Yes, this type of information is called sensitive information and is addressed in the Privacy Act 1988 (Cth). You should set out the type of health information you will be collecting, for example, weight, height, medical conditions, medications and how this information will be used or distributed in your Privacy Policy.