our website links to other sites; we are not responsible for their privacy practices.

14. Marketing

We do not sell your information or use your health information for marketing. We contact you only about your care, appointments and follow-up. If we ever propose to use your information for marketing, we will seek your express consent first and give you an easy way to opt out.

15. Access and correction

You may ask to access or correct your record by writing to our Privacy Officer (details below). We will respond within 30 days. There is no charge for making a request; a reasonable fee may apply for copying. If we cannot give access or make a correction, we will explain why in writing, and you may ask us to attach a statement to your record.

16. Privacy enquiries and complaints

Please raise any concern with us first, in writing. We will acknowledge it within 7 days and respond within 30 days. If you are not satisfied, you may contact:

  • Office of the Australian Information Commissioner: oaic.gov.au, 1300 363 992

  • NSW Information and Privacy Commission: ipc.nsw.gov.au, 1800 472 679

  • NSW Health Care Complaints Commission: hccc.nsw.gov.au, 1800 043 159

17. Contact

Privacy Officer: Practice Manager / Dr Nicholas Cocco

Practice: Dr Nicholas Cocco

Address: Suite 19, Westmead Private Hospital, Cnr Mons & Darcy Rd, Westmead NSW 2145

Phone: (02) 9052 1884

Email: info@drnicholascocco.com

18. Changes to this policy

We review this policy at least annually, and sooner if our operations, the law or our technology change (for example, adopting a new AI tool or online booking). Significant changes will be communicated in the practice, on our website or by email.

bottom of page