Privacy Policy

1. About this policy

Your health information is private, and I treat it that way. This policy explains what personal information I collect, why, how I keep it safe, and how you can see or correct it.

ReCentre Physio is my telehealth physiotherapy practice (Emily Jones, ABN 93 661 171 070), based in Australia. In this policy, "I", "me" and "my" mean ReCentre Physio. "You" means my clients, people who contact me, and visitors to this website.

As a health service provider, I must follow the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), whatever the size of my business. Because I practise in New South Wales, I also follow the Health Privacy Principles in the NSW Health Records and Information Privacy Act 2002. As a physiotherapist registered with the Australian Health Practitioner Regulation Agency (AHPRA), I also follow the Physiotherapy Board of Australia's Code of conduct, which requires me to keep your information confidential and your health records accurate and secure.

This policy covers all the information I hold about you, whether you give it to me through this website, my booking system, by email, on a form or during a session.

2. What information I collect

I only collect information I need to give you safe, good-quality care and to run my practice.

Personal details: your name, date of birth, gender, address, phone number, email address and emergency contact.

Health information (this is "sensitive information" under the Privacy Act, and I give it extra protection):

• your reasons for seeking support, symptoms, medical history, diagnoses, medications and test results
• information from your intake and health screening form
• information from the optional "Getting to Know Your Nervous System" form, if you choose to complete it (for example, sensory preferences and what helps you feel safe in a session)
• my clinical notes (including notes drafted with AI assistance, if you agree to it), assessments, treatment plans and progress
• letters and reports to or from your GP, psychologist, specialists or other health providers

Billing and funding details: your Medicare number and GP referral or care plan details, private health fund details, NDIS participant number and plan manager details, and any insurer or claim details. When you book, you add a card, which is stored securely by my payment provider, Stripe. I never see or store your full card number. Your saved card is only charged as you agree at booking: initial assessments at the time of booking, follow-up sessions straight after each session, and the full session fee for changes or cancellations within 24 hours or non-attendance. If you are an NDIS plan-managed client, I invoice your plan manager instead.

Email list and quiz information: your first name, email address and general quiz result type, if you complete my nervous system self-check or join my email list (see section 6).

Website information: your messages to me, and basic technical information about how you use this website (see section 5).

You don't have to tell me anything you're not comfortable sharing, and you never have to tell me your trauma story to work with me. If you choose not to give some information, I'll talk with you about how that might affect your care.

3. How I collect your information

I collect most information directly from you:

• when you book online or fill in forms through my practice management system, splose
• during your telehealth sessions
• when you email me at hello@recentrephysio.com.au
• when you complete the nervous system self-check or sign up to my email list on this website

Sometimes I collect information from other people, but only with your consent or where the law allows. This includes your GP (for example, a referral or care plan), other health providers in your care team, your NDIS plan manager, a parent or guardian for clients under 18, or a support person you have asked to be involved.

If someone gives me information about you that I didn't ask for, I'll decide whether I need it. If I don't, I'll destroy or de-identify it where it is lawful to do so.

A note about email. Email isn't fully secure. Please keep detailed health information for our sessions or your splose forms rather than email.

4. How I use and share your information

I use your information to provide your care and run my practice. That includes:

• assessing you, planning and providing physiotherapy, and keeping accurate clinical records
• managing bookings and reminders, charging your saved card as agreed at booking, and emailing you a receipt after each payment
• helping you claim Medicare rebates, private health fund benefits or NDIS funding
• communicating with you about your appointments and care
• meeting my legal, professional and insurance obligations
• improving my service (using de-identified information wherever possible)

Sharing with your health team. I work alongside your GP, psychologist and specialists. I only share information with them with your permission, or when it is directly related to your care and you would reasonably expect it. You can tell me at any time who you do or don't want me to talk to.

Other disclosures. I may also share information with:

• Medicare (Services Australia), your private health fund, your NDIS plan manager or an insurer, to process payments or claims you have asked for
• the trusted service providers who help me run my practice (see section 5)
• my professional indemnity insurer or legal advisers, if needed
• AHPRA or the Physiotherapy Board of Australia, if required

I will only share information without your consent where the law requires or allows it. Examples are a court order, mandatory reporting obligations (such as child protection reporting), or where I reasonably believe it is needed to lessen or prevent a serious threat to someone's life, health or safety.

Clinical supervision. I may discuss my work with a clinical supervisor or mentor to support good care. When I do, I leave out anything that could identify you.

I never sell your information. I will never use your health information, your story or your image in advertising or testimonials. This is also in line with AHPRA's rules on advertising regulated health services.

Your clinical records stay separate from my email list. Anything you share in sessions or through splose stays in splose. It is never shared with MailerLite or used for marketing.

5. Bookings, telehealth, AI note-taking and service providers

Bookings and records. My bookings, forms, client records and clinical notes are managed in splose, my practice management software. splose stores this information for me in Australia, and this policy covers it.

Telehealth. Sessions run on Healthdirect Video Call, a secure video platform funded by Australian governments. You join through a link; you don't need an account. I don't keep video or audio recordings of sessions. Please don't record sessions without my agreement. For your own privacy, I suggest joining from a private space where you won't be overheard. At the start of each session I confirm your identity and where you are, so I can get you help quickly if there's an emergency.

AI-assisted note-taking (splose AI). With your permission, I may use splose AI, a feature of my practice software, to help write my clinical notes. During the session it listens and turns our conversation into a draft note, so I can focus on you rather than typing. This is how I use it:

• I always ask first. I explain what the tool does and ask for your consent before I use it. This is separate from your consent to treatment, in line with AHPRA's guidance on AI in healthcare. I record your answer in your file and check again if anything changes.
• It's your choice. Saying no won't affect your care, your fees or how I treat you. You can change your mind at any time, even partway through a session, and I'll switch it off.
• Everyone present is asked. If a support person joins, I ask them too. For clients under 18, I ask both the young person and their parent or guardian.
• I stay responsible. I read, check and correct every AI draft before it is saved. AI never makes decisions about your care.
• How your information is handled. splose AI's voice-to-text feature processes your session securely, in real time, within the splose platform. It is powered by OpenAI. Your session content is not saved on the web, and it is not used to train AI models. splose follows Australian privacy law and the GDPR. Only the final, checked note is kept in your splose record. Any recordings are handled and stored securely under splose's Terms of Service.

Service providers. I use a small number of trusted providers. They can only use your information to provide their service to me.

Swipe or scroll sideways to see the full table.

Overseas disclosure. Your clinical records are stored in Australia. Some of my providers handle limited information overseas. MailerLite stores my email list in the European Union (mainly Germany, the Netherlands and Lithuania). Emails you send me are held by Google Workspace, which may store them in its data centres around the world, including the United States. Cloudflare hosts this website on a global network of data centres, with its core systems in the United States and the European Economic Area, and may handle website usage data there. Stripe may process payment information overseas, including in the United States. If you agree to AI note-taking, session content is processed by OpenAI in the United States to create the draft note and is not kept by OpenAI. I take reasonable steps to make sure these providers protect your information to a standard similar to the Australian Privacy Principles.

Cookies and analytics. This website may use cookies and similar tools to keep it working and to understand how it is used (for example, Cloudflare Web Analytics). This information doesn't identify you by name. You can block cookies in your browser settings; the site will still work.

Automated decisions. I don't use computer programs to make decisions about your care, eligibility or services. Your quiz result is general information only, not a diagnosis or a decision about you. Every decision about your care is made by me, with you.

6. My email list and website quiz

What I collect. Your first name, your email address and your general quiz result type.

Why I collect it. To send you your quiz results and occasional educational emails about nervous system health and my services. I only email you if you have ticked the consent box and confirmed your email address.

How it's stored. I use MailerLite to manage my email list. MailerLite stores this information in ISO/IEC 27001-certified data centres in the European Union (mainly Germany, the Netherlands and Lithuania), and follows the EU's General Data Protection Regulation (GDPR). I take reasonable steps to make sure MailerLite handles your information in line with the Australian Privacy Principles.

Kept separate from your clinical records. My email list holds only the details above. Your appointments and health information stay in splose and are never shared with MailerLite.

Tracking. MailerLite records whether emails are opened and which links are clicked. I only look at this in summary, to understand which content is helpful.

Unsubscribing. Every email has an unsubscribe link. You can also email me at hello@recentrephysio.com.au and I'll remove you within two business days.

How long I keep it. I keep your email list details until you unsubscribe or ask me to delete them.

7. How I keep your information safe

I store your records electronically in secure, password-protected systems. I don't keep paper files; any paper you send me is scanned and then securely destroyed.

My safeguards include:

• multi-factor authentication on my practice software and email
• encrypted connections for this website, my booking system and video calls
• access limited to the people who need it to provide your care
• up-to-date devices with screen locks and security software
• sessions conducted from a private room where they can't be overheard

How long I keep records. I keep health records for at least 7 years after your last session. For clients under 18, I keep records until they turn 25, or for 7 years after the last session, whichever is later. After that, I securely destroy or de-identify them. If I ever close or transfer my practice, I'll make sure your records stay secure and that you can still access them.

8. Your choices and rights

Young people (14 to 17). I need a parent or guardian's consent before I see a client under 18. I respect young people's growing right to privacy. Where it is safe and appropriate, I'll talk with the young person about what is shared with their parent or guardian.

Support people. You are welcome to bring a partner, family member or support worker to sessions. They will hear what is discussed. I'll only share information with them outside sessions if you tell me that's okay.

Using a pseudonym. You can ask a general question by email without giving your name. For treatment, Medicare, health fund or NDIS claims, I need to know who you are.

Interpreters. You're welcome to use a free interpreter through TIS National (131 450). Interpreters keep what they hear confidential.

Accessing your information. You can ask for a copy of the information I hold about you, or ask me to delete your email list details. Email me and I'll acknowledge your request within two business days and respond in full within 30 days. I may need to confirm your identity first. I won't charge you to ask, but I may charge a reasonable fee to cover copying costs; I'll tell you before I do. You can also ask me to send a copy of your records to another health practitioner, such as a new physiotherapist or your GP. In rare cases the law lets me refuse access, such as where it would pose a serious threat to someone's life, health or safety. If so, I'll explain why in writing.

Correcting your information. If something I hold is wrong, out of date or incomplete, let me know and I'll fix it. If I don't agree a change is needed, I'll tell you why, and you can ask me to note your view on your record.

9. Data breaches, complaints and contact

If something goes wrong. If a data breach is likely to cause you serious harm, I'll tell you and the Office of the Australian Information Commissioner (OAIC) as soon as practicable, under the Notifiable Data Breaches scheme. I'll also tell you what I'm doing about it and the steps you can take to protect yourself.

Questions or complaints. Please contact me first. I take every concern seriously, and I'll respond within two business days.

How quickly I respond.

• Emails and general questions: within two business days

• Requests to change an appointment by email: within two business days
• Requests to access or correct your information: acknowledged within two business days, with a full response within 30 days
• Unsubscribe requests: within two business days
• Complaints: within two business days
• Email: hello@recentrephysio.com.au

If you're not happy with my response, you can contact:

• Office of the Australian Information Commissioner (OAIC), for privacy concerns: oaic.gov.au or 1300 363 992
• NSW Information and Privacy Commission (IPC), for health privacy concerns under NSW law, within 6 months of becoming aware of the issue: ipc.nsw.gov.au or 1800 472 679
• Australian Health Practitioner Regulation Agency (AHPRA), to raise a concern or make a complaint about a health practitioner: Phone: 1300 419 495 From outside Australia: +61 3 9125 3010 (Monday to Friday, 9am to 5pm AEST/AEDT) Online: AHPRA Raise a Concern portal
• Health Care Complaints Commission (HCCC), for concerns about health care in New South Wales: hccc.nsw.gov.au or 1800 043 159
• Office of the Health Ombudsman (OHO), for concerns about health care in Queensland: oho.qld.gov.au or 133 646

Changes to this policy. I may update this policy as my practice or the law changes. The latest version is always on this page.

Last updated: [date the page goes live]