Privacy Policy.

1. Who We Are

Move Physiotherapy & Fitness Pty Ltd (ABN to be confirmed) operates physiotherapy and fitness clinics at Beeliar, Booragoon, East Fremantle, and Jandakot in Western Australia. In this policy, "we", "us", and "our" refer to Move Physiotherapy & Fitness Pty Ltd.

Our primary contact for privacy matters is our Practice Manager, reachable at info@movephysiotherapy.com.au or by phone on 08 6113 8062.

2. What Information We Collect

We collect two categories of information about you.

Personal information

• Name, date of birth, address, phone number, and email address
• Emergency contact details
• Medicare, DVA, private health insurance, WorkCover, and NDIS details
• Referral information from GPs, specialists, and other health professionals
• Billing and payment information (processed securely via Stripe — we do not store full card details)

Health information (sensitive information)

• Medical history, current conditions, medications, and allergies
• Clinical notes, assessment findings, treatment plans, and progress records
• Imaging reports, specialist letters, and other clinical correspondence
• Physiotherapy session records including exercise programs and outcomes
• Physical assessment data collected using our VALD force measurement systems

Health information is classified as sensitive information under the Privacy Act and is afforded a higher level of protection. We only collect health information that is necessary to provide you with physiotherapy and related services.

Information collected through our website

• Contact form submissions (name, email, phone, message)
• Online program purchases via Stripe checkout (name, email, payment details)
• Website usage data collected via Google Analytics (anonymised)
• Marketing engagement data via Meta Pixel (subject to Meta's own privacy policy)

3. How We Collect Information

We collect personal and health information in the following ways:

• Directly from you — through initial intake forms, verbal history-taking during consultations, and written correspondence
• From other health professionals — GP referrals, specialist letters, imaging reports, and clinical correspondence with your consent
• Through our practice management software — Cliniko, which is used to manage appointments, clinical records, and patient communications
• Through our website — contact forms, online bookings, and digital program purchases
• Through our marketing platform — email communications sent through our patient engagement hub, where you have consented to receive them

4. Why We Collect and Use Your Information

We use your personal and health information to:

• Provide physiotherapy assessment, treatment, and rehabilitation services
• Manage your appointments, recalls, and ongoing care
• Communicate with other health professionals involved in your care, with your consent
• Process payments and manage billing, Medicare, DVA, WorkCover, and NDIS claims
• Send appointment reminders, post-treatment follow-ups, and clinical communications
• Send marketing communications where you have opted in (you may unsubscribe at any time)
• Fulfil digital product purchases (exercise programs and guides)
• Comply with our legal, professional, and regulatory obligations
• Maintain records as required by AHPRA, Medicare, and relevant state legislation

We do not use your health information for marketing purposes. Marketing communications relate only to our general services and programs, not to your clinical record.

5. Disclosure of Your Information

We may disclose your personal or health information to the following parties:

Other health professionals

With your consent, we share relevant clinical information with your GP, specialists, or other treating practitioners involved in your care. You may withdraw consent to share at any time.

Third-party service providers

We use the following third-party platforms that may handle your data on our behalf. Each is bound by contractual obligations to protect your information:

• Cliniko — practice management and clinical records (Australian servers; data stored in Australia)
• Stripe — payment processing (PCI-DSS compliant; we do not store card details)
• SendGrid (Twilio) — patient email communications
• Google Analytics — anonymised website analytics
• Meta (Facebook) — advertising and conversion tracking via Meta Pixel
• Vercel — website hosting

Legal and regulatory bodies

We may disclose information where required by law, court order, or regulatory authority — including AHPRA, Medicare, WorkCover, the NDIS Commission, and law enforcement agencies where lawfully required.

What we will not do

• We will not sell your personal information to any third party
• We will not disclose your health information for marketing purposes without your explicit consent
• We will not disclose your information overseas except where required by the third-party services listed above (e.g. Stripe, SendGrid, Meta), which process data in the United States under their own applicable privacy frameworks

6. How We Store and Protect Your Information

Clinical records are stored in Cliniko, which uses Australian data centres, encryption at rest and in transit, and role-based access controls. Website and payment data is processed through Vercel and Stripe, both of which maintain industry-standard security certifications.

Physical records, where they exist, are stored in locked facilities accessible only to authorised clinical staff.

We retain clinical records for a minimum of seven years from the date of last entry, or until a patient is 25 years of age (whichever is later), in accordance with Western Australian health records legislation. Records are then securely destroyed.

Despite our efforts, no system is completely secure. If you have concerns about the security of your information, please contact us directly.

7. Your Rights

Under the Australian Privacy Act, you have the right to:

• Access your personal and health information held by us
• Correct information that is inaccurate, incomplete, or out of date
• Request deletion of your information in circumstances where we are not legally required to retain it
• Withdraw consent to receiving marketing communications at any time (via the unsubscribe link in any email, or by contacting us directly)
• Complain about how we have handled your information

To exercise any of these rights, contact us at info@movephysiotherapy.com.au. We will respond within 30 days. In some circumstances we may need to verify your identity before disclosing or amending records.

8. Cookies and Website Tracking

Our website uses cookies and similar tracking technologies for the following purposes:

• Google Analytics — to understand how visitors use our website. Data is anonymised and aggregated; no personally identifiable information is collected through Analytics.
• Meta Pixel — to measure the effectiveness of our advertising on Facebook and Instagram, and to deliver relevant ads to people who have visited our website. Meta may use this data in accordance with its own data policy.

You can opt out of Google Analytics tracking by installing the Google Analytics Opt-out Browser Add-on. You can manage Meta advertising preferences at facebook.com/ads/preferences.

9. Children's Privacy

We treat patients of all ages, including children. Where a patient is under 18, we collect information from and communicate with a parent or legal guardian. Consent for treatment of minors is obtained from a parent or guardian, and health records for minor patients are managed with appropriate confidentiality protections.

10. Complaints

If you believe we have mishandled your personal or health information, we encourage you to contact us first so we can attempt to resolve your concern. Contact our Practice Manager at info@movephysiotherapy.com.au.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

• Website: www.oaic.gov.au
• Phone: 1300 363 992
• Post: GPO Box 5218, Sydney NSW 2001

11. Changes to This Policy

We may update this policy from time to time to reflect changes in our practices or legal obligations. The current version is always published on this page with the date of last revision. Material changes will be communicated to patients via email where appropriate.