Privacy Policy

DX Physiotherapy Pty Ltd

1. Introduction

DX Physiotherapy Pty Ltd (“DX Physiotherapy”, “we”, “us” or “our”) is committed to protecting the privacy of everyone who interacts with our clinic, including patients, prospective patients, and website visitors. This Privacy Policy explains what personal information we collect, why we collect it, how we use and protect it, and what rights you have in relation to it.

This policy applies to information collected when you book an appointment, attend our clinic for physiotherapy or pilates services, use our website, or otherwise interact with us. It should be read alongside our Terms of Service. By using our services, you acknowledge that your personal information will be handled in accordance with this policy.

2. Who We Are

DX Physiotherapy Pty Ltd (ABN 651 749 209) is the organisation responsible for deciding how and why your personal information is collected and used – in privacy law this is sometimes referred to as being the entity accountable for your information. Our details are:

Legal name: DX Physiotherapy Pty Ltd
ABN: 651 749 209
Clinic address: 3/398 Sydney Road, Balgowlah NSW 2093 | LG 320 Military Road, Cremorne NSW 2090
Phone: 02 9949 3770
Email: info@dxphysiotherapyau.com
Website: https://dxphysiotherapy.com.au/

We are bound by the Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs), as well as NSW health records legislation, in the way we handle your personal and health information.

3. What Personal Data We Collect

The information we collect depends on how you interact with us, but generally includes the following categories:

Identity data such as your full name, date of birth, gender, and emergency contact details.
Contact data such as your postal address, email address, and phone number.
Health and clinical data such as your medical history, current symptoms and conditions, medications, previous injuries or surgeries, physiotherapy assessment findings, treatment notes, pilates program details, progress notes, and any other information relevant to your physiotherapy or pilates care.
Financial data such as payment card details (processed securely and not retained by us in full), payment history, and private health insurance membership details where relevant to claiming a rebate.
Technical data such as your IP address, browser type, and general usage information when you visit our website.
Communications data such as emails, phone calls, appointment booking correspondence, and any feedback or complaints you send us.

4. How We Collect Your Data

We collect personal information directly from you in the following ways:

When you book an appointment through our online booking system, Cliniko, by phone, or in person.
When you complete a new patient intake form or health questionnaire.
During your consultations and treatment sessions, as your practitioner records clinical notes.
When you make a payment in clinic by card or cash.
When you contact us by phone, email, or through our website.
When you subscribe to receive marketing communications from us.

In some circumstances, we may also collect information from third parties, such as a referring general practitioner or specialist, or your private health insurer where relevant to processing a claim, but only where you have provided the necessary consent or authority for this.

5. Why We Collect Your Data and Our Legal Basis

Under the Privacy Act 1988, health information is treated as “sensitive information” and receives a higher level of protection. We only collect, use, and disclose your personal and health information for the following purposes:

Providing clinical treatment: we collect and use your health information to assess your condition, plan and deliver physiotherapy and pilates treatment, and monitor your progress. This relies on your consent to treatment as described in our Terms of Service, and is necessary for us to provide you with appropriate healthcare.
Booking and appointment management: we use your contact details to schedule, confirm, and manage your appointments through Cliniko.
Processing payment: we use your financial data to process payments for services received and, where applicable, to assist with private health insurance claims.
Sending appointment reminders: we use your contact details to send you reminders and administrative updates about your appointments. These are considered part of providing our services, not marketing, and cannot be opted out of in the same way as marketing emails.
Complying with legal obligations: we retain clinical records and other information as required by NSW health records law, and may disclose information where required by law, for example in response to a court order or statutory request.
Marketing communications: where you have opted in, we use your email address to send newsletters, health tips, or clinic updates via our email marketing platform, Brevo. This is based on your consent, which you may withdraw at any time – see section 11 for more detail.

We will not use or disclose your personal information for any purpose beyond those described above without seeking your consent, unless permitted or required by law.

6. Who We Share Your Data With

We only share your personal information with third parties where necessary to provide our services, where you have authorised us to do so, or where required by law. The following parties may process your data:

Cliniko (booking and clinical records system): used to store your booking information and clinical records. Cliniko is an Australian company and stores data on servers located in Australia.
Brevo (email marketing platform): used to send marketing communications to patients who have opted in. We have not independently confirmed the specific country in which Brevo processes data for this clinic – we recommend you confirm this directly with Brevo and update this policy accordingly.
Associate practitioners and admin staff: members of our clinical and administrative team access patient records as necessary to provide your care, manage your appointments, and handle billing. All staff are bound by confidentiality obligations.
Private health insurance companies: where you wish to claim a rebate or where a claim requires supporting clinical information, we may share relevant information with your insurer, generally with your authorisation.
Referral partners: such as your referring GP, specialist, or other treating health practitioners, where relevant to your ongoing care and where you have consented to this exchange of information.
Professional and legal advisers, and regulators: such as our accountant, insurer, or AHPRA, where necessary for the operation of our business or as required by law.

We do not sell your personal information to any third party. Where any of the above providers are based overseas or store data outside Australia, we take reasonable steps in line with Australian Privacy Principle 8 to ensure your information continues to be handled in a manner consistent with the APPs.

7. How Long We Keep Your Data

We retain your personal and clinical information for as long as necessary to provide our services and to meet our legal and professional obligations. In line with the default position under NSW health records law, we generally retain adult patient records for a minimum of 7 years from the date of your last consultation.

Where a patient was under 18 at the time of treatment, we retain their records until they turn 25 years of age, or for 7 years from the last consultation, whichever period is longer. After the applicable retention period has passed, we will securely destroy or de-identify your information, unless we are required or permitted by law to retain it for longer.

8. How We Keep Your Data Safe

We take the security of your personal and health information seriously and have put in place a range of technical and organisational measures to protect it against loss, misuse, unauthorised access, and disclosure. These measures include:

storing clinical records in Cliniko, a secure, access-controlled digital system rather than on paper or local devices;
restricting access to patient records to associate practitioners and admin staff who need that information to do their jobs;
requiring all staff to comply with confidentiality obligations regarding patient information, both during and after their engagement with us;
using secure payment processes for card transactions in clinic; and
reviewing our data handling practices periodically to help ensure they remain appropriate and up to date.

While we take reasonable steps to protect your information, no system can guarantee complete security. If you have any concerns about the security of your information, please contact us using the details in section 15.

9. Your Rights

Under the Privacy Act 1988 and the Australian Privacy Principles, you have a number of rights in relation to your personal information. These include:

Right to access: you can ask us for a copy of the personal information we hold about you, including your clinical records. We will generally respond to access requests within a reasonable timeframe and may charge a reasonable fee to cover the cost of providing copies.
Right to correction: if you believe any information we hold about you is inaccurate, out of date, or incomplete, you can ask us to correct it.
Right to anonymity or pseudonymity: where lawful and practicable, you have the option of not identifying yourself, or using a pseudonym, when dealing with us – though this may not be possible where we need to verify your identity to provide safe clinical care.
Right to opt out of direct marketing: you can ask us to stop sending you marketing communications at any time, without this affecting your ability to receive clinical or appointment-related communications.
Right to complain: you have the right to make a complaint about how we have handled your personal information – see section 14 for how to do this.

To exercise any of these rights, please contact us using the details in section 15. We may need to verify your identity before actioning certain requests, particularly those involving access to clinical records.

10. Children’s Privacy

We provide physiotherapy and pilates services to patients under the age of 18. Where a patient is a minor, a parent or legal guardian must provide consent to treatment and to the collection and use of the minor’s personal and health information, consistent with the process described in our Terms of Service.

Consent provided by a parent or guardian is recorded in the minor’s clinical file in Cliniko. We apply the same security and access controls to minors’ records as we do for adult patients, and retain those records for the extended period described in section 7 to reflect their status as a minor at the time of treatment.

11. Marketing Communications

We use Brevo to send marketing communications, such as newsletters, clinic updates, or health and wellbeing information, to patients who have opted in to receive them. We will only send you marketing emails if you have actively agreed to this, for example by subscribing via our website or ticking a consent box.

You can unsubscribe from marketing communications at any time by clicking the “unsubscribe” link included in every marketing email, or by contacting us directly using the details in section 15. Please note that opting out of marketing will not affect clinical or administrative communications, such as appointment confirmations and reminders, which are necessary for us to provide our services to you.

12. Cookies and Website Tracking

Our website, https://dxphysiotherapy.com.au/, may use functional cookies and similar technologies to help the site operate properly, remember your preferences, and understand general usage patterns, such as which pages are visited most often. These cookies do not collect sensitive health information.

Most web browsers allow you to control or disable cookies through their settings. Please note that disabling certain cookies may affect the functionality of our website. If we introduce additional tracking or analytics tools in future, we will update this section accordingly.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the services we offer, or our legal obligations. Where we make material changes, we will update the “Last Updated” date below and, where appropriate, notify you by email or by displaying a notice at our clinic or on our website. We encourage you to review this policy periodically.

14. How to Make a Complaint

If you have any concerns about how we have handled your personal information, we would like the opportunity to address them directly. Please contact us using the details in section 15, and we will investigate your complaint and respond to you within a reasonable timeframe.

If you are not satisfied with our response, or would prefer to raise your concern with an external body, you have the right to lodge a complaint with the Office of the Australian Information Commissioner (OAIC), which is the independent regulator responsible for privacy matters in Australia. In the event of an eligible data breach that is likely to result in serious harm, we will also comply with our notification obligations under the Notifiable Data Breaches (NDB) scheme, which may include notifying affected individuals and the OAIC.

15. Contact Us

If you have any questions about this Privacy Policy, would like to exercise any of your rights, or wish to raise a concern about how we handle your personal information, please contact us at:

DX Physiotherapy Pty Ltd
3/398 Sydney Road, Balgowlah NSW 2093
Phone: 02 9949 3770
Email: info@dxphysiotherapyau.com
Website: https://dxphysiotherapy.com.au/

16. Last Updated

This Privacy Policy was last updated on 1 July 2026.