Privacy Policy

1. Who we are

This Privacy Policy applies to Health Max Exercise Physiology Pty Ltd (ABN [INSERT ABN]) ("Health Max", "we", "us", "our"), a clinical exercise physiology practice located in Manly, New South Wales.

Because we are a health service provider, we are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) regardless of our size, and by the Health Records and Information Privacy Act 2002 (NSW) and its Health Privacy Principles. Our Accredited Exercise Physiologists also practise in accordance with the professional and ethical standards of Exercise & Sports Science Australia (ESSA).

2. Information we collect

The information we collect depends on your relationship with us. It may include:

Personal information

• Name, date of birth, gender
• Contact details — address, phone, email
• Emergency contact details
• Medicare number, DVA number, private health fund and membership details
• Payment information (processed by our payment provider — we do not store full card numbers)
• Referring GP or specialist details

Health information (sensitive information)

• Medical history, current conditions, medications and past injuries
• Referrals, care plans, DEXA scan results and other clinical reports you or your practitioners provide
• Assessment findings, movement screens, exercise programs and progress notes
• Objective measures recorded during your program, including body weight and strength or performance measures
• Correspondence with your GP, specialist or other treating practitioners

3. How we collect it

We collect information directly from you wherever possible — through booking forms, intake and health history questionnaires, consultations, assessments, telehealth sessions, email, phone and SMS.

We may also collect information from third parties where you have consented or where it is reasonably necessary for your care, such as from your referring GP, specialist, imaging provider, or in some cases a family member or carer.

4. Why we collect it

We collect, hold and use your information to:

• Assess your suitability for our services and screen for risk
• Design, deliver, supervise and progress your exercise program
• Maintain accurate clinical records as required by our professional obligations
• Communicate with you about appointments, programs and results
• Correspond with your GP, specialist or other treating practitioners about your care
• Process payments and claim rebates on your behalf through Medicare, DVA, HICAPS or your private health fund
• Meet our legal, insurance, accreditation and professional obligations
• Send you marketing communications, where you have consented (see section 8)

If you choose not to provide certain information, we may be unable to deliver our services safely or at all, and we will tell you if that is the case.

5. Health information and consent

Health information is "sensitive information" under the Privacy Act and receives a higher level of protection. We only collect it with your consent and where it is reasonably necessary for delivering your care.

By providing your health information and participating in our services, you consent to us collecting, using and disclosing that information as described in this policy. You may withdraw your consent at any time by contacting us, though this may affect our ability to continue providing services to you.

6. Who we share information with

We do not sell your personal or health information. We may disclose it to:

• Your GP, specialist or other treating practitioners involved in your care, with your consent
• Medicare, DVA or your private health fund, for claiming and rebate purposes
• Our service providers, who are bound to protect your information (see section 7)
• Our insurers or professional advisers, where reasonably necessary
• Any person or body where disclosure is required or authorised by law, or where there is a serious and imminent threat to the life, health or safety of any person

7. Third-party systems we use

We use trusted third-party platforms to operate our practice. Each has its own privacy policy, and we encourage you to review them:

• Cliniko — our practice management system, where bookings, clinical records and clinical notes are stored
• Stripe — payment processing for memberships and direct debits
• HICAPS — on-site private health fund and Medicare claiming
• Our website and marketing platform — hosting of our website, contact forms and marketing email/SMS
• A weight-tracking application that we use to record and monitor client body weight measures over time as part of your program

Body weight recorded against an identifiable client is health information under Australian privacy law, and we treat it with the same protections as the rest of your clinical record.

8. Marketing communications

With your consent, we may send you newsletters, offers, promotions and practice updates by email or SMS. These messages will always identify Health Max and include a simple way to unsubscribe, in line with the Spam Act 2003 (Cth).

You can opt out at any time by using the unsubscribe link in any message, or by contacting us directly. Opting out of marketing will not affect appointment reminders, clinical correspondence or other communications necessary for your care.

9. Storage and security

We take reasonable steps to protect your information from misuse, interference, loss, and unauthorised access, modification or disclosure. These steps include password protection and access controls, encrypted and reputable cloud-based systems, restricting access to staff who need it to perform their role, and secure handling and destruction of any physical records.

No method of electronic storage or transmission is completely secure, and while we take all reasonable steps, we cannot guarantee absolute security.

10. How long we keep records

We retain adult health records for a minimum of seven (7) years from the date of last service, in line with NSW health records requirements.

For clients who were under 18 at the time of service, we retain records until they turn 25 years of age.

When information is no longer needed and we are not required by law to keep it, we take reasonable steps to destroy or de-identify it securely.

11. Accessing and correcting your information

You have the right to request access to the personal and health information we hold about you, and to ask us to correct anything that is inaccurate, out of date or incomplete.

To make a request, contact us using the details in section 18. We may ask you to verify your identity. We will respond within a reasonable period — generally within 30 days. In limited circumstances permitted by law we may decline a request, in which case we will explain why in writing. An administrative fee may apply for providing copies of records, and we will tell you before any fee is incurred.

12. Clients under 18

We provide services to clients under 18 with the consent of a parent or legal guardian. A parent or guardian may access their child's health information, subject to the child's right to privacy and their capacity to make their own decisions about their health care, which we assess on a case-by-case basis in line with our professional obligations.

13. Website, cookies and analytics

Our website may use cookies and similar technologies to help the site function correctly and to understand how visitors use it. You can disable cookies in your browser settings, although some parts of the site may not work as intended.

[IF APPLICABLE — CONFIRM AND RETAIN OR DELETE: We use analytics and advertising tools such as Google Analytics and the Meta (Facebook) Pixel, which collect information about your visit, including pages viewed and general location. This information is used to improve our website and measure the effectiveness of our advertising. You can opt out of Google Analytics using the Google Analytics Opt-out Browser Add-on, and manage advertising preferences in your Facebook or Instagram account settings.]

Our website may contain links to third-party sites, including our booking system. We are not responsible for the privacy practices of those sites.

14. Overseas disclosure

Some of our third-party providers may store or process data on servers located outside Australia. Where this occurs, we take reasonable steps to ensure those providers handle your information in a manner consistent with the Australian Privacy Principles. By providing your information, you consent to this disclosure. You can contact us if you would like more detail about where your information is held.

15. Data breaches

We have procedures in place to respond to suspected data breaches. Where a breach is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.

16. Complaints

If you believe we have breached your privacy, please contact us first using the details in section 18. We take complaints seriously and will acknowledge your complaint promptly and aim to resolve it within 30 days.

If you are not satisfied with our response, you may contact:

• Office of the Australian Information Commissioner (OAIC) — 1300 363 992 or oaic.gov.au
• NSW Information and Privacy Commission — 1800 472 679 or ipc.nsw.gov.au
• NSW Health Care Complaints Commission (HCCC) — 1800 043 159 or hccc.nsw.gov.au

17. Changes to this policy

We may update this Privacy Policy from time to time. The current version will always be available on our website, with the date it was last updated shown at the top of the page.

18. Contact us

For any privacy question, request or complaint:

Health Max Exercise Physiology Pty Ltd
Manly, NSW 2095
Phone: (02) 9053 2283
Website: healthmaxep.com.au

← Back to Health Max