Inspire Clinic · Rockhampton, Queensland

Privacy Policy

How Inspire Clinic collects, uses, holds, discloses and protects your personal and health information, in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles, and our professional obligations as a registered physiotherapist under the Health Practitioner Regulation National Law and the standards of the Physiotherapy Board of Australia.

Effective date: 31 August 2026  ·  Version: 1.8  ·  Next review: June 2027  ·  Supersedes: v1.7

1. About this Policy

This Privacy Policy applies to all personal information collected and held by Inspire Clinic, however it is collected — through our website (inspireclinic.au), by telephone, email, online booking, referral, SMS, or in person at our clinic premises.

We review and update this Policy periodically to reflect changes in our practices and in the law. The current version is always available on our website. Where a change is significant, we will take reasonable steps to notify affected individuals. Your continued use of our services or website following any update constitutes acceptance of the revised Policy.

"Personal information" means information or an opinion about an identified individual, or an individual who is reasonably identifiable. "Health information" and "sensitive information" are categories of personal information that attract additional protections under the Privacy Act.

2. Who we are

In this Policy, "Inspire Clinic", "we", "us" and "our" refer to the legal entity that operates the clinic:

3. What personal information we collect

The personal information we collect depends on your relationship with us. We only collect information that is reasonably necessary for, or directly related to, the services we provide.

3.1 Patient and clinical information

When you register as a patient or attend for assessment or treatment, we may collect:

• Full name, date of birth, gender, and contact details (residential address, phone, email);
• Medicare number, DVA file number, private health fund details, NDIS participant number and plan information, and concession or pension details;
• GP, specialist and other referrer details, and referral correspondence;
• Relevant medical and health history, presenting condition, diagnosis, medications, allergies and relevant investigation or test results;
• Clinical assessment findings, treatment notes, outcome measures, exercise records and progress over your episode of care;
• Next-of-kin or emergency contact details, and details of carers or substitute decision-makers where relevant;
• Payment, billing and claim information.

3.2 Website and enquiry information

When you use our website or contact us, we may collect:

• Your name, email address and phone number submitted via our contact, registration or booking forms;
• The nature of your enquiry and the service you are interested in;
• Responses you enter into self-assessment tools made available on our Resources page (for example, a sleep-apnoea screening questionnaire);
• Technical information such as your IP address, device and browser type, and the pages you visit, collected automatically through cookies, analytics and spam-protection tools (see clause 14).

3.3 Sensitive information

Health information is "sensitive information" under the Privacy Act and receives the highest level of protection. We collect health information only where it is reasonably necessary for the provision of physiotherapy and rehabilitation services, or where you have given consent, or as otherwise required or authorised by law. We do not collect sensitive information about your racial or ethnic origin, religion, sexual orientation or similar matters unless it is directly relevant to your care and you have consented.

4. How we collect personal information

Wherever it is reasonable and practicable, we collect personal information directly from you — for example when you complete our registration or contact forms, book online, or speak with us in person or by phone.

We may also collect personal information about you from third parties, including:

• Your GP, specialist or other referring or treating health professional;
• Radiology and pathology providers, where you have consented to us requesting reports of your prior imaging and tests;
• Medicare, the Department of Veterans' Affairs, the NDIS (NDIA), WorkCover Queensland, your private health insurer, My Aged Care or your aged-care coordinator;
• Our clinical practice-management and online-booking provider;
• A parent, guardian, carer or substitute decision-maker acting on your behalf;
• Automatically, when you interact with our website.

If we collect personal information about you from a third party, we will, where required, take reasonable steps to make you aware of the collection and the matters set out in this Policy. If you provide us with personal information about another person (such as an emergency contact), you must ensure you are entitled to do so and that they are aware of this Policy.

5. Why we collect and use personal information

We collect, hold and use personal information for the following primary purposes:

• Providing safe, effective and appropriate physiotherapy and rehabilitation services;
• Scheduling, confirming, reminding you of and managing your appointments;
• Communicating with your GP, specialists and care team as part of collaborative, coordinated care;
• Processing payments and managing Medicare, DVA, NDIS (self-managed and plan-managed), WorkCover Queensland, aged-care and private health-fund claims;
• Creating and maintaining accurate, complete and contemporaneous health records as required by law and professional standards;
• Conducting quality improvement, clinical audit, risk management and service-evaluation activities (using de-identified information wherever practicable);
• Meeting our obligations under applicable legislation and the standards of the Physiotherapy Board of Australia and Ahpra;
• Responding to your enquiries, feedback or complaints;
• Sending appointment reminders, service updates and relevant health information (see clause 7).

We will not use or disclose your personal information for a secondary purpose unless you would reasonably expect it, you have consented, or the use or disclosure is required or authorised by law.

6. AI-assisted consultation notes (i-scribe)

With your consent, your clinician may use i-scribe, an AI ambient documentation tool provided by Akuru Pty Ltd, during your consultation. It listens and produces a written transcription which your clinician reviews and edits before anything is added to your record. It assists with documentation only and does not make clinical decisions.

• Consent first. We ask when you register, and your clinician will confirm before starting. Using i-scribe is optional.
• No audio is retained. Recordings are not stored; text transcriptions are encrypted and held in Australia.
• Withdrawal. You may decline, or withdraw your consent at any time and for any future appointment, and your care will not be affected.

Where you do not consent, your clinician documents the consultation in the usual way.

7. Direct marketing and communications

From time to time we may contact you with appointment reminders, recall notices, service updates, or health information we consider relevant to your care. These communications are a normal part of providing physiotherapy services. We do not sell or rent your information to third parties for marketing purposes. Any non-clinical or promotional communication will include a simple means of opting out, and you may ask us at any time to stop sending it by contacting reception@inspireclinic.au.

8. Disclosure of personal information

8.1 With your consent — your care team

We share relevant clinical information with other health professionals involved in your care — such as your GP, respiratory physician, cardiologist, surgeon or other treating practitioners — with your consent, unless disclosure is otherwise required or permitted by law.

8.2 Service providers

We engage trusted third parties to help us deliver our services. These may include:

• Our cloud-based clinical practice-management and online-booking provider;
• Medicare, DVA and private health insurers, for billing and claims;
• Registered plan managers, for plan-managed NDIS billing, and the NDIS Quality and Safeguards Commission where a report is required of us. We are not a registered NDIS provider and do not bill the NDIA directly;
• WorkCover Queensland, for approved workplace-injury claims;
• My Aged Care, and aged-care providers or care partners, for Support at Home coordination;
• Our website host, analytics provider and embedded map provider;
• IT, data-storage, payment-processing and professional advisers (including our accountant and, where necessary, our legal and insurance advisers).

We require our service providers to handle personal information consistently with applicable privacy laws and to use it only for the purposes for which we engage them.

8.3 Disclosures required or authorised by law

We may disclose personal information where required or authorised by law — for example, to Ahpra or the Physiotherapy Board, to Medicare or other funders for audit, to a court, tribunal or coroner under subpoena or order, to satisfy mandatory-reporting obligations, or where disclosure is necessary to lessen or prevent a serious threat to the life, health or safety of any individual or to public health or safety.

9. Where your information goes, and sending information overseas

Some of our service providers may store or process data on servers located outside Australia. Where we disclose your personal information to an overseas recipient, we take reasonable steps to ensure the recipient handles it in a manner consistent with the Australian Privacy Principles. The providers most relevant to your information are set out below.

• Our own server (Cloudflare Workers). Every form on our website is submitted to a server we operate ourselves on Cloudflare Workers. Nothing is sent from your browser directly to any third party. The server validates your submission and then passes it on as described below; it does not retain your submission as a record once it has done so. Requests may be processed at Cloudflare locations outside Australia in the ordinary course of routing traffic. Our forms are protected by Cloudflare Turnstile (see clause 14).
• Registration form — written directly into Nookal. Your clinical and patient records are stored in Nookal, our practice-management system. When you complete our online registration form, our server writes your details directly into your Nookal client record through Nookal's secure application programming interface (API); they are not re-keyed from an email and are not stored on our website server. Nookal holds Australian clients' data on Australian-based cloud servers in order to strictly adhere to the Australian Privacy Principles and local health regulations, and advises that it also complies with HIPAA, the GDPR and other relevant data-protection standards.
• Contact and screening forms — email delivery (Resend). These are delivered to the clinic by Resend, an email-delivery service, so that reception can respond. For forms you complete in full, a copy of the completed form is attached as a PDF. Resend does not store your submission as a record: the contents pass through as an email and are then held within our own clinic email and practice-management systems. Resend may process the message on servers located outside Australia. A second form-handling service (Web3Forms) was previously used as a standby delivery path. It was removed from our website in July 2026 and the account was closed in August 2026; it holds no information from us. An earlier registration form hosted by SnapForms was retired when the current website replaced the previous one. Submissions made through it were transferred into our clinical records in Nookal, the account has been deleted, and the form no longer accepts submissions.

We do not routinely send your health records overseas in the ordinary course of providing care.

10. Storage and security

Clinical records are created and maintained in a secure, cloud-based clinical-management system, and are stored and transmitted using industry-standard encryption. Any paper records are held securely at our clinic premises.

We take reasonable physical, technical and administrative steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure — including access controls, staff confidentiality obligations, secure passwords and regular review of our systems. Only authorised clinicians and administrative staff who require access to perform their duties may access patient records.

11. Data breaches

We maintain a data-breach response plan. If we become aware of unauthorised access to, or disclosure or loss of, personal information that is likely to result in serious harm, we will respond in accordance with the Notifiable Data Breaches scheme under the Privacy Act — including, where required, notifying affected individuals and the Office of the Australian Information Commissioner (OAIC) as soon as practicable.

12. Retention and destruction of records

We retain health records in accordance with our legal and professional obligations. As a general rule:

• Records of adult patients are retained for a minimum of seven years from the date of the last service;
• Records for patients who were under 18 at the time of treatment are retained until the patient turns 25.

When personal information is no longer required and we are not required by law to retain it, we take reasonable steps to destroy it securely or to permanently de-identify it.

13. Accessing and correcting your information

13.1 Access

You have the right to request access to the personal information we hold about you. To make a request, please contact us at reception@inspireclinic.au. We will respond within a reasonable period (generally within 30 days) and will verify your identity before releasing information. We may charge a reasonable fee to cover the cost of locating and providing access (for example, copying costs). In limited circumstances permitted by law we may decline access — for example where providing it would pose a serious threat to the life, health or safety of any person — in which case we will explain our reasons and any avenues available to you.

13.2 Correction

If you believe information we hold about you is inaccurate, incomplete, out of date, irrelevant or misleading, please contact us and we will take reasonable steps to correct it. Where we disagree that a correction is warranted, you may ask us to attach a statement noting your view.

14. Cookies, website analytics and spam protection

Our website uses cookies and similar technologies to make the site work, to remember your preferences and to understand how visitors use our site. We use Google Analytics 4, a service provided by Google, which sets cookies and collects information such as your device and browser type and the pages you visit, so we can measure and improve the website. Google Analytics 4 does not log or store IP addresses. An IP address is used momentarily to derive an approximate, city-level location and is then discarded; this is how the product works, and it is not a setting we configure or can switch off. Our online forms are also protected by Cloudflare Turnstile, a service provided by Cloudflare, Inc., which collects your IP address, device and browser information and interaction data in order to distinguish real people from automated abuse. In most cases it runs invisibly and asks you to do nothing. Cloudflare already operates the servers that host and deliver this website, so no additional organisation receives your information; Cloudflare may process it outside Australia in accordance with its own privacy policy, and it is used only to protect the forms and never to identify you as a patient. Turnstile replaced hCaptcha (Intuition Machines, Inc.) on 31 August 2026, and hCaptcha no longer receives information from our forms. This analytics data is aggregated and de-identified wherever practicable and is not used to identify you individually. Google processes this information in accordance with its own privacy policy; you can opt out using the Google Analytics Opt-out Browser Add-on. You can also configure your browser to refuse cookies, but some features of the website may not function correctly if you do.

Our website embeds a third-party map for showing our clinic location. That provider may collect information in accordance with its own privacy policy. Links to external websites are governed by those sites' own privacy policies (see our Terms and Conditions).

15. Children and young people

We provide services to children and young people with the consent of a parent or guardian. Personal and health information for patients under 18 is collected and held in accordance with this Policy. A parent or guardian may generally access their child's records, subject to the child's right to privacy and the clinician's assessment of the young person's maturity and best interests.

16. Privacy complaints

This clause deals with concerns about how we have handled your personal or health information. If your concern is about your care, your treatment, or the conduct of a member of our team, please see Concerns and complaints about your care, which sets out a separate process.

Tell us first. If you believe we have breached your privacy or mishandled your personal information, please contact our Privacy Officer at reception@inspireclinic.au or on 0402 166 415. You do not need to put it in writing, though it helps if you can.

What we will do. We will acknowledge your complaint within 5 business days, investigate it, and give you a written response within 30 days. If we need longer, we will tell you why and agree a timeframe with you. We will explain what we found, what we have done about it, and what you can do if you remain dissatisfied.

If you are not satisfied. You may refer your complaint to the Office of the Australian Information Commissioner, the independent national regulator for privacy:

The OAIC will usually ask that you have raised the matter with us first and allowed us up to 30 days to respond. You may contact the OAIC at any time for advice.

Making a complaint will not affect your care. You are welcome to have a family member, carer, advocate or interpreter assist you at any stage.

17. Contacting our Privacy Officer

For any privacy-related enquiry, access or correction request, or complaint, please contact:

18. Changes to this Policy

We may update this Policy from time to time. The current version is always available at inspireclinic.au, and shows its version number and effective date. Where a change is significant — for example, a change to who we share your information with — we will take reasonable steps to notify you, and where the change affects information we hold with your consent, we will seek your consent again rather than rely on the update alone.