Carlisle Health Pty Ltd (ACN 168 006 157) carries on the business of Carlisle Health Pty Ltd Clinics under ABN 55 168 006 157.

In this Privacy Policy (Policy) Carlisle Health Pty Ltd will be referred to as ‘Carlisle Health Pty Ltd’, ‘it’, ‘its’, ‘us’ or ‘we’, as context requires.

Carlisle Health Pty Ltd is committed to protecting the privacy and confidentiality of all personal information it collects from patients, healthcare professionals, employees, service providers, suppliers and other persons or entities with which it engages, in the course of its business operations.

This Policy explains how Carlisle Health Pty Ltd collects uses, discloses and keeps personal information it collects secure and confidential and how it complies with the Privacy Act 1988 (Cth) (Privacy Act), the Australian Privacy Principles (APPs) and other laws which regulate the way private sector health service providers must handle personal information used to provide medical and health care services to patients and their associated health care professionals.

From time to time, Carlisle Health Pty Ltd may change or update this Policy. Whenever changes are made, they will be posted immediately on our website.

By providing personal information to Carlisle Health Pty Ltd, you consent to us collecting, using and disclosing your personal information in the ways set out in this Policy.

Who does Carlisle Health Pty Ltd ask to provide personal information?

In this Privacy Policy, we use the following terms:

• ‘patients’ to refer to individuals who receive, or enquire about receiving services from us;
• ‘healthcare providers’ to refer to practitioners, treating practitioners, healthcare professionals, and individuals at hospitals and other healthcare facilities involved in a patient’s care;
• ‘suppliers’ to refer to individuals or individuals at businesses who provide us with goods or services, but excludes healthcare practitioners;
• ‘visitors’ to refer to individuals who engage with us on our websites or social media channels, or who enquire about our functions or activities via electronic means; and
• ‘applicants’ refers to individuals who apply for employment or other engagement with us.

Carlisle Health Pty Ltd collects personal information from patients, healthcare professionals, employees, service providers, suppliers and other individuals and entities with which it engages as part of its usual business

What type of information does Carlisle Health Pty Ltd collect?

Most of the personal information we collect is provided by patients when they come to our clinics. The type of personal information we collect depends on who we are interacting with, and the information and services we are being asked to provide. Generally, we collect your name, contact details, and other information which is relevant to our dealings with you, and information which is required or authorised by law or a court or tribunal order. If you call us, the call may be recorded for quality and training purposes (which you can opt out of by telling us at the start of the call). If you visit us in person, CCTV may capture video of you (signs will notify you if CCTV is in use at the site you visit).

The personal information we collect may include:

• if you are a patient: we will also collect your age, gender, date of birth, and address and contact details; health information relating to your lifestyle and medical history relevant to providing healthcare services (such as your medical condition, medications, diagnostic tests and treatments, images and imaging data, medical reports, family medical history, occupational history, genetic or biometric information, medical device/implant information, and copies of correspondence to and from your healthcare professionals and providers); healthcare identifiers (such as your Medicare number and Private Health insurance details) and other details necessary for billing or other administrative purposes (including WorkCover, DVA, or Centrelink details); other personal information collected in the form of clinical images we capture and the imaging data associated with them, the reports our personnel prepare, samples, and test results; your medical history, medications, allergies, adverse events, immunisations, social history (including religion and ethnicity, when relevant), family history and risk factors; records of past interactions with you; emergency contacts, and any other information reasonably required to provide the services to you;
• If you are a healthcare provider: we will also collect information your practice details, provider numbers, and other information relevant to the provision of the services;
• If you are a supplier: we will also collect your ABN (for sole traders and partnerships), bank account details (for payment of your invoices), information about your role, and information required for our ESG governance;
• If you are a visitor, we may also collect information about your use of our websites and the device you are using (including numbers that identify your device, IP address, geographic location of your IP address and device where that is relevant to the services and information we are providing, cookie information, and user preferences). You may choose to enable or disable information you share with us via our websites in your browser or device settings. Disabling the sharing of some information may affect your ability to use certain features of the websites, and your visitor experience generally;
• If you are an applicant, depending on your potential or actual position with us, we will also generally collect your information contained within an application and CV/resume, employment history, information derived from a reference, background check or other pre-employment check, information derived from an interview, information derived through testing (including psychometric or aptitude testing, as applicable), licences and other certificates and qualifications, training records, information required by applicable laws, regulations, and standards, and information included in a passport, birth certificate, visa or other documentation demonstrating your right to work in Australia

Except as otherwise permitted or required by law, we only collect sensitive information about you if you consent to the collection of the information and if it is reasonably necessary for the performance of our functions and activities. Consent may be implied by the circumstances existing at the time of collection. There may also be circumstances under which we may collect sensitive information without your consent, as required or authorised by law. If you are a patient, collecting sensitive information about you is necessary for us to provide you with our services, and we obtain your consent to collect, use, hold, and disclose your sensitive information when you complete our patient intake forms. If you are an applicant, we are likely to collect sensitive information from you (such as criminal history) to enable us to assess your application, and we obtain your consent to collect, use, hold, and disclose your sensitive information when you complete your application form.

You are not required to provide personal information to us. However, if you do not provide us with all of the information we request or withhold information from us or provide incomplete or inaccurate information, the services we provide to you may be adversely affected or compromised and we may not be able to provide you with the services you need. If you are an applicant, refusal to provide personal information may mean we are unable to process your application.

How does Carlisle Health Pty Ltd collect personal information?

We collect personal information directly from patients, healthcare providers, suppliers, applicants, and other persons or entities we engage with in the course of our business by having them complete registration and other information collection forms when they visit our clinics, by email, in telephone calls (which may be recorded for quality and training purposes), in person consultations, via CCTV, through our website and social media channels, and employment and engagement application processes.

Where it is not reasonable or practicable for us to collect personal information directly from you, we may seek and collect information about you from other parties.

Other parties from whom Carlisle Health Pty Ltd may collect personal information about you include:

• any third party with your consent, or as otherwise required or authorised by law;
• if you are a patient:
  • your doctor, who will explain why information is being collected from you, how it will be used and where it will be sent;
  • other healthcare providers and professionals, including hospitals and healthcare facilities which may be involved in your care;
  • a responsible person (such as a spouse, partner, relative, carer or attorney);
  • your emergency contacts;
  • the My Health Record program, unless you have opted not to participate;
  • imaging platform providers, including through authorised access functionality that allows healthcare providers involved in your care to retrieve imaging records where clinically appropriate or otherwise authorised;
  • health insurers, law enforcement agencies or other government bodies;
  • an attorney holding an enduring power of attorney containing health directions or an attorney with an advanced health directive;
• if you are a healthcare provider: from our patients, other healthcare providers, and publicly available records;
• if you are a supplier: publicly available records such as the Australian Securities and Investments Commission, and the Australian Business Register;
• if you are a visitor: technology service providers and social media platforms;
• if you are an applicant: referees when they provide references, academic institutions or training and certification providers, providers of licence and background-checking services, recruiters and other service providers who assist in the engagement process, and other publicly available sources such as social media platforms.

If you provide us with personal information about someone else, you must ensure that you are authorised to disclose that information to us and that, without us taking any further steps required by applicable privacy laws, we may collect, store, use and disclose such information for the purposes described in this Privacy Policy. Where we request you to do so, you must assist us with any requests by the individual to access or update the personal information you have collected from them and provided to us.

Why does Carlisle Health Pty Ltd collect personal information?

Carlisle Health Pty Ltd collects, uses and discloses and stores personal information to enable it to provide medical imaging and related health services, and otherwise as reasonably necessary for or directly related to the performance of our functions and activities, and:

• To facilitate our internal business operations, including:

• if you are a patient:
  • To provide specialist medical reporting services to referring healthcare professionals and other healthcare service providers;
  • To co-ordinate and/or communicate with healthcare providers involved in your care;
  • To procure additional healthcare services (such as providing referrals to other providers or obtaining second opinions) and engage contractors and suppliers to provide products or services;
  • To keep your authorised representative such as guardian, carer, family member or attorney or legal advisor you have nominated informed about your care;
  • To report to relevant organisations, including Medicare, insurers, such as Private Health Funds, Workers Compensation insurer, Motor Vehicle insurers;
  • To make appointments and send reminders for follow-up care and account management by text message, mail or email to the contact details you have provided to us;
  • To liaise with your health fund, Medicare, the Department of Veterans’ Affairs, Department of Health or another payers or contractors for services;
• if you are a healthcare provider: communicating with you regarding referrals, diagnostic imaging services, clinical reports, patient care, billing and other healthcare-related matters;
• if you are a visitor: streamlining and personalising your experience within our websites, and tailoring our information and services for you;
• if you are a supplier: purchasing goods or services from you, and enquiring about your products and services;
• if you are an applicant: to assess applicants for employment opportunities;
• and generally:
  • To provide information to our professional and legal advisors for the purpose of seeking advice from them;
  • To report to government and regulatory authorities, as required or authorised by Australian laws;
  • To manage billing and payments;
  • To fulfil legal, regulatory and public health requirements, both at law and under our contractual arrangements with you and others, including liaising with regulatory or health authorities, as required or authorised by law;
  • To respond to enquiries submitted via our website;
  • To undertake quality assurance/improvement processes, accreditation, audits, risk and claims management, patient satisfaction surveys, and staff education and training;
  • To handle complaints and respond to legal enquiries or actions;
  • To conduct patient, referrer and other stakeholder satisfaction surveys, including net promotor score (NPS) surveys, and analysing survey results to assess and improve our services, patient and referrer experience, and business performance. Requests to participate in surveys will be sent via SMS or email. The personal information we use to identify and action patient feedback are: first name, mobile number, location (site code), provider ID, Carlisle patient ID, visit number, visit date/time, and modality;
  • To obtain feedback about our services or provide advice or information to you about products, services, treatment options and clinical trials that are relevant to you;
  • (with respect to CCTV) for the safety and security of our personnel, the people who visit us in person, and our business;
  • detecting, investigating and preventing fraud, misconduct, and unlawful activity; and
  • updating your Personal Information, including destroying or de-identifying it when it is no longer relevant (to the extent applicable).
• to de-identify and aggregate personal information we collect for use in carrying out clinical research, quality assurance or customer service, health outcome and other business analytics;
• to de-identify and aggregate personal information about you and your use of our services to improve the quality of our services, and for research purposes. We may retain de-identified and anonymised information (that can no longer be associated with you) and may continue to use this de-identified data indefinitely without further notice to you;
• for any other purpose identified at the time of collection or as otherwise required or authorised by law.

Who does Carlisle Health Pty Ltd disclose personal information to?

We generally disclose your personal information for the purposes for which it was collected (set out above). We may disclose personal information about you to:

• our related entities;
• our employees, contractors, consultants, and volunteers who require the information to assist us with the purposes for which it was collected;
• government departments and agencies where required or authorised by law;
• third party service providers who assist us in operating our business and providing information, resources, goods and services to you or someone else on your behalf (including IT and technology service providers, payment service providers, recruitment providers, insurers, and professional advisers such as lawyers, accountants, and auditors);
• third parties to whom you have agreed we may disclose your information and where the information was collected from you (or from a third party on your behalf) for the purposes of passing it on to the third party;
• any other entity as otherwise required or authorised by law, including regulatory bodies; and
• if you are a patient: your doctor and other healthcare providers and professionals, including hospitals and healthcare facilities which may be involved in your care, a responsible person (such as a spouse, partner, relative, carer or attorney), your emergency contacts, the My Health Record program, unless you have opted not to participate, health insurers, and an attorney holding an enduring power of attorney containing health directions or an attorney with an advanced health directive. We may also disclose or make available your diagnostic images and related health information to healthcare providers and healthcare organisations involved in your care through authorised access functionality within imaging platforms we use, where access is permitted by law and must be consistent with the purpose for which the information was collected.

Where we disclose personal information to a third-party service provider, we require them to satisfy us that they have information security measures and information handling practices in place which comply to an acceptable standard with the requirements of the Privacy Act and the APPs.

We may expand or reduce our business, and this may involve the sale and/or transfer of control of all or part of our business. Personal information, where it is relevant to any part of the business for sale and/or transfer, may be disclosed to a proposed new owner or newly controlling entity for their due diligence purposes under controlled due diligence management, and upon completion of a sale or transfer, will be transferred to the new owner or newly controlling party to be used for the purposes for which it was provided.

Does Carlisle Health Pty Ltd keep data within Australia?

Carlisle Health Pty Ltd may enter into arrangements with other entities outside of Australia to store, access or use data we collect, including personal information, in order for them to provide services to us such as data transcription and processing, analysis, interpretation or the performance of specialised tests.

When we do this, we require such entities to satisfy us that they have information security measures and information handling practices in place which comply to an acceptable standard with the requirements of the Privacy Act and the APPs.

We only partner with offshore contractors with whom we have Confidentiality and Privacy Agreements in place, and which do not have cross-border disclosure obligations which may require or compel them to disclose or allow access to, voluntarily or in involuntarily, personal information they hold or to which they have access to governments or organisations outside of Australia. These offshore contractors are in New Zealand.

All health information we store is stored in Australia.

How does Carlisle Health Pty Ltd store and protect personal information?

The ways Carlisle Health Pty Ltd stores personal information it has collected include electronically, on digital media devices; as paper records; as medical diagnostic images and when appropriate as video and audio recordings.

We take the security and accuracy of this information very seriously and use best endeavours to employ the latest technology and processes, including access control, encryption and firewalls to protect the information we collect, use and disclose from unauthorised access, modification or disclosure, misuse and loss.

All of the management and staff of Carlisle Health Pty Ltd are required to observe the strictest obligations of confidentiality and are required to sign Confidentiality Agreements.

Unless we are required by law to retain it, we may destroy or permanently de-personalise your personal information, when it is no longer needed for the purposes described in this Policy. If you are a patient, we retain your health record, including your images and reports, for at least the period required by law, generally at least seven years from your last attendance or, where you were under 18 at the time of the service, until you reach the age of 25.

How we use AI tools

We use software tools that incorporate artificial intelligence to support the delivery and administration of our services.

These tools may pre-analyse diagnostic images to highlight features for our personnel’s attention, summarise the clinical history accompanying your referral, assist in ordering our worklist, assist in the patient booking process, and transcribe reports dictated by our personnel.

The tools we use operate in an assistive capacity only. Output generated by any AI tool is reviewed by qualified personnel before it is relied upon or becomes part of your health record. No diagnosis, clinical finding or report is issued on the basis of AI output alone.

We do not permit the providers of our AI tools to use your personal information or health information to train, develop, test or improve their products or models, unless the information has first been irreversibly de-identified in accordance with our de-identification procedures, or you have given separate, express and specific consent.

We also use AI tools internally for business analysis and decision support, and to transcribe and summarise meetings, which may involve personal information incidentally.

Cookies and pixels

Our websites use cookies and tracking pixels (Tracking Tools), including through the use of third party service providers.

A “cookie” is a small data file placed on your machine or device which lets our digital service store information. Cookies are not executable programs and cannot do anything to your computer.

A pixel or web beacon is a JavaScript code snippet embedded on a web page or email that collects data about

user interactions and behaviour. Pixels are often used for remarketing (that is, serving targeted ads on social media platforms or other websites).

The main purpose of cookies is to identify users to create a personal record of when that user visits our websites and to prepare customised web pages for them so that we may provide our services more effectively. We may also use cookies to monitor the use of our websites and digital services, like the numbers and frequency of visitors to our websites, to help us improve our services and identify any problems that need fixing. If you choose not to accept cookies from our websites, you will not be able to maintain a session-based interaction and will be treated as an anonymous browser.

Our websites also use a number of third party services that utilise Tracking Tools. Use of your personal information by these third parties is also subject to their own privacy policies. For details on how each provider uses information collected through Tracking Tools, please refer to their respective websites. The third party services we use include:

• Google Analytics, for audience measurement and website optimisation;
• Meta Pixel for advertising analytics and remarketing on Meta platforms such as Facebook and Instagram; and
• Adobe, for audience measurement, remarketing, and advertising performance tracking.

The information that is disclosed in relation to third party cookies is:

• information about your use of our website, your IP address, browser type, ISP, and referring/exit pages;
• pseudonymous identifiers such as cookie, browser and session IDs;
• session metrics such as your session start time, duration, pages per session and engagement time; and
• website engagement metrics such as clicks, time spent on pages and scroll behaviour.

Most browsers allow you to choose whether to accept cookies or not. If you do not wish to have cookies placed on your computer, please set your browser preferences to reject all cookies before accessing our websites. You may also adjust your browser settings or use browser extensions to block other Tracking Tools. However, please note that if you do this, you may not be able to use the full functionality of our websites.

How may I access and correct my personal information?

Carlisle Health Pty Ltd endeavours to ensure that the personal information (including sensitive health information it collects, uses and discloses is accurate, up-to-date. The accuracy and completeness of that information depends on the information you provide to us.

If you believe that personal information we hold about you is inaccurate, incomplete or out-of-date you may ask us to up-date our records. You may do this by providing us with information when you visit one of our clinics or by contacting our Privacy Manager, whose contact details are set out on the last page of this Policy. If, having regard for the purpose for which the personal information is held, we are satisfied that any part of the information we hold about you is inaccurate, incomplete or out of date, we will take reasonable steps to up-date that information.

You have the right to request access to the personal information we hold about you. You may do so by contacting our Privacy Manager, whose contact details are set out on the last page of this Policy. It will be necessary for you to provide us with proof of your identity before we will provide you with access to your information.

We will provide you with access to that information, unless it reasonable for us to refuse or limit such access because of a provision of the Privacy Act or other law; or because we believe that giving access to it could pose a serious threat to the life, health or safety of any person, or to public health or safety; or if giving access could adversely impact the privacy of others. If we decline a request for access, where reasonable, we will provide you our reasons and information about your ability to complain about such refusal.

There are no charges for requesting access to or the correction of your personal information, however we reserve our rights to charge you any reasonable administration fees associated with your request. We will notify you in advance of any applicable fees.

We prefer to provide images and report to you in consultation with your treating health care provider, so that complex clinical information can be explained to you within the context of your individual circumstances. To that end, Carlisle Health Pty Ltd uses a secure web-based password protected portal which allows our patients and their registered Health Professionals to access their images and reports.

To access this service, Health Professionals must request and be provided with a unique username and password by Carlisle Health Pty Ltd. They must accept the terms of the User Agreement prior to any access being provided.

How do I contact Carlisle Health Pty Ltd regarding privacy enquiries, complaints or concerns?

If you wish to make a complaint about the way we handle your personal information or have comments or questions concerning this Policy, please contact our Privacy Manager at the details set out below.

We may need to verify your identity and ask for further information, in order to investigate and respond to you. We will aim to do so within a reasonable time.

Privacy Manager contact details:

E-MAIL | privacy@carlislehealth.com.au
ADDRESS | Level 1, 59 Hill Street, Cabramatta NSW 2166

If we are unable to resolve your concern or complaint to your satisfaction, you may wish to contact the Office of the Australian Information Commissioner (OAIC). The OAIC has the power to investigate the matter and make a determination.

Office of the Australian Information Commissioner (OAIC)

GPO Box 5218 Sydney, NSW 2001
E-MAIL | enquiries@oaic.gov.au
PHONE | 1300 363 992
WEBSITE | www.oaic.gov.au

Effective date: 24 September 2026