Contact Info
-
ShopL3, 13-31 Guineas CK Rd, Elanora QLD4221 The Pines Elanora Shopping Centre
- vahab@elanoraphysiotherapy.com.au
- (07)56325686
ShopL3, 13-31 Guineas CK Rd, Elanora QLD4221 The Pines Elanora Shopping Centre
PRIVACY POLICY
Elanora Physiotherapy
The Pines Shopping Centre, Elanora, Gold Coast QLD
Ph: 07 5632 5686 | vahab@elanoraphysiotherapy.com.au | elanoraphysiotherapy.com.au
[ABN: insert ABN]
Version 2.0
Effective: 22 July 2026 | Next scheduled review: July 2027
Elanora Physiotherapy is committed to protecting the privacy of the personal and health information of our clients, in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and consistent with our professional obligations under the Physiotherapy Board of Australia's Code of Conduct and the Australian Physiotherapy Association's (APA) guidance to members.
This policy explains what personal information we collect, why we collect it, how we use, store and disclose it, and how you can access or correct it, or make a complaint. It applies to clients of Elanora Physiotherapy and to other individuals whose information we hold, such as referring practitioners and contractors.
Note: Elanora Physiotherapy is a health service provider. This means it is bound by the Privacy Act and the APPs regardless of annual turnover, even though it operates as a small business.
Elanora Physiotherapy is a physiotherapy practice located at The Pines Shopping Centre, Elanora, on the Gold Coast, Queensland. The practice is principally operated by Dr Vahab Nedaey (Doctor of Physiotherapy), who is registered with the Physiotherapy Board of Australia (AHPRA), supported by an Allied Health Assistant engaged as a subcontractor.
References in this policy to “we”, “us” or “Elanora Physiotherapy” mean Elanora Physiotherapy and any subcontractors delivering services under our supervision (such as our Allied Health Assistant). References to “you” mean any individual about whom we hold personal information.
When you enquire about our services, or become a client, we collect personal information such as your name, address, date of birth, contact details, and emergency contact details. Where relevant to your care, we may also collect an image (for example, clinical photographs of an injury site, with your consent).
Personal information we collect in order to provide healthcare services is health information, and is treated by us as sensitive information under the APPs. Health information we collect may include:
your relevant medical history and details of previous or current treatment;
your presenting complaint, assessment findings, diagnosis and treatment/care plan;
medications you are taking, where relevant to treatment;
details of other health practitioners or services involved in your care (e.g. your GP, specialist, or other allied health providers);
information relevant to a WorkCover, DVA, NDIS or Medicare Chronic Disease Management (CDM) claim, where applicable; and
your healthcare preferences, and details of any guardian or person responsible for your healthcare decisions, where relevant.
We also collect information relevant to administering your payment arrangements, such as your private health fund membership details, Medicare number, DVA file number, WorkCover claim number, or NDIS participant number, where relevant to the services you receive. Where we collect a government-related identifier (such as a Medicare number), we will only use or disclose it as required or permitted by law, and will not adopt it as our own identifier.
We collect information directly from you wherever practicable — for example, through intake forms, in consultations, over the phone, by email, or via our website. We may also collect information from third parties, including:
your referring GP, specialist, or other treating practitioners;
WorkCover Queensland, the Department of Veterans' Affairs, the NDIS Commission or your NDIS plan manager, and Medicare, where you are being treated under one of these schemes;
your private health fund or its claiming facility (e.g. HICAPS), limited to information necessary to process a claim; and
a family member, carer, guardian, or attorney, where they are assisting with your care.
You may choose not to identify yourself, or to use a pseudonym, for a general enquiry. However, it is generally not practicable for us to provide ongoing clinical care without identifying you.
We also hold personal information about individuals who are not clients — for example, our subcontracted Allied Health Assistant, referring practitioners, and other health professionals or businesses we deal with. This is generally limited to name, contact details, professional registration details, and information about our dealings with them.
Personal information collected through our website is handled as described in section 14 (Website, cookies and online privacy) below.
We collect your personal and health information to assess and manage your physiotherapy care, including to:
assess your condition and provide safe, effective and appropriate treatment;
communicate and coordinate with other practitioners involved in your care;
determine and administer your eligibility for Medicare, DVA, WorkCover Queensland or NDIS funding, where applicable;
process private health fund claims and other payment arrangements; and
meet our record-keeping, reporting and other legal and professional obligations.
Providing accurate and complete information helps ensure your treatment is safe and effective, and that any funding or insurance claims are processed correctly. If you provide incomplete or inaccurate information, we may not be able to provide the services you are seeking. If you have any concerns about information we have asked you to provide, please let us know.
We may disclose relevant information to other practitioners involved in your care — for example, your referring GP or specialist, or another allied health provider treating you — generally only in ways you would reasonably expect, or with your consent. In an emergency, we may disclose necessary information to other health professionals or emergency services without your consent, where required to protect your health or safety.
Elanora Physiotherapy engages an Allied Health Assistant, working under supervision, to help deliver aspects of your care. We may also use third-party service providers for functions such as practice management software, appointment reminders, or payment processing. Where a service provider handles your personal information on our behalf, we take reasonable steps to ensure they protect it consistently with this policy.
We also use and disclose personal information for administrative and operational purposes, including:
billing, payments and debt recovery;
responding to enquiries or complaints, including to bodies such as AHPRA, the Office of the Health Ombudsman (Qld), or the Office of the Australian Information Commissioner (OAIC);
clinical audit, quality assurance, and professional supervision;
obtaining advice from our professional indemnity insurer, legal advisers, or the APA; and
responding to a subpoena, court order, or other legal requirement.
Where you are receiving treatment under a government scheme, we disclose the information reasonably required for that scheme to assess and pay claims, consistent with the relevant legislation and scheme requirements. This includes:
Medicare — for services provided under a Chronic Disease Management (CDM) plan, we disclose the information required by Medicare to process the claim;
Department of Veterans' Affairs (DVA) — for DVA-funded treatment, we provide clinical reports and claim information as required under your DVA arrangement;
WorkCover Queensland and compulsory third-party (CTP) insurers — for a work-related or motor-vehicle injury claim, we provide clinical notes, progress reports and invoices reasonably required by the insurer to manage your claim, consistent with the relevant workers' compensation or CTP legislation; and
National Disability Insurance Scheme (NDIS) — for NDIS-funded supports, we disclose service and billing information to you, your plan manager, or the NDIS Commission as required to administer your plan and to meet our obligations as an NDIS provider.
In each case, we disclose only the information reasonably necessary for that scheme's purpose, and we will discuss with you what is being shared where practicable.
Many clients use private health insurance (PHI) to claim a rebate for physiotherapy, whether on the spot through HICAPS or a similar claiming facility, or later directly with their fund. We recognise this is an area where a physiotherapist can be caught between a client's privacy rights and pressure from a health fund — so our position is set out clearly below.
To process a private health insurance claim on your behalf, we disclose only the minimum billing information necessary, ordinarily limited to:
your name and date of birth;
your health fund membership number and level of cover;
the date(s) of service;
the item number(s) and general description of the service provided; and
the fee charged and the amount claimed.
By presenting your membership card or details and asking us to process a claim, you authorise this limited, administrative disclosure, which is necessary for us to provide that service to you (consistent with Australian Privacy Principle 6).
Your clinical records — including your case history, assessment findings, clinical notes, treatment plans and progress notes — are not routine billing information, and are not covered by the disclosure described in 7.1. We will not release your clinical notes to a private health fund, a claiming facility, or any other third party — including in response to a benefits or compliance audit — unless:
you have given specific, current and informed written consent to that particular disclosure; or
the disclosure is otherwise required or authorised by law (for example, under a court order or subpoena).
Consistent with the Physiotherapy Board of Australia's Code of Conduct and the APA's published position on this issue, we recognise that:
a general consent clause in a health fund's membership terms, or on a claiming-facility receipt, does not override your right to withhold or withdraw consent to the release of your clinical notes;
if you have previously consented and later withdraw that consent, we will honour the withdrawal, and any earlier consent is treated as no longer valid; and
a threat by a health fund to suspend or terminate our claiming access (for example, HICAPS eligibility) is not, of itself, a lawful basis for us to override your right to privacy. In that situation we will decline the disclosure and, if needed, seek advice from the APA, our professional indemnity insurer, or AHPRA, rather than release clinical information without your valid consent.
Where a private health fund or its representative requests access to clinical records as part of a benefits review or compliance audit, we will:
confirm the specific scope and purpose of the information requested;
seek your informed, written consent before releasing anything beyond the billing details described in 7.1; and
tell you about the request and, where appropriate, give you the opportunity to review the material or object to the disclosure before it is made.
In short: we can, and do, share billing details so your health fund claims are processed smoothly. We do not share your clinical notes with a fund without your specific consent, and we will not treat a fund's commercial or contractual pressure as overriding that. If a conflict ever arises between a fund's requirements and your privacy rights, your rights under the Privacy Act and our obligations under the Physiotherapy Board of Australia's Code of Conduct take precedence.
We will only use or disclose your personal information for direct marketing purposes with your consent. If you consent to receive marketing communications (by email, SMS, post or phone), you can opt out at any time by contacting us using the details in section 15.
We hold most personal information electronically, in our practice management system and associated cloud storage, secured with measures such as password/user-access controls, staff training, and physical security at our premises. Paper records are stored securely at our premises and, where retained, in secure archive facilities.
Where our practice management or other software providers store data on servers located outside Australia, this is a cross-border disclosure under Australian Privacy Principle 8, and we take reasonable steps to ensure any overseas provider protects your information consistently with the APPs. [Insert the name of your practice management software and confirm the country/countries where client data is hosted, so this section can name them specifically.]
If we experience a data breach likely to result in serious harm to you, we will notify you and the OAIC in accordance with the Notifiable Data Breaches scheme under the Privacy Act.
You may request access to the personal information we hold about you at any time, by contacting us using the details in section 15. We will acknowledge your request within 14 days and aim to provide access within 30 days. In limited circumstances permitted under the Privacy Act — for example, where access would pose a risk to your safety or that of another person — we may decline a request, and will explain our reasons and your right to complain if we do.
If you believe information we hold about you is inaccurate, out of date, incomplete, or irrelevant, you may ask us to correct it. Where we are unable to amend a clinical record (for example, an existing consultation note), we will add a note or statement to the record reflecting your correction request.
We retain clinical records for a minimum of 7 years from the date of your last consultation, or, for a client who was a minor at the time of treatment, until they turn 25 — consistent with standard medical-records retention practice recommended by professional indemnity insurers. Information that is no longer required is securely destroyed or de-identified.
If you have any questions or concerns about this policy, or about how your personal information has been handled, please contact our Privacy Officer using the details in section 15. We will generally respond within 14 days for straightforward matters, and will acknowledge more complex complaints within 14 days while we investigate, aiming to resolve these within 30 days.
If you are not satisfied with our response, or believe we have breached the Australian Privacy Principles, you can contact the Office of the Australian Information Commissioner (OAIC) on 1300 363 992 or at www.oaic.gov.au. Complaints about the clinical care or professional conduct of a practitioner (rather than privacy specifically) can also be directed to the Office of the Health Ombudsman (Queensland) or to AHPRA.
You can visit our website (elanoraphysiotherapy.com.au) without identifying yourself. If you provide contact details — for example, through an enquiry form — that information is handled in accordance with this policy.
Our website uses cookies to help it function correctly and, where applicable, to understand how visitors use the site (for example, via Google Analytics) and to support any online advertising. You can control or disable cookies through your browser settings, and opt out of personalised advertising through your browser, device or platform settings, or via services such as Google's Ad Settings.
Any online payment facilities we use are encrypted and maintained by our third-party payment provider. Users should otherwise exercise care when sending personal information over the internet, as standard web pages on our site are not separately encrypted for this purpose. Our website may link to third-party sites; we are not responsible for the privacy practices of sites we do not operate.
We may review or update this policy from time to time to reflect changes in our practice or in privacy law. The current version is available on our website (elanoraphysiotherapy.com.au) or on request.
Privacy Officer: Dr Vahab Nedaey, Principal Physiotherapist
Elanora Physiotherapy, The Pines Shopping Centre, Elanora, Gold Coast QLD
Phone: 07 5632 5686
Email: vahab@elanoraphysiotherapy.com.au
Website: elanoraphysiotherapy.com.au