The Joint Physiotherapy and Allied Health Privacy Policy

Last updated: November 2025

This policy explains how we collect, use, disclose, store, and protect your personal and health information.

1. Our Commitment to Your Privacy

The Joint Physiotherapy and Allied Health (“we”, “our”, or “us”) is committed to protecting the privacy of your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). We also adhere to professional privacy and confidentiality obligations as outlined by the Australian Health Practitioner Regulation Agency (AHPRA) and the Exercise and Sports Science Australia (ESSA) Code of Professional Conduct and Ethical Practice for Accredited Exercise Physiologists (AEPs).

2. What Information We Collect

We collect personal and health information that is necessary to provide our physiotherapy and allied health services. This may include:

• Personal Information: name, date of birth, address, phone number, email address, emergency contact details, billing information, and other identifiers such as Medicare or private health fund details.
• Health and Sensitive Information: medical history, treatment notes, test results, reports, referrals, medications, and other health-related information relevant to your care. This information is collected through forms (online or paper), our practice management software (Cliniko, Heidi Health), allied systems (Physitrack, VALD, Allie, Medical Objects), telehealth consultations, emails, and other communications.

3. Purpose of Collection

Your information is collected and used for the following primary purposes:

• To provide safe, effective, and evidence-based physiotherapy and exercise physiology services. – To communicate with you regarding appointments, reports, and treatment outcomes.
• To liaise with other health professionals or insurers (e.g., GPs, specialists, NDIS, WorkCover, or private health funds) where necessary for your care.
• To comply with legal and professional obligations under AHPRA and ESSA. We may also use your contact information for administrative or marketing purposes, such as clinic updates or newsletters. You may opt out of such communications at any time.

4. Use and Disclosure of Personal Information

We will only use or disclose your information for the purpose for which it was collected or a directly related secondary purpose you would reasonably expect, including:

• Referral or reporting to other treating practitioners or case managers. – Billing, invoicing, and health fund or Medicare claims.
• Clinical supervision, audit, or quality improvement (de-identified data only).
• Legal or regulatory reporting when required by law. We do not sell or trade your personal information to third parties.

5. Telehealth and Digital Communications

We offer telehealth consultations via secure, encrypted platforms. While we take reasonable measures to protect your privacy online, all digital communication carries some inherent risk. We recommend avoiding sensitive personal details in unencrypted channels such as email. We will not record telehealth sessions without your explicit written consent. Clients are also asked not to record sessions or share materials without permission.

6. Third-Party and Cloud Software Providers

We utilise several secure, industry-standard software platforms to deliver our services:

• Cliniko – hosted in Australia, compliant with APPs.
• Heidi Health – APP-compliant, integrated with Cliniko.
• Physitrack – hosted on Australian AWS servers (with possible international redundancy).
• VALD Performance – uses secure cloud-based services, some hosted within the EU; data residency options are managed within the platform.
• Allie – linked with Cliniko, used for operational support.
• Medical Objects – hosted in Australia, used for secure referrals and reports. We take reasonable steps to ensure that any third-party provider we use complies with the APPs. Where there is potential for overseas data storage (e.g., Physitrack, VALD), we ensure that appropriate safeguards and contractual measures are in place.

7. Cross-Border Data Disclosure

While we primarily store data within Australia, some third-party services may store information on secure servers located overseas. In these cases, we take reasonable steps to ensure the overseas recipient upholds privacy protections substantially similar to those required under Australian law.

8. Storage, Security, and Retention

Your information is stored securely in electronic format, protected by password access, encryption,
and firewall security. Access is restricted to authorised staff. We retain client records for a minimum of seven (7) years from the last date of service, or longer if required by law or professional standards. After this period, records are securely destroyed or permanently de-identified.

9. Access and Correction

You may request access to, or correction of, your personal information by contacting our clinic. We will respond within a reasonable timeframe and may require identification before releasing information. There is no fee for access, but reasonable administrative costs may apply. If your request is denied (e.g., for legal reasons), we will explain the reason in writing.

10. Data Breach Notification

In the unlikely event of a data breach that may cause serious harm, we will comply with the Notifiable Data Breach Scheme under the Privacy Act 1988 and notify both you and the Office of the Australian Information Commissioner (OAIC) as required.

11. ESSA and AHPRA Obligations

All Accredited Exercise Physiologists (AEPs) at The Joint operate in accordance with the ESSA Code of Professional Conduct and Ethical Practice, which requires strict confidentiality and secure handling of all client data. Similarly, all registered physiotherapists adhere to AHPRA’s professional codes and privacy standards for handling health information.

12. Changes to This Policy

We may update this policy from time to time. The latest version will always be available on our website. Continued use of our services after an update indicates your acceptance of the revised terms.

13. Complaints and Enquiries

If you have any concerns about how your personal information is handled, please contact us:

The Joint Physiotherapy and Allied Health
9/1220 Sandgate Rd, Nundah QLD 4012
Email: info@thejointnundah.com
Phone: (07) 3191 4455

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or by calling 1300 363 992.
© The Joint Physiotherapy and Allied Health 2025