About this policy

Coastal Community Physio ("we", "us", "our") is committed to protecting the privacy of the people we work with. This policy explains how we collect, hold, use, disclose and protect personal information and health information.

It applies to everyone we deal with, including:

• visitors to this website

• clients and participants receiving physiotherapy services

• family members, carers, nominees, guardians and attorneys

• support workers, coordinators, referrers and other providers we work alongside

This policy is written to meet our obligations under Australian Privacy Principle 1. It sits alongside the specific privacy information we give you when you start services with us.

Who we are

Coastal Community Physio is a mobile physiotherapy practice serving the greater Sunshine Coast region. We provide services under the Support at Home program (aged care) and to participants of the National Disability Insurance Scheme.

Contact details

• Email: admin@coastalcommunityphysio.com.au

• Phone: 0477 252 899

The law that applies to us

We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles. As a health service provider, we are covered by the Privacy Act regardless of our size or annual turnover — the exemption available to some small businesses does not apply to us.

We are also subject to obligations under the National Disability Insurance Scheme Act 2013 (Cth) and the NDIS Practice Standards, the Aged Care Act and the Support at Home program requirements, and the professional and record-keeping standards set by the Physiotherapy Board of Australia and the Australian Health Practitioner Regulation Agency.

What we mean by personal and health information

Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable.

Health information is information about a person's health, disability, or the health services they have received. Health information is a type of "sensitive information" under the Privacy Act and attracts a higher level of protection. Most of the information we hold about clients is health information.

What information we collect

Website visitors

If you use this website we may collect:

• information you provide through an enquiry or contact form, such as your name, email address, phone number and the details of your enquiry

• information you send us by email or text message

• technical information collected automatically by our website host, such as your IP address, browser type, device type, pages visited and the date and time of your visit

• [IF APPLICABLE: aggregated website analytics data]

Please do not send detailed health information through our website enquiry form or by email.

• These channels are not secure. Tell us how to contact you and we will arrange a confidential discussion.

Clients and participants

To provide safe and effective physiotherapy we collect and hold:

• identifying and contact details, including your name, date of birth, address, phone number and email address

• the name and contact details of your emergency contact, next of kin, carers, family members involved in your care, guardian, attorney or nominee

• funding information, including your NDIS participant number, plan details, plan manager or support coordinator details, Support at Home details, My Aged Care reference number, DVA or private health insurance details, and Medicare number where relevant

• health information, including your medical history, diagnoses, medications, previous injuries and surgeries, allergies, falls history, pain, mobility and function, cognition and communication needs, and results of assessments and outcome measures

• information about your home environment relevant to your safety and mobility, including access, layout, hazards, equipment and assistive technology

• your goals, preferences, cultural and communication needs, and consent records

• clinical notes, treatment plans, home exercise programs, progress reports and correspondence

• accounts, invoices and payment records

• any incident, complaint or feedback records involving you

Other people

We may hold limited personal information about people who are not our clients, including support workers, coordinators, referrers, GPs and other treating practitioners. This is usually name, role, organisation and professional contact details.

How we collect information

Wherever it is reasonable and practicable, we collect information directly from you.

We may also collect information from:

• your family members, carers, guardian, attorney or nominee

• your support coordinator, plan manager, care partner or aged care provider

• the provider or agency that has engaged us to deliver your services

• your GP, specialists, hospital, or other treating health practitioners, with your consent

• referral forms, service agreements, care plans and assessment reports provided to us

• publicly available sources, where relevant

If we receive information about you from someone else and you have not been told, we will take reasonable steps to let you know.

Recordings, photographs and video

With your consent, we may:

• audio-record part or all of an assessment so that it can be accurately transcribed into your clinical record and report. This helps us keep our attention on you during the session and improves the accuracy of our documentation.

• take photographs or short video of movement, posture, gait, wounds, equipment set-up or your home environment, where this supports assessment, treatment planning or an equipment recommendation.

We will always ask before recording, and we record your consent. You can decline, or ask us to stop or delete a recording at any time, without any effect on the services you receive.

Recordings and images are treated as health information. They are stored securely, used only for the purposes described in this policy, and are DELETED AFTER TRANSCRIPTION AND VERIFICATION. We do not use them for marketing, teaching or any other purpose without your separate written consent.

We use secure software tools, which may include artificial intelligence tools, to help transcribe recordings and prepare draft documentation. All clinical decisions, assessments, recommendations and reports are made and approved by a registered physiotherapist. We do not use automated systems to make decisions about your care or your funding.

Why we collect, hold, use and disclose information

We collect and use your information to:

• assess your needs and provide physiotherapy services safely

• develop, deliver and review your treatment plan and home exercise program

• communicate with you and the people involved in your care

• prepare progress reports, assessment reports and equipment recommendations for your funder, coordinator or provider

• arrange appointments and manage our service delivery

• invoice for services and manage our accounts

• meet our obligations for incident reporting, complaints handling and quality and safety

• maintain our clinical records and comply with our professional and legal obligations

• respond to your enquiries and, if you consent, keep you informed about our services

We only use and disclose your information for the purpose we collected it, for a directly related purpose you would reasonably expect, where you have consented, or where the law permits or requires it.

Consent, capacity and substitute decision-makers

We seek your consent to collect and share your health information, and we explain what we are asking for in plain language.

If you have a guardian, attorney under an enduring power of attorney, or an appointed NDIS nominee, we may deal with that person in relation to matters within their authority. We will ask to see documentation of their appointment.

Where a person has difficulty giving consent, we support their decision-making wherever possible rather than bypassing it. We will involve family or a substitute decision-maker only to the extent that is lawful and appropriate.

You can withdraw or change your consent at any time by telling us. Withdrawing consent may affect our ability to deliver some services, and we will explain the practical effect before you decide.

Who we disclose information to

We may disclose your information to:

• your support coordinator, plan manager, care partner, aged care provider or the organisation that engaged us to provide your services

• the NDIA, or your Support at Home provider, for reporting and claiming purposes

• your GP, specialists, hospital, and other treating practitioners involved in your care

• equipment suppliers and assistive technology assessors, where relevant to a recommendation

• your family, carers, support workers, guardian, attorney or nominee, in accordance with your consent

• our professional indemnity insurer and legal advisers, where necessary

• our accountant and bookkeeper, in relation to invoicing and financial records

• our software and IT service providers, who host and support our systems

We require our service providers to protect your information and to use it only for the purpose we engage them for.

We do not sell your information, and we do not disclose it to third parties for their own marketing purposes.

Disclosures we may be required or permitted to make

We may use or disclose your information without your consent where we are required or permitted by law, including where:

• there is a serious and imminent threat to your life, health or safety, or to public health or safety

• we are required to report a reportable incident to the NDIS Quality and Safeguards Commission

• we are required to report a reportable incident under the Serious Incident Response Scheme in aged care

• we have a mandatory notification obligation under the Health Practitioner Regulation National Law

• we are required to respond to a subpoena, court order, warrant or lawful request from a regulator

• there is a reasonable suspicion of abuse, neglect or exploitation and reporting is required or appropriate

Where it is safe and lawful to do so, we will tell you if we need to make a disclosure of this kind.

Disclosures we may be required or permitted to make

We may contact you about our services if you have asked us to, or if you are an existing client and would reasonably expect it.

We will always give you a simple way to opt out, and we will action an opt-out request promptly. To opt out at any time, email admin@coastalcommunityphysio.com.au.

We do not use health information for marketing purposes without your express consent.

Our website

Cookies. Our website may use cookies — small files stored on your device — to help the site function and to remember your preferences. You can set your browser to refuse cookies or to alert you when a cookie is set. Some parts of the site may not work correctly if you do.

Analytics. We do not use third-party analytics or advertising tracking on this website.

Enquiry forms. Information you submit through an enquiry form is sent to our business email address and is used only to respond to your enquiry and, if you become a client, as part of your record.

Links to other sites. Our website may link to other websites. We are not responsible for the privacy practices of those sites, and we encourage you to read their privacy policies.

Hosting. Our website is hosted by Ventralip, which stores data in AUSTRALIA.

Our website

We use cloud-based software to run our practice, which may include practice management, clinical documentation, email and file storage, accounting, and transcription tools. Some of these providers store or process data on servers located outside Australia, or have parent companies or support teams overseas.

We currently use, or may use: Cliniko (practice management); Microsoft 365 (email and file storage); Xero (accounting); transcription tools.

Before using an overseas provider we take reasonable steps to satisfy ourselves that the provider handles personal information in a way consistent with the Australian Privacy Principles. If you would like to know which providers we use and where your information is stored, please ask.

How we store and protect information

We take reasonable steps to protect your information from misuse, interference, loss, and unauthorised access, modification or disclosure. These steps include:

• password protection, multi-factor authentication and device encryption

• access limited to those who need the information to do their work

• secure, reputable cloud storage rather than files held only on local devices

• secure handling of any paper records, which are kept to a minimum and stored securely while in transit

• confidentiality obligations for anyone working with or for us

• regular software updates and backups

• secure destruction of records when they are no longer required

Because we work in your home and in the community, we take particular care with mobile devices — screens are kept private, devices are locked when not in use, and we do not leave records unattended in vehicles.

Data breaches

If personal or health information we hold is lost, or accessed or disclosed without authorisation:

• We act immediately to contain the breach and limit any harm.

• We assess what happened, what information was involved and who may be affected — within 30 days, and faster wherever we can.

• If we have reasonable grounds to believe the breach is likely to result in serious harm, we notify the people affected and the Office of the Australian Information Commissioner as soon as practicable. This is required by the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth). - Our notification explains what happened, what information was involved, and the steps you can take to protect yourself.

• Where a breach involves an NDIS participant or an aged care client, we also notify the relevant provider, commission or funding body as required.

• Every breach and near miss is recorded and reviewed, so we can correct whatever allowed it to happen.

Anonymity and pseudonymity

You can browse this website, and make a general enquiry about our services, without identifying yourself.

We cannot provide physiotherapy services anonymously or under a pseudonym. We are required to keep accurate, identified clinical records, to verify identity for funding purposes, and to communicate with your care team.

Accessing and correcting your information

You can ask for access to the personal information we hold about you at any time.

How to ask. Email admin@coastalcommunityphysio.com.au or phone 0477 252 899. We may ask you to put your request in writing and to verify your identity.

Timeframe. We will respond within a reasonable period and no later than 30 days.

Fees. There is no charge for making a request. We may charge a reasonable, cost-based fee for providing access — for example, for photocopying or for the time spent compiling a large record. We will tell you the cost before we proceed.

Limits. In limited circumstances we may refuse access — for example, where giving access would pose a serious threat to the life, health or safety of any person, or would have an unreasonable impact on the privacy of others. If we refuse, we will explain why in writing and tell you how to complain. Where appropriate, we will offer an alternative, such as providing a summary or releasing the record to another health practitioner.

Corrections. If information we hold is inaccurate, out of date, incomplete, irrelevant or misleading, tell us and we will correct it. There is no charge for a correction. If we disagree that a correction is needed, we will note your comments on the record and explain our reasons.

Making a privacy complaint

If you have a concern about how we have handled your information, please raise it with us first. Most issues can be resolved quickly.

Contact: admin@coastalcommunityphysio.com.au or 0477 252 899.

We will acknowledge your complaint within [2] business days and aim to resolve it within 30 days. We will tell you the outcome in writing.

Raising a complaint will never affect the services you receive.

If you are not satisfied with our response, you can contact:

• Office of the Australian Information Commissioner — 1300 363 992 — oaic.gov.au

• NDIS Quality and Safeguards Commission (for NDIS services) — 1800 035 544 — ndiscommission.gov.au

• Aged Care Quality and Safety Commission (for Support at Home services) — 1800 951 822 — agedcarequality.gov.au

• Australian Health Practitioner Regulation Agency (about a practitioner's conduct) — 1300 419 495 — ahpra.gov.au

Changes to this policy

We review this policy regularly and may update it. The current version is always available on our website, and we will provide a copy free of charge on request in a format that suits you.