Privacy policy

01Information we collect

We collect information reasonably necessary for our physiotherapy services and related business activities. Depending on your interaction with us, this may include:

• Identity and contact: full name, date of birth, address, contact details, preferred contact method and relevant identification information.
• Health information: symptoms, medical history, medications, allergies, injuries, diagnoses, pain and functional assessments, movement and balance findings, clinical notes, referrals, imaging reports, treatment plans, exercises, rehabilitation progress and discharge reports.
• Clinical media: posture or movement photographs, gait and exercise videos, range-of-motion data, strength measures and, with appropriate consent, consultation audio and transcripts.
• Funding and accounts: Medicare and GP care-plan details, NDIS and plan manager information, DVA, ReturnToWorkSA or other work injury claim details, Support at Home or aged-care information, private health insurance and payment records. Full payment-card details are handled by payment providers rather than stored on our website.
• Support and contact persons: next of kin, guardian, authorised representative, carer, support coordinator, provider or facility information, as relevant.
• Enquiries and technical data: information you provide when you contact us, and browser, device and server-log information described in Section 10.

02How information is collected

Where practical, we collect information directly from you through appointments, intake and consent forms, telephone or email communications, enquiries, online bookings and physiotherapy consultations. We may also obtain information from your GP, specialists, referrers, other allied-health professionals, carers, authorised representatives, hospitals, aged-care providers, funders or insurers when appropriate and permitted by law.

If someone provides us with another person's information, they should have an appropriate reason or authority to do so. We give collection notices through relevant booking and intake processes and seek consent where required for health information or particular procedures.

03Why we use your information

We use personal information to assess and treat you; develop and monitor exercise and rehabilitation programs; document clinical care; manage appointment bookings and reminders; communicate with your treating team; coordinate treatment across services; provide reports and referrals; process healthcare funding and invoices; respond to enquiries; meet regulatory, insurance and recordkeeping obligations; and improve service quality and website usability.

We use or disclose sensitive health information for other purposes only with appropriate consent or another lawful basis, including directly related purposes you would reasonably expect or where law requires or permits the handling.

04Who we may share information with

Where relevant and lawfully permitted, we may disclose the minimum appropriate information to your GP, treating specialists, physiotherapists and allied-health practitioners; hospitals; aged-care or disability care providers; authorised carers and representatives; Medicare/Services Australia, DVA, the NDIA or NDIS plan managers; ReturnToWorkSA, work injury claims managers and insurers; and professional advisers or regulators.

We also use third-party systems and service providers for practice management, bookings, communications, clinical documentation, secure technology support, payment processing and website operation. Such providers must handle information in line with their contractual and legal obligations. We do not sell, rent or trade your personal information.

A support worker, family member or funding coordinator does not automatically receive unrestricted access to your clinical record merely because they are involved in your care. We assess consent, authority and other lawful grounds before sharing information.

05Coordination with KMW Podiatry

KMW Physiotherapy and Keep Me Walking Podiatry are related KMW services. If you receive care from both, relevant health information may be shared between appropriately authorised treating practitioners or administrative staff for coordinated care, subject to clinical need, access controls, your reasonable expectations, consent where required, and applicable law.

Using one KMW service does not automatically mean that everyone working in the other service may access your complete health record. Access is limited to legitimate clinical or administrative duties.

06Online bookings and patient forms

Our website links to our online appointment booking service, Cliniko (Red Guava Pty Ltd), including the KMW Cliniko booking portal. The information you enter for bookings and clinical administration becomes part of our patient management records as appropriate. We use Cliniko for patient practice management; its privacy information and our Privacy Officer can provide further details about information handling.

The public website does not contain a patient information or enquiry form. Booking information is entered through the linked booking service. Patient intake and consent processes may use other contracted form providers. Please avoid sending unnecessary detailed medical histories through ordinary email or general enquiries; contact us if you need a more suitable channel. Third-party booking and form services have their own privacy practices.

07AI-assisted clinical notes, letters and audio

With appropriate informed consent, we may use AI-assisted clinical documentation services to record or process consultation audio, create transcripts and prepare drafts of clinical notes, reports, referral letters and other care-related correspondence. We explain the proposed use and any recording before it begins, and document the patient's consent as required.

AI supports clinical documentation; it does not make independent clinical decisions. Your physiotherapist checks and approves clinical records and remains responsible for diagnosis, treatment, exercise prescription and clinical advice. You may ask how these tools handle your information, decline optional AI-assisted recording or transcription, and discuss an alternative way to document your care.

AI and transcription suppliers may process information through third-party systems. Their access, processing locations, recording retention and deletion practices are addressed under our supplier controls and overseas information arrangements. We do not intentionally authorise patient-identifiable information to be used for unrelated advertising or public AI training.

Publication of this policy is not, by itself, consent to recording, transcription or any other optional use of sensitive information. We seek consent relevant to the proposed use and circumstances.

08Clinical images, movement videos and treatment consent

We may collect clinical photographs, videos of movement, posture, walking or exercises, and functional assessment measurements where reasonably necessary for physiotherapy assessment, progress monitoring, rehabilitation planning and clinical records. These materials are treated as health information.

We explain treatment options, expected benefits, material risks and alternatives and seek informed consent. Where particular interventions call for additional consent, such as dry needling or other invasive treatment, we use more specific clinical consent documentation as appropriate. Consent and clinical agreements are maintained with relevant patient records.

We seek separate appropriate permission before using identifiable photographs or videos for education outside the treating team or promotional purposes. Any use must also meet applicable privacy and healthcare advertising requirements. Consent does not authorise advertising that is otherwise prohibited, including prohibited testimonials about clinical care. Declining promotional use does not affect your access to care.

09Virtual receptionists and supervised remote access

We may engage virtual reception personnel to help with calls, appointment bookings, reminders, general enquiries and other administrative tasks. Some authorised personnel may work outside Australia and may remotely view limited information using access-controlled cloud-based systems.

These staff operate under contractual confidentiality and privacy requirements. Access is restricted to the tasks they are authorised to perform. Our remote-access arrangements are designed to restrict unauthorised downloading, local saving, copying and onward sharing of patient records. Where enabled, access may be logged, supervised, monitored or screen-recorded for security and quality assurance.

Monitoring records may themselves contain personal information and are handled under applicable retention and security controls.

Even if clinical records remain hosted on Australian systems, overseas remote viewing may amount to an overseas disclosure under privacy law. Our overseas arrangements and safeguards are explained in Section 11.

10Website technology, logs and linked services

The public pages of this website use scripts to support navigation and contact or booking buttons. They do not currently send visitor analytics events to an analytics provider or include advertising pixels, session-replay tools, embedded booking forms or embedded maps.

Our website host may process ordinary server and security logs, which can include an IP address, browser information, the page requested and the time of a request. These records support website delivery, security and troubleshooting.

The fonts and images used by these public pages are served from this website. The hosting system receives the technical request information needed to deliver those resources, such as your IP address and browser or request information.

Links to Cliniko, Google Maps, KMW Podiatry and other external websites open services with their own privacy and cookie practices. Information you provide after following a link is handled through that service. Cookies or similar technologies may be used by hosting or linked services; you can manage these through your browser and the relevant service's settings.

We review this policy if the website's information-handling features change. Please contact us if you have questions about a particular website feature or provider.

11Overseas access, disclosure and processing

Clinical records are held in our patient practice-management systems. The location of hosting does not by itself determine where information may be accessed or processed. Overseas virtual reception personnel may view relevant patient information remotely for authorised administration.

Communication, AI-related and website resource suppliers may also process limited information in other countries, including the United States or locations in Europe, depending on the provider and service configuration.

Before disclosing personal information overseas, we take steps appropriate to the circumstances to address the Australian Privacy Principles, including provider due diligence, confidentiality contracts, access restrictions and security controls. We review the relevant countries and service arrangements and identify them where practicable. You can contact our Privacy Officer for further details about a particular provider or country.

12Information security

We hold patient information mainly in electronic, access-controlled clinical and administration systems. Where paper records are used, they are stored securely. Safeguards may include account security, role-based permissions, confidentiality requirements, supervised contractor access, restricted sharing, service-provider agreements and secure disposal processes.

We take reasonable steps to protect information against misuse, interference, loss and unauthorised access, modification or disclosure. However, no internet or electronic communication system can be guaranteed completely secure. Please avoid including detailed sensitive health information in ordinary email or general enquiries where a more secure channel is available.

13How long we keep information

We retain clinical records for the periods required by applicable law, professional obligations and legitimate clinical or legal needs. As a general guide, adult clinical records are commonly retained for at least seven years after the last attendance, and records concerning children until at least age 25, but longer periods may apply depending on the circumstances and governing obligations.

Other information, including enquiries, call or access logs, audio files and transcripts, may have different retention periods based on purpose, system configuration and relevant obligations. Once information is no longer required and we are legally permitted to dispose of it, we take reasonable steps to securely destroy or de-identify it.

14Access and correction

You may request access to personal information we hold about you and ask us to correct it if it is inaccurate, incomplete, outdated, irrelevant or misleading. Contact the Privacy Officer using the details below. We may verify your identity or authority before disclosing information.

We aim to respond within a reasonable period, usually within 30 days. There is no charge to make a request. If access requires reasonable retrieval or copying costs, we will explain any proposed charge in advance. Where a lawful exception permits refusal or restricted access, we will explain the decision and your complaint options. If we disagree with a requested correction, you may ask us to associate a statement with the record where applicable.

15Anonymity, consent and representatives

You can make general enquiries anonymously or using a pseudonym where lawful and practical. For clinical treatment, recordkeeping, healthcare referrals and payment claims, we normally need to identify you.

You may decline optional collection or withdraw consent where permitted. This could affect our ability to provide particular care, share information with your treating team or process funding; we will explain the likely consequences where appropriate.

For children, individuals with impaired decision-making capacity or patients supported by an authorised representative, we consider the person's capacity, relevant rights and the legal authority of a parent, guardian or representative before allowing access to records or seeking consent.

16Reminders, communications and marketing

We may contact you by telephone, SMS, email or other agreed channels about bookings, appointment reminders, clinical follow-up, care coordination and accounts. We minimise sensitive information in ordinary SMS and email messages where practical and may recommend a more secure method of communication.

We only send promotional messages in accordance with applicable consent and marketing requirements and provide an option to opt out. You can update communication preferences by contacting us. Opting out of marketing does not stop necessary appointment or treatment-related communications.

17Data breaches

We maintain procedures to identify, contain, investigate and assess suspected privacy or data-security incidents. If a breach is likely to cause serious harm and is notifiable under the Notifiable Data Breaches scheme, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required and provide information about relevant protective steps.

18Privacy complaints

If you are concerned about our handling of personal information, contact the Privacy Officer and describe the concern and what outcome you seek. We will acknowledge your complaint promptly, investigate fairly and aim to respond in writing within 30 days.

If you remain dissatisfied, you may contact the Office of the Australian Information Commissioner (OAIC) on 1300 363 992 or at oaic.gov.au. For complaints about healthcare services or handling of health information in South Australia, you may also contact the Health and Community Services Complaints Commissioner (HCSCC) on 1800 232 007 or at hcscc.sa.gov.au.

19Contact our Privacy Officer

20Changes to this policy

We may update this policy to reflect changes in the law, our services, systems or service providers. The latest policy will be published on the KMW Physiotherapy website with its last-updated date. This policy should be read alongside any relevant patient collection notice, consent form or treatment agreement.

You can contact us for a copy of this policy or ask for it in another accessible format.