Privacy Policy

1. Our privacy commitment

Healthroos provides mobile Physiotherapy, Occupational Therapy and Exercise Physiology services for NDIS participants, Support at Home clients, WorkCover clients and private patients. We manage personal information in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth), together with other privacy and health-record requirements that apply to our services.

This policy applies to information collected through our website, referral and enquiry forms, phone and email communications, clinical services and interactions with authorised representatives, referrers and care teams.

2. Information we collect and hold

The information we collect depends on your relationship with Healthroos and the services requested. It may include:

• identity and contact information, such as your name, date of birth, phone number, email and address;
• NDIS participant details, plan-management information, Support at Home or Home Care Package details, WorkCover information and relevant funding or claim identifiers;
• health information, medical and treatment history, medications, risks, assessments, goals, progress notes, reports and information relevant to safe service delivery;
• details of nominees, guardians, carers, support coordinators, care managers, referrers, treating practitioners and other authorised contacts;
• communication, accessibility and language preferences;
• appointment, service, billing, invoicing and administrative records; and
• website enquiry information and basic technical information associated with use of our website.

3. How we collect information

Where practical, we collect personal information directly from you. This may occur when you:

• submit an online NDIS referral, non-NDIS referral, booking request or enquiry;
• contact us by phone, email or through our contact page;
• speak with a clinician or provide information during an assessment or treatment session; or
• complete forms, provide documents or communicate with us about services, billing or reports.

With your consent, authority or where otherwise permitted by law, we may also collect information from a family member, nominee, guardian, carer, support coordinator, care manager, plan manager, treating practitioner, hospital, referrer, the NDIA, an insurer or another person involved in your care or funding.

4. Why we collect, hold and use information

We use personal information for purposes connected with our functions and services, including to:

• assess referrals, service suitability, clinical needs and safety requirements;
• deliver and coordinate Physiotherapy, Occupational Therapy and Exercise Physiology;
• schedule appointments and communicate with participants, families, authorised representatives and care teams;
• prepare assessments, treatment plans, progress updates, clinical reports and funding-related documentation;
• manage billing, invoicing, plan-management and administrative requirements;
• monitor service quality, clinical governance, safety and staff development;
• respond to enquiries, feedback, complaints and access or correction requests; and
• meet professional, contractual, insurance, regulatory and legal obligations.

If you do not provide information that is reasonably necessary, we may be unable to assess a referral, provide a requested service or safely coordinate care. You may withdraw consent where consent is the basis for a particular use; however, this may affect our ability to continue some services.

5. When we disclose information

We may disclose relevant information to:

• Healthroos clinicians and authorised team members who need the information to perform their role;
• your authorised representative, care team, referrer, support coordinator, care manager, plan manager, treating practitioners or other providers involved in your support;
• the NDIA, a Support at Home provider, insurer, employer or claims manager where required for an authorised service, payment or report;
• contracted technology, records, administration, accounting and professional service providers that support our operations and are expected to handle information securely;
• professional advisers, insurers, regulators or accreditation bodies where reasonably necessary; and
• government agencies, emergency services or other parties where disclosure is required or authorised by law, or necessary to address a serious threat as permitted by law.

We do not sell personal or health information.

6. Security and retention

Healthroos takes reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. Measures may include restricted role-based access, password protection, secure systems, encryption where appropriate, staff confidentiality obligations and secure disposal processes.

We retain records for as long as reasonably required to provide services and meet clinical, professional, contractual and legal obligations. When information is no longer required, we take reasonable steps to securely destroy or de-identify it, subject to applicable record-retention requirements.

7. Website, forms and online services

Our website may collect basic technical information such as browser type, device information, pages visited and approximate location through cookies, security tools or analytics services. This information helps us operate, protect and improve the website. You can manage cookies through your browser settings, although some website functions may be affected.

Information sent through online forms or email travels over the internet. We use reasonable safeguards, but no internet transmission is completely secure. Our website may contain links to third-party websites; their handling of personal information is governed by their own privacy policies.

8. Overseas storage or processing

Some technology or service providers used by Healthroos may store or process information using infrastructure located outside Australia. The countries involved can vary as providers and systems change. Where overseas handling occurs, we take reasonable steps appropriate to the circumstances to protect personal information and comply with applicable Australian privacy requirements. You may contact us for current information about likely overseas disclosures relevant to your information.

9. Accessing or correcting your information

You may request access to personal information Healthroos holds about you or ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading. Contact us using the details below and describe the information concerned. We may need to verify your identity or authority before acting.

We will respond within a reasonable period. In some circumstances, the law may permit or require us to refuse access or correction. If that occurs, we will explain the decision and available complaint options where required. Further guidance is available from the OAIC on accessing health information and correcting health information.

10. Privacy questions and complaints

If you have a privacy concern or believe Healthroos has mishandled your information, please contact us first. Include your name, contact details, a description of the concern and the outcome you are seeking. We will acknowledge the matter, investigate it and aim to respond within a reasonable period.

If you are not satisfied with our response, you may be able to contact the Office of the Australian Information Commissioner. The OAIC generally expects you to complain to the organisation first and allow it a reasonable opportunity to respond.

11. Changes to this policy

We may update this policy when our services, systems or legal obligations change. The current version will be published on this page with its effective date.