Privacy Policy

We collect only what we need to treat you safely and to run the practice.

• Identity and contact details — your name, date of birth, address, phone number, email address, and the name of an emergency contact.
• Health information — your reason for attending, medical and injury history, medications, results of physical assessment, treatment notes, exercise programs, progress measures, imaging or reports you give us, and correspondence from your doctor or specialist.
• Funding and claim details — Medicare number, DVA card number, NDIS participant number, WorkCover Queensland claim number, private health fund and membership number, and referral details, where these apply to you.
• Payment information — the record of what you were charged and what you paid. Card numbers are processed by our payment terminal and are not stored by us.
• Website information — anything you type into a form on this site, and anonymous statistics about how the site is used.

If you choose not to give us some of this information we will tell you what it means for your care. In some cases we may not be able to treat you safely, or a rebate may not be claimable.

• To assess your condition, plan and deliver your treatment, and track whether it is working.
• To communicate with you about your appointments, classes and program.
• To bill you, and to process claims through HICAPS, Medicare, DVA, the NDIS, WorkCover Queensland or your insurer.
• To meet our legal, professional and insurance obligations, including the record-keeping standards set by AHPRA and our professional associations.
• To manage the practice — staffing, quality of care, complaints and accreditation.

We do not sell your information, and we do not use your health information for advertising.

Wherever possible we collect information directly from you — on your registration form, during your appointment, over the phone, by email, or through our booking system.

Sometimes we receive information about you from someone else: a referring GP or specialist, a radiology or pathology provider, an insurer or claims manager, an NDIS plan manager or support coordinator, or a family member or carer where you have asked them to act for you. Where we collect information about you from a third party, we will tell you, unless you have already been told or it is unreasonable or impracticable to do so.

Your health information stays inside the practice unless one of the following applies.

• With your consent — to your GP, specialist, surgeon or another treating practitioner, so your care is coordinated.
• To process a claim you have asked us to make — HICAPS and your private health fund, Medicare, DVA, the NDIS or your plan manager, WorkCover Queensland, or a compulsory third party or income protection insurer.
• To service providers who help us run the practice — our practice management and booking systems, our IT and website providers, and our accountant. They are bound to protect your information and may use it only for the purpose we engaged them for.
• Where the law requires or permits it — for example a court order or subpoena, a mandatory reporting obligation, or where disclosure is necessary to lessen or prevent a serious threat to somebody’s life, health or safety.

We do not disclose your health information to an employer, a family member or anyone else simply because they ask.

Some of the technology services we rely on — website hosting, email, analytics and our booking platform — store data on servers located outside Australia. Where that happens we take reasonable steps to satisfy ourselves that the provider handles your information in a way consistent with the Australian Privacy Principles.

Your clinical record itself is held in our practice management system and is not routinely sent overseas.

• Electronic records are held in password-protected systems, accessible only to staff who need them to do their job.
• Any paper records are kept in a locked area of the clinic.
• Staff and contractors are bound by confidentiality obligations as a condition of working here.
• Access to your record is limited to the practitioners involved in your care and to the administrative staff who book, bill and claim on your behalf.

If a data breach occurs that is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

We keep your health record for at least seven years from the date of your last appointment. If you were under 18 when we last treated you, we keep the record until you turn 25. This is the standard applied to private health records in Queensland, and it exists so that your history is still available if a problem re-emerges years later.

When a record is no longer required we destroy or de-identify it securely.

You have the right to see the information we hold about you and to ask us to correct anything that is wrong, out of date or incomplete.

• Put your request in writing to info@forgewestend.com.au, or ask at reception.
• We will ask you to confirm your identity before releasing anything.
• We aim to respond within 30 days. A reasonable fee may apply to cover the cost of retrieving and copying a large record; we will tell you the amount before we start.
• We may refuse access in the limited circumstances the Privacy Act allows — for example where giving access would pose a serious threat to somebody’s life, health or safety, or would unreasonably affect another person’s privacy. If we refuse, we will tell you why in writing and explain how to complain.

• Forms. Anything you send through the contact form on this site arrives as an email to info@forgewestend.com.au. Please do not use it to send detailed clinical information — email is not a secure channel. Bring it to your appointment or call us instead.
• Analytics. We use Google Analytics to understand how the site is used — which pages people read, on what kind of device, and where they arrived from. This is aggregate and anonymous; it does not identify you and it is never connected to your clinical record. You can opt out with Google’s browser add-on.
• Cookies. Small files stored by your browser that keep the site working correctly. You can block or delete them in your browser settings; some parts of the site may then not work as intended.
• Booking. Appointments and classes are booked through Pogozo, which operates its own privacy policy for the information you enter there.
• Other sites. Where we link to another organisation, this policy stops at our boundary — their handling of your information is governed by their own policy.

If you think we have mishandled your personal or health information, tell us first. Write to info@forgewestend.com.au or call 07 3844 0686 and ask for the practice manager. We will acknowledge your complaint, investigate it and respond in writing, normally within 30 days.

If you are not satisfied with our response, you can take the matter to the Office of the Australian Information Commissioner:

• Online at oaic.gov.au
• By phone on 1300 363 992
• By post to GPO Box 5218, Sydney NSW 2001

Complaints about the conduct of a registered health practitioner can also go to the Office of the Health Ombudsman in Queensland on 133 646.

We review this policy as our practice and our systems change. The current version always sits at this address, with the date it was last updated shown at the top of the page. Material changes will be brought to your attention at your next appointment.

Questions about this policy go to info@forgewestend.com.au or 07 3844 0686, or write to us at Unit 4, 249 Montague Road, West End QLD 4101.