Privacy Policy

Tikva Medicolegal (Tikva) is committed to protecting the personal information and sensitive health information it handles in delivering independent medicolegal assessments, reports and associated administrative services. This policy explains how Tikva collects, holds, uses, discloses and safeguards personal information under the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), and other applicable requirements. Tikva may obtain information directly from individuals or from insurers, solicitors, employers, medical practitioners and other authorised referrers.

Depending on the referral, Tikva may collect identifying/contact information (name, date of birth, contact details and, when relevant, gender); referral, claim, insurance, employment, injury and legal-matter details; health information including clinical histories, medications, assessments, imaging, treating records and reports; appointment, communications and billing records; Medicare/private cover details only where relevant; and information supplied through authorised digital forms and portals. Website interactions may also generate technical data such as IP address and essential security/usage logs. Tikva seeks to collect only information reasonably necessary for its functions, and sensitive information only where permitted by law, including with consent where required.

Tikva uses information to receive and assess referrals; verify identity and referral scope; arrange and remind individuals about appointments (including SMS/email); prepare assessments and medicolegal reports; undertake internal quality assurance; communicate with authorised specialists, instructing solicitors and insurers; manage billing, records and security; and meet legal/regulatory duties. Disclosure is limited to the relevant lawful or authorised purpose and may include contracted service providers subject to suitable controls. Tikva is an independent medicolegal assessment provider and does not automatically act as the individual's treating practitioner. Individuals may contact Tikva if they do not wish to receive non-essential communications.

Tikva applies proportionate technical and organisational protections, including role-based and case-level access restrictions, secure authentication (including MFA for sensitive system access), encryption where supported and appropriate, controlled sharing and download, staff training, system monitoring, audit trails and incident response. Tikva requires suppliers and contractors handling information to meet documented contractual security/privacy safeguards. Medical and medicolegal records are retained according to applicable law, professional obligations, contractual requirements and approved retention schedules, then securely destroyed or de-identified when appropriate.

Where information relates to a child or young person, Tikva takes additional care with authority, consent, parental or guardian involvement and any capacity considerations. The appropriate authorisation will depend on the circumstances and applicable law; parental consent is not automatically the only lawful basis in every case.

Tikva uses authorised external providers for practice administration, accounting, website services, communications and, where applicable, medicolegal workflows. Tikva will assess supplier security and overseas disclosure risks before releasing sensitive information to a service.

Individuals may request access to personal information held about them or correction of information they believe is inaccurate, out of date, incomplete, irrelevant or misleading. Requests may be made through admin@tikvamedicolegal.com.au or 08 9230 6369. Tikva will verify identity and authority, respond within a reasonable period and explain any lawful refusal. Tikva will not charge for making an access or correction request; any charge for providing access must be reasonable, disclosed beforehand and permitted under law. Tikva does not charge for correction. Individuals may also lodge a privacy complaint through the same contact details; Tikva will investigate and respond. If dissatisfied, they may contact the Office of the Australian Information Commissioner (OAIC), www.oaic.gov.au.

Tikva maintains a process to identify, contain, assess, document and remediate suspected personal-information breaches. Incidents are evaluated under the Notifiable Data Breaches (NDB) Scheme. Where an eligible data breach is established, Tikva will make required notifications to affected individuals and the OAIC as applicable. Tikva will document response decisions, maintain an incident register and implement improvements following review.

Tikva may evaluate or use approved AI-enabled technologies for defined tasks such as transcription, administrative assistance, document processing, quality checking or template support, subject to appropriate governance, contractual confidentiality, privacy impact assessment and human oversight. AI tools must not be used to disclose identifiable patient information outside approved systems or permitted purposes. Any patient-facing transcription or other AI processing must follow applicable consent and notice requirements.

Tikva's website may collect enquiries and technical usage information. Do not submit clinical records or sensitive information through a general website contact form unless the form and its storage/transmission have been approved for that purpose.

Tikva's preferred operating position is Australian hosting for production medicolegal and health information. However, Australian hosting alone does not prove that all information stays within Australia: backups, analytics, AI APIs, email, monitoring and support access also require assessment. Before any overseas disclosure, Tikva will assess the applicable APP 8 obligations and put appropriate contractual and technical safeguards in place.

Privacy enquiries, correction/access requests or complaints: admin@tikvamedicolegal.com.au | 08 9230 6369 | www.tikvamedicolegal.com.au.

Tikva will review this policy at least annually and following material legal, system, vendor or workflow changes. The published version will show its current effective date and version.