Your record, and what happens to it.

Australia Pain Management is the data controller for the clinical and administrative records it creates about you. Where a hospital or imaging provider holds its own copy of a record, that organisation is the controller for its copy.

We hold only what is needed to assess and treat you safely.

• Identity and contact details, and your GP or referrer's details.
• Referral letters, clinical history, examination findings and imaging reports.
• Notes of consultations, procedures performed, consent records and medication.
• Questionnaire scores and diaries you complete.
• Billing records, insurer or scheme details, and payment references.
• Messages you send through the enquiry form on this site.

The lawful basis for holding clinical information is the provision of health care under Article 6(1)(e) and Article 9(2)(h) of the UK GDPR, together with the professional duty of confidence. Billing records are kept to meet legal and accounting obligations.

We write to your GP and referrer after each appointment. We share information with a hospital, imaging provider, laboratory or allied health clinician only where it is needed for your care, and with your insurer or scheme only to the extent needed to settle an account.

We do not sell information, and we do not use it for advertising or profiling.

Adult clinical records are retained for the periods set out in the applicable national records retention schedule; records relating to a person under 18 are held until their 25th birthday or longer where the schedule requires it. Enquiry-form messages that do not become a clinical episode are deleted within twelve months.

This site sets no advertising or tracking cookies. The enquiry form opens a message in your own email application; the details you type are not stored on this website. Anonymous, aggregated page counts may be used to understand which pages are read.

You may ask for a copy of your record, ask for factual errors to be corrected, ask us to restrict processing, and complain to the Information Commissioner's Office. Requests are answered within one month. Ask by email or in writing, and we will confirm your identity before releasing anything.

Write to the practice at the address on the Contact page, marked for the attention of the data protection lead.