Privacy policy

Penrith Physiotherapy Sports Centre ("we", "us") provides physiotherapy and allied health care from 119–121 Lethbridge Street, Penrith NSW 2750. Because we provide a health service, we are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and by the Health Records and Information Privacy Act 2002 (NSW). Health information gets the highest level of protection under those laws, and we treat it that way. Stable Labs, our vestibular clinic, is part of the practice and has its own privacy policy for its website and app.

1. The short version

We collect what we need to look after you, run the clinic and understand how people find us. We use your health information to care for you and for nothing else without your consent. We use standard website and advertising tools (Google, Meta and CallRail) to measure our website and ads, but we never send them your health records, and we never sell your information.

2. What we collect, and when

When you browse our website. Which pages you visit, roughly where you are, your device and browser, and any campaign tags on the link that brought you here. This is collected by the tools described in section 3.

When you call us or send a message. Calls to the phone numbers on our website go through a call-tracking service, which records the number you called from, the time and length of the call, and the page or ad that led to it. If a call is recorded, you are told at the start. Messages you send through the contact form go to reception, with the details you enter.

When you book online. Your name, date of birth, email address, mobile number, the appointment you chose, and anything you tell us in the booking notes. If a $50 holding fee applies, your card details go directly to our payment processor, Stripe. They never reach our own systems.

When you fill in an intake form. Some services ask you to complete a health questionnaire before your first visit. Your answers are saved to your patient record and sent to your treating clinician by email. If you start the form but leave part-way through, your name, contact details and how far you got are sent to the clinician so they can help you finish it.

When you are a patient. Your clinical record: your history, assessment findings, test results, treatment notes and correspondence, along with Medicare, health fund, NDIS or workers compensation details where they apply.

3. Website measurement, advertising and cookies

Our website uses Google Tag Manager to load these tools, which set cookies or similar identifiers in your browser:

• Google Analytics (Google) — which pages are visited and how people move through the site.
• Google Ads (Google) — tells us when someone who clicked one of our Google ads goes on to call or book, and lets us show our ads again to people who have visited the site.
• Meta pixel (Meta, the owner of Facebook and Instagram) — which pages were visited, so we can measure our Facebook and Instagram ads.
• CallRail — shows a local tracking number in place of our clinic number. It rings straight through to the clinic and tells us which page or ad led to the call. Our contact form also runs through CallRail.

Some pages also include content from other services, which can set their own cookies when the page loads: Google Maps (our location map), YouTube and Vimeo (videos in our articles) and Elfsight (the reviews shown on our review page).

Some of our pages are about specific conditions, so the address of a page you read can suggest the kind of topic you were interested in. These tools receive page addresses and browsing activity. They do not receive your name, your appointments or anything from your clinical record.

Some of our vestibular (dizziness and vertigo) booking links take you to stablelabs.com.au, our vestibular clinic's website. Those links carry the campaign tags from the ad or link that brought you here, so that a booking can be credited to the right ad. Stable Labs' own privacy policy covers what happens on that site.

You can block or clear these cookies in your browser settings, and the site works the same without them. Google offers an opt-out for Google Analytics at tools.google.com/dlpage/gaoptout, and you can manage ad personalisation in your Google account settings and in your Facebook or Instagram ad settings. Google, Meta and CallRail handle what they receive under their own privacy policies.

4. Why we use your information

• To provide your care and to communicate with you about it.
• To book, confirm, remind you about and manage your appointments.
• To process payments, Medicare and health fund claims, and invoices to other funders.
• To share information with other people involved in your care, such as your GP or a specialist, as described in section 5.
• To understand how our website and advertising perform.
• To meet our clinical, legal, tax and professional obligations.

We do not use your health information to target advertising, and we do not sell personal information to anyone.

5. Who we share it with

Only those who need it, and only what they need:

• Other health professionals involved in your care, such as your GP or a specialist, when you have agreed or would reasonably expect it, for example by sending a report to the doctor who referred you.
• Funders of your care — Medicare, your health fund, the NDIS, or a workers compensation or insurance provider — when they are paying for it.
• Our service providers: Nookal (practice management and clinical records), CliniqApps (appointment reminders and practice emails), Stripe (online payments), Amazon Web Services (website hosting and system emails), and the Google, Meta and CallRail tools described in section 3.
• Where the law requires or allows it, including where there is a serious threat to someone's life, health or safety.

6. Information sent overseas

Our website is hosted in Australia. Some of our service providers operate internationally, so information they handle may be stored or processed outside Australia: in particular Google, Meta and CallRail (website measurement, advertising and call tracking, mainly in the United States), Stripe (payments) and our email services. Where we can choose, we use Australian data storage for patient records.

7. How long we keep it

• Clinical records — as health-records law requires: at least 7 years from your last visit, and for patients who were under 18, until they turn 25.
• Payment and booking records — 7 years, as Australian financial record-keeping rules require.
• Website and advertising data — kept by Google, Meta and CallRail under their own retention settings and policies.

8. Your rights

You can ask for access to the personal and health information we hold about you, and ask us to correct it if it is wrong. You can also ask us to stop sending you anything that is not about your care. Contact us using the details below and we will respond within 30 days. There may be a reasonable fee for copying a large clinical record, and we will tell you before any cost applies.

9. Security

Your information is sent over encrypted connections and stored in access-controlled systems. No system is perfectly secure, but if a data breach occurs that is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

10. Questions and complaints

Contact us at reception@penrithphysiotherapy.com.au, on (02) 4721 5567, or by post to 119–121 Lethbridge Street, Penrith NSW 2750. Please tell us first if you think we have mishandled your information, so we can put it right. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au) or, for health information in New South Wales, the NSW Information and Privacy Commission (ipc.nsw.gov.au).