Lovely Allied Health

Policies

Privacy Policy

Last updated:

Lovely Allied Health is a registered business name of M.A.D Healthy Pty Ltd (ABN 14 685 570 923, ACN 685 570 923). We provide mobile physiotherapy and occupational therapy in people's homes across Sydney's Inner West, South East and South West. In this policy, “we”, “us” and “our” mean Lovely Allied Health.

We take the privacy of our clients seriously. We handle personal information, including health information, in line with the Privacy Act 1988 (Cth), the Australian Privacy Principles, and the Health Records and Information Privacy Act 2002 (NSW). This policy explains what we collect, why we collect it, who we share it with, how we protect it, and how you can access it or make a complaint.

1. What information we collect

We only collect information we need to provide and arrange your care. Depending on your situation, this can include:

  • Your details: name, date of birth, address, phone number and email address.
  • Emergency contact: their name, phone number and relationship to you.
  • Health information: the reason for your referral, your medical history, reports from your GP or specialists, support plans, and the assessments, treatment notes and reports our therapists write while working with you.
  • Funding and billing details: how your services are funded (for example through your aged care provider or a self-managed NDIS plan), your aged care provider's details, and where invoices should be sent. We don't record NDIS or Medicare numbers.
  • Home and equipment information: details about your home and needs that are required for equipment and home modification recommendations and applications, such as EnableNSW and Geat2GO submissions.
  • Referrer details: if someone refers you, such as a case manager or aged care broker, their name, organisation, phone number and email address.
  • Messages: what you tell us by phone, text message or email.

Health information is “sensitive information” under the law. We collect it only with your consent, or where the law allows, and only as needed to provide our services.

2. How we collect it

  • From you, when you talk to us, during appointments, and when you call, text or email us.
  • From people acting for you, such as a family member, carer or guardian.
  • From your referrer and care team, such as your GP, specialists, hospital, aged care provider, case manager or support coordinator, with your consent or where the law allows.
  • Through our website: the referral form and the contact form (see section 8).

If someone refers you to us, they must have your consent to share your information. If we receive information about you that we didn't ask for, we'll keep it only if we could have collected it ourselves. Otherwise we'll destroy it securely.

3. Why we use it

  • To assess your needs, plan and provide physiotherapy and occupational therapy, and keep accurate clinical records.
  • To contact you, for example to arrange and confirm appointments.
  • To work with the other people involved in your care, such as your GP, specialists and aged care provider.
  • To arrange funding, invoices and payments, and to prepare equipment or home modification applications.
  • To meet our legal and professional obligations, such as record-keeping, professional registration and insurance.
  • To respond to questions and complaints, and to improve our service.

We never sell your personal information, and we don't use your details for marketing, such as newsletters or promotions.

4. Who we share it with

We only share your information when it's needed for your care, you've agreed, or the law requires or allows it. This may include:

  • Your funding provider, such as your aged care provider or NDIS plan manager, to arrange and claim for your services.
  • Other health professionals involved in your care.
  • Equipment and home modification programs and suppliers, such as EnableNSW and Geat2GO, when we apply for equipment or modifications on your behalf.
  • Service providers who store or process information for us: Microsoft 365 (where we keep client information, clinical notes, email and documents) and Cloudflare (our website host, which also sends contact form and referral form messages to our inbox).
  • Others when the law requires or allows it, for example to lessen a serious threat to someone's life, health or safety, or in response to a court order.

5. Storing information outside Australia

We keep client records in Australia. Some of the service providers we use are based overseas, or handle information outside Australia:

  • Microsoft 365, where we keep client information and clinical notes, stores our data in Australia.
  • Cloudflare (our website host) runs a worldwide network, so website traffic, including contact form and referral form messages on their way to our inbox, may pass through other countries. Our website doesn't store client records or form messages.

We choose established providers that protect information with security measures such as encryption, and we take reasonable steps to make sure they handle it appropriately.

6. Keeping your information safe

  • Client records and clinical notes are kept in our Microsoft 365 cloud system, which stores data in Australia. Only staff who need them for your care can access them.
  • Our Microsoft 365 account, where client records are kept, is protected by multi-factor authentication: signing in needs an authenticator app on a phone as well as a password.
  • Our website uses an encrypted connection (HTTPS), so what you type into our forms is encrypted on its way to our website.
  • How long we keep records: NSW law requires us to keep health records for 7 years after your last appointment or, if you were under 18 when the information was collected, until you turn 25. After that, we destroy or permanently delete them securely and keep a note of what was destroyed and when.

7. Accessing and correcting your information

You can ask to see the information we hold about you, or ask us to correct it, by emailing admin@lovelyalliedhealth.com or calling 0468 410 108. We may ask you to confirm your identity first. We'll respond within 30 days.

There's no charge to make a request, and we don't usually charge for copies of your records. If a charge does apply, for example because a provider or legal entity requires it, we'll tell you before we go ahead, and any charge will be reasonable. In rare cases the law allows us to refuse access, for example if it would pose a serious threat to someone's life or health. If so, we'll explain why in writing.

8. Our website

  • Cookies and tracking: our website uses no cookies, analytics, advertising or tracking tools, and loads nothing from other companies. Fonts and images come from our own website.
  • Website host: Cloudflare, our host, processes basic technical information such as your IP address and browser type, to deliver the website and protect it from attacks.
  • Contact form: your message is sent to our website over an encrypted connection, and our website then emails it to our team through Cloudflare's email service. Our website doesn't keep a copy: the message is kept only in our Microsoft 365 inbox in Australia. If you give your email address, we reply to it directly.
  • Referral form: the referral form is part of our website. Your referral, and any files you attach, are sent to our website over an encrypted connection and then emailed to our team through Cloudflare's email service. Our website doesn't keep a copy: the referral is kept only in our Microsoft 365 inbox and records in Australia. Before sending, our website checks the details and files, for example that each file is a genuine document or image. If our website can't send a referral, it offers to open your own email app with the referral filled in instead.
  • Messages: if you text us, the message is handled by your phone provider and ours. Please don't send detailed medical information by text message or email. Call us instead.
  • Links: our website may link to other websites, which have their own privacy policies.

9. Staying anonymous

You can ask us general questions without giving your name, or using a different name. To provide therapy, though, we need to know who you are.

10. If there's a data breach

If your information is involved in a data breach that is likely to cause you serious harm, we'll tell you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

11. Questions and complaints

If you have a question or concern about your privacy, please contact us first using the details in section 13, and tell us what happened. We'll look into it and reply in writing within 30 days, explaining what we found and anything we'll do to fix it.

If you're not satisfied with our response, you can complain to:

  • Office of the Australian Information Commissioner (OAIC): online at oaic.gov.au, phone 1300 363 992, or write to GPO Box 5288, Sydney NSW 2001.
  • NSW Information and Privacy Commission (IPC), for health information: ipc.nsw.gov.au, freecall 1800 472 679, or email ipcinfo@ipc.nsw.gov.au. Complaints to the IPC should usually be made within 6 months of when you became aware of the problem.

12. Changes to this policy

We may update this policy from time to time. The latest version is always on this page, with the date it was last updated at the top.

13. Contact us

Privacy questions are handled by our admin team.
Email: admin@lovelyalliedhealth.com
Phone: 0468 410 108