PRIVACY POLICY FOR SAGE PHYSIO ROCKINGHAM

Current as of: June 22, 2026

1. Purpose and Business Structure

This policy outlines how Sage Physio Rockingham collects, holds, uses, and discloses your personal and sensitive health information.

While my practice operates physically from a leased room within another physiotherapy business clinic, Sage Physio Rockingham is an entirely independent business. Your clinical records are completely separate from the host business and are handled in strict compliance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

2. Information Collected

I collect information necessary to deliver safe, effective physiotherapy care, room scheduling, and financial invoicing. This includes:

  • Personal Data: Your name, date of birth, and contact details (phone, email, home address).

  • Government Identifiers: Your Medicare, Department of Veterans' Affairs (DVA), NDIS, or private health fund numbers, used exclusively for claims processing.

  • Sensitive Health Information: Clinical medical histories, physical symptoms, diagnostic imaging reports, treatment plans, progress notes, and referral letters.

3. How Data is Collected

Information is collected directly from you when filling out my digital intake forms, or verbally during clinic assessments. As a sole trader, I manage all administrative and reception tasks myself. Consent to this policy is logged electronically through Cliniko.

4. Use and Disclosure of Information

Your clinical records are viewed and managed exclusively by Sage Physio Rockingham. Your health data is never shared with the host clinic's practitioners or staff unless you provide explicit, written consent to co-manage a condition. I disclose information to external parties only when:

  • You provide clear consent (e.g., emailing a treatment update to your GP).

  • It is required to process automated third-party funding claims.

  • It is required by law (e.g., emergency public safety or court subpoenas).

5. Data Security, Cliniko Storage, and Room Boundaries

Because I operate in a shared professional facility, strict digital and physical boundaries are enforced:

  • Secure Cloud Storage: All clinical notes are stored electronically on Cliniko using end-to-end HTTPS encryption in transit and AES-256 encryption at rest. Data is housed on secure Australian cloud servers. The host clinic has no digital access to the Sage Physio Rockingham Cliniko database.

  • Device Security: Devices used inside the treatment room (laptops, tablets, or phones) are secured with biometric authentication (Face ID or fingerprint), strong local passwords, and automatic screen locks.

  • Physical Visibility & Shared Infrastructure: No paper files are printed or stored in the shared space. My treatment room is locked when not in use. If shared network printers are utilized, documents are collected immediately to ensure no data is left exposed.

  • Data Retention: Clinical records are legally preserved for a minimum of 7 years from the date of last interaction (or until the age of 25 if the patient was a minor).

6. Accessing and Correcting Your Records

You have the legal right to request access to, or ask for corrections to, your personal health information. Requests must be lodged in writing directly to Sage Physio Rockingham at admin@sagephysiorockingham.com.au and will be processed within 30 days. Please do not submit these requests to the host clinic's staff.

7. Complaints and Feedback

If you believe a breach of privacy has occurred, or if you wish to provide feedback on how your data is handled, please contact me directly at 0402 970 212 or via email at emma@sagephysiorockingham.com.au. I take all feedback and privacy concerns seriously and will work to resolve the matter immediately. If my resolution is unsatisfactory, you may escalate the matter to the Office of the Australian Information Commissioner (OAIC).