About Health Legal
Our office is located at:
46-48 Boundary Street
South Melbourne Vic 3205
Phone: 03 9865 1300
Fax: 03 9865 1388
About us and this privacy policy
Health Legal (we, us, our) respects your privacy and is committed to ensuring that your privacy is maintained.
We will handle your personal information in accordance with applicable privacy laws, including the Privacy Act 1988 (Cth) (the Privacy Act) and its Australian Privacy Principles (APPs).
This privacy policy (this Policy) explains how we will collect, use, disclose, store, and protect your personal information. This Policy also describes the way in which you may access or correct the personal information we hold about you, and how to contact us if you have any complaints in relation to your privacy.
This Policy applies to our handling of personal information in relation to our legal services and other services and products, our website at healthlegal.com.au, our email communications, and our use of digital analytics and marketing tools
What is ‘personal information’?
This Policy applies to our handling of personal information. ‘Personal information’ means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information is true or not and whether the information is recorded in a material form or not.
Personal information includes ‘sensitive information’, which is a particular type of personal information. Sensitive information includes health information, and information about racial or ethnic origin, political opinions or associations, religious or philosophical beliefs, and sexual orientation or practices.
What types of personal information do we collect?
We may collect personal information including the following, to the extent this is necessary for the services and activities we provide:
- name and contact details;
- job title, organisation, employer;
- information about your matter and relationship with us (such as instructions, correspondence, documents you provide, and information about disputes or regulatory issues);
- billing and payment information (such as bank account details and transaction history);
- information collected via our website and emails, including IP address, device identifiers, browser type, access dates and times, pages viewed, and interactions with our online forms and marketing emails; and
- information collected using cookies and tracking technologies, including tracking pixels (for example, LinkedIn Insight Tag and HubSpot tracking pixels), which may relate to your browsing behaviour on our website and engagement with our content.
Where necessary for our services, we may also collect sensitive information with your consent or where permitted or required by law.
How do we collect your personal information?
We will collect your personal information in a lawful and fair way, and in a manner that is not unreasonably intrusive.
We may collect personal information:
- directly from you, including when you engage us, communicate with us, complete our online forms, subscribe to updates, attend our events or interact with us on social media;
- from third parties, such as your organisation or employer, referees, other advisers, regulators, counterparties and their advisers, referrers, and publicly available sources (such as company registers); or
- automatically when you use our website or interact with our emails, through cookies and similar technologies, including tracking pixels.
When we collect your personal information, we will as soon as is practicable take reasonable steps to notify you of the details of the collection (including notifying you through this Policy), such as the purposes for which the information was collected, the organisations (if any) to which the information will be disclosed, and also notify you that this Policy contains details on how you may access or correct your information, or raise any complaints.
You are not required to disclose your personal information to us. However, if you do not provide the information requested, you may not be able to receive our services or engage with us effectively.
Why do we collect, use and disclose your personal information?
We collect personal information from you so that we can provide our services to you, or where this is otherwise necessary for our functions or activities.
The purposes for which use or disclose your personal information will depend on why you are engaging with us and in what capacity. We will generally only use or disclose your personal information for the main purposes for which you have provided it to us.
We will otherwise only use or disclose your personal information to other persons:
- for other purposes for which you have provided consent;
- for purposes which are related to these main purposes for which the information was collected (or directly related for sensitive information), in circumstances where you would reasonably expect us to disclose your information for these purposes; or
- where we are otherwise required or authorised by law to do so, for example:
- where disclosure is necessary under law, such as where we need to comply with a subpoena or Court order; or
- where it is unreasonable or impracticable to obtain your consent and we reasonably believe disclosure is necessary to lessen or prevent a serious threat to the life, health or safety of any individual, or to public health or safety.
We may collect, use and disclose personal information for purposes including:
- providing our services and managing our relationship with you;
- responding to enquiries and requests;
- managing and complying with our legal, professional and regulatory obligations;
- managing our business operations, including billing and other administrative matters;
- operating, maintaining and improving our website, ICT systems and security;
- conducting marketing and business development activities, including sending legal updates, event invitations and other communications that may be of interest to you (with your consent, and from which you can opt out at any time);
- analysing the performance of our website and communications and understanding audience engagement, including through cookies and similar technologies, including tracking pixels.
Do we disclose your personal information to others?
We respect the privacy of your personal information and we will take reasonable steps to keep it confidential and protected.
We may disclose personal information to third parties in connection with the purposes described in this Policy, including:
- other professional advisors, external legal counsel, experts and consultants;
- courts, tribunals, regulators and law enforcement agencies;
- our insurers, auditors and professional advisers; and
- our third party service providers, such as ICT hosting and cloud services, document management, analytics, marketing and communication platforms, including LinkedIn and HubSpot as discussed in this Policy below.
Where service providers have access to personal information, we take all reasonable steps to ensure they handle personal information in accordance with the APPs.
Our duty of confidentiality and obligations of non-disclosure
In respect of the legal services we provide, we have a duty to maintain the confidentiality of our clients’ affairs, including personal information. Our duty of confidentiality applies except where disclosure of a client’s personal information is:
- with that client’s consent;
- compelled by law; or
- for the sole purpose of avoiding the probable commission or concealment of a criminal offence.
We may be subject to obligations of non-disclosure in respect of personal information which we hold arising from the fiduciary duties we owe to clients, or as a result of applicable professional conduct rules.
In certain cases, information which we hold will be subject to legal professional privilege.
Marketing communications
We may use your personal information (such as your name and contact details) to send you marketing communications about our products and services, including by SMS, email, or other electronic means. We will only do so as permitted by applicable law, including the Privacy Act and the Spam Act 2003 (Cth). You may opt out of receiving marketing communications at any time by using the unsubscribe function we provide with such communications or by contacting us using our contact details set out below.
Automated decision making and use of artificial intelligence (AI)
We do not make decisions which could reasonably be expected to significantly affect the rights or interests of individuals solely by means of automated decision making or the use of AI, and all AI use is subject to human oversight and individual judgement.
We will inform you through this Policy if in future we use any other computer programs or AI systems that use personal information to make automated decisions that could reasonably be expected to significantly affect the rights or interests of an individual. This will include information about the kinds of personal information used in, and types of decisions made by, such computer programs or AI systems that use personal information to make such decisions.
Will we transfer your personal information overseas?
We comply with the requirements of the APPs when disclosing personal information overseas.
Certain personal information may be disclosed overseas through our use of the LinkedIn Insight Tag (discussed below).
We will only disclose your personal information overseas if we would be lawfully permitted to disclose it to a recipient in Australia, and:
- we have taken reasonable steps to ensure that the interstate or overseas recipient of your personal information does not breach the APPs; or
- the overseas recipient is subject to a law, binding scheme or binding contract that provides substantially similar protection to the APPs which you can access and enforce; or
- the disclosure overseas is otherwise required or authorised by law.
How do we store and secure your personal information?
The security of your personal information is important to us. We take reasonable steps to protect your information from misuse, interference and loss, and from unauthorised access, modification or disclosure.
Your personal information may be stored either in hard copy documents or as electronic data via our ICT systems and networks. We maintain physical security over our paper and electronic data stores and premises, such as locks and security systems. We use technical and cybersecurity measures to protect our ICT systems and networks, and organisational measures including strict authorisation and password requirements for our staff to access our systems, and requiring our staff to maintain the privacy of personal information in accordance with this Policy.
We keep your personal information for the time periods required by law. When your personal information is no longer required to be retained for any lawful purpose, we will take steps to securely destroy the information or to ensure that the information is permanently de-identified.
How can you access and correct your personal information?
You have a right to seek access to, and correction of the personal information we hold about you.
You may request access to the personal information that we hold about you, using our contact details set out below. In certain circumstances, we may refuse to allow you access to your personal information where this is authorised by the law, such as where providing access would have an unreasonable impact on the privacy of other individuals, providing access would pose a serious threat to the life or health of any person or to public health or safety, or giving access would be unlawful.
If you believe that the personal information we hold about you requires correction (for example, because the information is inaccurate, out-of-date, incomplete, irrelevant or misleading), you may request that the information be corrected using our contact details set out below.
If we refuse your request for access or correction, we will provide you with reasons for the refusal in writing, and details about how you may complain about the decision.
Tracking pixels, cookies and analytics
Our website and email communications use cookies and similar technologies, including tracking pixels, to understand how people use our services and to improve them.
We use the LinkedIn Insight Tag, which is a piece of code that enables LinkedIn to collect data about visits to our website, including URL, referrer, IP address, device and browser characteristics, and timestamp. We use this information to assess how effective our LinkedIn advertising and to understand our website audience, and by LinkedIn to provide us with anonymised reports and to help deliver more relevant advertising to you. Personal information processed through the LinkedIn Insight Tag may be transferred outside Australia by LinkedIn via its own ICT systems and infrastructure. LinkedIn’s privacy policy is found here: linkedin.com/legal/privacy-policy. You can control LinkedIn’s use of your data for advertising purposes through your LinkedIn account settings.
We use HubSpot for website analytics, marketing automation and managing our contact database. HubSpot uses cookies and tracking pixels to collect information such as your IP address, browser type, pages visited, and interactions with our website forms and marketing emails. This helps us understand how our content is used and to make our communications more relevant. HubSpot data is hosted on Amazon Web Services (AWS) data centres located in Sydney, Australia. HubSpot’s privacy policy is found here: legal.hubspot.com/privacy-policy.
We use Google Analytics and Google Ads, including Google tags, cookies and similar technologies, to measure visits to and interactions with our website, understand the effectiveness of our online advertising, improve our services and, where enabled, support remarketing or more relevant advertising. These technologies may collect or generate information such as your IP address, device and browser information, approximate location, pages viewed, referring website, interactions with our website and ads, and date and time of access. Google may process this information for us and for its own purposes in accordance with Google’s applicable terms and privacy documentation, including through systems and infrastructure located outside Australia. Google’s privacy policy is found here: policies.google.com/privacy, and information about Google’s use of advertising cookies is found here: policies.google.com/technologies/ads.
How you can opt out of and control cookies and similar technologies
You can:
- manage or disable cookies and similar technologies by adjusting your browser settings and tools, including blocking third-party cookies, and using add-ons to limit Google Analytics where available;
- use the privacy and advertising settings provided by LinkedIn, Google, and other platforms to control personalised advertising;
- use industry-wide opt-out tools where available;
- use email settings where available to disable the automatic loading of images and avoid clicking tracking links if you do not wish email engagement to be tracked.
Data breaches
We are required to comply with mandatory ‘notifiable data breach’ scheme (the NDB scheme) under the Privacy Act. The NDB scheme applies when an ‘eligible data breach’ of personal information occurs.
An ‘eligible data breach’ occurs when:
- there is unauthorised access to or unauthorised disclosure of personal information, or a loss of personal information, that an organisation holds; and
- this is likely to result in serious harm to one or more individuals; and
- the organisation has not been able to prevent the likely risk of serious harm with remedial action.
An organisation may take remedial steps to prevent the likelihood of serious harm occurring for any affected individuals after a data breach has occurred, in which case, the data breach is not an ‘eligible data breach’.
Where we have reasonable grounds to believe that we have experienced an eligible data breach (and remedial action cannot be used), we will promptly notify affected individuals and the Office of the Australian Information Commissioner about the breach in accordance with the Privacy Act.
Privacy related questions and complaints
We respect your privacy and we take all complaints regarding privacy very seriously.
If you have any questions about privacy-related issues, or wish to complain about a breach of your privacy or the handling of your personal information by us, you may lodge your question or complaint in writing to us using the contact details below. We will respond to you as soon as possible, but generally no later than 30 days from receipt of your question or complaint.
If you are not satisfied with our response, or if you do not wish to raise a question or complaint with us directly, you may wish to contact the Office of the Australian Information Commissioner. See www.oaic.gov.au.
Our contact details
If you would like to contact us regarding any privacy matters, including where:
- you would like to request access to or correction of your personal information; or
- you have a complaint or concern regarding your privacy,
please contact us using the following details:
- Email address: [email protected]
- Telephone number: 03 9865 1300
- Address: 46-48 Boundary Street, South Melbourne, Victoria 3205, Australia
Updates to this Policy
We may update this Policy from time to time. We will notify you about any changes to this Policy through our website, and we will make the most current version of the Policy available to you when you receive services from us, or on your request.
Last updated: 5 August 2026