HPNA is part of Valuo

03 8375 4177

Privacy Policy

Last updated

About this policy

This policy explains what personal information HPNA collects through this website, why we collect it, who we disclose it to, how long we keep it, how we protect it, and how you can ask for access to it or ask us to correct it. HPNA provides independent business valuations for healthcare businesses across Australia. If you want to know what an engagement involves before you send us anything, read how it works or about HPNA.

This website is operated by Valuation Group Pty Ltd (ABN 48 702 469 252), trading as HPNA, referred to below as HPNA, we or us.

Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether or not it is true and whether or not it is recorded in a material form. That definition is in section 6(1) of the Privacy Act 1988.

HPNA handles personal information in accordance with the Australian Privacy Principles, the 13 principles in Schedule 1 to the Privacy Act 1988. The Office of the Australian Information Commissioner (the OAIC) states that the Australian Privacy Principles govern the collection, use and disclosure of personal information, an organisation's governance and accountability, the integrity and correction of personal information, and the rights of individuals to access their personal information. The OAIC is the regulator that oversees them. Australian Privacy Principle 1 requires a clearly expressed and up to date policy describing how an entity manages personal information. This is that policy.

The OAIC states that a small business, one with an annual turnover of $3 million or less, is generally not covered by the Privacy Act 1988, that some businesses are covered whatever their turnover, including health service providers and businesses that trade in personal information, and that a small business may choose to be covered. HPNA does not rely on that exemption. We apply the Australian Privacy Principles to every piece of personal information we handle, whether or not the Act requires it of us, and this policy is written on that basis.

What we collect

The enquiry form

When you complete the form on request a valuation or contact you give us your name and email address and, if you choose, your phone number, the purpose of the valuation and a short description of the business and what you need. Those fields let us work out whether we can help and what an engagement would involve.

The form also records the page you were on when you submitted it and, where available, how you arrived at the site: the landing page, the referring site, any campaign tags in the link, the advertising click identifier and the time of your first visit (and of your most recent visit from a search engine, an advertisement or another website). Your browser keeps those details on your device until you send the form, and they are sent only to us, with your enquiry, so we can tell which channels produce genuine enquiries.

Documents you share with us

The enquiry form does not accept attachments. If an engagement proceeds, documents are shared with us through a private link. Owners of healthcare businesses usually share financial statements, tax returns, management reports, a lease, a shareholder or partnership agreement, practitioner service agreements, or a report exported from a practice management or dispensing system.

Material of that kind carries personal information about identifiable individuals even though it is prepared for a commercial purpose. Practitioner billing and service reports, contractor and service-fee arrangements, wage and superannuation records, and the terms on which a practitioner occupies a suite all identify people. The usual examples in this sector are Medicare and MBS billing summaries for a medical or allied health practice, script volume and dispensing reports for a pharmacy, participant service agreements and plan-management reports for an NDIS provider, and rostering and award classification records for an aged care or community care business.

Send only what is needed to answer the question you are asking us, and remove or aggregate identifiers where you can. A practice can usually be valued from practitioner-level billing that is de-identified or shown by practitioner code rather than by name.

Patient, participant, resident and client records

Please do not send us patient, participant, resident or client records.

Sensitive information is a subset of personal information under section 6(1) of the Privacy Act 1988 and it includes health information about an individual. It attracts additional protection. HPNA values businesses, not the people treated or supported by them, and does not need health information about a patient or a participant to do that. If a document you send contains it, tell us, and we will confirm whether we need the document at all or whether a redacted or aggregated version is enough.

Correspondence and engagement records

If an engagement proceeds we also hold the correspondence, notes, financial and operational information and working papers created in the course of it. What is held depends on the scope agreed for that engagement.

The valuation calculator

The valuation calculator, which also appears on some of our "what is my practice worth" pages, runs in your browser, and nothing you type into it is sent to us unless you ask for the breakdown by email. Whether or not you ask, and unless you have opted out of analytics, Google receives only the industry you chose, the basis of the result (a profit figure you entered or a typical margin for the industry) and whether you asked for the breakdown and, if you did, the same record an enquiry produces (the page it came from and which advertising campaign, if any, first brought you to the site), never your figures or your email address.

If you ask for the breakdown, we collect your email address, the industry, figures and options you chose and the range calculated from them, the page you were on, how you arrived at the site where that has been recorded (landing page, referrer, campaign tags, advertising click identifier and time of first visit), your approximate country and your browser type. The request is received by an endpoint at valuationgroup.au operated by Valuation Group Pty Ltd, the same company that operates this website, and is recorded in our practice management system in the same way as an enquiry. The breakdown is emailed to you, and a notice of the request to us, through Resend, an email delivery service.

To limit abuse, a keyed one-way hash of your IP address and of your email address is kept briefly, separately from the request, and deleted after it expires. The website's own copy of the request is deleted automatically after 90 days. The record in our practice management system is kept while we need it to respond to you and to meet our record-keeping obligations, and we will delete it if you ask.

Technical information

This website is delivered by a cloud hosting provider whose systems keep short-lived request records that may include an internet protocol (IP) address, the browser used and the pages requested. To limit automated abuse of the enquiry form, the site counts recent submissions against a one-way hash of the requester's IP address, which is an irreversible fingerprint, rather than against the address itself. Where an automated bot check is enabled on the form, the provider of that check also processes technical information about the request.

Analytics, and your choice about it

Two things are worth separating here. The first is Cloudflare Web Analytics, which our hosting provider adds to every page. It counts page views and referrers in aggregate, sets no cookies, stores nothing on your device and does not follow you to other websites.

The second is Google Analytics and Google Ads measurement, which do track across a session and for which Google sets cookies on your device. These load when you arrive, so that we can see how the site is used and which enquiries came from our advertising. You can opt out at any time from the notice at the foot of the page, and we will stop sending measurement data from your device. Your choice is stored in your own browser under a single local storage key, is not sent to us, and can be changed at any time. The website itself sets no cookies of its own.

We do not send Google the contents of your enquiry. What we record is that an enquiry was submitted, the reference number we gave it, which form on the site was used and which page it came from. Your name, your email address, your telephone number and what you wrote are never sent to an analytics provider.

Why we collect it and how we use it

Australian Privacy Principle 3 limits the collection of personal information to what is reasonably necessary for our functions and activities, and Australian Privacy Principle 6 limits use and disclosure to the purpose it was collected for, a directly related purpose you would reasonably expect, or a purpose you consent to. We collect the information above to:

  • respond to your enquiry and confirm the scope, purpose, valuation date and fee of a possible engagement
  • carry out a valuation engagement, if one proceeds, and communicate with you and the advisers you nominate
  • keep our own business, accounting and quality records
  • understand in aggregate how this website is used, and which enquiries came from our advertising, unless you have opted out
  • meet obligations imposed on us by law

We do not sell personal information and we do not disclose it to anyone for their own marketing. HPNA does not send marketing or newsletter communications and this website has no mailing list. We contact you about your enquiry, about an engagement, or about a matter you have raised with us, and for nothing else.

Decisions about your enquiry are made by people

A valuation conclusion is an opinion formed by a valuer, not an output of a model or a calculator. The valuation calculator on this website shows indicative arithmetic, not a valuation, and decides nothing about you. Every enquiry submitted through this website is recorded, delivered to HPNA and read by a person. The only automated processing applied to a submission is a set of checks that tell a genuine enquiry from spam: a limit on how many submissions can be sent from one connection in a short period, a hidden form field that real browsers leave empty, a check that the form was not submitted faster than a person could fill it and, when it is switched on, Cloudflare Turnstile. Those checks decide only whether a submission is accepted as an enquiry. Nothing scores, ranks, screens or triages enquiries, and nothing about you or your business is decided by a program.

At the time of writing the OAIC states that from 10 December 2026, an entity covered by the Privacy Act must add information to its privacy policy where it has arranged for a computer program to make, or to do something substantially and directly related to making, a decision that could reasonably be expected to significantly affect the rights or interests of an individual, and personal information about that individual is used in the operation of the program. The policy must then describe the kinds of personal information used and the kinds of decisions made solely by the operation of such a program. HPNA has not arranged for any computer program to make, or to do anything substantially and directly related to making, a decision of that kind. If that ever changes, this section will be updated before the change takes effect.

Who we disclose it to

We disclose personal information to:

  • the provider that runs this website, delivers our email and holds the enquiry record, so that your enquiry and our acknowledgement reach their destination
  • Google, unless you have opted out of analytics, which receives the measurement events described above together with the identifiers its own cookies set, and which processes them outside Australia
  • Resend, Inc., an email delivery service, which sends the calculator breakdown you ask for and our notice of the request
  • your accountant, lawyer or other adviser, where you ask us to deal with them
  • professional advisers of our own, where we need advice about a matter
  • anyone else you direct us to, or where disclosure is required or authorised by law

HPNA and Oliver Group Valuations are trading names of the same company, Valuation Group Pty Ltd, so an enquiry handled by our Oliver Group practice is not disclosed to anybody outside it. Because the signing valuer works across both, a reply to your enquiry may come from an olivergroup.com.au address.

Today that provider is Cloudflare, Inc., which hosts this website on its network, delivers the enquiry email and our acknowledgement, and provides the spam protection described above. An enquiry record exists in the email Cloudflare delivers and in a short-term record store operated by Cloudflare, so that an enquiry is not lost if email delivery fails and so that it appears in our practice management system. Records in that store are deleted automatically 90 days after they are created. The enquiry form does not accept attachments. Each provider holds information under its own published terms and privacy policy and processes it only to provide its service to HPNA.

Disclosure outside Australia

Some of the providers described above may store or process information on servers outside Australia. Australian Privacy Principle 8 requires an entity, before it discloses personal information to an overseas recipient, to take such steps as are reasonable in the circumstances to ensure that the recipient does not breach the Australian Privacy Principles. Section 16C of the Privacy Act 1988 goes further: an entity that discloses personal information to an overseas recipient remains accountable for acts and practices of that recipient that would breach those principles.

Cloudflare is a United States company that operates infrastructure in many countries, so information you send through this website may be stored or processed in the United States and in other countries where Cloudflare operates. HPNA relies on the standard terms and security commitments Cloudflare publishes and has no separate contract with it. Resend is also a United States company, so a calculator breakdown you ask for may be processed in the United States, under Resend's published terms and privacy policy.

How we store and protect it

Australian Privacy Principle 11 requires an entity to take reasonable steps to protect personal information it holds from misuse, interference and loss, and from unauthorised access, modification or disclosure. Information submitted through this website is sent over an encrypted connection, and access to enquiry records and engagement files is restricted to the people who need it. No transmission over the internet and no system of storage is completely secure, and we cannot promise absolute security.

The Notifiable Data Breaches scheme applies to entities covered by the Privacy Act 1988. The OAIC states that where a data breach involving personal information is likely to result in serious harm, the entity must notify the affected individuals and the OAIC. We will follow that scheme if a breach affecting your information occurs.

How long we keep it

We keep enquiry records and engagement files for as long as we need them for the purpose they were collected for and for as long as we are required to keep them by law, including tax and limitation periods. When neither applies, we take reasonable steps to destroy the information or to de-identify it.

An enquiry that does not become an engagement is kept only while it may still lead to one and is then destroyed or de-identified in a periodic review. An engagement file, including working papers and the report, is kept for as long as the law and our record-keeping obligations require, because a valuation report can be relied on, questioned or audited years after it is issued.

Access and correction

Australian Privacy Principle 12 gives you the right to ask for access to the personal information we hold about you, and Australian Privacy Principle 13 requires us to take reasonable steps to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading. Ask us through the form on our contact page and tell us what you are looking for.

We may need to confirm your identity first. We do not charge you for making a request. The OAIC's guidance on Australian Privacy Principle 12 is that an organisation may impose a charge for giving access provided the charge is not excessive, that a charge must not be used to discourage a request, and that the organisation should tell the individual in advance if a charge may be imposed and the likely amount. We will follow that guidance, so if retrieving a large volume of material would involve a charge we will tell you the likely amount before we start and you can decide whether to go ahead. The same guidance says an organisation must respond in a reasonable period after the request is made, and that as a general guide a reasonable period should not exceed 30 calendar days. If we cannot give you access or make a correction, we will tell you why in writing and how to take the matter further.

Dealing with us anonymously

Australian Privacy Principle 2 gives you the option of dealing with an entity anonymously or under a pseudonym where that is lawful and practicable. You can read this entire website, including the glossary and the insights articles, without telling us who you are, and you can ask a general question about how valuations work without identifying yourself. We cannot prepare a valuation, or reply to a written enquiry, without contact details.

Complaints

If you think we have handled your personal information in a way that breaches the Australian Privacy Principles, tell us first. Send us the details through the form on our contact page, setting out what happened and what you would like us to do. We will investigate and respond to you in writing.

The OAIC asks that you complain to the organisation first. Its guidance states that if the organisation does not respond to your complaint in 30 days, or you are not happy with the response, you can then lodge a complaint with the OAIC. The OAIC publishes its complaint form and its current contact details on its own website.

Changes to this policy

We may update this policy as our systems, providers or obligations change. The date at the top of this page shows when it was last updated. Material changes will be described here rather than made silently.

Contact

Valuation Group Pty Ltd (ABN 48 702 469 252), trading as HPNA. Privacy enquiries go through the form on our contact page.

See also our website terms of use and our disclaimer.

References