Privacy policy

This policy explains how Dr Harry Constantin's practice collects, uses, stores and shares your personal and health information, and how you can see it, correct it or make a complaint. It applies to patients, people who contact the practice and visitors to this website.

Version 1.0 · Last reviewed October 2026. The current version is always on this page.

The law we follow

The practice handles your information in line with:

• The Privacy Act 1988 (Cth) and the Australian Privacy Principles.
• The Health Records and Information Privacy Act 2002 (NSW) and the NSW Health Privacy Principles.
• The Notifiable Data Breaches scheme under the Privacy Act.

What information we collect

We only collect the information we need to look after you. This may include:

• Your details: name, date of birth, address, phone number, email address and emergency contact.
• Billing and cover: Medicare, health fund, Department of Veterans' Affairs, workers compensation and CTP claim details.
• Your health: medical history, medicines, allergies, family history, lifestyle factors such as smoking, and information about your shoulder or elbow problem.
• Records made during your care: consultation notes, examination findings, operation notes, clinical photos taken during your consultation, photos and videos taken during surgery, letters and reports.
• Forms you complete: registration details, health questionnaires and consent forms you fill in online before your appointment or surgery.
• Information from others: referrals from your GP or specialist, scan and pathology reports, hospital records, and reports from your physiotherapist or insurer.

Where possible we collect information directly from you. We collect it from others, such as your GP, with your consent or where it is needed for your care.

How we use your information

We use your information to:

• assess, diagnose and treat you, and plan your surgery and recovery
• communicate with you, your GP, your physiotherapist and the hospital about your care
• bill Medicare, your health fund or your insurer
• meet our legal, professional and insurance obligations

We may also use information for purposes you would reasonably expect, such as checking the quality and results of our care (clinical audit). Information is used for research or teaching only with your consent, with ethics approval, or after it has been de-identified so that you cannot be identified.

Your information is never used for marketing, and we do not sell or rent it to anyone.

AI-assisted note-taking

Dr Constantin may use an AI medical scribe called Medow Health during your consultation, but only if you agree. It listens to the consultation and drafts the clinical notes and letters. Dr Constantin checks and corrects every note before it is saved to your record.

• Where it is stored: in Australia, on secure Microsoft Azure servers.
• Audio: deleted automatically within 7 days, once the note has been checked.
• Training: your information is not used to train AI models.
• Your choice: you can say no, or ask for it to be switched off at any point, and this will not affect your care.

Dr Constantin will ask for your consent before the scribe is used, and your answer is recorded in your notes. A consultation is never recorded without your consent.

Teaching, photos and recordings

• Doctors in training: Dr Constantin teaches surgical registrars, fellows and medical students. We will ask you before a trainee or student is involved in your consultation or care, and you can say no.
• Clinical photos and videos: Dr Constantin may take photos during your consultation, or photos and videos during your operation, to record your condition and treatment. They are stored securely in your medical record in Gentu. They may also be used for teaching, research or presentations, but only with your consent or once they have been de-identified so that you cannot be identified. You can ask for photos not to be taken for teaching.
• Case discussions: your case may be discussed at a clinical meeting, such as the monthly orthopaedic department meeting at the Mater Hospital, to get the views of other surgeons. Only the information needed for your care is shared.
• Research: Dr Constantin's research is conducted through the North Sydney Orthopaedic Research Group (NSORG). Taking part in research is voluntary, requires ethics approval, and you can withdraw at any time without it affecting your care.
• Social media and advertising: your information, photos and story are never shared on social media or used in advertising.

Visit the North Sydney Orthopaedic Research Group (NSORG) website

Who we share your information with

We share your information only where it is needed for your care, where you have agreed, or where the law requires it:

• Your treating team: your GP, referring doctor, other specialists, anaesthetist, assistant surgeon, hospital staff and physiotherapist.
• Payers: Medicare, the Department of Veterans' Affairs, your health fund, and workers compensation or CTP insurers for an accepted claim.
• Registries: if you have a shoulder replacement, details of the operation and implant are sent to the Australian Orthopaedic Association National Joint Replacement Registry, which monitors how joint replacements perform. You can ask not to be included.
• Where the law requires it: for example a subpoena or court order, a notification to a public health authority, or a request from AHPRA or our medical indemnity insurer.

Letters about your care. As a rule, Dr Constantin sends a copy of his clinical letter to you, as well as to your GP, your physiotherapist and anyone else in your healthcare team, such as other specialists. If there is anyone you would prefer not to receive a letter, please let Dr Constantin's practice manager know.

We use trusted service providers to run the practice. They can only use your information to provide their service to us:

• Gentu (Magentus): practice management software that holds your medical record, appointments and billing. Data is stored in Australia.
• Medow Health: AI scribe (see above). Data is stored in Australia.
• Consentic: secure online forms we send you to complete, such as registration details, health questionnaires and consent forms. Your answers are saved to your medical record in Gentu. Consentic encrypts information when it is sent and when it is stored, and only authorised people can access it (see overseas).
• HealthLink: secure messaging for referrals, letters and results between doctors.
• Email: the practice email account, used for appointments and correspondence. All email data is stored in Microsoft's cloud in Australia, protected by Australian privacy law.
• Netlify: the company that hosts this website and receives the appointment and referral forms you submit on it.

Is my information sent overseas?

Your medical record is stored in Australia. Some of the services we use operate overseas or may store information outside Australia:

• Website forms: Netlify is based in the United States, so details you enter in the appointment or referral forms on this website may be stored overseas. Please do not include detailed medical information in these forms.
• Online forms (Consentic): Consentic operates internationally, and the forms you complete through it may be handled or stored outside Australia. Consentic says it takes reasonable steps to make sure anyone receiving information overseas complies with the Privacy Act. Information is encrypted when it is sent and when it is stored. Your completed forms are saved to your medical record in Gentu, which is stored in Australia.
• Google: this website uses Google Fonts and Google Maps. When a page loads, your browser sends your internet (IP) address to Google, which may process it overseas. No health information is sent.

We take reasonable steps to make sure these providers protect your information. If you would rather not use the online forms, please call the rooms on (02) 9409 0503.

How we keep it safe

• Your records are electronic and stored securely in the cloud. The practice does not keep paper files.
• Access is limited to people who need it for your care or to run the practice, using individual accounts with passwords and multi-factor authentication where available.
• Information is encrypted when it is sent and when it is stored.
• Everyone who works with the practice is bound by confidentiality.

If something goes wrong. If there is a data breach that is likely to cause you serious harm, we will tell you and the Office of the Australian Information Commissioner (OAIC) as soon as practicable, and explain what you can do to protect yourself.

How long we keep it

Under NSW law, health records are kept for at least 7 years after your last visit. If you were under 18 when the information was collected, records are kept until you turn 25, or for 7 years after your last visit, whichever is later. Records may be kept longer where there is a legal reason. After that, they are securely destroyed or de-identified. If the practice closes or moves, your records will continue to be kept and made available to you as NSW law requires.

Your rights

• See your records: you can ask for a copy of the information we hold about you. We will acknowledge your request within 14 days and respond within 30 days. A reasonable fee may apply for large copies, and we will tell you before we charge it. In rare cases the law allows access to be limited, and we will explain why.
• Transfer your records: if you move to another doctor, we will promptly send your records or a summary when you or your new doctor ask.
• Correct your records: if something is wrong, out of date or incomplete, tell us and we will correct it or add a note.
• Withdraw consent: you can change your mind about how your information is used, for example for AI note-taking or research, at any time. This will not affect your care, but it cannot undo what has already happened.
• Stay anonymous: you can make a general enquiry without giving your name, but this is not usually possible once you become a patient.
• Parents and guardians: a parent or guardian can usually act for a child. Older children may be able to make their own decisions about their health information.

To make a request, contact the rooms (see Contact and complaints).

This website

• This website does not use advertising or analytics cookies, and does not track you across other websites.
• If you submit a form, we receive the details you enter so we can reply to you and arrange your appointment.
• The hosting company keeps basic technical logs, such as your IP address and browser type, to run the site securely.
• Links to other websites, such as hospitals and professional bodies, are covered by their own privacy policies.

Contact and complaints

If you have a question or concern about your privacy, please contact the practice first. We will acknowledge your complaint within 14 days and aim to resolve it within 30 days.

• Privacy contact: Renee Klioufis, Patient Liaison Officer
• Email: team@drharryconstantin.com (please mark it "Private and confidential")
• Phone: (02) 9409 0503
• Post: Dr Harry Constantin, North Sydney Orthopaedic and Sports Medicine Centre, The Mater Hospital, 25 Rocklands Rd, Wollstonecraft NSW 2065

If you are not happy with our response, you can contact:

• Office of the Australian Information Commissioner: oaic.gov.au or 1300 363 992
• NSW Information and Privacy Commission: ipc.nsw.gov.au or 1800 472 679

Changes to this policy

We may update this policy when our services, systems or the law change. The latest version, with its review date, is always on this page.

Frequently asked questions

This policy is general information about how the practice handles personal information. It is not legal advice.