Privacy Policy

Seasons West Pty Ltd as trustee for the Cary Family Trust, trading as Esperance Physiotherapy (ABN 21 211 491 826)

5 William Street, Esperance WA 6450  |  (08) 9071 5055

About this policy

Esperance Physiotherapy is committed to protecting your privacy. This policy explains how we collect, use, store and disclose your personal information, including your health information, and how you can access it, correct it or make a complaint.

We are bound by the Privacy Act 1988 (Cth) and the thirteen Australian Privacy Principles. As a health service provider, we are covered by the Privacy Act regardless of our size. Your health information is treated as sensitive information, which attracts a higher level of protection than other personal information.

Information we collect

We collect only the information we need to provide you with safe and effective physiotherapy care. This usually includes:

• Your name, date of birth, address, telephone number and email address.
• Your Medicare number, Department of Veterans' Affairs number, private health fund details, or workers' compensation claim and insurer details, where these apply.
• Your emergency contact and, where relevant, your parent, guardian or carer.
• Your medical history, current symptoms, medications, and any other health information relevant to your treatment.
• Notes, assessments, treatment plans and outcome measures created during your care.
• Referrals, imaging and reports we receive from your general practitioner, specialist or other health practitioners.
• Your accounts, payments and any outstanding balances.

How we collect your information

Wherever possible we collect information directly from you — on your new client registration form, during your consultations, and when you contact us by telephone or email.

Sometimes we collect information about you from other people, such as your general practitioner or specialist when they refer you, a radiology or pathology provider, your workers' compensation insurer or case manager, or a parent, guardian or carer where you are unable to provide the information yourself. We only do this where it is reasonably necessary for your care or where you have consented.

You may deal with us anonymously or under a pseudonym where it is lawful and practicable to do so. In most cases this will not be practicable, because we need to identify you to treat you safely, to keep an accurate clinical record, and to claim on your behalf from Medicare, your health fund or an insurer.

Use of an AI scribe

With your consent, we use an AI transcription service called Heidi to record and transcribe your consultation. This allows your physiotherapist to spend more time with you and less time typing. Your physiotherapist reviews and edits every transcribed note before it becomes part of your clinical record and remains responsible for its accuracy.

We do not use computer programs to make decisions about your care, your treatment or your access to our services. Decisions about your care are made by your treating physiotherapist. Where we use software that involves artificial intelligence, as described in this policy, it supports the record of a decision or the running of the practice rather than making a decision that affects you.

Recording your consultation means your health information is disclosed to Heidi, which acts as our service provider and is subject to the Privacy Act. Heidi has confirmed to us that it does not use your information to train or refine its artificial intelligence models, and that it uses the information only to provide the transcription service. Heidi has also confirmed that your consultation content is not reviewed by its staff for quality assurance or product improvement purposes; only de-identified, non-clinical operational data such as feature usage and error rates is used for that. Any other providers Heidi relies on — its Australian cloud hosting providers — are bound by written agreements, operate within Heidi's Australian infrastructure, and retain nothing once processing is complete. Once the note has been imported into your clinical record in Cliniko, we delete the transcript from Heidi. Heidi has confirmed that deletion is permanent and irreversible — the data is removed from its primary storage and its backups, with no recoverable copy retained. Heidi keeps a technical audit log of session identifiers and timestamps, which contains no health information, for twelve months for security and compliance purposes. Heidi has confirmed that its support and engineering personnel do not access your information routinely. Access occurs only where necessary to investigate a support issue you or we have raised, to troubleshoot a technical problem, or to respond to an incident, and where appropriate with our permission. Any personnel who may access Australian clinical information for these purposes are located in Australia. Heidi has first-level support staff in other countries, but they do not have access to clinical information held in our account. All support access is controlled and logged, and Heidi has confirmed it can provide access records to us on request.

Cliniko, the system that holds your clinical record, also uses artificial intelligence in limited ways. Cliniko has confirmed to us that it does not use clinical content or personal information to train or develop its AI models. It has also told us that it screens outgoing emails and text messages that its systems identify as at risk of misuse, that a message identified as at risk is passed to a language model, and that personal information contained in such a message may be included. Cliniko has told us this applies only to messages identified as at risk rather than to all practice communications, that it does not apply to your clinical notes, and that it believes information is de-identified as part of the process. Cliniko has not yet confirmed the full scope of this screening in writing and has undertaken to clarify it, so we treat this position as unconfirmed and will update this policy once we have its written confirmation.

You do not have to agree to the use of an AI scribe. If you would prefer that your consultation is not recorded, tell your physiotherapist or reception at any time, including part-way through an appointment. Your care will not be affected in any way, and your physiotherapist will simply type the notes as they did before.

Why we collect and use your information

We collect and use your information to:

• Assess, diagnose and treat your condition, and plan and review your care.
• Keep an accurate and complete clinical record, as we are professionally and legally required to do.
• Communicate with you about your appointments and your care.
• Bill you and process payments, and claim from Medicare, the Department of Veterans' Affairs, your private health fund or an insurer.
• Comply with our obligations under the Health Practitioner Regulation National Law (Western Australia) and other laws.
• Review and improve the quality and safety of the care we provide, including through internal audits of our clinical records.

If we cannot collect the information we need, we may not be able to treat you safely, or at all.

When we disclose your information

We do not sell your information, and we do not disclose it to anyone else except as described below.

With your consent, we disclose your information to:

• Your general practitioner, specialist or other treating health practitioner, so that your care is coordinated.
• Another physiotherapist or practice, if you transfer your care.
• Your employer's workers' compensation insurer or case manager, where you are being treated under a workers' compensation claim.

Without your consent, we may disclose your information where:

• It is required or authorised by law — for example, in response to a subpoena or court order, or where we are required to report suspected child abuse or a notifiable disease.
• It is necessary to lessen or prevent a serious threat to someone's life, health or safety.
• It is necessary for us to claim payment from Medicare, the Department of Veterans' Affairs or your health fund, or to recover an unpaid account.

We also use service providers who handle your information on our behalf, including our practice management software provider and our accounting software provider. They are bound to protect your information and may only use it to provide services to us.

Within the practice, all our physiotherapists can see your clinical record. This lets us care for you safely if your usual physiotherapist is unavailable. If you have any concern about this, please raise it with your physiotherapist or the Practice Principal.

Research and quality improvement

We review the care we provide to improve it. This may include auditing clinical records within the practice.

We may also use information that does not identify you in research aimed at improving health care. Where research uses information that could identify you, we will seek your consent, and you are free to refuse without it affecting your care in any way. Published research results will never identify you.

In limited circumstances, identifiable health information may be used for medical research without consent where the research serves an important public interest. This may only occur in accordance with guidelines issued by the National Health and Medical Research Council and with the approval of a registered human research ethics committee.

How we store and protect your information

Your clinical record is held electronically in Cliniko, our cloud-based practice management system. Our accounts are kept in Xero, our accounting system, which records payments received — including your name where you pay by electronic transfer — but holds no clinical information about you. Any paper documents we receive are scanned into your electronic record and then securely destroyed.

We protect your information by restricting access to authorised staff with individual logins and passwords, setting access levels according to each person's role, positioning screens so they cannot be read by others, using firewalls and anti-virus software, and backing up data securely. Paper records held at the practice are kept in locked or closed storage in areas not accessible to the public.

Your clinical record in Cliniko is stored on servers located in Australia. Heidi has confirmed to us that transcripts and notes generated by its AI transcription service are processed and stored exclusively in Australia, and that audio recordings are never stored. Heidi is not currently able to switch off overseas access to an account as a separate setting. Based on Heidi's written confirmation, this does not create a pathway to your clinical information from overseas, because its personnel outside Australia do not have access to the clinical information in our account. We rely on that confirmation and review it when Heidi changes its service or support arrangements. Xero, which holds only our accounting information, stores that information on servers located in the United States. Xero has confirmed to us that its hosting providers are not permitted to access or use the information except for the limited purpose of storing it. Xero has also told us that where its analytics features use third-party artificial intelligence providers, the information given to them is anonymised and is not used to train their models. We have asked Xero to confirm in writing that your information is not used to train artificial intelligence systems more generally. We take reasonable steps to ensure any overseas recipient handles your information consistently with the Australian Privacy Principles. If you would like more detail about where your information is held, please ask us.

How long we keep your information

We keep your clinical record for at least seven years after your last appointment. Where you were under 18 at the time of your last appointment, we keep your record until you turn 25. After that, records are securely destroyed or de-identified.

Accessing and correcting your information

You have a right to ask for access to the personal and health information we hold about you. Please make your request in writing to the Practice Principal. We will respond within a reasonable time, usually within 30 days.

We may give you access by letting you view your record, by discussing it with you, or by giving you a summary. Your physiotherapist may offer to go through the record with you, so that clinical notes are not misunderstood or taken out of context.

There are limited circumstances in which we may refuse access — for example, where giving access would pose a serious threat to the life, health or safety of any person, or where the record contains information about someone else whose privacy would be unreasonably affected. If we refuse, we will tell you why in writing and explain how you can complain.

We will need to charge a reasonable fee for the staff time involved in giving you access. We will tell you the fee before we proceed. There is no fee for simply making a request.

If you believe information we hold about you is inaccurate, out of date, incomplete or misleading, please tell us and we will correct it. We do not delete or overwrite clinical notes; a correction is added to the record so that the history remains complete, as our professional obligations require.

Appointment reminders and practice communications

With your consent, we send appointment reminders by SMS and/or email and may send you practice newsletters or information about new services. You can opt out at any time by telling reception, replying to the message, or contacting us through our website. Opting out of marketing will not affect your appointment reminders or your care.

If something goes wrong

If we become aware of unauthorised access to, or loss or disclosure of, your information, we will assess it promptly. Where a breach is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner and tell you what has happened and what you can do about it. This is required under the Notifiable Data Breaches scheme.

Making a complaint

If you have a concern about how we have handled your information, please raise it with us first. Contact the Practice Principal in writing at 5 William Street, Esperance WA 6450, or through the contact form on our website at www.esperancephysio.com/about-us/contact-us. We will acknowledge your complaint, investigate it, and respond to you in writing, usually within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at www.oaic.gov.au or on 1300 363 992. If your concern relates to the conduct of a registered health practitioner, you may also contact the Australian Health Practitioner Regulation Agency at www.ahpra.gov.au or on 1300 419 495, or the Health and Disability Services Complaints Office of Western Australia on 1800 813 583.

Changes to this policy

We review this policy regularly and will update it as our practice or the law changes. The current version is available on our website at www.esperancephysio.com, at our reception desk, and on request.

Last reviewed September 2026