Privacy Policy

Who we are

Olympus Therapy Pty Ltd (ABN [ABN], "Olympus Therapy", "we", "us") is a physiotherapy practice operating in Melbourne, Victoria. We provide physiotherapy services in homes, aged care facilities, workplaces and clinical settings, along with pre-employment screening and manual handling training for organisations.

We take the privacy of your personal and health information seriously. This policy applies to everyone we deal with — patients, NDIS participants, their families and carers, people we assess on behalf of an employer, staff who attend our training, and visitors to this website.

The law that applies

We are bound by the Privacy Act 1988 (Cth) and the thirteen Australian Privacy Principles (APPs) contained in it. Although some small businesses are exempt from the Privacy Act, that exemption does not apply to us: organisations providing a health service are covered regardless of their size or turnover.

Because we operate in Victoria, we are also bound by the Health Records Act 2001 (Vic) and its Health Privacy Principles, which govern how health information is handled in this state.

Information we collect

Personal information

• Name, date of birth, address, phone number and email address
• Emergency contact, next of kin, and details of family members or carers involved in your care
• Medicare number, DVA number, private health fund and membership number
• NDIS participant number, plan dates, and plan manager or support coordinator details
• WorkCover or TAC claim numbers and employer or insurer details
• Payment and billing information

Health information

Health information is treated as sensitive information under the Privacy Act and attracts a higher level of protection. We may collect:

• Your symptoms, medical history, past injuries, surgeries and medications
• Assessment findings, measurements, test results and clinical observations
• Treatment notes, exercise programs and progress records
• Referral letters, imaging and specialist reports
• Photographs or video, where you have given separate written consent
• Information about your home environment relevant to safety, mobility and equipment

Website information

• Details you submit through our enquiry form
• Standard technical data such as IP address, browser type and pages visited

How we collect it

Wherever it is reasonable and practicable, we collect information directly from you — in conversation, at your appointment, or through forms you complete. We may also collect information from:

• Your GP, specialist or another treating practitioner who refers you
• A family member, carer or guardian, where you are unable to provide it yourself
• Your NDIS plan manager, support coordinator or the NDIA
• An aged care provider or facility where you live or receive care
• Your insurer, employer or their agent, in the case of WorkCover, TAC or pre-employment assessments
• Hospitals, imaging providers and pathology services

You may deal with us anonymously or under a pseudonym where it is lawful and practicable to do so. In most cases this will not be practicable, because we cannot safely provide clinical care, or invoice a funder, without knowing who you are.

Why we collect it

• To assess, diagnose and treat you, and to plan and review your care
• To communicate with you about appointments and your program
• To liaise with your GP, specialists and other members of your care team
• To prepare reports required by the NDIS, an insurer, an employer or a facility
• To invoice you or your funder and manage payments
• To meet our professional, insurance, legal and record-keeping obligations
• To conduct pre-employment screening or deliver training under contract to an organisation
• To improve our services, and for staff training and quality assurance

We do not sell your information. We do not use your information for marketing without your consent, and any marketing we do send will include a simple way to opt out.

Consent

We collect health information only with your consent, or where the law otherwise permits or requires it. Consent may be given verbally or in writing, and you can withdraw it at any time by contacting us — though this may affect our ability to continue treating you safely.

Pre-employment screening. If we assess you on behalf of a prospective or current employer, we will explain before the assessment begins what will be reported and to whom. We assess your capacity against the inherent physical requirements of the specific role. You will be asked to give written consent to the report being released to the organisation that engaged us. You are entitled to receive a copy.

Who we disclose to

We disclose your information only for the purposes described in this policy, and only to the extent necessary. This may include:

• Your GP, specialists and other treating health practitioners involved in your care
• Your NDIS plan manager, support coordinator or the NDIA, for services delivered under your plan
• WorkSafe Victoria, the TAC, or your private health fund, for claims and invoicing
• An aged care provider or facility, where they arrange or fund your care
• A family member, carer or guardian you have authorised, or a person with legal authority to act for you
• The organisation that engaged us, in the case of pre-employment screening or training
• Our service providers — practice management software, secure hosting, email, accounting and, where necessary, debt recovery
• Our professional indemnity insurer and legal advisers, where required
• Any person or body where disclosure is required or authorised by law, or where there is a serious and imminent threat to someone's life, health or safety

Overseas disclosure

We aim to keep clinical records within Australia. Our practice management system stores Australian account data on servers located in Australia.

Some supporting services we use may store or process limited information outside Australia — for example, our website enquiry form provider and parts of our email and website infrastructure operate from or route through the United States and other countries. This is why we ask you not to submit detailed health information through the website.

Where we disclose personal information to an overseas recipient, we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles. If you would like to know which providers we currently use and where they are located, contact us and we will tell you.

Storage and security

Clinical records are held electronically in a purpose-built practice management system with encryption in transit and at rest, individual logins and multi-factor authentication. Any paper records are kept in locked storage and converted to electronic records where practicable.

Devices used to access records are password protected and encrypted. We limit access to those who need it to do their job. When information is no longer needed and we are no longer required to keep it, it is securely destroyed or de-identified.

No system can be guaranteed completely secure, but we take reasonable steps to protect your information from misuse, interference, loss, and unauthorised access, modification or disclosure.

How long we keep records

Under the Health Records Act 2001 (Vic) we are required to retain health records for at least seven years from the date of your last service. Where you were under 18 at the time of your last service, the record must be kept until you turn 25.

Some records are kept longer where required for insurance, legal or professional reasons. After that, records are securely destroyed.

Access and correction

You have the right to ask for access to the personal and health information we hold about you, and to ask us to correct it if it is inaccurate, out of date, incomplete or misleading.

Requests should be made in writing to the contact details below. We will respond within 30 days. We may ask you to verify your identity, and in limited circumstances permitted by law we may refuse access — for example, where giving access would pose a serious threat to someone's life, health or safety, or unreasonably affect another person's privacy. If we refuse, we will tell you why in writing and explain how to complain.

A reasonable administrative fee may apply for retrieving and copying records. There is no fee simply for making a request.

This website

Our website is a static site served over an encrypted (HTTPS) connection. Information you submit through the enquiry form is transmitted to a third-party form provider, which forwards it to our email address and retains a copy on its servers.

We may use website analytics to understand how visitors use the site. Analytics data is aggregated and is not used to identify individuals. Most browsers allow you to block cookies through their settings; blocking them will not affect your ability to use this site.

This site may link to other websites. We are not responsible for the privacy practices or content of those sites.

Data breaches

We are covered by the Notifiable Data Breaches scheme. If a data breach occurs that is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner as soon as practicable, and tell you what steps you can take in response.

Complaints

If you believe we have mishandled your information, please contact us first using the details below. We will acknowledge your complaint within 7 days and aim to resolve it within 30 days.

If you are not satisfied with our response, you can take the matter to:

• Office of the Australian Information Commissioner (OAIC) — 1300 363 992, oaic.gov.au
• Health Complaints Commissioner (Victoria) — 1300 582 113, hcc.vic.gov.au
• Ahpra, for concerns about a practitioner's conduct — 1300 419 495, ahpra.gov.au

Contact us

Our Privacy Officer handles all privacy enquiries, access requests and complaints.

Privacy Officer

[NAME]

Email

privacy@olympustherapy.com.au

Phone

0400 000 000

Post

[POSTAL ADDRESS]

We review this policy regularly. Any updated version will be published on this page with a revised date.