The Physio Society | Last updated: 1st November 2026 | Effective: 1st November 2026

1. About this policy

In this policy, "we", "us" and "our" mean The Physio Society Pty Ltd (ABN 66 734 647 355) trading as The Physio Society.

We provide physiotherapy and related health services, including musculoskeletal and sports physiotherapy, pelvic health physiotherapy, and pre- and post-operative rehabilitation, clinical exercise classes including Pilates and gym based rehabilitation, from our clinic in Malvern, South Australia.

We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). As a private health service provider, we are covered by the Act regardless of our size. This policy explains how we collect, use, store and disclose your personal information, including your health information, and how you can access or correct it or make a complaint.

2. Our privacy commitment

Your privacy matters to us. We aim to be open and clear about how we handle your information, and we only collect, use and disclose it in ways the law allows and you would reasonably expect.

3. The information we collect

Personal information is information or an opinion about an identified person, or a person who is reasonably identifiable. Health information is a type of sensitive information and receives a higher level of protection under the Privacy Act.

Depending on the service you receive, we may collect:

• Contact and identity details: name, address, phone number, email, date of birth, gender, emergency contact or next of kin, and your preferred contact person

• Health information: your medical and injury history, presenting complaint, assessment findings, diagnoses, treatment plans and progress notes, imaging and test results, medications, and referral information from your GP, specialist or other health professional

• Funding and claim details: Medicare number, private health fund and membership details, Department of Veterans' Affairs (DVA) card details, NDIS plan details, and workers compensation, compulsory third party (CTP) or other insurer claim information

• Consents and communications: consents you give us, records of your interactions with us, bookings, feedback and complaints

• Payment details: billing information and payment records. We do not store full credit card details on our systems

• Photos, video or recordings: only where needed for your care and with your consent (for example, movement analysis)

• Website and device information: IP address, device type, browser, pages visited and similar data, collected through cookies and similar technologies

Providing information is optional, but if you choose not to give us the information we ask for, we may not be able to provide safe or appropriate treatment, process a claim, or contact you. Where possible, you may deal with us anonymously or under a pseudonym (for example, when making a general enquiry), but this is generally not practicable for treatment or claims.

4. How we collect your information

We collect information directly from you wherever possible, including through intake forms, consultations, phone calls, email, SMS, our online booking system and our website.

We may also collect information from others, with your consent or where the law allows, including your referring GP or specialist, other treating health professionals, hospitals, radiology and pathology providers, your health fund, Medicare, DVA, NDIS, insurers and employers (for example, in a workers compensation claim), and your authorised representative.

If you are under 18, or you are unable to make decisions for yourself, we will generally deal with your parent, guardian or authorised representative, while still taking your own views and capacity into account.

5. Why we collect, use and disclose your information

We collect information that is reasonably necessary for our functions and activities, mainly to:

• assess, diagnose, treat and manage your health care and wellbeing

• communicate with you and other health professionals involved in your care

• book and manage appointments, and send reminders

• process payments and claims with Medicare, health funds, DVA, NDIS and insurers

• meet our legal, professional and regulatory obligations, including our obligations to the Physiotherapy Board of Australia and AHPRA

• manage, maintain and improve our services, systems, quality and safety

• handle enquiries, feedback and complaints

• manage our insurance and professional indemnity requirements

We will use or disclose your information for these purposes, or for a related purpose you would reasonably expect (for health information, a directly related purpose). We will ask for your consent for anything else, unless the law requires or authorises it.

6. Who we share your information with

We may disclose your information to:

• your GP, referrer, specialists, hospitals and other health professionals involved in your care with your consent

• Medicare, DVA, NDIS, your private health fund, workers compensation and CTP insurers, and employers, where needed for funding or claims

• our service providers, such as practice management and booking software, cloud storage and IT support, telehealth, payment, and communications providers, who are required to protect your information

• our professional advisers, insurers and auditors

• government agencies and courts where required or authorised by law, such as notifiable disease reporting, a subpoena or a court order, or a request from a regulator

• a family member, carer or next of kin, where you have agreed, or where permitted by law (for example, where you are unable to consent and disclosure is necessary for your care)

• anyone else you ask us to, or consent to us, disclosing information to

We do not sell your personal information.

7. My Health Record

We do not upload or access My Health Record.

8. Communicating with you

We will contact you by phone, SMS, email or mail about your appointments and care, including confirmations, reminders, follow-ups and invoices. Because these messages are part of providing your service, you cannot opt out of essential service messages while you are an active patient. You can tell us your preferred contact method at any time.

9. Direct marketing

We will only send you marketing, newsletters or promotional material if you have consented, or where the law otherwise allows. We comply with the Spam Act 2003 (Cth). You can unsubscribe at any time using the link in the message or by contacting our Privacy Officer, and we will not use your health information for marketing without your express consent.

10. Technology, AI tools and automated decision-making

Digital tools. We use technology to support our administrative and clinical work. This includes our online booking and practice management software - Cliniko, which can include telehealth services, AI scribe - Arlo, Exercise Prescription software – Physitrack, and strength testing equipment – Strength by Numbers - Axit System. Where a tool listens to or records a consultation, such as an AI scribe, we will ask for your consent first, and you can say no without affecting your care. Your clinician reviews and remains responsible for all clinical notes.

Information processed by these tools is used to provide your service and to update your health record in our secure clinical systems. We require our providers, through contract and security assessment, to protect your information, and we do not allow them to use your information to train their own AI models [confirm with each vendor].

Automated decision-making. We do not currently use computer programs to make, or substantially help make, decisions that could reasonably be expected to significantly affect your rights or interests. All decisions about your care, funding and access to services are made by our people.

11. Sending information overseas

We aim to store your information in Australia. Some of our service providers, such as cloud, software, email or AI providers, may store or access information in other countries. Before we disclose your personal information overseas, we take reasonable steps to ensure the recipient handles it in line with the APPs, or we obtain your consent, or the disclosure is otherwise permitted by law.

12. How we store and protect your information

We hold your records in electronic and, in some cases, paper form. We take reasonable steps to protect them from misuse, interference, loss, and unauthorised access, modification or disclosure, including:

• a secure, encrypted practice management system with role-based access and multi-factor authentication

• regular backups, firewalls, antivirus and security updates

• confidentiality agreements and privacy training for all staff, contractors and practitioners

• locked storage and restricted access for any paper records

• due diligence on, and contracts with, our service providers

If there is an unauthorised access to or loss of your information that is likely to result in serious harm to you, we will follow the Notifiable Data Breaches scheme under the Privacy Act, which means we will notify you and the Office of the Australian Information Commissioner (OAIC) as required, and tell you what steps to take.

13. How long we keep your information

We keep health records for as long as the law and professional standards require. For adults, we keep records for at least 7 years after your last visit. For patients under 18, we keep records until they turn at least 25.

14. Your rights: access and correction

You can ask to see the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading. Please make your request in writing to our Privacy Officer. We will ask you to verify your identity, and we will respond within 30 days.

We may refuse access in limited situations the Privacy Act allows (for example, where access would pose a serious threat to someone's life, health or safety, or would unreasonably affect another person's privacy). If we do, we will explain why in writing, and tell you how to complain. If we refuse to correct your information, you can ask us to attach a statement to your record noting that you disagree. We do not charge for making a request, but may charge a reasonable fee for providing access.

Please help us by keeping your details up to date.

15. Our website and cookies

When you visit our website, we may collect technical information such as your IP address, device, browser and pages viewed, using cookies, analytics and similar technologies, to run and improve the site. You can disable cookies in your browser settings, but some features may not work. Our website may link to third-party sites, which have their own privacy policies and are not covered by this one.

16. Questions, concerns and complaints

If you have a question or concern about how we handle your information, or you believe we have breached the APPs, contact our Privacy Officer:

Privacy Officer, The Physio Society
Email: admin@thephysiosociety.com.au
Phone: 08 8164 5527
Post: 211 Unley Road, Malvern SA 5061

We will acknowledge your complaint promptly and aim to respond within 30 days. If you are not satisfied with our response, you can contact:

• the Office of the Australian Information Commissioner (OAIC): 1300 363 992 | www.oaic.gov.au | enquiries@oaic.gov.au

• the South Australian Health and Community Services Complaints Commissioner (HCSCC): www.hcscc.sa.gov.au, which handles complaints about health service providers in South Australia

Complaints about the professional conduct of a physiotherapist can also be made to the Australian Health Practitioner Regulation Agency (AHPRA): www.ahpra.gov.au.

17. Changes to this policy

We review this policy regularly and may update it as our practices, technology or the law change. The current version is always on our website, with the date it was last updated. You can also ask us for a free copy at any time, in any format reasonably practicable.