Privacy Policy

We are committed to protecting the privacy of your personal information, including your health information. This Privacy Policy explains how we collect, hold, use and disclose personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

As a provider of health services, we are bound by the Privacy Act regardless of our annual turnover, and we treat health information as sensitive information, which receives a higher level of protection under the APPs.

By providing personal information to us, you acknowledge that we will collect, use, hold and disclose your information as described in this Privacy Policy and as otherwise permitted or required by law. Where consent is required, we will seek your consent in accordance with applicable privacy laws.

Depending on how you interact with us, we may collect:

• Identity information — name, date of birth, gender, address, contact details
• Health information — medical history, symptoms, diagnoses, treatment notes, referrals, Medicare/health fund details, and other information relevant to your care
• Contact and appointment information — phone number, email address, appointment history, communications with our clinic
• Billing information — payment details, Medicare or health fund numbers, invoicing history
• Website usage information — pages visited, time spent on our site, browser and device type, and general location, collected via cookies and analytics tools (see section 5)
• Emergency contact and next of kin details, where provided

We collect personal information:

• Directly from you, when you make a booking, complete an intake or registration form, communicate with us by phone, email or in person, or use our website's booking system
• From our online booking and practice management software
• From third parties where necessary for your care — for example, referring practitioners, other treating health professionals, Medicare, or your health fund (generally only with your consent, or where otherwise permitted by law)
• Automatically through your use of our website, via cookies and analytics tools

Wherever practicable, we collect personal information directly from you.

We collect and use personal information to:

• Provide healthcare services and manage your treatment and ongoing care
• Make and manage appointments and send appointment reminders
• Process payments, Medicare claims and health fund claims
• Communicate with you about your care, including follow-ups and recalls
• Comply with our legal and professional obligations, including health record-keeping requirements
• Improve our website and services, including through analytics
• Respond to enquiries, feedback or complaints

We will only use or disclose your information for the purpose it was collected, a related purpose you would reasonably expect, or as otherwise required or authorised by law.

Our website uses Google Analytics (or a similar analytics service) to help us understand how visitors use our site. This may involve the collection of information such as your IP address, browser type, pages visited, and the time and duration of your visit, generally in a de-identified or aggregated form.

Google Analytics uses cookies — small text files stored on your device. You can disable cookies through your browser settings, though this may affect how our website functions. You can find more information about how Google collects and processes data at Google's Privacy Policy.

We do not intentionally collect or disclose health information through website analytics tools. Analytics tools are configured to collect general website usage information only, and are not used to record or transmit information entered into clinical or appointment forms.

We use Cliniko, a third-party practice management and online booking platform, to manage appointments and store patient records for the Clinic. When you make a booking through our website or Cliniko, your personal and health information is collected and stored by Cliniko on our behalf, under contractual and privacy obligations consistent with the Privacy Act. Cliniko stores data for Australian accounts on servers located in Australia.

Please note that practitioners operating from our premises are independent practitioners who may, in some cases, use their own separate practice management system for their own patient records. Where this occurs, that system and its data handling practices are managed by the individual practitioner rather than by Gold Coast Allied Health Pty Ltd, and the practitioner's own privacy practices will apply to that information. If you have questions about how a specific practitioner manages your records, please ask them directly or contact us and we will point you to the right person.

We may disclose your personal and health information to:

• Other treating health practitioners involved in your care, with your consent or as reasonably necessary for treatment
• Medicare, the Department of Veterans' Affairs, or your private health fund, for billing and claims purposes
• Our practice management, booking, payment processing and IT service providers, to enable us to operate the clinic
• Regulatory bodies, insurers or legal advisers, where required by law or necessary to establish, exercise or defend a legal claim
• Any other party you have authorised us to disclose information to

We do not sell your personal information to third parties, and we do not use or disclose health information for direct marketing purposes without your consent.

Some of the third-party service providers we use to operate our website and clinic may store or process personal information outside Australia. Where this is likely, we identify the relevant countries below, to the extent practicable:

• Cliniko (practice management and booking) — hosted on servers located in Australia for Australian accounts.
• Base44 (website hosting platform) — hosted on servers located in the United States.
• Google Analytics (website analytics) — operated by Google, which processes data on servers located in the United States and other countries in which Google operates.
• Tyro (payment processing) — an Australian payment provider; card and payment data is processed within Australia.

Where your information is disclosed to an overseas recipient, we take reasonable steps to ensure that recipient handles your information in a manner consistent with the Australian Privacy Principles, including through contractual data processing arrangements. If you do not want your information disclosed to an overseas recipient, please contact us to discuss alternative arrangements where reasonably possible.

We take reasonable steps to protect the personal information we hold from misuse, interference, loss, and unauthorised access, modification or disclosure. This includes:

• Secure, access-controlled practice management and booking software
• Staff training on privacy and confidentiality obligations
• Physical and electronic security measures for records held at our premises

No method of electronic storage or transmission is completely secure, and while we take reasonable steps to protect your information, we cannot guarantee absolute security.

You have the right to request access to the personal information we hold about you, and to request that we correct any information that is inaccurate, out of date, incomplete or misleading.

To make a request, please contact us using the details in section 14. We may need to verify your identity before providing access, and in some circumstances permitted by law we may need to refuse a request (for example, where access would pose a serious threat to health or safety, or would unreasonably impact the privacy of others). If we refuse a request, we will provide reasons where required to do so.

There is generally no charge for requesting access to your information, though we may charge a reasonable fee to cover the cost of retrieving and providing copies of records.

We retain health records for the minimum period required by applicable legislation, professional standards and regulatory requirements. Where different retention periods apply (for example, to different professions, record types, or minors versus adult patients), we will retain records for the longer applicable period. After the applicable retention period, records are securely destroyed or de-identified.

If we become aware of a data breach involving personal information that is likely to result in serious harm, we will assess and respond to the breach in accordance with our legal obligations, including the Notifiable Data Breaches (NDB) scheme under the Privacy Act. Where required by law, we will notify affected individuals and the Office of the Australian Information Commissioner.

If you have concerns about how we have handled your personal information, please contact us using the details below. We will investigate your complaint and respond within a reasonable time.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

• Website: www.oaic.gov.au
• Phone: 1300 363 992

If you have any questions about this Privacy Policy, or wish to access or correct your personal information, please contact us:

We may update this Privacy Policy from time to time to reflect changes in our practices or legal obligations. The updated policy will be posted on our website with a revised "last updated" date. We encourage you to review this policy periodically.