Effective 11 September 2026.
Pivotal Motion Physiotherapy Pty Ltd
ABN 21 155 577 834
Our commitment to your privacy
Pivotal Motion Physiotherapy Pty Ltd (“Pivotal Motion”, “we”, “us”, “our”) provides physiotherapy, exercise science, rehabilitation and related health services from 240 Enoggera Road, Newmarket QLD 4051, and online through telehealth.
Your health information is some of the most personal information you have. We treat it that way. We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles, which apply to us no matter what size our business is, because we provide a health service. Health information is “sensitive information” under the Act, so it has extra protection.
This policy explains what we collect, why, who we share it with, how we keep it safe, and what you can do if you want to see it, correct it, or complain about how we have handled it.
What information we collect
Personal details. Your name, date of birth, address, phone number, email address, emergency contact, occupation and employer where relevant, and your private health fund details, DVA number, NDIS participant number or WorkCover Queensland claim number where these apply to your care.
Health information. Your reason for seeing us, symptoms, injury history, medical history, medications, results of assessments and movement screens, treatment notes, exercise programs, progress notes, referral letters, imaging and specialist reports, and correspondence with your other health practitioners.
Payment information. Records of what you were charged and what you paid, and receipts and invoices. We do not store your card details at the clinic. Card payments are handled directly by our payment providers, Tyro and Commonwealth Bank Smart Health, on their own secure systems.
Information about your visit to our website. See the “Our website” section below and our Cookie Policy.
If you contact us on behalf of someone else, for example as a parent, carer, guardian, case manager or employer, we will also collect your details so we know who we are dealing with and what authority you have.
How we collect your information
We usually collect information directly from you: when you book online or by phone, when you complete a new patient form, during your consultation, when you email or message us, and when you attend a class or a telehealth appointment.
Sometimes we collect information about you from someone else. That happens when:
- a doctor or specialist refers you
- an insurer, employer, WorkCover Queensland, the NDIS or DVA sends us information about a claim or a plan
- a family member or carer books on your behalf
- another treating practitioner sends us reports
Where we collect your information from someone else, we will take reasonable steps to make sure you know we have it and why.
We only collect health information about you with your consent, or where we are otherwise permitted or required by law to collect it.
Software that helps write up your notes. We use software that listens to the conversation during your appointment and produces a draft set of clinical notes, so that your practitioner can concentrate on you rather than on typing. Your practitioner will tell you before it is used and ask whether you are comfortable with it. You can say no, at that appointment or as a standing preference, and it will not affect your care. Our AI page explains this in more detail.
Why we collect it and how we use it
We collect and use your information to:
- assess, diagnose and treat you safely and effectively, and write and update your treatment plan and exercise program
- keep an accurate clinical record, which we are professionally and legally required to do
- contact you about your appointments, including reminders and confirmations
- communicate with your GP, specialist or other treating practitioners about your care, where you have agreed to that
- bill you, process payments, claim on your behalf from your private health fund, DVA, the NDIS or WorkCover Queensland, and meet our reporting obligations to those funders and to regulators
- manage feedback, complaints and incidents
- improve our services, train our team and run internal quality checks
- meet our obligations under the Health Practitioner Regulation National Law, our professional codes and any other law that applies to us
We will not use your health information for a purpose you would not reasonably expect, unless you have agreed to it or the law requires or permits it.
Who we share your information with
We share your information only where it is necessary, and only with:
- Our own team. Treating practitioners and administration staff who need access to your record to do their job. Our registered practitioners are bound by the confidentiality obligations in their professional Code of conduct.
- Other health practitioners involved in your care. Your GP, specialist, surgeon, or another allied health provider, where you have agreed to us communicating with them.
- Funders and insurers. WorkCover Queensland, the National Disability Insurance Agency and NDIS plan managers, the Department of Veterans’ Affairs, and private health funds, where you are being treated under one of those arrangements. These bodies generally require clinical information such as reports, treatment plans and progress updates as a condition of funding your care. If you do not want that information shared, you may not be able to be treated under that funding arrangement. You are welcome to be treated as a private patient instead.
- Your employer or a rehabilitation provider, where you are receiving return to work support and you have agreed to that. We will not send your employer clinical detail beyond what is needed for your return to work plan.
- Our software and service providers. Our practice management system PracSuite, which holds our clinical records and appointment data. Our payment providers Tyro and Commonwealth Bank Smart Health. Our website host, Kinsta. Google, for website analytics. Campaign Monitor, which sends our newsletter to people who have subscribed. Chatbase, which runs the chat assistant on our website. The clinical documentation software described above, Heidi and Lyrebird, where you have agreed to it being used in your appointment. These providers are required to protect your information and to use it only for the purpose we engaged them for.
- Our professional advisers, such as our lawyers, accountants, auditors and insurers, where this is necessary, for example to defend a claim.
- Anyone else you tell us to share it with, such as a family member, carer or advocate, on your written authority.
- Where the law requires or allows it. For example, to comply with a subpoena, court order or statutory notice, to meet a mandatory reporting obligation, to report a notifiable data breach, or to lessen or prevent a serious threat to someone’s life, health or safety where it is unreasonable or impracticable to get consent.
We do not sell your personal information. We do not disclose your health information for marketing.
Sending information overseas
Some of the software we use is delivered over the internet, so it is possible that your information is stored on servers outside Australia. Google Analytics involves disclosure to Google LLC in the United States, and our newsletter service and our website chat assistant may store information in the United States.
Before we disclose your information to an overseas recipient we take reasonable steps to make sure the recipient handles it in a way that is consistent with the Australian Privacy Principles, unless an exception in the Privacy Act applies.
Marketing and electronic messages
We do not use your health information for marketing, and we do not give your details to anyone else for their marketing.
If we send you practice information such as a newsletter, health tips, a class timetable or a service update by email or SMS, we will only do that where you have asked for it or would reasonably expect it. Every such message will identify us and will include a simple way to unsubscribe. If you unsubscribe, we will stop.
We will still send you the messages we need to send you about your own care, such as appointment reminders, booking confirmations, and account or invoice information. Those are not marketing.
You can ask us at any time to stop sending you marketing, by contacting us using the details below.
Keeping your information secure
We take reasonable steps to protect your information from misuse, interference, loss, and unauthorised access, modification or disclosure.
Your clinical records are held in our practice management system, PracSuite, rather than in loose paper files. Card payments are taken through our payment providers, so your card number is not stored on our own systems.
No system is completely secure. If we become aware of a data breach that is likely to result in serious harm to you, we will follow the Notifiable Data Breaches scheme. We will contain the breach, assess it, notify you, and notify the Office of the Australian Information Commissioner as the Privacy Act requires.
How long we keep your information
We keep your health record for as long as we are required to by law, and for as long as it is needed for the purpose we collected it. When information is no longer needed and we are not required to keep it, we destroy it or delete it securely.
Accessing and correcting your information
You have the right to ask for a copy of the personal and health information we hold about you, and you do not have to give a reason. To make a request, contact us using the details below. We may ask you to verify your identity. We will respond within 30 calendar days.
We do not charge you for making a request. If we charge for giving you access, the charge will not be excessive and we will tell you what it is before we proceed.
In limited cases the Privacy Act allows us to refuse access, for example where giving access would pose a serious threat to someone’s life, health or safety, or would unreasonably affect another person’s privacy. If we refuse, we will tell you why in writing and explain how you can complain. Where we can, we will find another way to give you what you need, such as a summary, or releasing the record to another health practitioner.
If you think information we hold about you is wrong, out of date, incomplete or misleading, tell us and we will correct it. Clinical records cannot simply be erased, because they are a record of what happened at the time. Where a clinical note is disputed, we will add a correction or a statement of your view to the record, so that anyone reading it sees both.
Our website
Our website is at pivotalmotion.physio. You can read most of it without giving us any personal information. If you use our online booking or contact forms, the information you enter is sent to us and stored in our systems so we can respond to you.
If you subscribe to our newsletter using the signup form on our website, your details are sent to Campaign Monitor, the email service we use to send it. You can unsubscribe at any time using the link in any newsletter.
Our website has an automated chat assistant, powered by Chatbase. If you use it, what you type is sent to Chatbase so the assistant can reply. It is not a practitioner, so please do not type health details into it.
We use Google Analytics to understand how our website is used. It collects information such as your IP address, approximate location, device and browser type and the pages you view, and we look at it in aggregate rather than to identify you. We share one Google Analytics measurement with our education website, pivotalmotioneducation.physio, so we can see how many readers go on to visit the clinic. We do not use our website to collect health information, and our online booking is handled by PracSuite on its own booking site.
Our website uses cookies and similar technology. What those do, and how you can control them, is explained in our Cookie Policy.
Our website may link to other websites, for example a health fund or a funding body. We are not responsible for the privacy practices of those websites, and we encourage you to read their own privacy policies.
Children and young people
Where a patient is a child, we will normally deal with a parent or guardian, and we will collect and disclose the child’s information accordingly. As young people mature they may become capable of making their own decisions about their health information. Where we assess that a young person has that capacity, we will deal with them directly and will respect their privacy, including in relation to their parents, so far as the law allows.
Automated decision making
Clinical decisions about your care are made by a registered practitioner.
From 10 December 2026, the Privacy Act will require our privacy policy to describe any computer program we use to make, or to substantially and directly help make, a decision that significantly affects your rights or interests. We will update this section before that date. If we use any such program, we will say so here, and we will explain what kinds of information it uses and what kinds of decisions it is involved in.
Anonymity
You can ask us a general question anonymously or under a pseudonym, for example a general enquiry about our services or fees. We cannot provide clinical care anonymously, because we are required to keep an identified clinical record, and because your safety depends on us knowing your history.
Complaints
If you think we have mishandled your personal or health information, please tell us. We would rather hear from you and fix it. Contact us using the details below and set out what happened. We will acknowledge your complaint within 5 business days and give you a written response within 20 business days.
You can go to an external body at any time, and you do not have to come to us first.
Office of the Australian Information Commissioner (OAIC), for privacy concerns.
Website: oaic.gov.au
Phone: 1300 363 992
Office of the Health Ombudsman, for concerns about a health service or about the conduct of a registered health practitioner. In Queensland this is the single entry point for health service complaints, and it refers practitioner conduct matters to the Australian Health Practitioner Regulation Agency where that is appropriate.
Website: oho.qld.gov.au
Phone: 133 646
NDIS Quality and Safeguards Commission, if you receive services from us under the NDIS.
Website: ndiscommission.gov.au
Changes to this policy
We review this policy at least once a year and update it when our systems or services change. The current version is always the one published on this page.
How to contact us
Privacy enquiries, access requests and complaints go to:
Pivotal Motion Physiotherapy Pty Ltd
240 Enoggera Road, Newmarket QLD 4051
Email: admin@pivotalmotion.com.au
Phone: (07) 3352 5116
Website: pivotalmotion.physio
