Privacy Policy
1. Purpose
The purpose of this Privacy Policy is to outline how The Healthy Body Company (THBC) collects, uses, stores and discloses personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
THBC is committed to protecting the privacy, confidentiality and security of personal information in line with our commitment to safe, high-quality care and our Clinical Governance framework
2. Scope
This policy applies to all personal information collected and held by THBC in relation to:
- Patients and clients
- Website users
- Employees and contractors
- Students and volunteers
- Referrers and other stakeholders
3. Definitions
Personal Information: Information or an opinion about an identified individual, or an individual who is reasonably identifiable.
Sensitive Information: Personal information requiring a higher level of protection, including health information and other information defined under privacy law.
Health Information: Information about an individual’s physical or mental health, disability, or health services provided.
Consent: Permission given for personal information to be collected, used or disclosed. This may be express (written or verbal) or implied.
Use: Handling personal information within THBC.
Disclosure: Providing personal information to a third party outside THBC.
Data Breach: Unauthorised access to, disclosure of, or loss of personal information.
De-identified Information: Information that no longer identifies an individual.
Australian Privacy Principles (APPs): The legal framework governing how personal information is managed in Australia.
OAIC: Office of the Australian Information Commissioner.Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable.
4. What Personal Information We Collect
THBC collects personal information that is reasonably necessary to provide physiotherapy services and operate our business.
This may include:
- Personal and contact details
- Health and medical information
- Appointment and treatment records
- Billing and payment information
- Website usage information
Information is collected:
- Directly from individuals (in person, phone, email or online)
- Through practice systems (e.g. Nookal)
- From third parties such as referrers or insurers
Where information is collected from a third party, reasonable steps will be taken to inform the individual.
5. Why We Collect Personal Information
We collect and use personal information to:
- Provide physiotherapy assessment and treatment
- Maintain accurate clinical records
- Communicate with you regarding appointments and care
- Process payments and manage accounts
- Comply with legal and regulatory obligations (including AHPRA requirements)
- Improve our services and patient outcomes
- Support internal business operations
If you do not provide required information, we may not be able to deliver our services effectively.
6. Consent
THBC collects and uses personal and health information with your consent.
Consent may be:
- Express – written or verbal consent provided directly
- Implied – through your engagement with our services
You may withdraw your consent at any time by contacting us. This may impact our ability to provide services.
7. Website and Digital Information (Cookies)
When you access our website, we may collect information such as:
- IP address
- Pages visited
- Time spent on pages
- Device and browser information
We may use cookies and analytics tools (e.g. Google Analytics) to:
- Improve website performance
- Understand user behaviour
- Optimise content and marketing
You can control cookies through your browser settings.
8. Disclosure of Personal Information
We may disclose personal information where necessary to:
- Treating healthcare professionals
- Referring practitioners
- Insurers, Medicare or funding bodies (e.g. NDIS, WorkCover)
- IT service providers and software platforms
- Administrative and business service providers
- Regulatory bodies where required by law
We will not sell personal information.
9. Overseas Disclosure
Some of our service providers may store data overseas.
Where this occurs, we take reasonable steps to ensure your information is handled in accordance with Australian privacy laws.
10. Storage and Security of Information
THBC takes reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure.
This includes:
- Secure electronic systems (password-protected)
- Restricted access to authorised personnel
- Secure storage of physical records
- Staff training in confidentiality and privacy
11. Data Retention
We retain personal and health information in accordance with legal requirements:
- Adults: minimum 7 years
- Children: until age 25
When no longer required, information is securely destroyed or de-identified.
12. Data Breaches
THBC takes data security seriously.
In the event of a data breach we will take immediate steps to contain and assess the breach.
Where required, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC)
13. Access to and Correction of Personal Information
You may request access to or correction of your personal information in writing.
We will:
- Respond within a reasonable timeframe (generally within 30 days)
- Take reasonable steps to verify your identity
- Access may be declined in certain circumstances as permitted by law.
- Direct Marketing
We may, with your permission use your contact details to provide:
- Health information
- Service updates
- Promotions or events
- You may opt out at any time.
14. Complaints
If you have a concern about how your personal information is handled, you may contact:
Privacy Officer
The Healthy Body Company
Email: info@thehealthybodycompany.com.au
Phone: 0247312959
Address: PO Box 356, Penrith NSW 2751
We aim to respond within 5 days.
You may also contact the Office of the Australian Information Commissioner (OAIC).