Privacy Policy

ProHealth Rx (including ProPilates)

Last updated: 7 September 2026

1. About this policy

ProHealth Rx is a multidisciplinary allied health clinic providing exercise physiology and occupational therapy services. ProPilates is our Reformer Pilates studio and is a division of ProHealth Rx. In this policy, “we”, “us” and “our” means ProHealth Rx and ProPilates.

Your privacy matters to us. As a health service provider we hold information about you that is personal, and in many cases sensitive. This policy explains what we collect, why we collect it, who we share it with, how we keep it safe, and what you can do if you have a concern.

This policy applies to everyone we hold information about, including clients, participants, studio members, carers and representatives, referrers, job applicants and visitors to our website.

2. The law we work under

We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Health service providers are covered by the Privacy Act regardless of business size, so these obligations apply to us in full.

We also comply with the Spam Act 2003 (Cth) and the Do Not Call Register Act 2006 (Cth) when we send you electronic messages or make marketing calls, and with our professional obligations under AHPRA and ESSA codes of conduct.

3. What information we collect

Personal information

• your name, date of birth, gender and preferred pronouns
• your contact details, including email address, mobile number, home and work phone numbers and postal address
• emergency contact details, and the details of any carer, guardian, nominee or support person you tell us about
• your occupation, employer and living situation where it is relevant to your care

Health and other sensitive information

• your medical history, diagnoses, medications, allergies and current symptoms
• referral letters, imaging, pathology and specialist reports
• assessment results, measurements, exercise programs, treatment notes and progress reviews
• correspondence with your GP, specialists and other treating practitioners
• information about your disability, support needs and goals
• where relevant to your care, information about your cultural background, family or relationship circumstances

Payment and funding information

• Medicare number, DVA number, private health fund and membership details
• NDIS number, plan dates, plan management arrangements and the contact details of your plan manager or support coordinator
• workers’ compensation, CTP or insurance claim details, and your employer or case manager’s contact details
• bank or card details for payments, and your billing and payment history

Website and technical information

When you visit our website we collect your IP address, browser and device type, the pages you visit, and how you arrived at our site. We collect this through cookies and analytics tools. See section 13 for more.

4. How we collect your information

Wherever it is reasonable and practical, we collect information directly from you. That happens when you complete intake or consent forms, attend appointments, speak with our admin team, book online, complete a survey, or contact us by phone, email, our website enquiry form or social media.

We also collect information from other people where you have consented or where the law allows it, including:

• your referring GP, specialist or other treating health professionals
• your carer, guardian, nominee, support coordinator or plan manager
• Medicare, the NDIA, DVA, your private health fund or your insurer
• your employer or their workers’ compensation insurer, where you have an active claim
• My Health Record, where you have one and have consented to us accessing it

If we receive information about you that we did not ask for and do not need, we will destroy or de-identify it where the law allows

5. Why we collect, hold and use your information

We collect and use your information to:

• assess your needs and provide safe, appropriate and effective care
• develop, deliver and review your exercise programs, therapy plans and support plans
• communicate with you about your appointments and your care
• coordinate your care with your GP, specialists and other treating practitioners
• write reports and progress updates for your referrer, funding body or insurer
• bill for our services and claim from Medicare, the NDIA, DVA, your health fund or your insurer
• manage your account, including invoices, receipts and payment reminders
• run our clinic and studio safely, including class bookings, waitlists and incident management
• meet our legal, professional, accreditation and insurance obligations
• improve our services, including through quality reviews, staff training and supervision, and de-identified reporting
• respond to your feedback, questions and complaints

We will only use your information for the purpose we collected it, a directly related purpose you would reasonably expect, a purpose you have consented to, or where the law requires or authorises it.

6. How we contact you

About your care and your account

You agree that we may contact you by email, SMS, phone call or post about matters relating to your care and your account. This includes appointment confirmations, reminders, changes and cancellations, waitlist and rescheduling offers, forms and consent documents, exercise programs, reports and results, recalls and progress follow-ups, invoices, receipts, payment reminders, funding and plan expiry notices, and important clinic notices such as a change of practitioner, opening hours, location or services.

These messages are part of delivering your care and managing your account, so we will send them while you are a client or member.

Clinic updates and educational information

We would also like to send you occasional emails or SMS with clinic news, health and exercise education, new services, group programs and events. This is optional, and we will only send it if you have opted in.

You can opt out at any time by using the unsubscribe link in any email, replying STOP to an SMS, or contacting our admin team. We will action your request promptly. Opting out will not affect your care, and we will still send you the appointment and account messages described above.

We will never sell or rent your contact details to anyone.

A note on email and SMS

Email and SMS are convenient but they are not completely secure. If you would prefer we did not use a particular method, or would prefer we did not leave voicemail messages or discuss your care with anyone who answers your phone, please tell our admin team and we will record your preference.

7. Who we disclose your information to

We only share your information where it is necessary for your care, where you have consented, or where the law requires or authorises it. We may disclose your information to:

1. practitioners and staff within ProHealth Rx and ProPilates who are involved in your care or in administering your account
2. your referring GP, specialist or other treating health professionals, so your care is coordinated
3. your carer, guardian, nominee or support person, where you have nominated them or where you are not able to make decisions for yourself
4. funding bodies and their representatives, including Medicare, the NDIA, your plan manager or support coordinator, DVA, your private health fund, your insurer, or your employer’s workers’ compensation insurer, for claiming, reporting and plan reviews
5. our service providers, including our practice management software, appointment reminder and communication systems, email and file storage providers, payment processors, accountants, auditors and IT support. We require these providers to protect your information and to only use it for the purpose we engaged them for.
6. our professional indemnity insurer and legal advisers, where necessary
7. any person or body where we are required or authorised by law to disclose, including under mandatory reporting obligations, a subpoena or court order, or a request from a regulator such as AHPRA or the NDIS Quality and Safeguards Commission
8. any person where we reasonably believe disclosure is necessary to lessen or prevent a serious threat to your life, health or safety, or to the life, health or safety of another person

We do not disclose your information to anyone else without your consent.

8. Overseas disclosure

Some of the software and cloud services we use may store or process information on servers located outside Australia, or may be operated by companies based overseas. Where that is the case, the countries involved are likely to be [insert countries — for example, the United States].

Before we use an overseas provider we take reasonable steps to satisfy ourselves that they handle personal information in a way that is consistent with the Australian Privacy Principles.

If you would like to know which of our providers store information overseas, please contact us and we will tell you.

9. How we use artificial intelligence

We use artificial intelligence (AI) tools in parts of our clinic and studio. We think you should know where we use them, what they do, and what we do to keep your information safe.

Clinical documentation

With your consent, we use an AI scribe. It listens to your appointment and drafts a summary into your clinical record so your practitioner can spend more time with you and less time typing.

• We will ask for your consent at the start of every appointment where we intend to use it.
• You can decline, or ask us to turn it off at any point during your appointment. This will not affect your care in any way, and your practitioner will simply write the notes themselves.
• Your practitioner reviews and edits every note before it is saved. Your practitioner, not the software, is responsible for what goes into your record.

Reports, letters and summaries

We may use AI to help draft reports, referral letters, progress summaries and correspondence. A practitioner reviews and approves every document before it is sent to you, your referrer or your funding body.

Administration, billing and accounts

We use AI to help with appointment scheduling and reminders, invoicing, payment follow-up and general administration.

A staff member reviews and approves decisions about your account, including any decision to place an account on hold or to refer an overdue account to a debt collection agency. These decisions are not made by software on its own.

Enquiries and online chat

Where we use automated chat or automated replies on our website or social media, we will make it clear that you are talking to an automated system and not a person. You can ask to speak with a member of our team at any time.

How we protect your information when we use AI

• We only use AI tools that we have assessed as having appropriate security and privacy terms.
• We do not enter your personal or health information into publicly available or consumer generative AI tools.
• We require our AI providers not to use your information to train their models.
• Our staff are trained on how these tools may and may not be used.
• A person always reviews the output. No AI tool makes a decision about your care, your eligibility for services or your account without a member of our team involved.
• Some AI providers may store or process information outside Australia. See section 8.

Automated decision-making

We do not use computer programs to make decisions about your care, your eligibility for our services or your account without a person reviewing and approving that decision.

10. How we store and protect your information

Your information is held in our practice management system and in secure electronic files. Any paper records we hold are kept in locked storage at our clinic.

We protect your information by:

• limiting access to staff who need it to do their job
• using individual staff logins, strong passwords and multi-factor authentication
• requiring all staff and contractors to sign confidentiality agreements and complete privacy training
• using encrypted and reputable software providers, and keeping systems and devices up to date
• securing our premises, and locking away or securely destroying paper records
• reviewing who has access when a staff member’s role changes or they leave

No system is completely secure, but we take these steps seriously and review them regularly.

11. Data breaches

If we experience a data breach that is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988 (Cth). We have a data breach response plan and will act on any suspected breach promptly.

12. How long we keep your information

We keep your health records for at least seven years from the date of your last appointment. Where you were under 18 when we last saw you, we keep your records until you turn 25.

We may keep records for longer where we are required to by law, where a claim or complaint is on foot or reasonably foreseeable, or where the information is still needed for a purpose set out in this policy.

When we no longer need your information, we destroy or de-identify it securely.

13. Our website and cookies

Our website uses cookies and similar technologies. Cookies are small files stored on your device that help the site work properly and help us understand how it is used.

We use:

• essential cookies, which are needed for the site to function, such as remembering your form entries and keeping the site secure
• analytics cookies, which tell us how people find and use our site so we can improve it
• advertising cookies, which help us show relevant ads and measure how our ads perform

You can control or delete cookies through your browser settings. If you block cookies, some parts of our site may not work as well.

If you complete an enquiry or booking form on our website, we collect the details you provide so we can respond to you and, where relevant, set you up as a client.

Our website may contain links to other websites. We are not responsible for the privacy practices of those sites, and we encourage you to read their privacy policies.

14. Anonymity

You can ask us general questions about our services without giving us your name. However, we cannot provide clinical services anonymously or under a pseudonym. We need to identify you correctly to keep you safe, to keep accurate records, and to claim from Medicare, the NDIA, DVA and insurers.

15. Children and young people

We provide services to people aged 12 and over. Where a client is under 18, we generally collect information from and communicate with a parent or guardian, while still involving the young person in decisions about their care in a way that suits their age and understanding.

Where a young person is assessed as able to make their own decisions about their health care, we will respect their privacy accordingly.

16. Accessing and correcting your information

You have the right to ask for a copy of the personal and health information we hold about you, and to ask us to correct it if it is wrong, out of date or incomplete.

To make a request, contact our admin team using the details in section 18. We may ask you to put your request in writing and to confirm your identity.

We will respond within 30 days. In most cases we will give you access in the way you have asked for. There are limited situations where we may not be able to give you full access, for example where doing so would pose a serious threat to someone’s life, health or safety, or would unreasonably affect another person’s privacy. If we refuse, we will tell you why in writing and explain how you can complain.

There is no charge to make a request. We may charge a reasonable fee to cover the cost of retrieving and copying records, and we will tell you the amount before we proceed.

You can also update your contact details and your communication preferences at any time by contacting us.

17. Complaints

If you have a concern about how we have handled your personal information, please tell us first so we can put it right. Contact our Privacy Officer using the details below.

We will acknowledge your complaint within [insert number, for example 5] business days and aim to resolve it within 30 days. We will tell you the outcome in writing.

If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner:

• Phone: 1300 363 992
• Website: oaic.gov.au
• Post: GPO Box 5218, Sydney NSW 2001

If your concern relates to NDIS supports, you can also contact the NDIS Quality and Safeguards Commission on 1800 035 544 or at ndiscommission.gov.au.

18. Contact us

Privacy Officer, ProHealth Rx

• Phone: 0491 081 202
• Email: admin@prohealthrx.com.au
• Address: Cnr Klingner and Ashmole Roads, Redcliffe QLD 4020
• Website: prohealthrx.com.au

19. Changes to this policy

We review this policy regularly and may update it from time to time. The current version is always available on our website, and we will show the date it was last updated at the top of the page. If we make a significant change, we will let our clients know.

You can also ask us for a copy of this policy in another format, free of charge.