Privacy Policy
Honicomb is built for a profession that handles sensitive information every day. This policy explains what we collect, why we collect it, and the steps we take to keep it safe — in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
Honicomb Pty Ltd (“Honicomb”, “we”, “us”) operates an Australian doctor-to-doctor referral and Medicare Benefits Schedule (MBS) billing-support platform. We take privacy seriously because the people who use Honicomb — and the patients they care for — trust us with information that matters.
01 About this policy
This policy applies to the Honicomb website, the GP, specialist and administrator portals, and any related services we provide (together, the “Platform”). It covers personal information and sensitive information (including health information) as those terms are defined in the Privacy Act 1988 (Cth).
By creating an account or using the Platform, you acknowledge the practices described here. Where Honicomb handles patient information on behalf of a treating practitioner, that practitioner remains the party with the primary clinical relationship to the patient, and Honicomb acts as a conduit and record-keeper for the referral.
02 Information we collect
We only collect what we need to run a verified referral network. That includes:
- Account & identity data — name, email, phone, password (stored only as a salted hash), role (GP, specialist or administrator) and account status.
- Professional credentials — your AHPRA registration number, specialty and sub-specialty, provider details, practice name and address, consultation and billing type. These let us verify that every member is a registered Australian practitioner.
- Referral data — the clinical and administrative details a GP includes when referring a patient, and the status updates a specialist records in response (see Section 03).
- Billing & subscription data — your subscription tier and status. Card payments are processed by our PCI-DSS-compliant payment provider; Honicomb does not store full card numbers on its own systems.
- Usage & technical data — IP address, device and browser type, pages visited, and queries you run against the AI Billing Assistant, collected to keep the Platform secure and to improve it.
Where it is lawful and practical to do so, you may interact with parts of the public site (such as the homepage MBS search) without giving us identifying information.
03 Health information & referrals
Data minimisation by design. Honicomb is built so that referrals carry the minimum clinical detail needed to triage and accept a patient — not a full medical record.
Health information is sensitive information and attracts the highest level of protection under the APPs. We collect it only with the consent of the referring practitioner, who is responsible for obtaining the patient’s consent to share their information for the purpose of the referral, consistent with their own professional and privacy obligations.
Access to referral content is scoped to the parties involved — the referring GP, the receiving specialist, and authorised Honicomb administrators acting under strict confidentiality. We do not use patient health information for marketing, and we never sell it.
04 How we use information
We use the information we collect to:
- verify practitioner identity and AHPRA registration before granting access;
- create, route, track and store referrals between GPs and specialists;
- provide the MBS search and AI Billing Assistant features;
- manage subscriptions, payments and account administration;
- secure the Platform, prevent fraud and misuse, and meet our legal obligations;
- respond to your enquiries and provide support; and
- improve our services, using aggregated or de-identified data wherever possible.
We will only use your information for a purpose you would reasonably expect, or for a directly related secondary purpose, unless you have consented otherwise or we are required or authorised by law.
05 When we disclose information
Honicomb does not sell personal information. We disclose it only in limited, necessary circumstances:
- Between members — to the GP and specialist who are party to a referral, so the referral can be actioned.
- To service providers — hosting, payment processing, email delivery and analytics providers who are bound to handle data only on our instructions and to keep it secure.
- To verify credentials — to confirm AHPRA registration and professional standing.
- Where required by law — to courts, regulators or law-enforcement bodies where we are legally compelled, or to prevent a serious threat to life, health or safety.
06 The AI Billing Assistant
The AI Billing Assistant helps members interpret the MBS by retrieving relevant item numbers and generating plain-language explanations. Queries you submit are processed by a third-party AI provider to generate a response.
Please don’t paste identifiable patient details into the assistant. Ask your billing questions in general terms. The assistant provides general information about MBS items — it is not financial, legal or clinical advice, and final billing decisions remain the practitioner’s responsibility.
We may retain assistant conversations associated with your account so you can return to them and so we can monitor quality and safety. We do not use the content of your conversations to train external public AI models.
07 Storage, security & location
We protect information with measures appropriate to its sensitivity, including encryption in transit (TLS), hashed credentials, role-based access controls, network and application-level safeguards, and audit logging of administrative activity.
We host data with reputable cloud providers and prefer Australian data-region storage where available. Some service providers (for example, AI processing) may handle information overseas. Where information is disclosed outside Australia, we take reasonable steps to ensure it is handled in a way consistent with the APPs.
No method of transmission or storage is completely secure. If a data breach likely to cause serious harm occurs, we will respond in accordance with the Notifiable Data Breaches scheme under the Privacy Act.
08 How long we keep it
We keep personal information only for as long as it is needed for the purposes described in this policy, or for as long as we are required to retain it under Australian law — including medical records and tax-related retention obligations. Referral records may need to be retained for extended periods to support continuity of care and to meet record-keeping requirements. When information is no longer required, we securely delete or de-identify it.
09 Your rights & choices
Under the Australian Privacy Principles, you can:
- Access the personal information we hold about you, and ask for a copy;
- Correct information that is inaccurate, out of date or incomplete — much of which you can update directly in your profile;
- Withdraw consent or opt out of non-essential communications at any time; and
- Close your account, subject to any records we must retain by law.
To exercise any of these rights, contact us using the details below. We may need to verify your identity first, and we will respond within a reasonable period.
11 Changes to this policy
We may update this policy from time to time to reflect changes in our services, technology or legal obligations. When we make material changes, we will update the “last updated” date above and, where appropriate, notify you through the Platform. Continued use of Honicomb after a change means you accept the updated policy.
12 Contact & complaints
Privacy enquiries
If you have a question, want to access or correct your information, or wish to make a complaint about how we have handled your personal information, contact our Privacy Officer at privacy@honicomb.com.au.
We will acknowledge your complaint promptly and aim to resolve it fairly. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.