Privacy Policy

 

Effective date: 6 October 2026
Last updated: 6 October 2026

1. About this policy

This Privacy Policy explains how THE PHYSIO DOCTOR PTY LTD, trading as THE PHYSIO DOCTOR, collects, uses, stores and discloses personal information and health information.

It applies when you:

  • visit our website at [insert correct website address];

  • contact us;

  • make or attend an appointment;

  • complete a health or intake form;

  • receive physiotherapy or another service from us;

  • communicate with us by phone, email, text message or social media; or

  • interact with our online booking, payment or other digital services.

We handle information under:

  • the Privacy Act 1988 (Cth) and the Australian Privacy Principles;

  • the Health Records Act 2001 (Vic) and Victorian Health Privacy Principles;

  • other applicable Australian privacy and health-record laws; and

  • professional obligations applying to registered physiotherapists.

This policy explains your main privacy rights in straightforward language. It does not replace specific consent forms, treatment information, terms of service or our internal policies.

2. Who we are

The organisation responsible for handling your information is:

THE PHYSIO DOCTOR PTY LTD
ACN: 15 637 987 547
Trading as: THE PHYSIO DOCTOR
Clinic address: G04/288 Albert st Brunswick VIC 3056
Telephone: 0483 925 799
Website: www.thephysiodoctor.com.au

For privacy questions, contact:

Privacy Officer
Email: info@thephysiodoctor.com.au
Telephone: 0483 925 799
Postal address: G04/288 Albert st Brunswick VIC 3056

3. Information we collect

We collect information that is reasonably necessary to provide healthcare, operate the clinic and communicate with you.

Information that identifies you

This may include your:

  • name;

  • date of birth;

  • address;

  • email address;

  • telephone number;

  • preferred pronouns, where relevant;

  • emergency-contact details;

  • parent, guardian, carer or authorised representative details; and

  • identity or authority information where needed.

Health information

When providing physiotherapy, we may collect:

  • your medical and health history;

  • symptoms, conditions, diagnoses and disabilities;

  • physical examination findings;

  • pain, movement, function and treatment information;

  • medications and allergies;

  • previous and current treatment details;

  • specialist, imaging and other healthcare reports;

  • information about your mental health where relevant to your care;

  • treatment plans and progress notes;

  • workers’ compensation, transport accident or insurance information; and

  • photographs, videos or other clinical images where reasonably necessary and appropriately authorised.

Health information is sensitive information and receives additional protection under Australian law.

Billing and payment information

We may collect:

  • billing and invoicing details;

  • Medicare, private-health-insurance and insurer information;

  • workers’ compensation or transport accident claim details;

  • payment and transaction information; and

  • information needed to process refunds or claims.

Where possible, payment details will be handled directly by our payment provider. We do not ordinarily store complete credit-card numbers or card security codes.

Website and device information

When you use our website, we may collect:

  • IP address;

  • browser and device type;

  • operating system;

  • pages visited;

  • links clicked;

  • approximate location;

  • referring website;

  • date and time of access;

  • website security information; and

  • information submitted through online forms.

We may collect this information through cookies, analytics tools or similar technologies. We will treat information as personal information where you can reasonably be identified.

Communications and complaints

We may keep information contained in:

  • emails;

  • phone calls;

  • text messages;

  • online enquiries;

  • appointment and cancellation communications;

  • complaints and feedback;

  • incident reports;

  • correspondence from referrers, insurers or other providers; and

  • social-media messages.

4. How we collect information

We usually collect information directly from you when you:

  • make an appointment;

  • complete an intake, consent or health-history form;

  • attend the clinic;

  • use our website;

  • contact us;

  • make a payment;

  • subscribe to communications; or

  • provide feedback.

Where reasonably necessary and lawful, we may collect information from:

  • your parent, guardian, carer or authorised representative;

  • another health practitioner;

  • a referrer;

  • a hospital, specialist or diagnostic provider;

  • an insurer, employer or claims administrator;

  • Medicare or another government agency;

  • a payment, booking or technology provider; or

  • another person involved in coordinating your care.

We will generally collect health information directly from you. We may collect it from another source where you consent, where it is unreasonable or impracticable to collect it directly from you, or where the law permits or requires it.

If we receive personal information that we did not ask for, we will consider whether we could lawfully have collected it. If we could not have collected it lawfully, we will destroy or de-identify it where lawful and reasonable to do so.

5. Why we collect and use information

We collect, hold, use and disclose information for the following purposes.

Providing healthcare

  • assessing your health needs;

  • providing physiotherapy and related services;

  • preparing and managing your treatment plan;

  • monitoring your progress;

  • arranging referrals, investigations or coordinated care;

  • communicating with you about your care;

  • responding to an emergency;

  • maintaining continuity of care; and

  • keeping accurate clinical records.

Running the clinic

  • booking and managing appointments;

  • sending appointment reminders;

  • processing payments and refunds;

  • issuing invoices and receipts;

  • processing Medicare, insurance or statutory claims;

  • managing accounts;

  • responding to enquiries;

  • handling complaints;

  • managing risks and incidents;

  • improving service quality; and

  • maintaining business, financial and administrative records.

Legal, professional and safety purposes

  • complying with laws and professional obligations;

  • responding to subpoenas, court orders or lawful requests;

  • cooperating with regulators and government authorities;

  • preventing fraud or unlawful activity;

  • protecting the safety of patients, staff and other people; and

  • managing legal claims or disputes.

Website and communications

  • operating and securing our website;

  • preventing spam and cyberattacks;

  • understanding website use;

  • improving website content and functionality;

  • sending information you requested; and

  • sending marketing where permitted by law and where you have consented or another lawful basis applies.

We will not use health information for direct marketing without your consent unless a specific legal exception applies.

6. Consent

We will ask for consent where the law requires it, including where appropriate for:

  • collecting and using health information;

  • sharing information with a nominated third party;

  • contacting another healthcare provider;

  • using photographs or videos;

  • publishing a testimonial or case study;

  • sending marketing communications; or

  • using information for a purpose unrelated to your treatment.

Consent should be voluntary, informed, current and specific.

You may withdraw consent at any time by contacting us. Withdrawal may mean that we cannot safely or effectively provide some services. We will explain any significant consequence where practicable.

Consent to receive treatment does not automatically mean consent to:

  • marketing;

  • photography or filming;

  • testimonials;

  • social-media publication; or

  • disclosure to an employer, insurer, family member or other third party.

We may collect, use or disclose information without consent where permitted or required by law, including in limited emergencies, safety situations, legal proceedings or regulatory matters.

7. Who we may disclose information to

Depending on the circumstances, we may disclose relevant information to:

  • physiotherapists and other healthcare professionals involved in your care;

  • your nominated emergency contact;

  • a parent, guardian, carer or authorised representative;

  • hospitals, specialists and diagnostic providers;

  • referrers;

  • Medicare and private health insurers;

  • workers’ compensation or transport accident insurers;

  • employers or claims administrators where authorised and relevant;

  • booking, practice-management, telehealth, payment, billing, cloud-storage, email, SMS, IT, website-hosting and security providers;

  • lawyers, accountants, insurers and other professional advisers;

  • regulators and government agencies;

  • courts, tribunals, law-enforcement bodies or other authorities where required or authorised by law; and

  • a purchaser or successor of the clinic, subject to applicable privacy obligations.

We will generally disclose only the information reasonably necessary for the relevant purpose.

We will not disclose information to a family member, employer, insurer or other third party merely because they ask for it. We will consider consent, authority, clinical necessity and applicable law first.

We do not sell or rent personal information.

8. Referrals and information sharing

To coordinate your care, we may need to send relevant information to another healthcare provider. This may include a referral, treatment summary, progress report or discharge information.

Where appropriate, we will explain the proposed disclosure and obtain consent. We may disclose information without consent where a legal exception applies or disclosure is necessary for a permitted healthcare purpose.

You may ask us what information has been sent and to whom.

9. Marketing

We may send information about our services, educational resources, events or offers where permitted by law.

You can unsubscribe at any time by:

We will process marketing opt-out requests promptly. You may still receive necessary non-marketing communications about appointments, treatment, payments, safety or legal matters.

We will not use your health information for marketing without appropriate consent.

10. Cookies and analytics

Our website may use essential cookies for security and functionality. It may also use analytics or similar technologies to understand website traffic and improve our website.

Before publishing this policy, we will identify the actual tools used on the website, such as:

  • website analytics;

  • online booking;

  • payment services;

  • email forms;

  • advertising platforms;

  • security services; and

  • video or embedded-content providers.

These providers may collect information under their own privacy policies.

You can manage cookies through your browser settings. Disabling cookies may affect some website features.

We will not use analytics to identify you or infer your health condition for marketing purposes unless the practice has confirmed that the activity is lawful and you have provided any required consent.

11. Overseas disclosure and storage

Some service providers may store or access information outside Australia.

The countries involved depend on the providers we actually use. They may include:

  • the United States;

  • New Zealand;

  • the Philippines;

  • the United Kingdom;

  • Ireland; and

  • other countries in which our contracted technology providers operate.

This list must be updated if our providers change.

Before disclosing information overseas, we will take reasonable steps required by Australian privacy law to ensure that the information is handled appropriately. Some cloud systems may be accessible from more than one country, and it may not always be possible to identify every location in which information is stored or accessed.

12. Security

We take reasonable technical and organisational measures to protect information from:

  • misuse;

  • interference;

  • loss;

  • unauthorised access;

  • unauthorised modification; and

  • unauthorised disclosure.

Depending on the system, these measures may include:

  • role-based access;

  • secure passwords;

  • multi-factor authentication;

  • secure electronic systems;

  • encryption where available;

  • physical security;

  • staff confidentiality obligations;

  • privacy training;

  • access monitoring;

  • secure disposal; and

  • contractual requirements for service providers.

No electronic system is completely secure. If we identify a data breach, we will assess and respond to it under the Notifiable Data Breaches scheme and any other applicable law. If required, we will notify affected individuals and the Office of the Australian Information Commissioner.

13. Retention of information

We retain information only for as long as reasonably necessary for the purposes described in this policy or as required by law, professional obligations, insurance requirements, dispute processes or legitimate record-keeping needs.

Clinical records must not be deleted simply because a patient asks for deletion or because information is later found to be inaccurate. Where appropriate, we will correct the record or add a note while preserving the original clinical history.

Victorian health-record requirements may require us to retain health information for extended periods. The applicable period can depend on the type of record and the patient’s age. We will retain records in accordance with the Health Records Act 2001 (Vic), applicable regulations and professional requirements.

When information is no longer required and may lawfully be destroyed, we will securely destroy it or permanently de-identify it.

14. Accessing and correcting information

You may ask us for:

  • access to personal information we hold about you;

  • access to your health information;

  • correction of information that is inaccurate, incomplete, out of date, irrelevant or misleading; or

  • transfer of relevant health information to another healthcare provider.

Send your request to info@thephysiodoctor.com.au. You do not need to use a particular form.

We may ask for reasonable proof of identity or authority before providing access. Requests by a parent, guardian, carer or representative may require evidence of authority.

We will respond within a reasonable period. We may refuse or limit access where permitted by law, including where access would:

  • pose a serious threat to a person’s life or health;

  • unreasonably affect another person’s privacy;

  • be unlawful;

  • prejudice an investigation or legal process; or

  • fall within another lawful ground for refusal.

If we refuse access or correction, we will explain the reason in writing and tell you how to complain or seek review.

We will not charge a fee for correcting information. Any fee for providing access will be limited to lawful and reasonable administrative costs.

15. Children and representatives

If a patient is a child or cannot make a privacy decision, we will consider who is legally authorised to consent, access records or receive information.

We may consider:

  • the patient’s age and maturity;

  • the patient’s capacity;

  • the patient’s wishes;

  • the authority of the person making the request; and

  • the safety and best interests of the patient.

A parent or guardian will not necessarily receive unrestricted information in every situation.

16. Anonymous or pseudonymous dealings

You may ask questions anonymously or use a pseudonym where lawful and practicable.

This may not be practicable when we need to:

  • provide safe healthcare;

  • create or maintain clinical records;

  • process a payment or claim;

  • verify identity or authority;

  • manage an appointment; or

  • comply with a legal or professional obligation.

17. Photographs, videos and testimonials

We will not publish a patient’s photograph, video, clinical information, testimonial or case study without appropriate informed consent.

Consent to treatment does not include consent to marketing or publication.

If you withdraw consent, we will stop future use where reasonably practicable. Withdrawal may not affect material already lawfully published or printed.

We will take care not to identify patients through a combination of names, images, conditions, dates or other details.

18. Complaints

If you believe we have mishandled your personal or health information, contact our Privacy Officer:

Privacy Officer
THE PHYSIO DOCTOR PTY LTD
Email: info@thephysiodoctor.com.au
Telephone: 0483 925 799
Postal address: G04/288 Albert st Brunswick VIC 3056

Please include:

  • your name and contact details;

  • what happened;

  • relevant dates;

  • the information involved; and

  • the outcome you are seeking.

We will acknowledge your complaint, investigate it fairly and aim to provide a response within 30 days. If we need more time, we will explain why.

If you are dissatisfied with our response, or if we do not respond within a reasonable time, you may contact:

Office of the Australian Information Commissioner

Website: oaic.gov.au
Telephone: 1300 363 992

Health Complaints Commissioner Victoria

Website: hcc.vic.gov.au
Telephone: 1300 582 113

The Health Complaints Commissioner can receive complaints about health-information handling by Victorian private health-service providers.

Concerns about a registered physiotherapist’s professional conduct may also be raised with Ahpra or the Physiotherapy Board of Australia.

19. Other complaints

This policy deals with privacy complaints. You may separately complain about:

  • treatment or clinical care;

  • communication;

  • fees or cancellations;

  • disability access;

  • practitioner conduct; or

  • another service issue.

You can initially raise those matters with the clinic. Ahpra’s Code of Conduct says registered practitioners should listen to complaints, explain relevant processes and work toward local resolution where possible.[ahpra.gov]

20. Automated decision-making and artificial intelligence

At the date of this policy, we do not use a computer program to make decisions about patients that significantly affect their rights or interests.

If this changes, we will update this policy as required. From 10 December 2026, APP entities must include specified information in their privacy policies where personal information is used in computer programs to make, or substantially contribute to, decisions that could significantly affect an individual’s rights or interests.[oaic.gov][oaic.gov]

Routine appointment reminders, calendar functions and ordinary website analytics would not ordinarily be the type of significant decision covered by this requirement. However, you should obtain advice before using AI or automated systems to triage patients, deny appointments, assess eligibility, determine treatment access or make similar significant decisions.

21. Changes to this policy

We may update this policy when our services, technology, information-handling practices or legal obligations change.

We will publish the current version on our website with its effective date and last-updated date. We may notify patients directly of significant changes where appropriate.

22. Contact

For privacy questions, access or correction requests, health-record transfer requests or privacy complaints:

THE PHYSIO DOCTOR PTY LTD
Email: info@thephysiodoctor.com.au
Telephone: 0483 925 799
Address: G04/288 Albert st Brunswick VIC 3056
Website: www.thephysiodoctor.com.au

Patient collection notice

Place this shorter notice on your intake forms, booking forms and enquiry forms. The long privacy policy should not be the only information patients receive at the time their information is collected.

Privacy collection notice
THE PHYSIO DOCTOR PTY LTD collects your personal and health information to provide physiotherapy services, manage your appointments, communicate with you, process payments and claims, maintain clinical records and meet legal and professional obligations.

We may disclose relevant information to healthcare providers involved in your care, referrers, insurers, claims administrators and service providers that help us operate the clinic. Some service providers may be located overseas.

Our Privacy Policy explains how to access or correct your information and how to make a privacy complaint. You can contact us at info@thephysiodoctor.com.au.

You may choose not to provide information, but we may be unable to provide safe or effective care or process your appointment, payment or claim.

Required implementation work

The policy alone will not make the clinic compliant. Complete these tasks before publication:

  1. Verify the company details. Confirm the ACN, registered company name, clinic address, telephone number and website.

  2. Audit every data recipient. List the actual booking, practice-management, payment, SMS, email, cloud, telehealth, analytics and website providers.

  3. Confirm overseas locations. Do not publish a country list unless it reflects actual providers.

  4. Create consent forms. Use separate consent for treatment, information sharing, photography, testimonials and marketing.

  5. Create a records policy. Set retention, access, correction, transfer, secure disposal and paper-record procedures.

  6. Create a data-breach plan. Include who investigates, who decides whether notification is required and how affected patients are contacted.

  7. Create a privacy complaint procedure. The public policy can remain short; staff need a detailed internal process.

  8. Review children and capacity procedures. Decide how the clinic verifies parents, guardians, carers and authorised representatives.

  9. Review AI and software use. Confirm whether any tool triages, scores, filters, refuses or otherwise makes significant decisions about patients.

  10. Audit marketing separately. Ahpra advertising rules prohibit misleading claims, unlawful testimonials and unreasonable expectations of treatment benefits.[ahpra.gov]