Privacy Policy

Dr Chahaya Gauci — Colorectal & General Surgeon
Coffs Colorectal · Suite 4, 29–33 Orlando Street, Coffs Harbour NSW 2450 · (02) 6651 6211
Last updated: 10 October 2026

About this policy

This policy explains how I collect, use, store and share your personal and health information. As a private practitioner in NSW, I follow the Privacy Act 1988 (Cth), including the Australian Privacy Principles, and the Health Records and Information Privacy Act 2002 (NSW).

I am an independent specialist practising at Coffs Colorectal, a shared practice with Dr Andrew Sutherland. Coffs Colorectal provides my rooms, reception and administrative staff, and practice systems as a service to me. I am responsible for the health information of my patients and for how it is handled under this policy. Coffs Colorectal staff handle your information on my behalf, and they are bound by confidentiality and by this policy.

What information I collect

To provide safe, high-quality care, I collect:

  • Personal details: your name, date of birth, address, phone number, email address and emergency contact, as well as your Medicare, private health fund, DVA and concession details.

  • Health information: your medical, surgical, medication, allergy, family and social history; your symptoms; your test, imaging and endoscopy results; clinical notes; and questionnaire scores.

  • Other information relevant to your care, such as your referring doctor, whether you need an interpreter, and whether you are of Aboriginal or Torres Strait Islander origin. You can always choose not to provide this.

I only collect information that is reasonably necessary for your care. I collect it with your consent and, wherever possible, directly from you.

How I collect it

I collect information:

  • during consultations

  • through online forms and questionnaires

  • by phone and email

  • from your referral

  • from other health professionals involved in your care, such as your GP, hospitals, pathology and imaging providers, and other specialists

AI scribe

With your consent, I use an AI scribe tool called Heidi during consultations. I use it either to type up notes I dictate, or to transcribe and summarise our conversation.

The audio is not kept. The transcript and draft note are held on secure, encrypted servers in Australia and are automatically deleted after 90 days. I check and approve every note before it goes into your medical record.

Heidi does not diagnose you or make decisions about your care. Heidi is an Australian company bound by the Privacy Act 1988 (Cth).

Using Heidi is voluntary. You can decline or withdraw your consent at any time, including part-way through a consultation, and this will not affect your care.

Why I collect and use it

I use your information to:

  • assess, diagnose and treat you, including planning and performing procedures

  • communicate with your GP and other treating practitioners

  • arrange hospital admission and anaesthesia

  • process Medicare, health fund and billing claims

  • send appointment reminders and follow-up questionnaires

  • meet my legal, professional and medico-legal obligations

I may use de-identified information for clinical audit and quality improvement. If I ever want to use identifiable information for research, I will ask for your consent first, unless the law allows otherwise.

Who I share it with

I only share your information with:

  • Coffs Colorectal staff, for the purposes above, and, where relevant to your care, Dr Andrew Sutherland — for example, if he is covering for me, assisting, or performing a procedure

  • other people involved in your care, such as your GP, anaesthetist, hospitals, pathology and imaging providers, and other specialists

  • Medicare, your private health fund or DVA, for billing

  • my medical indemnity insurer and legal advisers, if required

  • anyone else where the law requires or allows it, such as mandatory reporting, a court order, or to lessen a serious threat to someone’s life, health or safety

I do not sell your information or use it for marketing.

Storage and security

Your medical record is held securely in the practice management system, Genie (Magentus), which Coffs Colorectal operates on my behalf. Access is limited to the practitioners and staff who need it for your care or for running the practice.

I take reasonable steps to protect your information from misuse, interference, loss, and unauthorised access, change or disclosure. These include:

  • password-protected systems, with two-step verification on email and cloud accounts

  • limiting staff access to what each role requires

  • confidentiality obligations for all staff

  • securely deleting temporary copies of information, such as form emails, once the information has been added to your medical record

Your medical record is kept for at least as long as NSW law requires: 7 years from your last contact for adults, and until age 25 for patients treated as children. In practice, records are kept for as long as I am in practice.

Email and information stored overseas

My practice email service is Google Workspace. Emails sent to the rooms, including the online forms you send, are stored on Google’s servers in Europe. Some processing, such as email delivery and security scanning, may take place in other countries where Google operates.

Under its data processing terms, Google is contractually bound to:

  • keep this data secure

  • use it only to provide the email service

  • notify me of any breach

Google’s services are independently audited against international security and privacy standards.

Access to the practice mailbox is limited, and it is protected with two-step verification. Once a form’s contents have been added to your medical record, the email is deleted. Deleted emails are then permanently removed from Google’s systems within the timeframes set out in Google’s terms.

Online forms and this website

Answers you enter into my online forms stay on your own device until you choose to send them. The website does not receive or store your answers.

When you send a form, it goes to the rooms by email from your own email account, and the answers are then added to your medical record. A copy will usually remain in your email’s sent items, which you can delete if you wish. You can clear a form from your device at any time using the “Clear this device” button.

If you’d prefer not to send information by email, you can print your form and bring it to your appointment, or complete it at the rooms.

This website is hosted by Squarespace. Squarespace never receives the answers you enter into the online forms, because they are processed entirely on your own device. Squarespace may use cookies and collect basic, anonymous information about how the site is used.

Accessing and correcting your information

You can ask to see or get a copy of your health record. You can also ask me to correct information you believe is inaccurate, out of date or incomplete. Please contact the rooms. Requests can be made verbally or in writing.

I will respond within 30 days. There is no charge for making a request. A reasonable fee may apply for copying records, and I will tell you about it beforehand.

In rare cases, the law allows access to be limited, for example if access would pose a serious risk to someone’s health or safety. If that happens, I will explain why.

If I don’t agree to make a correction you’ve requested, I will explain why in writing. You can then ask for a statement of your view to be attached to your record.

Making a privacy complaint

If you have a concern about how your information has been handled, please contact the rooms first on (02) 6651 6211, or write to the address above. I will acknowledge your complaint promptly and aim to resolve it within 30 days.

If you’re not satisfied with the response, you can contact:

Data breaches

If a data breach is likely to cause you serious harm, I will notify you and the OAIC, as required by the Notifiable Data Breaches scheme.

Changes to this policy

I may update this policy from time to time. The current version is always available on this page, or from the rooms on request.