Your information, protected

The Big Pink Physio ("I", "me", "my", "the practice") is committed to protecting your privacy. I am a health service provider, and I take particular care with the sensitive health information you trust me with. This policy explains how I handle your personal information in accordance with Australian privacy law.

1. Who I am

The Big Pink Physio is a physiotherapy practice operating in Sydney, New South Wales, run by an APA Titled Sports & Exercise Physiotherapist registered with the Physiotherapy Board of Australia (AHPRA).

• Trading name: The Big Pink Physio
• ABN: 49 740 742 653
• Address: Dee Why, NSW 2099
• Email: mace@thebigpinkphysio.com.au
• Phone: 0400 882 643
• Privacy Officer: Mason Neal - contactable at the email above

2. Laws that apply

I handle your information in accordance with:

• the Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs);
• the NSW Health Records and Information Privacy Act 2002 (HRIP Act) and the 15 Health Privacy Principles (HPPs), which apply to health service providers in New South Wales; and
• the Notifiable Data Breaches (NDB) scheme under the Privacy Act.

As a health service provider, the Privacy Act applies to me regardless of my annual turnover.

3. What personal information I collect

The information I collect depends on your interaction with me. It may include:

• Identity & contact details - name, title, pronouns, date of birth, address, phone, email, and emergency-contact details.
• Health information (sensitive information) - your medical and physiotherapy history, symptoms, examination findings, diagnoses, treatment and progress notes, imaging and test results, medications, and information relevant to pelvic, sexual, bladder, bowel and gender-affirming care.
• Administrative & payment information - Medicare number, private health-fund details, DVA details, referral information, and payment records (I do not store full card numbers).
• Communications - emails, messages, booking details and enquiry information.
• Website data - see section 12.

4. How I collect it

Wherever practicable, I collect personal information directly from you - through intake forms, consultations, phone, email, or my online booking system. Sometimes I collect information from others with your consent or where the law allows, such as your GP or referring practitioner, other treating health professionals, your private health fund, Medicare, or DVA.

5. Why I collect and use it

I collect, hold and use your information to:

• assess, plan, provide and manage your physiotherapy care;
• communicate with you about appointments, results and treatment;
• liaise with other health professionals involved in your care;
• process payments, claims and rebates (Medicare, private health, DVA);
• meet my professional, legal and record-keeping obligations; and
• manage and improve my services.

I will only use your information for the purpose it was collected, a directly related purpose you would reasonably expect, or where you have consented or the law requires or permits it.

6. Consent & sensitive information

Health information is one of the most sensitive categories of personal information and attracts additional protection under the law. I generally collect it only with your consent, and only where it is reasonably necessary for your care. By providing your health information and receiving treatment from me, you consent to me handling it as described in this policy. You can withdraw or vary your consent at any time by contacting me, though this may affect my ability to provide care.

7. Who I disclose it to

I do not sell your information. I may disclose it to:

• other health professionals involved in your care (with your consent) - for example your GP, specialists, surgeons or other allied-health providers;
• Medicare, DVA, or your private health fund for claims and rebates;
• my service providers who help me operate - such as my practice-management and booking software, secure hosting, IT support, and accounting - who are bound to protect your information;
• a person responsible for you (for example a carer) where appropriate; and
• others where required or authorised by law, or to lessen or prevent a serious threat to health or safety.

8. Overseas disclosure

I aim to keep your information in Australia. However, some of my third-party software providers (for example cloud-based practice-management, booking or email services) may store or process data on servers located outside Australia. Where this occurs, I take reasonable steps to ensure those providers protect your information in a manner consistent with the APPs.

9. Storage & security

I take reasonable steps to protect your information from misuse, interference, loss, and unauthorised access, modification or disclosure. These steps include secure electronic records with access controls and passwords, encryption in transit where available, secure storage of any physical records, staff confidentiality obligations, and reputable software providers with their own security safeguards.

10. How long I keep it

I retain your health records for the minimum periods required by law. In general, adult health records are kept for at least 7 years from the date of last contact. For patients who were under 18, records are kept until the person reaches 25 years of age. When records are no longer required, I destroy or de-identify them securely.

11. Access & correction

You have the right to request access to the personal and health information I hold about you, and to ask me to correct it if it is inaccurate, out of date, incomplete or misleading. To make a request, contact my Privacy Officer using the details in section 17. I will respond within a reasonable time and may need to verify your identity. In limited circumstances I may decline access as permitted by law - for example where providing access would pose a serious threat to someone's life, health or safety - and if so I will explain why in writing and set out how you can respond.

12. Website, cookies & analytics

When you visit this website, my hosting and analytics tools may automatically collect limited technical information such as your IP address, browser and device type, pages viewed, and the date and time of your visit. This is used to keep the site secure and to understand and improve how it is used. I do not use this information to identify you personally.

My website may use cookies - small files stored on your device - to help the site function and to gather anonymous usage statistics. You can disable cookies in your browser settings, though some features may not work as intended.

13. Online booking

Appointments may be booked through Cliniko, my third-party booking and practice-management provider. Information you enter into the booking system is collected and stored by Cliniko on my behalf and handled in accordance with this policy and Cliniko's own privacy and security controls. You can read about Cliniko's security at cliniko.com/security.

14. Data breaches

I have procedures to respond to suspected data breaches. If a breach of your personal information is likely to result in serious harm, I will notify you and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme, and take steps to contain and remedy the breach.

15. Complaints

If you believe I have mishandled your personal information or breached your privacy, please tell me first so I can put it right. Contact my Privacy Officer using the details in section 17. I will acknowledge your complaint promptly, investigate, and respond in writing - usually within 30 days.

If you are not satisfied with my response, you can contact:

• Office of the Australian Information Commissioner (OAIC) - 1300 363 992 · oaic.gov.au
• Information and Privacy Commission NSW (IPC) - 1800 472 679 · ipc.nsw.gov.au
• Health Care Complaints Commission NSW (HCCC) - 1800 043 159 · hccc.nsw.gov.au

16. Changes to this policy

I may update this policy from time to time to reflect changes in my practices or the law. The current version is always available on this page, with the "last updated" date shown at the top.

17. Contact me

For any privacy question, request, or complaint, contact my Privacy Officer:

• The Big Pink Physio - Privacy Officer
• Email: mace@thebigpinkphysio.com.au
• Phone: 0400 882 643
• Post: Unit 2, 2 Monash Parade, Dee Why, NSW, 2099