Privacy Policy

MedCall is a secure video-consultation service operated by Westergaard Pty Ltd (ABN 22 663 084 900), trading as Telehealth Australia Group (“MedCall”, “we”, “us”). We are based at 89 Latrobe Terrace, Paddington QLD 4064. This policy explains what personal information we handle and how, and applies the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth).

This is the plain-English version of how MedCall protects a consult. If anything here is unclear, email hello@medcall.au.

Who this covers

MedCall is used by two kinds of people: clinicians, who hold an account with us, and patients, who join a consultation by tapping a link their clinician sends them. Patients do not create accounts. This policy covers both.

What we collect

From clinicians: your name, the display name your patients see, email address, mobile number, Ahpra registration number, provider number (if given) and clinic or practice name. We use these to create your account and operate the service.

About practices and billing: the practice name, who manages it, which clinicians belong to it, how many consults each has run, and its subscription status. If a practice subscribes, its billing details (such as billing email, address and ABN, if given) and payments are handled by our payment provider, Stripe. We do not receive or store card numbers.

From or about patients: the mobile number your clinician enters to send you a consult link; any text messages, photos or documents exchanged in the consult chat; and consult metadata (when a link was opened, when each party joined and left, call duration, and connection-quality measures). We may also record an optional 1–5 quality rating.

About other people added to a call: if a clinician adds someone else to a consult (for example a carer, family member, interpreter or another clinician), we store that person's name, the mobile number or email address their link was sent to, and the same consult metadata as for patients. They do not create an account.

We never record video or audio. The consultation stream exists only for the live duration of the call and is not stored, captured or retained in any form.

Technical information: to keep the service reliable and working across devices, we record limited technical data about the browser, operating system and device type used to join a consult, and any errors encountered. The optional device-check tool at medcall.au/test records anonymous results (device type, and whether the camera, microphone and connection passed).

Website analytics: on our public website pages we use a cookieless analytics service (Ahrefs Web Analytics) to count page views. It is not loaded on consult pages, waiting rooms, the dashboard or call records, and it does not identify you.

What we do not collect

MedCall is only the call. We do not collect Medicare numbers, clinical notes, diagnoses, prescriptions, dates of birth or health records — those stay in your practice management software, which we never see.

How we use it

We use personal information solely to provide and operate MedCall: to set up clinician accounts, connect a clinician and patient in a consultation, deliver the SMS invitation, keep a record of consults for the clinician, support users, and maintain the security, reliability and quality of the service. We do not use it for advertising, and we do not sell it.

The SMS invitation

When a clinician starts a consult, we send the patient an SMS containing a secure link. SMS is delivered through our telecommunications provider (Twilio). The message contains the clinician's display name, the patient's first name if the clinician entered one, and the link. Email invitations, sent through our email provider (SendGrid), contain the same.

Where your information is stored

Our application, database and file storage run in the Amazon Web Services Sydney region. Consult records, chat messages and shared files are stored in Australia.

One matter we state plainly: the video and audio of a call travel directly between the browsers of the people in it (the clinician and patient, and anyone else the clinician adds), encrypted end-to-end. On the minority of connections where a direct path is blocked (for example, strict clinic or corporate firewalls), the encrypted stream is relayed through our connectivity provider's nearest server — for Australian users, effectively within Australia. The relay forwards encrypted packets it cannot read; it never has access to the content of your consultation. Our SMS, email and payment providers (Twilio, SendGrid and Stripe) operate infrastructure outside Australia, including in the United States; each receives only what its function needs — a mobile number or email address and the invitation text, or a practice's billing details. Patient consult content is not sent to them.

How long we keep it

Consult links expire 24 hours after they are created. We keep consult records, chat and call logs for seven years after the consult, so clinicians can rely on them for their own record-keeping, after which they are deleted or de-identified. Clinicians can ask us to delete their account and associated records.

Disclosure

We disclose personal information only to the service providers who help us run MedCall — our hosting, database, SMS, email and payment providers, listed on our Trust & compliance page — bound to protect it and use it only for that purpose; where you direct us to (for example, when a patient joins a consult, the clinician sees the consult); or where required or authorised by law. A clinician's personal contact details are never released to patients.

Security

We protect information with encryption in transit, access controls, row-level database security, isolation of patient-facing functions, single-use expiring consult links, and rate limits. No system is perfectly secure, but we design MedCall to hold as little as possible and to protect what it holds.

Data breaches

We maintain a data-breach response plan. If a breach involving personal information is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner in line with the Notifiable Data Breaches scheme.

Accessing or correcting your information

You can ask us for a copy of the personal information we hold about you, or to correct it, by emailing hello@medcall.au. We will respond within a reasonable time.

Complaints

If you believe we have mishandled your personal information, contact us first at hello@medcall.au and we will work to resolve it. If you are not satisfied, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

Changes to this policy

We may update this policy as MedCall evolves. The current version always lives at this page, with the date it was last updated shown at the top.