Your information deserves careful handling.

About this policy

We are a physiotherapy and remedial massage practice at 372 Burwood Road, Belmore NSW 2192. We handle personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles and, where applicable, the Health Records and Information Privacy Act 2002 (NSW) and its Health Privacy Principles.

Health information is sensitive information. We aim to collect only the information reasonably needed to provide and manage our services, meet our legal and professional obligations, and operate the practice safely.

Information we may collect

Depending on your contact with the practice, this may include:

• your name, date of birth, address, telephone number, email address and emergency contact;
• health history, symptoms, diagnoses, referrals, treatment plans, clinical notes, correspondence, consent and relevant test or imaging information;
• Medicare, DVA, private health, NDIS, Workers Compensation or CTP details where they apply to your care;
• appointment, billing, payment and account information;
• communications, feedback, complaints and other information you choose to provide; and
• limited technical information produced when you use this website or an embedded third-party service, such as your device, browser and IP address.

How we collect information

We usually collect information directly from you, including in person, by telephone or email, and through our Nookal booking and digital intake services. With your consent, or where the law otherwise permits, we may also receive relevant information from a parent, guardian or authorised representative, a referring GP, specialist or other health professional, or an insurer, funding body or claims manager.

You may ask to deal with us anonymously or by using a pseudonym where this is lawful and practical. We may need accurate identifying details when providing clinical care, creating a health record, making a claim or meeting another legal requirement.

Why we collect and use information

We may use your information to:

• respond to an enquiry and arrange, confirm or manage an appointment;
• assess your needs, provide care and maintain an appropriate clinical record;
• communicate with you about treatment, appointments, accounts or practice administration;
• process billing, rebates, approved claims and funded-care requirements;
• coordinate care with other health professionals or relevant parties, with your consent or as permitted by law;
• maintain the safety, quality and security of our services; and
• meet legal, professional, insurance and record-keeping obligations.

We do not sell patient information, and we do not use health information for third-party advertising.

When information may be shared

We may disclose information to members of our treatment and administrative team who need it for their work, and to treating or referring health professionals where you have consented or the disclosure is otherwise permitted by law. Relevant information may also be provided to an insurer, plan manager, claims manager, government program, payment provider, professional adviser or service provider when needed to administer your care, account or approved claim.

We may disclose information where required or authorised by law, or where necessary to lessen or prevent a serious threat to health or safety. We take reasonable steps to limit a disclosure to what is needed for its purpose.

Website and online services

Nookal

Nookal is our external online booking platform and provides the secure new-patient details form available on the booking page after an appointment has been confirmed. Information you enter into either service is submitted through Nookal so that we can manage your appointment and care. Nookal also handles that information under its own privacy policy. Nookal states that personal information for Australian clinics is hosted in Australia, although strictly necessary support, security or service operations may involve processing outside Australia.

Read Nookal’s privacy policy (opens in a new tab).

Maps, social media and email

The Contact and Home pages include Google Maps, the site loads web fonts supplied by Google, and the website links to Facebook. When you load an embedded service or follow an external link, that provider may receive technical information and apply its own privacy and cookie practices. Email links open your own email service; ordinary email may not be a secure way to send sensitive or urgent health information.

Cookies and analytics

We use Cloudflare Web Analytics to understand aggregate page traffic, referring websites, device types and real-world page performance. Cloudflare states that this service does not collect or use visitors’ personal data, does not track individuals across its customers’ websites, and does not log URL query strings. We do not use it to collect appointment reasons or information entered into Nookal.

Read more about Cloudflare Web Analytics and privacy (opens in a new tab).

We also use Google Analytics 4, only after a visitor allows Analytics, to understand how people reach and move through the website. The clinic mainly reviews aggregate counts of public page visits and fixed, non-clinical website interactions. On the booking page, those counts can include when someone selects the initial-appointment telephone button, selects the pre-addressed callback-email button, follows the returning-patient booking link or follows the link to the new-patient details section and, once per page view, when at least half of the embedded Nookal details form becomes visible. These records show only that a website button or link was selected or the form frame was substantially visible. They do not show that a telephone call connected, an email application opened, a callback request was sent, or a booking or form was started, completed or submitted.

Google Analytics may use first-party cookies containing a pseudonymous browser identifier and receive ordinary consented session information, such as browser, device and approximate-location information. It also receives a sanitised public page path, tightly limited campaign labels and fixed action labels. For the four count-only booking-page measures described above, clinic code supplies only the fixed event name. The two initial-contact selections may also contribute to the existing general telephone-link or email-link count, using the sanitised public-page and fixed-action context described above. It does not inspect the cross-origin Nookal form or send names, contact details, patient, appointment or service identifiers, conditions, injury descriptions, clinical or health information, field names, form contents or answers, keystrokes, CAPTCHA data, free text, or raw URL query strings or fragments.

Google Analytics is optional. Its tag does not load, set Analytics cookies or send measurement requests unless you select “Allow analytics”. Interactions that occurred before consent are not queued or replayed. Declining Analytics, or leaving the choice unanswered, does not affect your ability to use the website, contact the clinic, use the Nookal booking platform or complete the new-patient details form. If you allow it, first-party Analytics cookies may be stored so visits and acquisition can be measured. Advertising storage remains denied, and Google Signals, user-provided data and advertising personalisation are disabled. The tag also stays off when a supported browser sends a Do Not Track or Global Privacy Control signal. Google may process consented technical measurement information overseas under its own safeguards. Read more about Google Analytics privacy and data safeguards (opens in a new tab).

Your choice is kept in this browser for up to 12 months so you are not asked on every page or visit. If you do not choose, Google Analytics remains off. You can review the choice at any time using “Analytics choices” in the website footer. Choosing to keep Analytics off clears the website’s stored campaign labels and any accessible first-party Google Analytics cookies.

After you allow Analytics, an approved campaign link may keep up to six standard UTM campaign labels temporarily in your browser session. Only exact, non-sensitive values pre-approved by the clinic in the website code are accepted. They may be passed to the returning-patient Nookal booking link so the clinic can understand campaign performance. Other URL query information and page fragments are excluded from Google Analytics. We do not put campaign labels on internal website links.

Apart from the consented Google Analytics measurement described above, we do not use clinic-selected advertising pixels, remarketing, session replay, heatmaps or fingerprinting. The site host and embedded services may use cookies or similar technology needed to deliver, secure or operate their services. Technical data may be processed in Australia or overseas depending on the provider and network used.

Storage, security and retention

We take reasonable administrative, physical and technical steps to protect information from misuse, interference, loss and unauthorised access, modification or disclosure. Access to patient information is limited to people who need it for their role, subject to professional and workplace confidentiality obligations.

We retain health and business records for the periods required by applicable law and professional obligations. When information is no longer required, and the law permits, we take reasonable steps to destroy it securely or de-identify it. If an eligible data breach occurs, we will respond in accordance with applicable notification requirements.

Access and correction

You may ask for access to personal information we hold about you, or ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading. Contact the practice using the details below. We may need to verify your identity. If the law permits us to refuse or limit a request, we will explain the reason and available review options.

Privacy enquiries and complaints

Contact us if you have a privacy question, want to request access or a correction, or wish to make a complaint. Please mark an email “Privacy enquiry” so reception can direct it appropriately.

We will consider your concern and respond within a reasonable time. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (opens in a new tab) or the Information and Privacy Commission NSW (opens in a new tab).

For appointment or clinical matters, please use our contact details. Do not use email for an emergency or urgent medical concern.