PRIVACY POLICY

INNER ACTIVE PELVIC HEALTH & PHYSIOTHERAPY

Effective Date: 23 October 2026
Policy Owner: Practice Director
Next Review: October 2027, or earlier where required by law

1. PURPOSE AND APPLICATION

1.1 Inner Active Pelvic Health & Physiotherapy (Inner Active, the Practice, we, us or our), operated by Inneractive healthcare Pty Ltd and ABN 48 650 244 054, is committed to protecting the privacy, confidentiality, security and integrity of personal information entrusted to us.

1.2 This Privacy Policy (Policy) governs the collection, holding, use, disclosure, access, correction, retention and disposal of personal information in connection with our healthcare services, website and business operations.

1.3 This Policy applies to patients, prospective patients, parents and guardians, website visitors, referrers, employees, contractors, students, suppliers and other individuals whose personal information we collect or hold.

1.4 Our handling of personal information is governed by applicable legislation, including:

(a) Privacy Act 1988 (Cth), including the Australian Privacy Principles (APPs);

(b) Health Records Act 2001 (Vic), including the Health Privacy Principles (HPPs);

(c) Health Records Regulations 2023 (Vic);

(d) Spam Act 2003 (Cth);

(e) Notifiable Data Breaches scheme under the Privacy Act; and

(f) any other applicable legislation concerning health information, healthcare identifiers, confidentiality and professional recordkeeping.

1.5 Where multiple laws apply, we will comply with each applicable requirement. Nothing in this Policy is intended to exclude, restrict or diminish any right or protection conferred by law.

2. COLLECTION OF PERSONAL INFORMATION

2.1 We collect personal information only where reasonably necessary for our functions and activities, or where otherwise permitted or required by law.

2.2 Personal information collected may include:

(a) Identifying information

• Name, date of birth, address and contact details;

• Emergency contact information;

• Parent, guardian or authorised representative details;

• Medicare, healthcare identifier, private health insurance and compensable claim information.

(b) Health information

• Medical and surgical history;

• Current symptoms, diagnoses and medications;

• Physiotherapy assessments and treatment records;

• Clinical examination findings, investigations and reports;

• Pregnancy, childbirth and postpartum history;

• Pelvic floor, bladder, bowel and continence information;

• Pelvic pain, sexual health and reproductive health information;

• Rehabilitation goals, treatment outcomes and clinical correspondence;

• Clinical images, ultrasound findings and other records relevant to healthcare.

(c) Administrative and financial information

• Appointment history and attendance;

• Invoices, payments, rebates and funding approvals;

• Communications and correspondence;

• Complaints, requests and feedback.

(d) Electronic information

• Website enquiries and online booking information;

• IP addresses and device information;

• Website activity and technical records;

• Cookies and other digital identifiers, where used.

2.3 Health information constitutes sensitive information under Australian privacy law and is subject to additional protections.

2.4 We will obtain appropriate consent before collecting sensitive information unless collection without consent is permitted or required by law.

2.5 Collection must be lawful, fair and proportionate to the relevant purpose.

3. METHODS OF COLLECTION

3.1 Wherever reasonable and practicable, we collect personal information directly from the individual concerned.

3.2 Collection may occur through:

(a) Patient registration and intake forms;

(b) Clinical consultations and examinations;

(c) Website and online booking systems;

(d) Telephone, email, SMS and other communications;

(e) Telehealth appointments;

(f) Clinical questionnaires and outcome assessments;

(g) Referrals and clinical correspondence; and

(h) Payment, insurance and funding processes.

3.3 We may collect information from third parties, including medical practitioners, hospitals, allied health providers, insurers, parents, guardians or authorised representatives, where the collection is lawful and appropriate.

3.4 Where required, we will provide information at or before collection concerning the purposes of collection, relevant disclosures, consequences of non-collection and other matters required by the APPs and HPPs.

3.5 Individuals may make general enquiries anonymously or under a pseudonym where lawful and practicable. Healthcare provision will ordinarily require sufficient identifying information to support safe treatment, accurate records and appropriate billing.

4. PURPOSES OF COLLECTION, USE AND DISCLOSURE

4.1 Personal information is collected and used primarily to provide safe, appropriate and effective healthcare.

4.2 Permitted purposes include:

(a) Assessing, diagnosing and treating conditions within our professional scope;

(b) Preparing and reviewing individual treatment plans;

(c) Managing referrals and coordinating healthcare;

(d) Maintaining accurate clinical records;

(e) Managing appointments and communicating with patients;

(f) Processing payments, rebates and authorised claims;

(g) Meeting professional, regulatory and legal obligations;

(h) Investigating complaints and managing clinical risk;

(i) Conducting lawful clinical governance, quality assurance and health management activities; and

(j) Administering the Practice and maintaining appropriate business records.

4.3 Information collected for a particular purpose will not be used or disclosed for an unrelated secondary purpose unless:

(a) the individual has consented;

(b) the individual would reasonably expect the use or disclosure and it is directly related to the primary purpose, where the law permits; or

(c) another applicable legal exception authorises or requires it.

4.4 Any secondary use or disclosure must remain proportionate, lawful and consistent with applicable privacy requirements.

5. PROTECTION OF SENSITIVE PELVIC HEALTH INFORMATION

5.1 The Practice acknowledges the particularly intimate and sensitive nature of information disclosed during pelvic health, women’s health, men’s health and paediatric consultations.

5.2 Such information may concern urinary or bowel dysfunction, pelvic organ prolapse, sexual dysfunction, sexual pain, pregnancy, childbirth, reproductive health, prostate conditions, trauma or other highly personal matters.

5.3 We will limit access to identifiable health information to authorised persons with a legitimate clinical, administrative or legal need.

5.4 Staff, practitioners and contractors are required to maintain patient confidentiality and comply with applicable professional and organisational privacy obligations.

5.5 Information obtained during an intimate examination will be recorded and handled in accordance with applicable privacy, professional and clinical recordkeeping standards.

5.6 Consent to the collection of health information is distinct from consent to any examination, procedure, photograph or recording.

5.7 Specific informed consent will be sought for intimate examinations and other procedures requiring such consent.

5.8 We will not publish identifiable patient information, clinical images, treatment experiences or testimonials for promotional purposes without appropriate specific authorisation.

6. DISCLOSURE TO HEALTHCARE PROVIDERS AND THIRD PARTIES

6.1 We may disclose relevant personal information where reasonably necessary for the provision or coordination of healthcare, with appropriate consent or another lawful basis.

6.2 Potential recipients include:

(a) Referring general practitioners and medical specialists;

(b) Hospitals, surgeons and other treating healthcare professionals;

(c) Allied health practitioners involved in patient care;

(d) Medicare, private health insurers and relevant government programs;

(e) TAC, WorkCover insurers, DVA or other authorised funding bodies;

(f) Professional advisers, auditors and regulatory authorities where legally appropriate; and

(g) Contracted service providers performing legitimate Practice functions.

6.3 Disclosures will be limited to information reasonably necessary for the relevant lawful purpose.

6.4 Requests from employers, insurers, solicitors, family members or other third parties do not, by themselves, establish an entitlement to confidential patient records.

6.5 We will assess each request against applicable consent requirements, statutory authorities, legal obligations and professional confidentiality duties.

6.6 Where information is requested under a subpoena, court order or other compulsory legal process, we will assess the validity and scope of the request and any applicable restrictions or protections before responding.

6.7 We do not sell identifiable patient health information.

7. CHILDREN AND YOUNG PEOPLE

7.1 We recognise the particular privacy interests of children and adolescents receiving healthcare.

7.2 Collection, consent and disclosure arrangements will be determined according to the individual’s age, maturity, decision-making capacity, clinical circumstances and applicable law.

7.3 A parent or guardian does not necessarily have an unrestricted right to access an adolescent’s confidential health information.

7.4 Requests for information relating to minors will be assessed individually, including consideration of the young person’s legal rights, safety and best interests.

7.5 We will take particular care to prevent inappropriate disclosure of sensitive information concerning young patients.

8. ELECTRONIC HEALTH RECORDS AND INFORMATION SECURITY

8.1 We maintain patient records using electronic practice management systems and, where necessary, physical documentation.

8.2 These systems may include Cliniko and other authorised healthcare, billing, communication and administrative platforms.

8.3 We take reasonable steps, appropriate to the nature and sensitivity of the information, to protect personal information against:

(a) Misuse or interference;

(b) Loss or accidental destruction;

(c) Unauthorised access;

(d) Unauthorised modification; and

(e) Unauthorised disclosure.

8.4 Protective arrangements include appropriate access controls, confidentiality requirements, secure record-handling procedures, management of user permissions and reasonable oversight of third-party service providers.

8.5 Access to records is restricted according to legitimate roles and responsibilities.

8.6 Electronic and physical records are managed in accordance with applicable security, retention and disposal requirements.

8.7 We review information security risks and take reasonable steps to address identified vulnerabilities.

8.8 While reasonable safeguards are maintained, no information system or electronic transmission can be guaranteed to be entirely free from security risk.

8.9 The Practice remains accountable for its own obligations when engaging external information technology, cloud storage or administrative service providers.

9. RETENTION AND DESTRUCTION OF HEALTH RECORDS

9.1 Health records will be retained for the minimum periods required by applicable Victorian law and for any longer period required by other legal obligations.

9.2 Subject to applicable exceptions, health information collected while a patient was an adult must not be deleted until more than seven years have elapsed since the last occasion on which we provided the patient with a health service.

9.3 For health information collected while a patient was a child, deletion must not occur before the patient has attained 25 years of age or before the applicable seven-year period following the last health service has elapsed, whichever is later.

9.4 Records may be retained beyond these minimum periods where required or justified by law, clinical obligations, complaints, litigation, insurance matters or other legitimate purposes.

9.5 When deletion is lawful and appropriate, we will take reasonable steps to ensure secure destruction or irreversible de-identification.

9.6 Where required by Victorian law, we will maintain a written record of the deletion of health information.

9.7 Requests for deletion will be considered in accordance with applicable law and may be declined where retention remains legally required.

10. PATIENT ACCESS TO INFORMATION

10.1 Individuals may request access to personal and health information held by the Practice.

10.2 Requests should be directed to the Privacy Officer using the contact details in Section 20.

10.3 We may require sufficient information to verify the identity of the applicant and any authority to act on another individual’s behalf.

10.4 Access requests concerning health information will be assessed under the Health Records Act 2001 (Vic), the Privacy Act 1988 (Cth) and other applicable requirements.

10.5 We will respond without unreasonable delay and within the applicable statutory timeframe. Victorian health-record access requests must ordinarily be addressed within a maximum of 45 days.

10.6 Access may be provided through inspection, a copy, an accurate summary or another legally permitted method, having regard to the individual’s request and applicable law.

10.7 Access may be refused or restricted only where lawful grounds exist, including where disclosure would unlawfully affect another person’s privacy or pose a serious threat to life or health.

10.8 Where access is refused, we will provide the legally required explanation and information concerning available review or complaint avenues.

10.9 Fees may apply to providing access, but only to the extent permitted by law and subject to applicable statutory limits. No fee will be charged merely for lodging an access request.

11. CORRECTION OF PERSONAL INFORMATION

11.1 We take reasonable steps to ensure personal information is accurate, complete, relevant and up to date, having regard to its intended use.

11.2 Individuals may request correction of information believed to be inaccurate, incomplete, misleading or outdated.

11.3 Requests to correct Victorian health information will be assessed and addressed within the applicable statutory timeframe, ordinarily no later than 30 days.

11.4 Clinical records will not be improperly altered, concealed or destroyed.

11.5 Where appropriate, amendments, annotations or supplementary statements may be added to preserve clinical record integrity.

11.6 If a correction request is refused, we will provide applicable reasons and permit the individual to exercise any right to have a statement of disagreement associated with the record.

11.7 No fee will be charged for requesting correction of health information.

12. WEBSITE PRIVACY AND DIGITAL TRACKING

12.1 Our website is www.inneractivephysio.com.au

12.2 Information may be collected when individuals browse our website, complete an enquiry form, make an online booking or interact with embedded third-party services.

12.3 Technical information collected through website systems may include IP address, device and browser details, referring website, pages viewed, session information and relevant technical identifiers.

12.4 Website technologies may include essential cookies, analytics services and other tools necessary for identified website functions.

12.5 Any use of third-party analytics, tracking pixels, advertising technologies or similar services must be assessed for compliance with applicable privacy law, particularly where website activity could reveal health-related information.

12.6 The Practice will not treat a person’s mere use of the website, or failure to reject cookies, as automatic consent to the collection or disclosure of sensitive health information for advertising purposes.

12.7 Where express consent is required for a particular tracking activity, we will obtain that consent before undertaking the activity.

12.8 We will take reasonable steps to prevent health information submitted through patient forms, booking pathways or clinical communications from being disclosed inappropriately through advertising or website tracking technologies.

12.9 Where optional tracking technologies are deployed, information about their purposes, recipients and available choices will be provided through an appropriate website notice or consent mechanism.

12.10 Users may manage certain cookies through browser or website controls, although disabling essential technologies may affect website functionality.

12.11 Our website may provide links to independently operated websites. We are not responsible for their independent privacy practices and encourage users to review their privacy notices.

Website technology disclosure: [Before publication, insert the verified website analytics, cookie, tracking and advertising arrangements, including relevant third-party recipients and user choices.]

13. ONLINE BOOKINGS, COMMUNICATIONS AND TELEHEALTH

13.1 Personal information submitted through online booking platforms is handled for the purpose of managing appointments and related healthcare administration.

13.2 We may contact patients by telephone, email or SMS concerning appointments, relevant treatment administration, billing and necessary clinical follow-up.

13.3 Electronic communications may present risks of interception, incorrect delivery or unauthorised access.

13.4 Patients are encouraged to advise the Practice of any particular confidentiality concerns or preferred communication arrangements.

13.5 Communication preferences will be accommodated where reasonably practicable, subject to clinical, legal and operational requirements.

13.6 Telehealth services will be provided using appropriate communication methods, with reasonable steps taken to protect patient confidentiality.

13.7 Telehealth consultations will be documented in the patient’s clinical record in accordance with applicable professional requirements.

13.8 We will not make an audio or video recording of a clinical consultation without appropriate authorisation and compliance with applicable law.

13.9 Patients should use a reasonably private environment for telehealth consultations where practicable.

14. MARKETING AND PROMOTIONAL COMMUNICATIONS

14.1 We may provide information about services, classes, educational activities, events and health promotion programs.

14.2 Personal information will be used for direct marketing only where authorised by applicable privacy and electronic communications laws.

14.3 Where consent is legally required, including for the use of sensitive information for direct marketing, appropriate consent will be obtained.

14.4 Consent to healthcare is not, by itself, consent to marketing.

14.5 Commercial electronic communications will comply with the Spam Act 2003 (Cth), including applicable consent, sender identification and unsubscribe requirements.

14.6 Individuals may withdraw marketing consent or opt out of promotional communications at any time.

14.7 Marketing opt-out requests will be processed without charge and within applicable legal timeframes.

14.8 Opting out of marketing will not prevent necessary clinical, appointment, payment or administrative communications.

14.9 We will not publish identifiable patient stories, photographs, testimonials or treatment information for marketing without appropriate specific consent.

15. DISCLOSURE AND TRANSFER OUTSIDE VICTORIA OR AUSTRALIA

15.1 Certain technology and service providers may operate across Australian jurisdictions or internationally.

15.2 Any transfer or disclosure of health information outside Victoria must comply with the applicable requirements of Health Privacy Principle 9 and other relevant laws.

15.3 Where personal information is disclosed to overseas recipients, we will comply with applicable cross-border disclosure obligations, including Australian Privacy Principle 8.

15.4 We will take reasonable steps required by law in relation to overseas recipients and applicable safeguards.

15.5 The Practice’s overseas disclosure position must accurately reflect its actual service arrangements.

15.6 We are not currently likely to disclose personal information to overseas recipients.

16. USE OF ARTIFICIAL INTELLIGENCE, AUTOMATED SYSTEMS AND CLINICAL RECORDINGS

16.1 Use of Artificial Intelligence

Inner Active Pelvic Health & Physiotherapy utilises Cliniq Apps and other authorised artificial intelligence (AI) and digital technologies to support clinical and administrative workflows, improve operational efficiency and assist in the delivery of healthcare services.

These technologies may assist with clinical documentation, consultation transcription, preparation of reports and correspondence, appointment management, patient communications and other administrative functions.

16.2 Patient Consent and Clinical Recordings

Where AI-assisted technology involves recording or transcribing a patient consultation, we will obtain appropriate informed consent before commencing the recording.

Patients will be informed of the purpose of the recording, the involvement of relevant third-party technology providers and how the resulting information will be handled. All recordings will be periodically destroyed.

Patients may decline AI-assisted recording or withdraw their consent to future recordings. Where recording is declined, appropriate alternative clinical documentation processes will be used without adversely affecting the patient’s access to care.

16.3 Retention and Destruction of AI Recordings

Inner Active is committed to minimising the retention of temporary audio and video recordings processed through AI-assisted systems.

The Practice will seek to establish arrangements with its authorised AI service providers requiring the secure deletion of raw clinical recordings within 30 days of their creation.

We will request that providers undertake deletion on a rolling 30-day basis and take reasonable steps to verify their retention and deletion arrangements.

Where a provider’s technical systems, backup arrangements or legal obligations prevent deletion within this period, we will assess the circumstances and take appropriate steps to ensure information is not retained longer than reasonably necessary or otherwise permitted by law.

This provision relates to temporary AI-generated or AI-processed recordings and does not override our legal obligations to retain clinical records, including approved consultation notes, reports and other health information.

16.4 Privacy, Confidentiality and Third-Party Providers

All personal and health information processed using AI-assisted systems remains subject to our obligations under applicable Australian privacy and health records legislation.

We will take reasonable steps to ensure that authorised AI providers maintain appropriate confidentiality, information security, access controls and data protection measures.

We do not authorise the use of identifiable patient information for unrelated AI model training, commercial exploitation or third-party marketing without an appropriate lawful basis and any consent required by law.

16.5 Clinical Accountability and Human Oversight

AI-assisted technologies are used as supporting tools and do not replace the professional judgment, clinical reasoning or responsibilities of our treating physiotherapists.

Clinical documentation generated or assisted by AI will be reviewed as appropriate by the responsible healthcare practitioner before being accepted into the clinical record.

The Practice remains responsible for the appropriate handling of patient information and the provision of safe, professional healthcare.

16.6 Automated Decision-Making

Where the Practice uses automated systems that make, or substantially and directly contribute to, decisions that could reasonably be expected to significantly affect an individual’s rights or interests, we will provide the disclosures required by applicable privacy law.

We will review our systems and update this Policy as necessary to comply with the Australian Privacy Principles, including the automated decision-making transparency requirements..

17. DATA BREACH MANAGEMENT

17.1 The Practice maintains processes for identifying, assessing, containing and responding to actual or suspected privacy and information security incidents.

17.2 Where a suspected eligible data breach occurs, we will assess the circumstances promptly and undertake the assessment required by the Notifiable Data Breaches scheme.

17.3 Where there are reasonable grounds to believe that an eligible data breach has occurred, we will comply with applicable notification obligations to the Office of the Australian Information Commissioner and affected individuals, subject to any statutory exceptions.

17.4 We will take reasonable steps to contain incidents, mitigate reasonably foreseeable harm, investigate contributing factors and implement appropriate corrective measures.

17.5 The Practice will maintain appropriate internal records of incidents and its responses.

18. CLINICAL EDUCATION, QUALITY ASSURANCE AND RESEARCH

18.1 Patient information may be used for legitimate clinical supervision, governance, auditing, quality improvement and professional development where permitted by law.

18.2 We will seek to minimise the use of identifiable information where the relevant purpose can reasonably be achieved using de-identified information.

18.3 Identifiable clinical information will not be disclosed for unrelated teaching, publication or research purposes without an applicable lawful basis.

18.4 Participation in research or other activities requiring separate consent or ethics approval will be managed in accordance with applicable requirements.

18.5 Where students or observers participate in clinical consultations, appropriate consent will be obtained in accordance with professional and legal requirements.

19. TRANSFER, SALE OR CLOSURE OF THE PRACTICE

19.1 If the Practice is sold, transferred, amalgamated or closed, patient records will be managed in accordance with applicable statutory and professional requirements.

19.2 This includes any legally required notices to patients and arrangements concerning records access, custody, security and ongoing retention.

19.3 Any proposed transfer of identifiable health records will be assessed for compliance with applicable privacy and health records legislation.

20. PRIVACY OFFICER AND CONTACT DETAILS

Requests concerning privacy, confidentiality, access to records, correction of information or complaints should be directed to:

Privacy Officer
Inner Active Pelvic Health & Physiotherapy
1/2 Enterprise Drive
Bundoora VIC 3053

Telephone: (03) 7006 5112
Email: admin@inneractivephysio.com.au
Website: www.inneractivephysio.com.au

Correspondence should be clearly marked:

CONFIDENTIAL – PRIVACY ENQUIRY

We may request reasonable identity verification before responding to a request involving personal or health information.

21. PRIVACY COMPLAINTS AND DISPUTE RESOLUTION

21.1 Individuals who believe that their personal information has been mishandled may lodge a privacy complaint with the Practice.

21.2 Complaints should be submitted to the Privacy Officer using the contact details in Section 20.

21.3 We will consider the complaint fairly, confidentially and in accordance with applicable legal obligations.

21.4 We aim to acknowledge complaints promptly and provide a substantive response within 30 days where practicable. Where further investigation is reasonably required, we will advise the complainant of the status of the matter.

21.5 We may seek additional information reasonably necessary to investigate and resolve the complaint.

21.6 If an individual is dissatisfied with our response, they may contact the appropriate external regulator.

Office of the Australian Information Commissioner (OAIC)
Website: www.oaic.gov.au
Telephone: 1300 363 992

Health Complaints Commissioner Victoria
Website: www.hcc.vic.gov.au
Telephone: 1300 582 113

21.7 An individual should ordinarily raise a Privacy Act complaint with the Practice before approaching the OAIC, consistent with the OAIC’s complaint-handling requirements.

21.8 Nothing in this Policy prevents an individual from exercising any right to complain or seek a remedy under applicable law.

22. REVIEW AND AMENDMENT

22.1 We will review this Policy periodically and whenever material changes occur to privacy legislation, information systems, healthcare services or business practices.

22.2 We may amend this Policy to reflect such changes.

22.3 The current version will be made available through our website free of charge.

22.4 Where required by law, we will provide additional notification or obtain consent before implementing a materially different use or disclosure of personal information.

22.5 A revised Privacy Policy does not, merely by being published, retrospectively authorise the collection, use or disclosure of information for purposes not otherwise permitted by law.

INNER ACTIVE PELVIC HEALTH & PHYSIOTHERAPY

Professional healthcare. Respectful treatment. Confidential information management.

Document Control

Policy Owner: Practice Director
Effective Date: 23 October 2026
Review Frequency: Annually or as required