1.What information we collect

In short: we collect the personal and health information needed to provide safe, effective physiotherapy care, plus limited information collected automatically through our website.

Personal information you provide to us

• Name, address, date of birth, email and contact details
• Information about your family or relatives (e.g. emergency contact, next of kin, or a person responsible for you)
• Information about other health professionals involved in your care
• Government identifiers such as your Medicare number, DVA number, or NDIS participant number — we do not use these to identify you within our practice
• Job titles and contact preferences (where relevant, e.g. WorkCover claims)

Health information

• Your relevant medical history and record of symptoms
• Diagnosis and treatment provided to you, including physiotherapy assessment notes
• Specialist reports and test results
• Your healthcare identifier
• Your appointment and billing details
• Your prescriptions
• Your health fund, NDIS, DVA, or WorkCover claim details
• Other health information collected for the purpose of providing your care

Information collected automatically

When you visit our website, we automatically collect some technical information that does not on its own identify you, including your IP address, browser and device characteristics, operating system, referring URLs, general location, and how you interact with our site. We use this for security, site performance, and analytics.

Information from other sources

We may occasionally collect limited information from public databases, joint marketing partners, or other outside sources (e.g. mailing addresses, job titles, social media profiles) to help us keep our records accurate or promote our services. We do not use this for clinical purposes.

2.How we collect your information

We generally collect personal information about you:

• Directly from you — face-to-face, over the phone, or via a registration or online form
• From a person responsible for you, such as a parent, guardian, or carer
• From a third party where permitted by law — for example, other healthcare professionals involved in your care, your health insurer, your NDIS plan manager, WorkCover, DVA, or the My Health Record system
• Automatically, through your use of our website

3.Why we collect and use your information

In short: primarily to provide your physiotherapy care and communicate with those involved in it, and for the everyday administration of our practice.

We process your information to:

• Deliver physiotherapy and allied health services to you, including assessment, treatment, and ongoing care
• Communicate with you and others involved in your care
• Respond to your enquiries and provide support
• Send administrative information, such as appointment reminders and changes to our policies
• Manage our accounts and administrative services, including billing, health fund and NDIS/DVA/WorkCover claims, and pursuing unpaid accounts
• Conduct accreditation, quality assurance, or internal audits
• Request feedback about your experience with us
• Send marketing and promotional communications, where you have not opted out
• Evaluate and improve our services, website, and patient experience
• Comply with our legal obligations, respond to legal requests, and establish or defend our legal rights

4.When and with whom we share your information

We may disclose your information to others outside our practice where permitted or required by law, including to:

• Comply with our legal obligations, such as mandatory reporting under legislation, or responding to a court order or subpoena
• Consult with other health professionals involved in your healthcare
• Obtain results from diagnostic and pathology services
• Claim on insurance, or communicate with your health fund, NDIS plan manager, DVA, WorkCover, or Medicare
• Manage our accounts and administrative services, including billing, debt recovery, and arrangements with health funds
• Lessen or prevent a serious threat to a patient's life, health, or safety, or a serious threat to public health or safety
• Help locate a missing person
• Establish, exercise, or defend a claim, including through the My Health Record system
• Prepare the defence of anticipated or existing legal proceedings
• Discharge notification obligations to our liability insurers
• Facilitate a business transfer, such as a merger, sale, or acquisition involving our practice
• Support IT and cloud service providers who host our systems, under confidentiality obligations

We do not sell your personal information to third parties.

5.Cookies and tracking technologies

We may use cookies and similar tracking technologies to maintain the security of our website, remember your preferences, and understand how visitors use our site. We also use Google Analytics for this purpose. You can opt out of Google Analytics tracking via the Google Analytics opt-out browser add-on, and manage cookie preferences through your browser settings.

Cookie data is used for site analytics and security only — we do not use tracking technologies to share your health information with advertisers.

6.AI-based tools we use

As part of our services, we use tools powered by artificial intelligence or automation technologies — for example, our virtual receptionist system, which helps manage appointment bookings and clinic communications at our Capalaba clinic. Any personal information processed by these tools is handled in accordance with this Privacy Policy and secured through encrypted, access-controlled systems. We do not use AI tools to make automated decisions about your clinical care.

7.How long we keep your information

We keep your personal and health information for as long as necessary to provide your care and to meet our legal obligations — including minimum health record retention periods required under Queensland law (generally at least 7 years for adults, and until age 25 for records relating to a patient who was a minor). When we no longer have a legitimate need to retain your information, we securely delete or de-identify it.

8.How we keep your information safe

We take reasonable technical and organisational steps to protect the personal information we hold, designed to prevent unauthorised access, modification, disclosure, misuse, or loss. This includes:

• Holding information on an encrypted database
• Holding information in secure cloud storage
• Requiring staff to sign confidentiality agreements
• Providing staff with training on confidentiality and security
• Restricting access to information on a need-to-know basis
• Enforcing strong password protections on all systems

No method of electronic transmission or storage is 100% secure, so while we do our best to protect your information, we cannot guarantee absolute security.

9.Overseas disclosure of your information

Other than through these service providers, we do not otherwise disclose your personal information to anyone overseas. If we intend to transfer your personal information overseas in a way not covered above, we will seek your consent first, unless we are required by law to make the transfer.

10.Treatment of children and minors

Moov Physio provides treatment to patients of all ages, including children. Where a patient is under 18, we collect and hold their personal and health information with the consent of a parent or guardian, who may also exercise access and correction rights on the child's behalf. We do not use children's health information for marketing purposes, and we apply the same security and confidentiality standards to minors' records as to all other patient information.

Our website itself is not directed at children, and we do not knowingly collect personal information through the website from anyone under 18 outside the context of arranging or receiving treatment. If you believe we hold information about a child that was collected inappropriately, contact us via our contact form.

11.Anonymity and use of a pseudonym

Where it is lawful and practicable for us to do so, you have the right to receive treatment from us anonymously or through the use of a pseudonym.

12.Your privacy rights

Access and correction

You have the right to seek access to, and correction of, the personal information we hold about you. We will normally respond to your request within 30 days. Access requests do not have to be in writing, though a written request can help us keep an accurate record, particularly for more sensitive matters.

If you believe the information we hold about you is incorrect, let us know in writing. We will take reasonable steps to correct it, and we may periodically ask you to verify that your details remain accurate.

Withdrawing consent

Where we rely on your consent to process your information, you may withdraw that consent at any time by contacting us. This will not affect the lawfulness of processing carried out before your withdrawal.

Marketing preferences

You can opt out of marketing and promotional communications at any time by using the unsubscribe link in our emails, replying "STOP" to SMS messages, or contacting us directly. We may still contact you for service-related, non-marketing purposes.

13.Australian Privacy Principles

We collect and process your personal information under the obligations and conditions set by the Privacy Act 1988 (Cth). This policy satisfies the notice requirements of the Act, including what personal information we collect, from which sources, for what purposes, and to which recipients it may be disclosed.

If you do not wish to provide certain personal information, this may affect our ability to provide treatment or respond to your request.

14.Do-Not-Track signals

As no uniform industry standard for Do-Not-Track (DNT) signals currently exists, our website does not respond to browser DNT signals. If a recognised standard is adopted in future, we will update this policy accordingly.

15.Changes to this policy

We may update this policy from time to time to reflect changes in our information-handling practices or the law. We will notify you of material changes by displaying updates at reception and posting the revised policy on our website, with an updated "Last updated" date at the top of this page.

16.Privacy complaints

If you have a concern about how we've handled your personal information, please let us know in writing. We will aim to respond within 30 days.

If you are not satisfied with our response, you can refer your complaint to the Office of the Australian Information Commissioner (OAIC):

17.How to contact us

For any privacy-related questions, access requests, or corrections, please contact: