Privacy policy

True Active Physiotherapy Pty Ltd (“we”, “us”, “our”) is committed to protecting your privacy and handling your personal and health information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), and Victoria’s Health Records Act 2001. This policy explains how we collect, hold, use and disclose your information, and how you can access it or make a complaint.

1. The information we collect

As a physiotherapy practice, much of the information we collect is health information, which is treated as sensitive information under the Privacy Act and attracts a higher level of protection. The information we collect may include:

• Identifying and contact details — name, date of birth, address, phone and email
• Emergency contact details and, for minors, parent or guardian details
• Medicare, DVA, NDIS, private health, WorkCover or TAC details for billing and claims
• Payment information (processed by our payments platform — see section 5)
• Your health information, including medical history, presenting condition, injury history, clinical notes, assessment findings, imaging and test results, treatment plans and progress
• Photographs or video where used for assessment, diagnosis or rehabilitation, with your consent
• Information about your use of our website and online booking system

Where the patient is a minor, we collect information from the patient and from a parent or legal guardian. By providing us with a minor’s information, the parent or guardian confirms they have authority to consent to that minor’s assessment and treatment and to the handling of their personal and health information as described in this policy. Mature minors may consent to their own treatment where clinically and legally appropriate.

2. How we collect information

Wherever practicable, we collect information directly from you — for example, during a consultation, via our intake forms, through our online booking system, or when you contact us by phone, email or social media. We may also collect information from third parties where it is reasonably necessary for your care or where you have authorised us to do so, including:

• Your referring GP, specialist or surgeon
• Other allied health practitioners involved in your care
• Imaging providers and pathology services
• Sporting clubs or organisations where we provide team coverage and you have consented to information sharing
• Medicare, the Department of Veterans’ Affairs, the NDIA, WorkCover, the TAC, or your private health insurer
• Your nominated emergency contact

3. Why we collect, use and disclose your information

We collect, hold, use and disclose your information for purposes directly related to providing physiotherapy services and operating our practice, including to:

• Assess, diagnose, treat and review your physiotherapy care
• Communicate with you about appointments, treatment, results and follow-up
• Liaise with your referrers and other treating practitioners as part of your care
• Process payments and claim rebates through Medicare, DVA, NDIS, private health insurers, WorkCover or the TAC
• Maintain accurate clinical and business records as required by law and professional standards
• Manage feedback, complaints and clinical incidents
• Comply with our legal, regulatory and professional obligations (including the Health Practitioner Regulation National Law and AHPRA requirements)
• Conduct quality improvement, peer review, clinical audit and staff training
• Operate, improve and secure our website, booking system and associated platforms
• Market and promote our services to existing and prospective clients, where permitted by law

We will not use your health information for direct marketing without your consent. You may opt out of marketing communications at any time using the unsubscribe link in any email or by contacting us.

4. Disclosure of your information

We will not sell your personal information. We may disclose your information to third parties only where it is necessary for the purposes described in this policy or otherwise required or permitted by law. This may include:

• Your treating practitioners and referrers (GPs, specialists, surgeons and allied health)
• Government agencies and insurers for billing and claims (Medicare, DVA, the NDIA, WorkCover, the TAC and private health insurers)
• Our service providers — our payments and invoicing platform (currently HaltH), practice management software (currently Cliniko), AI clinical documentation provider (currently Preve), IT and cyber-security providers, accountants and professional advisers — each bound by confidentiality obligations
• Regulators and professional bodies where required (for example, AHPRA)
• Anyone you have authorised, or where disclosure is required or permitted by law

5. Payments

Payments and private health fund claims are processed through our payments and invoicing platform (currently HaltH). Your card details are entered directly into HaltH’s secure system and are not stored or seen by our clinic. HaltH maintains its own independent security certifications for handling payment data, including ISO 27001 and PCI-DSS Level 1. If you would prefer not to enter your details online, you are welcome to call the clinic.

6. AI-assisted clinical documentation

We use an AI-assisted documentation tool (currently Preve) to help prepare clinical notes, treatment plans and letters. With your consent, your consultation may be recorded and transcribed to generate a draft note, which your physiotherapist reviews and edits before it is saved to your record. You may opt out of recording at any time — simply let your physiotherapist know — and signage at reception explains this. Recordings and transcripts are stored by Preve on secure infrastructure and are handled in accordance with Preve’s privacy and security commitments and this policy. If you would like more information about Preve, please ask your physiotherapist or contact us.

7. Telehealth and remote consultations

Where appropriate, we may offer consultations by video or phone. We use reasonable measures to keep these consultations secure and private, and we will not record a telehealth consultation without your consent. Telehealth may not be suitable for every condition, and your physiotherapist will advise if an in-person assessment is needed.

8. Storage, security and retention

We store clinical records primarily in our practice management system (Cliniko), which holds data on secure cloud infrastructure. Audio recordings and transcripts generated by our AI documentation tool (Preve) are stored on the provider’s secure infrastructure. Business and administrative records may be stored in other secure cloud services. We take reasonable steps to protect your information from misuse, interference, loss, and unauthorised access, modification or disclosure, including through access controls, encryption in transit, staff training and confidentiality obligations.

We retain health records for the periods required by law and professional standards — generally a minimum of seven years from your last appointment for adults, and for minors until they reach 25 years of age. When information is no longer required and we are not legally obliged to keep it, we take reasonable steps to securely destroy or de-identify it.

9. Cookies and analytics

Our website uses cookies and analytics tools to understand how visitors use our site and to improve and promote our services. These may include Google Analytics (GA4), Google Ads, Google Business Profile, the Meta (Facebook) Pixel, and our website host (Wix). They may collect information such as your IP address, device and browser type, and the pages you visit. You can control cookies through your browser settings; disabling them may affect how the website functions.

10. Access and correction

You may request access to the personal and health information we hold about you, and ask us to correct it if it is inaccurate, out of date or incomplete. Please contact our Privacy Officer using the details below. We may need to verify your identity before providing access. In the limited circumstances permitted by law where we cannot grant a request, we will explain why in writing.

11. Complaints

If you have a concern about how we have handled your information, please contact our Privacy Officer first so we can try to resolve it. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au, or the Victorian Health Complaints Commissioner at hcc.vic.gov.au.

12. Notifiable data breaches

If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the OAIC as required under the Notifiable Data Breaches scheme.

13. Changes to this policy

We may update this policy from time to time to reflect changes in our practices or legal obligations. The current version will always be available on our website, with the effective date shown above.