Who we are

Rouse Hill Chiropractic (“we”, “us”, “our”) is a chiropractic clinic located at Suite 8/40 Panmure Street, Rouse Hill NSW 2155. This policy applies to our website (rousehillchiro.com.au), our clinic booking and patient management system (Cliniko), and any other way we collect personal or health information from you.

We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and — because we hold health information about patients in NSW — the Health Records and Information Privacy Act 2002 (NSW) (HRIP Act). This policy is governed by the laws of New South Wales.

If you have any questions about this policy, contact us:

• Phone: 02 8883 2270
• Address: Suite 8/40 Panmure Street, Rouse Hill NSW 2155
• Website: rousehillchiro.com.au
• Email: reception@rousehillchiro.com.au

What information we collect

Information you give us directly

When you book an appointment, become a patient, or contact us, we may collect:

• Name, date of birth, gender, contact details (phone, email, address)
• Emergency contact details
• Medicare, health fund, and billing/payment details
• Health information relevant to your care — including your presenting complaint, health history, examination findings, chiropractic treatment notes, imaging or reports from other providers, and progress notes
• Front and side posture photographs, taken in-clinic as part of your assessment and used to track your progress objectively over the course of your care

This health information is sensitive information under the Privacy Act and the HRIP Act, and we only collect what's clinically relevant to providing you with safe, appropriate care. Posture photographs are stored securely as part of your clinical file and are not shared, published, or used for any purpose beyond your care unless you separately and explicitly consent to a specific use, such as marketing. Clinical-use consent and marketing-use consent are treated as two separate consents — one is never assumed from the other.

How we collect it

• In person: at consultation, via new patient forms and ongoing clinical notes
• Through Cliniko, our practice management software: used for online bookings, appointment reminders (SMS/email), patient records, and invoicing. When you book online or receive a reminder, that information is processed through Cliniko on our behalf.
• Through our website: if you use a contact form, or through cookies (see below)

We collect information directly from you wherever practical. If we need to collect health information from a third party (for example, a referring GP or specialist), we will only do so with your consent or where otherwise permitted or required by law.

Dealing with us anonymously

Where it's lawful and practicable, you may contact us anonymously or using a pseudonym — for general enquiries, for example. This isn't practical for booking or receiving clinical care, since we need to identify you accurately to provide safe treatment and maintain your health records.

Patients under 18

Where we treat a patient under the age of 18, we collect health information with the consent of a parent or guardian, who may also access or request correction of that patient's records on their behalf. A young person may request access to or correction of their own records where we're satisfied they have the maturity to understand and make that request themselves.

Cookies (website)

If you leave a comment on our website, you may opt in to having your name, email, and website saved in a cookie for convenience on future visits — these last one year. If our site has login functionality, standard login and display-preference cookies apply. Our site may also include embedded content (e.g. videos) from other websites, which behave as if you visited that site directly and may set their own cookies.

Referral platform

We use a separate online referral platform, operated by us, to help manage referrals to the clinic. When you access this platform, we collect your name, phone number, and email address. This information is used to process your referral and get in touch with you about booking an appointment. Once your referral is processed, you'll be redirected to our Cliniko booking page to make an appointment, at which point Cliniko's own data handling (described elsewhere in this policy) applies to any information you provide there.

The referral platform is run by us, not by a third party, and the information collected through it is held and protected under the same security and access standards described in this policy. We don't use this information for any purpose beyond facilitating your referral and booking, and we don't share it beyond what's necessary to do that.

How we use your information

We only use and disclose your information for the purpose we collected it for (providing your chiropractic care), or for a directly related secondary purpose you'd reasonably expect, unless you've consented to another use or an exception applies under the Privacy Act or HRIP Act — for example, a serious threat to someone's life, health, or safety, or where disclosure is required by law.

We use your information to:

• Provide chiropractic assessment, treatment, and ongoing care
• Contact you about appointments, reminders, and follow-up care
• Process payments, Medicare, and health fund claims
• Communicate with other healthcare providers involved in your care, with your consent (e.g. referrals, reports to your GP)
• Meet our legal, regulatory, and insurance obligations
• Improve our website and services, and — where you've opted in — send you clinic news or offers (you can opt out at any time by replying "unsubscribe" to any marketing email or SMS, or by asking our reception team to remove you)

We do not use your health information for marketing without your explicit, separate consent, and we do not use it for any automated decision-making that affects your care.

How consent works

Where this policy refers to your consent — for example, sharing information with your GP, or sending you marketing communications — that consent may be recorded verbally and noted in your file, via a signed form, or via an online booking/consent checkbox through Cliniko. Consent is specific to the purpose it was given for and can be withdrawn at any time by contacting us; withdrawal doesn't affect anything already done in reliance on it.

Keeping your information accurate

We take reasonable steps to ensure the personal and health information we hold is accurate, up to date, and relevant, including asking you to confirm your details at appointments. If you believe any information we hold about you is incorrect, let us know and we'll correct it or note your concern on file.

Who we share your information with

We don't sell or rent your personal information. We may share it with:

• Cliniko (Red Guava Pty Ltd) — our practice management software provider. Legally, we are the “controller” of your information and Cliniko is the “processor” acting on our instructions. Your data is encrypted both in transit and at rest, and Australian-based accounts (including ours) are stored on servers in Australia. A list of Cliniko's own subprocessors is available at cliniko.com/security. If we ever connect a third-party app to Cliniko, we're responsible for reviewing that app's own privacy practices before doing so.
• Other healthcare providers, with your consent (e.g. your GP, a specialist, imaging provider)
• Medicare, health funds, and payment processors, to process claims and payments
• Our website hosting/maintenance provider, to keep the site running
• Regulators or authorities, where required by law (e.g. AHPRA, a court order, or a mandatory reporting obligation)

Any third party we share information with is only given what's necessary for that purpose, and we take reasonable steps to ensure they handle it in a way consistent with this policy.

Overseas storage and disclosure

Your information is stored in Australia through Cliniko. Some of Cliniko's supporting subprocessors (services that help Cliniko operate, such as cloud storage and email delivery) may be located overseas. A full list of these subprocessors and their locations is available at Cliniko's published subprocessor list. Where information may be handled overseas, we take reasonable steps to ensure it's protected consistently with the Australian Privacy Principles.

How long we keep your information

In line with our professional and legal obligations, we retain patient health records for a minimum of 7 years from the date of your last consultation (or, if you were a child when treated, until you turn 25). We may retain records longer where required by law or professional obligations. When records are no longer required, we securely destroy or de-identify them.

Storage and security

Your information is stored securely within Cliniko's encrypted, access-controlled systems, and/or in secure physical files at our clinic. Access is limited to clinic staff who need it to provide your care, and our staff are bound by confidentiality obligations as a condition of their employment. We regularly review our practices to help prevent unauthorised access, loss, or misuse.

If a data breach occurs that's likely to result in serious harm, we'll notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as soon as practicable, in accordance with the Notifiable Data Breaches scheme.

Accessing or correcting your information

You have the right to:

• Request access to the personal and health information we hold about you
• Request a correction if any of it is inaccurate or out of date
• Ask us to transfer a copy of your records (e.g. to a new provider)

To do this, contact us using the details above. We may need to verify your identity first. We aim to respond within 30 days and, in most cases, at no cost — though a reasonable fee may apply for extensive record requests, in line with the HRIP Act.

There may be limited circumstances where we're not required to provide access (for example, where release could pose a serious risk to your health or someone else's, or where it would unreasonably impact another person's privacy). If we refuse a request, we'll explain why in writing and let you know how you can complain about that decision.

If our practice changes ownership or closes

If Rouse Hill Chiropractic is ever sold, merged with another practice, or closes, your patient records will be transferred securely to the new provider responsible for your ongoing care, or otherwise retained and stored in accordance with our legal record-keeping obligations. We'll take reasonable steps to notify current patients if this occurs.

Complaints

If you have a concern about how we've handled your personal information, please contact us first so we can try to resolve it directly. We aim to acknowledge your complaint promptly and respond within 30 days.

If you're not satisfied with our response, you can lodge a complaint with:

• NSW Health Care Complaints Commission (for health service complaints) — hccc.nsw.gov.au
• Office of the Australian Information Commissioner (OAIC) — oaic.gov.au

Changes to this policy

We may update this policy from time to time. The current version will always be available on our website, with the “last updated” date shown above. Where a change is significant, we'll take reasonable steps to bring it to the attention of current patients.