Privacy Policy

Who this policy covers

This policy applies to The Physio Studio at 93 Goodwood Road, Goodwood SA 5034, and to every practitioner and staff member working here.

As a health service provider we are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles. This applies to us regardless of our size: the small business exemption available to most businesses does not extend to health service providers. Our practitioners are also bound by the confidentiality and record-keeping obligations in the Physiotherapy Board of Australia's Code of Conduct.

What we collect

We collect personal information and health information. Health information is treated as sensitive information under the Privacy Act, which means a higher standard applies to how we collect and handle it.

Personal details

• Your name, date of birth, address, phone number and email address
• Your emergency contact, and for children, their parent or guardian
• Medicare, DVA, private health fund, NDIS, ReturnToWorkSA or CTP claim details where relevant
• Payment and billing information

Health information

• Your presenting problem, symptoms and injury history
• Relevant medical history, medications and previous investigations
• Assessment findings, diagnoses, treatment provided and your progress
• Correspondence with your GP, specialist or other treating practitioners

Recordings and measurements

Depending on the service you receive, we may record:

• Treadmill and gait video, as part of a running assessment
• On-bike video, as part of a bike fit
• Force plate and dynamometry data from VALD ForceDecks strength and balance testing
• Exercise videos or photographs shared with you through Physitrack or VALD TeleHab

We record these only where they help your care, and we ask your permission first. They are used for your treatment and progress tracking, and nothing else. We do not use patient video or photographs in advertising or on our website.

Digital scribing

Some of our practitioners use Heidi, an Australian clinical documentation tool, to help write consultation notes. Heidi listens to the consultation and produces a draft note, which the practitioner reviews and corrects before it enters your record.

We will tell you before using it and ask whether you're comfortable. You can decline, and your care will not be affected in any way. The audio is not retained: only the written note is kept, in your file. Heidi stores data in Australia.

How we collect it

Usually directly from you, in person, by phone, through our online booking system or on the forms you complete before your first appointment.

Sometimes we receive information from others: a referral from your GP or specialist, an insurer or claims manager, or a family member where you've asked them to speak for you. If we receive information about you from someone else and you haven't been told, we'll let you know unless there's a good reason not to.

Why we collect it

• To assess, diagnose and treat you, and to plan your care
• To communicate with other practitioners involved in your treatment
• To bill you and process claims through Medicare, DVA, HICAPS, private health funds, ReturnToWorkSA, CTP insurers or the NDIS
• To send appointment reminders and confirmations
• To meet our legal, professional and insurance obligations
• To improve our service, using de-identified information

If you choose not to give us information we've asked for, we'll explain the consequences. In some cases we may not be able to treat you safely without it.

Who we share it with

We share your information only where it's part of your care, part of a claim you've made, or required by law. Specifically:

Who	Why
Your GP, specialist or referrer	Reports on your assessment, progress and outcome
Other practitioners in this clinic	Continuity of care if you see more than one of us
Private health funds	To process your claim
Medicare and DVA	To process claims under a care plan or entitlement
ReturnToWorkSA and its agents	Where your treatment relates to a work injury claim
CTP motor vehicle insurers	Where your treatment relates to a motor vehicle injury claim
NDIS and plan managers	Where your treatment is funded through an NDIS plan
Solicitors	Only with your written consent, or under a subpoena or court order

We do not sell your personal or health information, and we do not disclose it for marketing by anyone else.

Where your information is held

Your clinical record is held in Cliniko, an Australian practice management system that stores data in Australia. Physitrack and VALD TeleHab, which we use for exercise programs and telehealth, and Heidi, described above, also store data in Australia.

Peptalkr - If you opt in to our marketing content, your name and email address are stored in servers in Australia. No health information is ever sent to Peptalkr.

Services that operate overseas

One thing we use is not Australian, and the Privacy Act requires us to tell you:

• Website analytics - our website uses Google Analytics and Vercel Analytics, which process data in the United States. These record how people use the site, not who they are, and are not connected to your clinical record.

How we protect it

• Electronic records are held in access-controlled systems, with individual logins and passwords
• Staff access only the records they need to do their job
• Everyone who works here is bound by confidentiality obligations
• Devices are password-protected and screens are positioned away from public view
• Any paper records are stored securely and destroyed confidentially

How long we keep it

We keep adult health records for at least seven years from your last appointment. For patients who were under 18 at the time of treatment, we keep records until they turn 25. This reflects professional and legal requirements for health record retention.

When records are no longer needed, we destroy or de-identify them securely.

Seeing and correcting your record

You have the right to ask for access to the personal and health information we hold about you. Put your request in writing to the Director, and we'll respond within 30 days.

We may charge the reasonable cost of retrieving and copying your record. We will not charge you a fee for making the request itself. In limited circumstances we may need to withhold some information, for example where releasing it would pose a serious threat to someone's life, health or safety, or where it would unreasonably affect another person's privacy. If that happens, we'll explain why in writing.

If something in your record is wrong, tell us and we'll correct it. Where a clinical opinion has been recorded and you disagree with it, we can't delete it, but we will add your statement to the record so both are visible.

Asking us to delete your information

We will delete what we're legally able to delete. In practice, this means we can remove you from our newsletter list, delete marketing contact details and remove information we're not required to keep.

We generally cannot delete your clinical record within the retention periods described above. Health record retention is a legal and professional obligation, and it also protects you: the record is evidence of the care you received. Once the retention period has passed, the record is destroyed securely.

Email and marketing

Appointment reminders, confirmations and messages about your care are part of providing treatment, and you'll receive them as our patient.

Our newsletter is different. You'll only receive it if you've actively opted in, and you can unsubscribe from any email or by calling the clinic. We won't add you to a marketing list simply because you gave us your email address to book an appointment.

Our website

You can browse our website without telling us who you are. Our online booking runs through Cliniko, and information you enter there is handled under this policy.

We use analytics to understand which pages are useful, as described above. We do not use advertising pixels or tracking for advertising purposes. You can block cookies in your browser without affecting your ability to use the site.

Data breaches

If a data breach occurs that is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme. We will tell you what happened, what information was involved and what you can do about it.

Complaints

If you're concerned about how we've handled your information, please tell us. Most concerns can be sorted out quickly.

Contact the Director:

• In writing: The Director, The Physio Studio, 93 Goodwood Road, Goodwood SA 5034
• Email: admin@thephysiostudio.com.au
• Phone: (08) 8357 0418

We'll acknowledge your complaint within five business days and respond within 30 days.

If you're not satisfied with our response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992. Concerns about a practitioner's professional conduct can be raised with the Australian Health Practitioner Regulation Agency at ahpra.gov.au.

Changes to this policy

We review this policy annually and whenever our systems change. The current version is always on this page, with its effective date at the top.