Privacy Policy

1. About This Policy

Mine Medical Control ("we", "us", "our") is committed to protecting the privacy of all individuals whose information is handled through our platform. This Privacy Policy explains how we collect, use, hold and disclose personal information — including sensitive health information — in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

By accessing or using Mine Medical Control, you agree to the practices described in this policy. If you do not agree, please do not use our services.

2. Who We Are

Mine Medical Control is a product of Mine Medical Control, an Australian company providing medical management software to mine sites operating under Western Australian mining and pharmaceutical regulations.

3. Information We Collect

3.1 Account & Organisation Information

When an organisation subscribes to Mine Medical Control, we collect:

• Organisation name, ABN and site location details
• Administrator name, email address and contact information
• Billing name and email address
• Payment information (processed securely by Stripe — we do not store card numbers)
• User account details for each staff member added to the platform (name, email, role)

3.2 Clinical & Patient Information

The core function of Mine Medical Control is to record and manage patient care information on behalf of mine site medical services. Through use of the platform, the following categories of information may be entered and stored:

• Patient name, date of birth, employee number and contact details
• Chief complaint, mechanism of injury or illness, and clinical history
• Vital signs (blood pressure, heart rate, SpO₂, respiratory rate, GCS, temperature)
• Treatment administered, medications given and dosages
• Controlled drug administration records (S8, S4R, S4 medications)
• Patient outcomes, handover notes and follow-up actions
• Medical attendance letters generated from patient encounter data

3.3 Usage & Technical Information

We may automatically collect limited technical data to operate and improve the platform:

• Browser type and version, device type and operating system
• IP address and approximate location (city/region level)
• Pages visited, actions taken and session duration
• Error logs and performance diagnostics

4. Health Information — Sensitive Data

Mine Medical Control processes health information as a data processor on behalf of the subscribing mine site medical service (the data controller). The medical service operator is responsible for ensuring that health information is collected, entered and used in accordance with applicable laws and professional obligations, including:

• Privacy Act 1988 (Cth) — Australian Privacy Principles
• Health Records and Information Privacy Act 2002 (where applicable)
• Applicable WA health privacy guidelines
• Professional obligations under relevant registration standards (AHPRA)

We collect and handle health information only to the extent necessary to provide the platform services and will not use or disclose patient health information for any other purpose without explicit consent, unless required by law.

5. How We Use Information

We use the information we collect for the following purposes:

• Service delivery: Providing, operating and maintaining the Mine Medical Control platform
• Account management: Creating and managing user accounts, organisations and subscriptions
• Billing: Processing subscription payments via Stripe and managing billing communications
• Email communications: Sending attendance letters from patient encounter data via the integrated email service (Gmail API)
• Security: Monitoring for unauthorised access, fraud or misuse of the platform
• Support: Responding to support requests and resolving technical issues
• Compliance: Meeting our legal obligations as a data processor and Australian Privacy Act obligations
• Improvement: Analysing anonymised usage patterns to improve platform features (never using identifiable patient data)

6. Disclosure to Third Parties

We engage the following trusted third-party service providers who may process your information as part of delivering our services. All providers are bound by appropriate data processing agreements:

6.1 Google Firebase & Google Cloud Platform

Our platform is hosted on Google Firebase and Google Cloud Platform, with data stored in Australian-region data centres where available. Firebase services used include Authentication, Firestore (database) and Hosting. Google's privacy policy and data processing terms apply.

6.2 Stripe

Payment processing is handled by Stripe, Inc. When you subscribe to a plan, your payment card details are entered directly on Stripe's secure payment page and are never transmitted to or stored by Mine Medical Control. Stripe is PCI DSS Level 1 certified. Stripe's privacy policy applies to payment data.

6.3 Google Gmail API

The attendance letter email feature uses the Google Gmail API to dispatch letters on behalf of the configured sender address. Content transmitted through this service is subject to Google's terms.

6.4 Legal & Regulatory Disclosure

We may disclose information where required by law, regulation, court order, or at the direction of a regulatory authority. Where possible and lawful, we will notify you before making such a disclosure.

6.5 Business Transfers

In the event of a merger, acquisition or sale of all or part of our business, personal information may be transferred as part of that transaction. You will be notified of any change in ownership and your choices in relation to your information.

7. Data Storage & Security

Your data is stored on Google Cloud Platform infrastructure. We implement the following security measures:

• All data transmitted to and from the platform is encrypted in transit using TLS 1.2 or higher
• Data at rest is encrypted by Google Cloud's default encryption
• Role-based access controls ensure users can only access data within their authorised organisation
• Firebase Authentication enforces secure login for all platform users
• S8 drug register entries require dual verification (two-staff sign-off) by design
• All actions on the platform are logged with timestamps and user identifiers
• API keys and service credentials are stored as encrypted secrets and never exposed in code

While we implement industry-standard security measures, no system is completely immune from security threats. We encourage all users to use strong passwords and report any suspected security issues to us immediately.

8. Data Retention

We retain information for as long as necessary to provide our services and meet our legal obligations:

• Patient care records (PCRs): Retained for the duration of the active subscription plus seven (7) years after the last patient encounter, in accordance with Australian medical record retention standards
• Drug register records: Retained for a minimum of seven (7) years as required by the Medicines and Poisons Regulations 2016 (WA)
• Account and billing information: Retained for seven (7) years after subscription end for Australian tax and legal compliance purposes
• Usage logs and diagnostics: Retained for up to 90 days, then deleted or anonymised

Upon cancellation of a subscription, data is moved to an archived state and access is suspended. Data is not immediately deleted to allow for potential reactivation or data export requests.

9. Your Rights

Under the Australian Privacy Act, you have the right to:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate, out-of-date or incomplete information
• Complaint: Lodge a complaint if you believe we have breached the Australian Privacy Principles
• Opt out: Opt out of receiving non-essential communications from us

For patient records held within the platform, the relevant mine site medical service is the appropriate point of contact as the data controller. Mine Medical Control can facilitate access or correction requests where directed by the subscribing organisation.

To exercise any of these rights, contact us at support@minemc.com.au. We will respond within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

10. Cookies & Tracking

The Mine Medical Control marketing website (minemc.com.au) may use limited cookies for:

• Session management and security
• Remembering your preferences
• Analytics (Google Analytics, if enabled) — using anonymised data only

The Mine Medical Control application (mine-medical-control.web.app) uses session cookies strictly for authentication and security purposes.

You can control cookies through your browser settings. Disabling cookies may affect some functionality of the marketing website but will not affect your ability to use the application.

11. Children's Privacy

Mine Medical Control is a professional platform intended for use by authorised medical personnel at mine sites. It is not directed at children under 18. We do not knowingly collect personal information from minors other than as incidental to patient care records entered by authorised medical staff in their professional capacity.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology or legal obligations. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Notify current subscribers by email at least 14 days before changes take effect
• Post a notice within the Mine Medical Control platform

Continued use of the platform after changes take effect constitutes acceptance of the revised policy.

13. Contact Us

For any privacy-related questions, requests or complaints, please contact us:

If you are unsatisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC):