Effective date: [DD Month YYYY]
1. Purpose and scope
Formula Plus Physio [legal entity and ABN] respects the privacy of patients, carers, referrers and website visitors. This policy is intended to reflect the Privacy Act 1988 (Cth), Australian Privacy Principles, Health Records Act 2001 (Vic), Health Privacy Principles and applicable professional obligations.
2. Information collected
We may collect identity and contact details, relevant health information, referral and funding details, appointments, consent, clinical, payment and administrative records.
3. Collection and purpose
We aim to collect only information reasonably necessary to provide services, manage appointments, communicate, administer claims and accounts, meet legal and professional duties, and protect patients and systems.
4. Cliniko
Online booking and patient-management functions are provided through Cliniko. Confirm and insert the current privacy and data-handling details applying to the practice account.
5. Use and disclosure
Information may be used or disclosed for the primary purpose, a directly related and reasonably expected purpose, with consent, or as authorised or required by law. We do not sell patient information.
6. Security
Reasonable technical and organisational safeguards may include individual accounts, role-based access, multi-factor authentication, secure systems, staff training, access reviews, backups and incident response.
7. Retention and disposal
Records are retained for applicable legal, professional and clinical periods, then securely destroyed or permanently de-identified where lawful. Insert the approved retention schedule.
8. Access and correction
Individuals may request access to or correction of information. Identity or authority may need to be verified, and lawful exceptions may apply.
9. Overseas disclosures
[Confirm any overseas recipients and countries, including service providers, support, analytics and backups.]
10. Data breaches
The practice will contain and assess suspected incidents, reduce harm and notify affected individuals and regulators where required.
11. Complaints and contact
Contact [Privacy Contact, email, phone and postal address]. Unresolved concerns may be raised with relevant privacy or health complaints regulators.