Privacy Policy

1. Our commitment

On Form Physiotherapy provides physiotherapy, bike fitting and related services in Perth, Western Australia. To care for you properly we need to collect personal information, including health information. We treat that information as confidential and handle it in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

As a health service provider, we are bound by the Privacy Act regardless of our size, and health information is given a higher level of protection than ordinary personal information.

This policy explains what we collect, why, who we share it with, how we protect it, and how you can access it or raise a concern.

2. What we collect

Identity and contact details — your name, date of birth, address, phone number, email address, emergency contact, and your GP or referring practitioner.

Health information — your medical history, current symptoms, assessment findings, treatment notes, exercise programs, progress and outcome measures, correspondence from other practitioners, imaging and test results, and details of medications or relevant conditions you tell us about.

Movement recordings — for bike fitting, running gait analysis and some physiotherapy assessments, we capture video, photographs and measurement data of you moving. These form part of your clinical record and are treated as health information.

Billing and funding details — your Medicare number, DVA number, private health fund membership, NDIS participant number, workers compensation claim number, or insurer and claim details, as they apply to you. Payments and health fund claims are processed by our payment providers; we do not store your full card numbers.

Website and communication information — anything you send us through our contact form, by email, by phone or on social media, and technical information collected automatically when you use our website (see section 9).

If you choose not to give us some information, we will still do our best to help, but there may be care we cannot safely provide, or claims we cannot process on your behalf.

3. How we collect it

Wherever possible we collect information directly from you — when you book, complete intake forms, attend appointments, or contact us.

Sometimes we collect information about you from others, where it is reasonably necessary for your care or for a claim: your GP or referring practitioner, another treating practitioner, a hospital or imaging provider, your insurer, employer or rehabilitation provider in a workers compensation or motor vehicle claim, your NDIS plan manager or support coordinator, or a parent, carer or advocate where appropriate.

If we receive information about you from someone else and you would not reasonably expect it, we will tell you, unless the law says otherwise.

4. Why we use it

We use your personal and health information to:

• assess, diagnose, treat and review your condition
• prescribe and deliver home exercise programs through our exercise platform
• communicate with you about appointments, reminders, results and your care
• write to your GP, referrer or other practitioners involved in your treatment
• process payments, Medicare, DVA, NDIS and private health fund claims
• manage workers compensation and motor vehicle insurance claims, including required progress reports
• meet our legal, professional, insurance and record-keeping obligations
• manage our practice, including quality improvement, staff supervision and training, and accounting
• respond to your enquiries, and send you clinic news or offers where you have agreed to receive them

We do not use your health information to decide what marketing to send you.

5. Who we share it with

We disclose your information only where it is necessary, expected, or required by law. This may include:

• Practitioners involved in your care — our physiotherapists and administrative staff, and your GP, referrer or other practitioners you have agreed we should communicate with.
• Practitioners working alongside us — remedial massage at our Rockingham clinic is provided by Athletes Edge, an independent provider who works within our practice and records treatment in our clinical system. They can access the records of the clients they treat, and are bound by the same confidentiality and privacy obligations as our own staff.
• Funders and insurers — Medicare, DVA, your private health fund, the NDIS or your plan manager, your workers compensation insurer and WorkSafe WA, the Insurance Commission of WA, or your employer’s rehabilitation coordinator, where you are making a claim through them. In a workers compensation or motor vehicle claim, the insurer is entitled to information relevant to that claim, and our reports are shared with them.
• Our service providers, who handle information on our behalf under confidentiality obligations — our practice management and clinical records system, our online booking and claiming platform, our exercise prescription platform, our payment provider, our website host and email provider, and our accountant.
• Others where required or permitted by law — for example a court order or subpoena, a mandatory reporting obligation, or to lessen a serious threat to someone’s life, health or safety.
• A purchaser of the practice — if On Form Physiotherapy is ever sold or transferred, records may pass to the new owner as your ongoing provider. You would be notified.

We do not sell your information, and we do not give it to anyone for their own marketing.

6. Consent

By attending an appointment and providing your information, you consent to us collecting, using and disclosing it as set out in this policy. You can withdraw or limit that consent at any time by telling us, though this may affect the care or claims we can manage for you.

For patients under 18, a parent or guardian usually provides consent and receives information about care. Where a young person is assessed as able to make their own decisions about their treatment, we will respect their privacy accordingly.

7. Storage, security and how long we keep it

Your clinical record is held electronically in our practice management system, with access limited to staff who need it for your care or our administration. We use individual logins, multi-factor authentication on our systems, and encrypted connections. Any paper records are stored securely and are converted to our electronic record where possible.

We keep health records for at least 7 years from your last appointment. For patients treated as children, we keep records until they turn 25. After that, records are securely destroyed or de-identified. We also keep information longer where the law, an insurer or an open claim requires it.

Where your information is stored. Our clinical records are held in Australia by our practice management provider. Our payment and claiming provider processes payment and sensitive information in Australia, and may use service providers located overseas. Our home exercise platform, which holds your name, contact details and exercise program (but not your full clinical record), is hosted on servers located in Japan. Where information is held or accessed outside Australia, we take reasonable steps to ensure it is protected to a standard consistent with the Australian Privacy Principles.

If we ever suffer a data breach likely to cause you serious harm, we will act on it and notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

8. Appointment reminders and clinic communications

We may contact you by SMS, email or phone about your appointments, your exercise program and your care. These are part of providing your treatment, not marketing.

From time to time we also send clinic news, health information and occasional offers by email to people who have agreed to receive them. Every one of these messages includes an unsubscribe link, and you can also ask us at any time to stop. Opting out will not affect your care. We do not use your health information to decide what to send you, and we never share your details with other businesses for their marketing.

9. Our website

Contact form. When you use the contact form on our website, the details you enter are sent to our clinic email so we can respond. Please don’t send detailed health information through the form — bring it to your appointment or call us.

Booking. Our “Book Now” links take you to our online booking platform, which is operated by a third party and collects your details under its own terms and privacy policy.

Cookies and analytics. Our website uses cookies and similar technologies, including Google services, to keep the site working, understand how visitors use it, and measure the performance of our advertising. This information is aggregated and does not identify you personally. You can block or delete cookies in your browser settings; some parts of the site may then work less well.

Links. Our site links to other organisations, including research articles and our co-located partners. We are not responsible for their privacy practices.

10. Accessing and correcting your information

You have the right to ask for a copy of the personal and health information we hold about you, and to ask us to correct anything inaccurate, out of date or incomplete.

To make a request, contact us using the details below. We may ask you to put the request in writing and to confirm your identity. We will respond within 30 days. Where a request takes significant time to prepare, we may charge a reasonable fee for the cost of retrieving and copying the records; we will tell you before any cost is incurred.

We can refuse access in the limited circumstances the Privacy Act allows — for example, where giving access would pose a serious threat to someone’s life, health or safety, or would unreasonably affect another person’s privacy. If we refuse, we will explain why in writing and tell you how to have the decision reviewed.

11. Complaints

If you have a concern about how we have handled your information, please tell us first. Contact us using the details below and we will acknowledge your complaint promptly and aim to resolve it within 30 days.

If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner: oaic.gov.au · 1300 363 992 · GPO Box 5288, Sydney NSW 2001.

12. Contact us

On Form Physiotherapy
Yangebup: 1/52 Erceg Road, Yangebup WA (inside One Life Fitness)
Rockingham: 10/9 Kent Street, Rockingham WA (inside SBR Collective)
Phone: (08) 6385 8029
Email: contact@onformphysio.com.au

13. Changes to this policy

We review this policy from time to time. The current version is always available at onformphysio.com.au/privacy-policy/. The date at the top shows when it was last updated.