Privacy Policy

1. About this policy

MoveLab Health (“we”, “us”, “our”) is a physiotherapy clinic at 85 Lava Street, Warrnambool, Victoria. We respect your privacy and handle your personal and health information carefully and confidentially.

This policy explains how we collect, use, store and share your information, and how you can access it or make a complaint. We are bound by:

• the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs)
• the Health Records Act 2001 (Vic) and its Health Privacy Principles (HPPs)
• the professional and confidentiality obligations of registered physiotherapists under the Physiotherapy Board of Australia and AHPRA

This policy applies to patients, prospective patients, website visitors, referrers and anyone else whose information we handle.

2. What information we collect

We collect only the information we need to provide safe, effective physiotherapy care and run our clinic.

Personal and contact details

• name, date of birth, gender, address, phone number and email
• emergency contact and next of kin
• details of a parent or guardian for patients under 18

Health information

• your medical history, current symptoms, injuries, medications and relevant family history
• assessment findings, diagnoses, treatment plans, clinical notes and exercise programs
• test results, imaging reports and correspondence from your GP, specialists or other health providers
• outcome measures, including those collected for programs such as GLA:D
• consent records, including for treatments such as dry needling

Billing and funding details

• Medicare, private health insurance, DVA, TAC or WorkSafe claim numbers and details
• employer or insurer details for compensable claims
• payment information (card payments are processed by our payment provider; we do not store full card numbers)

Other information

• appointment history and communications with us
• information you enter through our website or online booking system

Health information is “sensitive information” under the Privacy Act. We only collect it with your consent, or where the law allows.

3. How we collect it

Wherever practical, we collect information directly from you, including:

• when you book online, by phone, by email or in person
• through new patient intake forms (paper or electronic)
• during your consultation and ongoing treatment
• when you pay for services or make a claim

We may also collect information from others, with your consent or where the law allows:

• referrals and reports from your GP, specialist or other health practitioners
• a parent, guardian, carer or authorised representative
• insurers, employers, TAC, WorkSafe or DVA for compensable claims
• Medicare or your private health fund when processing claims

If we receive information about you that we did not ask for, we will decide whether we could have lawfully collected it. If not, we will destroy or de-identify it where lawful and reasonable.

4. How we use and share your information

We use your information mainly to assess, treat and manage your care. We also use it to:

• manage appointments and send reminders by SMS or email
• process payments and claims with Medicare, private health funds, DVA, TAC, WorkSafe or other insurers
• communicate with your referring doctor and other practitioners involved in your care
• meet our legal, professional and accreditation obligations
• improve our services through internal quality review, clinical audit and staff training

We may disclose your information to:

• your GP, specialists and other health providers involved in your care
• Medicare, private health funds and payment processors
• insurers, employers or government agencies for compensable claims, as authorised by you
• trusted service providers who help us run the clinic (see section 5)
• program registries, such as the GLA:D Australia registry, only with your consent and generally in de-identified form
• our lawyers, insurers or professional advisers where needed

We may also disclose information without consent where the law requires or allows it. Examples include a subpoena or court order, mandatory reporting, or where needed to lessen a serious threat to someone’s life, health or safety.

We do not sell your personal information. We will not use your health information for marketing.

5. Storage, security and retention

Your records are stored electronically in Cliniko, our secure cloud-based practice management system. Cliniko stores Australian clinic data on servers located in Australia.

We protect your information with reasonable safeguards, including:

• password-protected, role-based access, limited to staff who need it
• multi-factor authentication and encrypted data transfer
• secure storage and shredding of any paper records
• staff confidentiality obligations and privacy training

Service providers. We use trusted third-party providers for practice management, online booking, SMS and email reminders, payment processing, IT support and our website. They may only use your information to provide services to us and must protect it.

Overseas disclosure. We aim to keep your information in Australia. Some providers (for example, email or IT services) may process limited data overseas. Where this happens, we take reasonable steps to ensure the recipient protects it consistently with Australian privacy law.

Retention. As required by the Health Records Act 2001 (Vic), we keep health records for at least 7 years after your last visit. For patients under 18, we keep them until at least age 25. After that, we securely destroy or de-identify them.

Data breaches. If a data breach is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme.

6. Your rights and choices

Access and correction. You can ask to access or correct the information we hold about you. Contact us in writing (see section 7). We will respond within 30 days. We may ask you to verify your identity. We may charge a reasonable fee for copying records, but not for making the request. If we refuse access or correction, we will explain why in writing.

Anonymity. You can deal with us anonymously or under a pseudonym for general enquiries. For treatment and claims, we need to identify you.

Website and online booking. Our website, movelabhealth.com.au, links to our Cliniko online booking system. Information you enter there is handled under this policy. Our website may use cookies and analytics tools to understand how visitors use it. You can disable cookies in your browser. Our site may link to other websites, which have their own privacy policies.

Marketing. With your consent, we may send occasional clinic news, health information or program updates, such as GLA:D. You can opt out at any time using the unsubscribe link or by contacting us. Appointment reminders and clinical communications are not marketing.

7. Complaints and contact

If you have a question or concern about your privacy, please contact our Privacy Officer first. We will acknowledge your complaint within 7 days and aim to resolve it within 30 days.

If you are not satisfied with our response, you can contact:

8. Changes to this policy

We may update this policy from time to time. The current version is always available on our website and at reception. You can request a free copy in another format.

Last updated: September 2026