Privacy Policy

Olaed Pty Ltd trading as Arami Women’s Health

1. Introduction

Olaed Pty Ltd, trading as Arami Women’s Health (we, us, our, the Practice), is committed to protecting the privacy of our patients and website visitors. This Privacy Policy explains how we collect, use, store, disclose and otherwise handle your personal information and sensitive health information.

Our practice is located at 62 Wellington Parade, East Melbourne VIC 3002. We provide general practice medical services to adult patients (18 years and over), including telehealth services across Australia.

This Privacy Policy applies to all personal information collected by Arami Women’s Health, whether collected in person, through our website (www.aramiwomenshealth.com.au), through our technology platforms, or through any other means.

We recommend you read this Privacy Policy carefully. By attending our practice or using our services, you consent to the practices described in this Policy.

2. Our Legal Obligations

We are bound by a number of laws that govern how we handle your personal and health information:

  • Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs), which set out how we must collect, use, disclose, and store personal information;

  • Health Records Act 2001 (Vic) and the Health Privacy Principles (HPPs), which impose specific obligations in relation to health information held by health service providers in Victoria;

  • My Health Record Act 2012 (Cth), which governs how we access and upload information to the national My Health Record system;

  • Healthcare Identifiers Act 2010 (Cth), which regulates how we use Individual Healthcare Identifiers (IHIs) and Healthcare Provider Identifiers;

  • Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988 (Cth), which requires us to notify you and the OAIC if your information is involved in a data breach that is likely to cause serious harm; and

  • Spam Act 2003 (Cth), which applies to commercial electronic messages we send to you.

Where there is any inconsistency between the requirements of these laws, we will comply with the more stringent obligation.

3. What Personal Information We Collect

The types of personal and health information we collect and hold about you include:

3.1 Personal Information

  • Your full name, date of birth, gender identity, and contact details (address, phone number, email address);

  • Emergency contact details;

  • Medicare number and Individual Healthcare Identifier (IHI);

  • Private health insurance details (where applicable);

  • Billing and payment information collected through our payment platforms (primarily Halaxy, Healthengine with Zeller used for existing patients during our current changeover); and

  • Information you provide when completing intake forms, questionnaires, or when contacting us.

3.2 Sensitive Health Information

Health information is a category of sensitive information under the Privacy Act and attracts a higher level of protection. Under Australian Privacy Principle 3.3, we will only collect sensitive health information about you with your express consent, or where collection is required or authorised by law. We collect and hold:

  • Medical history, presenting symptoms, diagnoses, and clinical assessments;

  • Medications, allergies, and treatment plans;

  • Referral letters and specialist correspondence;

  • Pathology and imaging results;

  • Clinical notes generated during or after your consultation, including notes generated with the assistance of AI tools (see Section 7);

  • Telehealth consultation records; and

  • Any other information you provide to us in the course of seeking medical care.

3.3 Information Collected Through Our Technology

  • Information entered when booking appointments or completing online forms;

  • Information collected when you interact with our website, including analytics data (see Section 12); and

  • Information captured through our AI recording and transcription tools during consultations (with your express consent - see Section 7).

3.4 Unsolicited Information

If we receive personal or health information about you that we did not request, we will assess whether that information is information we could have collected under this Policy. If it is, we will handle it in accordance with this Policy. If not, we will destroy or de-identify it as soon as practicable, provided it is lawful and reasonable to do so.

4. How We Collect Your Information

  • Directly from you - when you register as a patient, complete intake forms or questionnaires, attend a consultation (in person or via telehealth), contact us, or sign up for our newsletter;

  • From other healthcare providers - referrals, specialist reports, pathology results, or clinical correspondence;

  • From Medicare and Services Australia - in connection with claims and healthcare identifier verification;

  • From the My Health Record system - where you have a My Health Record and we are authorised to access it; and

  • Through our technology platforms - including Halaxy (clinical management and telehealth, with Xestro retained during our current transition), our AI scribe and dictation tools (currently Heidi, or another clinical-grade tool selected by your treating practitioner), and our patient communications, customer relationship management (CRM), AI chatbot and AI telephony tools.

We will generally collect personal information directly from you. If we need to collect information about you from a third party, we will take reasonable steps to notify you.


4.1 Anonymity and Pseudonymity

Under Australian Privacy Principle 2, you have the right to deal with us anonymously or using a pseudonym where it is lawful and practicable. For medical treatment, it is generally not practicable to treat patients anonymously, as we are required to maintain accurate clinical records and verify your identity for Medicare purposes. However, where you interact with our website or make a general enquiry that does not involve receiving a health service, you may do so without identifying yourself, where our systems permit this.

5. Why We Collect and Use Your Information

  • Providing you with medical care and treatment;

  • Managing your healthcare, including communicating with treating clinicians, specialists, pharmacies, and allied health providers;

  • Booking, confirming, and managing your appointments;

  • Processing payments and submitting Medicare or private health insurance claims;

  • Uploading clinical information to the My Health Record system (where applicable);

  • Sending appointment reminders, health recalls, and newsletters or health updates (where you have consented);

  • Complying with our legal, regulatory, and professional obligations including AHPRA and Medicare; and

  • Internal administration, quality improvement, and practice management.

We will not use your personal information for any purpose unrelated to your healthcare or our practice management without your consent, unless required or authorised by law.

6. Who We Share Your Information With

6.1 Healthcare Providers

  • Specialists and other healthcare providers to whom we refer you;

  • Other treating clinicians involved in your ongoing care;

  • My Health Record - we may upload relevant clinical information where you participate in the system; and

  • Diagnostic and allied health services (pathology, imaging), where necessary for your treatment.

6.2 Administrative and Operational Third Parties

  • Our payment platforms - Halaxy (primary) and Zeller (used for existing patients during our current changeover);

  • Third-party medical administration, reception and virtual assistant services engaged by the Practice from time to time. These contractors are required to handle patient information confidentially and in accordance with our privacy obligations; and

  • Our technology vendors include Halaxy and, during our current transition, Xestro for clinical management and telehealth; our AI scribe and dictation providers (currently Heidi); and our patient communications, CRM, AI chatbot and AI telephony providers. Some of these vendors may store data overseas - see Section 8.

6.3 Regulatory and Legal Bodies

  • Medicare / Services Australia - for processing claims and verifying healthcare identifiers;

  • AHPRA - where we are required to report or respond to a regulatory matter;

  • Courts, tribunals, or law enforcement agencies - where required or authorised by law; and

  • The OAIC or the Health Complaints Commissioner (Vic) - in connection with a complaint or investigation.

We will not sell your personal information to any third party, nor disclose it for marketing purposes without your consent.

7. Artificial Intelligence (AI) Tools

Arami Women’s Health uses AI-powered tools to support clinical care. We are committed to transparency about how these tools work and how they handle your information.

7.1 AI Recording and Transcription Tools

We use an AI scribe tool - currently Heidi - to assist with clinical note-taking during and after consultations. Your treating practitioner may also use AI-assisted dictation tools to dictate clinical notes, and may use a different clinical-grade scribe or dictation tool; where they do, it will be subject to the same protections described in this Policy. These tools may record and transcribe clinical consultations and generate draft clinical notes.

  • Your express consent is required before any AI recording or transcription occurs. You will be asked to opt in before your consultation. You may decline without affecting the care you receive.

  • These tools may be active during consultations and in other clinical settings within the practice.

  • AI-generated notes are reviewed and edited by your treating clinician before entering your patient record. The clinician remains responsible for the accuracy of your record.

  • Our AI scribe and dictation tools may process data both within Australia and on servers located overseas (see Section 8).

  • You may withdraw your consent to AI recording at any time by notifying the practice before your consultation.

7.2 AI Chatbot

We are implementing an AI-powered chatbot to assist patients with appointment bookings and frequently asked questions. When using the chatbot:

  • The chatbot is an automated system, not a human, and is not a substitute for medical advice.

  • Information you provide (such as your name and appointment preferences) may be collected and stored by the chatbot provider.

  • The chatbot provider may store or process information outside Australia. We will identify the provider and its data storage location in this Policy once confirmed.

  • If the chatbot cannot assist you, it will direct you to contact the practice directly.

We will not use chatbot interactions to collect sensitive health information.

7.3 AI Telephony

We use an AI-assisted telephony or voice system to help manage incoming and outgoing calls, including answering general enquiries, taking messages, and assisting with appointment bookings. When this system handles a call:

  • You will be informed where a call is being handled or assisted by an automated system.

  • Information you provide during a call (such as your name and contact details) may be collected, recorded or transcribed to assist with your enquiry, and may be stored or processed by the telephony provider, which may be located overseas (see Section 8).

  • The system is an automated tool, not a human, and does not provide medical advice. Where it cannot assist, it will take a message or direct you to contact us by other means.

8. Overseas Disclosure of Your Information

We take care to ensure that most of our vendors are located in, and store data within, Australia. Some of our technology vendors, however, process or store data on servers located outside Australia. These currently include:

  • AI scribe and dictation tools (currently Heidi) - data may be processed both within Australia and overseas;

  • Patient communications, customer relationship management (CRM) and AI chatbot platforms - we are finalising our selection of these platforms and intend, where practicable, that patient data will be stored within Australia. We will update this Policy to identify the platforms and their data storage locations once confirmed;

  • Clinical management and telehealth platforms (Halaxy, and Xestro during our current transition) - we will confirm and update the data storage locations for these platforms in a future revision of this Policy; and

  • AI telephony or voice system - data may be processed both within Australia and overseas. We will identify the provider and its data storage location in this Policy once confirmed.

In accordance with Australian Privacy Principle 8 (APP 8), when we disclose your personal information to overseas recipients, we take reasonable steps to ensure that the recipient handles your information in a manner consistent with the Australian Privacy Principles. This may include entering into data processing agreements with our vendors.

By using our services, you acknowledge that some of your information may be transferred overseas as described in this section. We do not transfer your information overseas for any purpose other than the operation of the technology tools described in this Policy.

9. How We Store and Protect Your Information

9.1 Primary Clinical Records

Your primary patient records are stored in Halaxy, a cloud-based clinical management platform. During our current transition, some records may also be held in Xestro. These platforms may store data both within Australia and on overseas servers. Records are protected by access controls, encryption, and secure authentication.

9.2 Quality of Information

We take reasonable steps to ensure that the personal and health information we hold, use, and disclose is accurate, up to date, complete, and relevant. We encourage you to notify us if any of your information changes or if you believe any information we hold is inaccurate. See Section 14.2 for your right to seek correction of your records.

9.3 Access Controls

  • Access to patient records is limited to clinical staff and authorised contractors who require access to perform their duties;

  • Contractors and third-party staff who access patient data are subject to confidentiality obligations; and

  • All staff and contractors are expected to handle patient information in accordance with this Policy and applicable law. We are formalising our privacy training programme.

9.4 Personal Devices (BYOD)

Some staff and contractors may access patient records on personal devices. We require that any such devices be password-protected and have appropriate security measures in place. We are developing a formal BYOD policy to govern this practice.

9.5 Paperless Practice

Arami Women’s Health operates as a paperless practice. All records are stored electronically in our clinical management platforms. Secure shredding is used for any incidental paper documents no longer required.

9.6 Practice Changes

From time to time we engage new staff and contractors to support the Practice. All new staff and contractors are required to comply with this Policy from the date of their engagement.

10. How Long We Keep Your Information

We retain your personal and health information for as long as required by law. Under Victorian law, health records must be retained for a minimum of 7 years from the date of the last entry.

AI-generated transcripts and clinical notes are retained as part of your clinical record and are subject to the same retention obligations as other health records.

When your information is no longer required, it will be securely destroyed or de-identified. In the event that the practice closes or is transferred to another operator, we will take reasonable steps to ensure your records are transferred or disposed of in accordance with our legal obligations and with your privacy protected.

11. My Health Record and Healthcare Identifiers

11.1 My Health Record

Arami Women’s Health participates in the My Health Record system. We may access and upload clinical information - such as shared health summaries, discharge summaries, and prescription records - to your My Health Record, where you have one. You have the right to control what information is uploaded. For information about your My Health Record settings, please visit www.myhealthrecord.gov.au.

11.2 Individual Healthcare Identifiers (IHI)

We use Individual Healthcare Identifiers (IHIs) to manage your healthcare records and participate in the My Health Record system. IHIs are assigned by Services Australia and governed by the Healthcare Identifiers Act 2010 (Cth). We handle IHIs strictly in accordance with that Act.

12. Our Website and Digital Platforms

Our website is www.aramiwomenshealth.com.au. We are developing a patient portal that will be subject to additional privacy terms upon launch.

Our website may use cookies and analytics tools (such as Google Analytics) to collect information about how visitors use our site. This information is generally collected in aggregate and not linked to individual patients. You may disable cookies through your browser settings.

We may maintain a social media presence. If we respond to online reviews or social media comments, we will not disclose any information that would identify you as a patient of the practice.

13. Patient Communications and Marketing

With your consent, we may send you:

  • Appointment reminders;

  • Health recall notices (for example, reminders for routine health checks or flu vaccinations); and

  • Newsletters and health updates, where you have signed up through our intake form or questionnaire.

You may unsubscribe at any time by clicking the unsubscribe link in our emails or contacting us directly. Unsubscribing will not affect appointment reminders or clinically necessary communications. All electronic communications comply with the Spam Act 2003 (Cth).

14. Your Privacy Rights

14.1 Right to Access

You have the right to request access to the personal information and health records we hold about you. We will respond within 30 days. In limited circumstances, access may be refused - for example, where providing access would pose a serious threat to another person's life or health. If we refuse access, we will explain why in writing.

14.2 Right to Correction

If you believe information, we hold about you is inaccurate, incomplete, or out of date, you may ask us to correct it. We will correct or annotate your record as appropriate.

14.3 Right to Withdraw Consent

Where we rely on your consent - for example, for AI recording or marketing communications - you may withdraw consent at any time. Withdrawal does not affect the lawfulness of our prior use of your information.

14.4 Right to Complain

If you believe we have handled your information in a way that does not comply with the Privacy Act, the Health Records Act, or this Policy, please contact us first. If not satisfied with our response, you may complain to:

  • Office of the Australian Information Commissioner (OAIC) - www.oaic.gov.au  |  1300 363 992

  • Health Complaints Commissioner (Victoria) - www.hcc.vic.gov.au  |  1300 582 113

15. Data Breaches

In the event of a data breach likely to cause serious harm, we will comply with our obligations under the Notifiable Data Breaches (NDB) scheme, including assessing the breach, notifying the OAIC, and notifying affected individuals as required.

If you believe your information may have been compromised, please contact us immediately using the details in Section 17.

16. Changes to This Privacy Policy

We review and update this Privacy Policy from time to time to reflect changes in our practice, technology, or legal obligations. Given that our technology stack is actively evolving, this Policy is expected to be updated in the near future. The current version is always available at www.aramiwomenshealth.com.au. We will notify existing patients of any material changes by email or through our patient communications platform.

This Policy was last updated in June 2026 (Version 1.2).

17. Contact Us

If you have any questions about this Privacy Policy, wish to make a complaint, or want to access, correct, or withdraw consent in relation to your information, please contact our Privacy Officer:


Privacy Officer - Dr Kafayat Lee

Arami Women’s Health  |  Olaed Pty Ltd

ABN: 40 617 491 317

62 Wellington Parade, East Melbourne VIC 3002

Email: info@aramiwomenshealth.com.au

Website: www.aramiwomenshealth.com.au

We will respond to all privacy enquiries and complaints within 30 days of receipt.

18. Key Definitions

  • Health information means information or an opinion about the health or disability of an individual, as defined in the Privacy Act 1988 (Cth) and the Health Records Act 2001 (Vic).

  • Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, as defined in the Privacy Act 1988 (Cth).

  • Sensitive information includes health information and attracts additional protections under the Privacy Act.

  • Australian Privacy Principles (APPs) are the 13 principles in Schedule 1 of the Privacy Act 1988 (Cth) governing how APP entities handle personal information.

  • Health Privacy Principles (HPPs) are the principles in Schedule 1 of the Health Records Act 2001 (Vic) governing how health service providers in Victoria handle health information.

  • Unsolicited information means personal information received by the Practice that was not actively sought or requested.