Privacy Policy

1. Purpose of this policy

Velocity Physio respects your privacy and is committed to handling your personal information responsibly, securely and transparently.

This Privacy Policy explains how Velocity Physio collects, holds, uses and discloses personal information, including health information, when you:

• visit or use the Velocity Physio website;
• enquire about, book or receive a service;
• take part in telehealth physiotherapy, rehabilitation or performance support;
• join a program or membership, including the Velocity × High Performance Cricket (HPC) Rehab membership;
• communicate with Velocity Physio; or
• otherwise interact with the business.

As a health service provider, Velocity Physio is covered by the Privacy Act 1988 (Cth) regardless of business size. We handle personal information in accordance with that Act, the Australian Privacy Principles (APPs) and our professional obligations as a registered physiotherapist.

This policy should be read alongside any consent form, terms or privacy collection notice provided to you when you book or begin a service.

2. About Velocity Physio

Velocity Physio is operated by Brandon Hughes-Philpott, a registered physiotherapist, as a sole trader.

• ABN: 80 369 286 032
• Email: brandon@velocityphysiotherapy.com
• Location: Dunsborough, Western Australia (online services Australia-wide)

In this policy, “Velocity Physio”, “we”, “us” and “our” refer to Brandon Hughes-Philpott trading as Velocity Physio.

3. What personal information we may collect

The information we collect depends on how you interact with Velocity Physio and which services you use. It may include the following.

Identity and contact information

• Full name, preferred name, title and pronouns
• Date of birth, age, and sex or gender where clinically relevant
• Residential, postal or billing address
• Email address and telephone number
• Emergency contact and parent, guardian or representative details
• Identity information needed to verify an access or correction request

Health and clinical information

Health information is sensitive information under Australian privacy law. We may collect:

• Current symptoms, injuries, diagnoses and presenting concerns
• Medical, surgical and rehabilitation history
• Medications, allergies and relevant health conditions
• Information about pain, function, sleep, wellbeing and general health
• Relevant family, social and occupational history
• Sporting role, training history, workload, performance goals and participation demands
• Clinical observations, assessment findings and physiotherapy impressions
• Exercise programs, rehabilitation plans, treatment recommendations and progress notes
• Referral letters, medical certificates, reports and correspondence from other practitioners
• Medical imaging, investigation results and discharge information supplied to us
• Photographs, videos or movement recordings that you choose or consent to provide
• Information about adverse events, red flags, referrals and clinical outcomes

Administrative and financial information

• Appointment, attendance and cancellation information
• Service, membership and billing history
• Private health insurer, funding body or referral information
• Information needed to prepare an invoice or receipt
• Payment status and transaction details

Most payments are made by bank transfer, so we see the payment details your bank shows us, such as your name and the payment reference. We do not collect or store card details.

Communications and technical information

• Emails, messages, enquiry forms and other correspondence
• Information shared during telephone or video consultations
• Your physical location at the time of a telehealth appointment, where needed for safety
• Technical information such as IP address and browser type, collected by our website host (see section 13)
• Records of consent, preferences and communication choices

Information about other people

If you give us personal information about another person, such as an emergency contact, parent, coach or treating practitioner, you should have their authority to do so and, where appropriate, make them aware of this policy.

4. How we collect personal information

Where reasonable and practicable, we collect personal information directly from you. This may happen when you:

• complete an online intake, consent or screening form;
• make an enquiry, register your interest or make a booking;
• attend a telehealth consultation;
• take part in an assessment or rehabilitation program;
• send an email, message, photograph, video or document;
• make a payment; or
• give feedback or make a complaint.

With your consent, or where otherwise permitted by law, we may also collect information from:

• a parent, guardian, carer or authorised representative;
• your GP, specialist, physiotherapist or other healthcare practitioner;
• a coach, strength and conditioning professional, club or sporting organisation;
• High Performance Cricket, where you are part of a joint Velocity × HPC service;
• a private health insurer, employer, funding body or claims manager;
• a hospital, diagnostic imaging provider or pathology provider; or
• another person or organisation involved in your care, rehabilitation or service administration.

If we receive personal information we did not ask for, we will consider whether we could lawfully have collected it. If we could not, and it is lawful and practicable to do so, we will destroy or de-identify it.

5. Why we collect, hold and use personal information

We may collect, hold and use personal information to:

• respond to enquiries and work out whether a service is suitable for you;
• verify identity and contact details;
• assess, provide and review physiotherapy, rehabilitation and performance services;
• screen for urgent symptoms, medical concerns and telehealth suitability;
• develop, deliver and progress individualised rehabilitation or exercise programs;
• coordinate care with healthcare and performance professionals;
• communicate agreed restrictions, training modifications or return-to-sport information;
• arrange appointments and send reminders;
• maintain accurate clinical and business records;
• prepare reports, referrals, certificates, invoices and receipts;
• process payments and administer memberships;
• help with private health or third-party claims where requested;
• manage safety, quality, complaints and professional risk;
• comply with legal, regulatory, insurance and professional obligations;
• operate, secure and improve our website, systems and services; and
• send service updates or marketing communications where permitted.

We only use sensitive health information for the purpose it was collected for, for a directly related purpose you would reasonably expect, with your consent, or where otherwise permitted or required by law.

6. Consent and choices

We will ask for your consent to collect sensitive information where required. Consent may be express or, where legally appropriate, implied from your actions and the circumstances.

You may decline to provide particular information, or withdraw consent for a future use or disclosure. This may limit our ability to assess you safely, provide a service, communicate with another practitioner, process a claim or continue your care.

Withdrawing consent does not affect information already lawfully collected, used or disclosed, and does not require us to delete clinical records that we must or may lawfully keep.

7. When we may disclose personal information

Velocity Physio does not sell or rent client information.

We may disclose personal information where reasonably necessary to provide or administer services, where you have consented, or where otherwise permitted or required by law. Recipients may include:

• your GP, specialist, local physiotherapist or other treating practitioner;
• your parent, guardian, carer or authorised representative;
• a coach, strength and conditioning professional, club or performance staff member;
• High Performance Cricket, where you are part of a joint Velocity × HPC service;
• private health insurers, funding organisations, employers, claims managers or legal representatives, where relevant and authorised;
• the service providers listed in section 8;
• professional advisers, auditors, insurers or legal representatives;
• regulators, courts, tribunals, law-enforcement agencies or government authorities where required or authorised by law; and
• another health professional or emergency service, where reasonably necessary to lessen or prevent a serious threat to health or safety and permitted by law.

Velocity × HPC Rehab

In the joint membership, physiotherapy is provided by Velocity Physio and strength and conditioning is provided by High Performance Cricket (HPC). We will explain what information we propose to share with HPC and ask for your consent before sharing clinical information. What we share is limited to what HPC reasonably needs to coach you safely, such as participation status, rehabilitation restrictions, training modifications, agreed exercise programming and return-to-sport progress. HPC does not get access to your clinical record.

HPC delivers training programs through its own TeamBuildr account. Information held by HPC, including in TeamBuildr, is managed by HPC.

8. Service providers and cloud-based systems

We use trusted third-party providers to run the practice. They hold or process information on our behalf, only for the purpose of providing their service to us. We choose providers with appropriate security, set up our systems responsibly, and limit access to what each provider needs.

The main systems we currently use are:

If we introduce online card payments in future (for example, for digital resources), they will be processed by a payment provider such as Stripe, and we will update this policy first. We may change providers from time to time and will update this list when we do.

Where you use a provider's service directly, such as booking through Cliniko, messaging us on Instagram or completing a Google Form, that provider's own privacy policy also applies.

9. Overseas disclosure and storage

Your clinical records are held in Cliniko on Australian servers.

Some of the providers listed in section 8 store or process information outside Australia, mainly in the United States. Google and Meta may also process information in other countries where they operate data centres. In particular:

• information you submit in the HPC Rehab expression-of-interest form is stored by Google;
• Instagram messages, and WhatsApp account information, are held by Meta;
• website visit logs are processed by Netlify; and
• some of Cliniko's supporting services, such as email delivery, operate from the United States.

Before disclosing personal information to an overseas recipient, we take reasonable steps to make sure it will be handled consistently with the Australian Privacy Principles, including by choosing established providers with strong security and privacy commitments. We do not send clinical notes overseas.

10. Telehealth, email and messaging

Telehealth and electronic communication carry some privacy and security risks, including misdirected messages, unauthorised access, device loss and interception.

We take reasonable steps to use appropriate systems and working practices, including encrypted messaging with current clients. You can help protect your privacy by:

• using a private location for consultations;
• securing your device, accounts and passwords;
• checking recipient details before sending information;
• avoiding public or unsecured Wi-Fi for sensitive communications where possible;
• not recording a consultation without the agreement of everyone involved; and
• telling us promptly if you think information has been sent to the wrong person or your account has been compromised.

Email and messaging are not suitable for emergencies. In an emergency, call 000. Messages may form part of your clinical record where they contain information relevant to your care.

11. Photographs, videos, recordings and testimonials

Photographs or videos may be collected where relevant to movement assessment, rehabilitation or progress monitoring. When they relate to your care, they are treated as health information.

A telehealth consultation will not be audio- or video-recorded unless this has been explained to you and you have given consent.

We will not use an identifiable client image, story, review, testimonial or case study for advertising, social media, education or promotion without your separate, informed permission. Declining will not affect your care.

Where material is de-identified, we take reasonable steps to reduce the risk that you could be identified from the content or surrounding circumstances.

12. Artificial intelligence and automated decisions

Velocity Physio does not currently use artificial intelligence (AI) tools to record, transcribe or write up consultations, and we do not enter identifiable client information into AI tools. We use AI tools only for general business tasks that do not involve identifiable client information, such as drafting educational content and maintaining this website.

In future, we may introduce an AI-assisted clinical documentation tool (an “AI scribe”) such as Heidi Health to help prepare clinical notes from consultations. Before we do, we will update this policy with the tool's details, including where data is stored and how long audio is kept. We will also ask for your consent before using it in your consultations. If you decline, your care will not be affected. Your physiotherapist will review every AI-assisted note before it becomes part of your record.

No decision about your care, your suitability for a service or your access to a service is made by a computer program. All clinical and business decisions are made by your treating physiotherapist. If this changes, we will update this policy before the change takes effect, explaining the kinds of decisions involved and the information used.

13. Website, cookies and analytics

This website is a simple information site. It:

• does not use analytics, advertising or tracking cookies;
• does not use advertising or social media tracking pixels; and
• does not ask for an account, email address or other personal details to download our free resources.

Some information is still collected by the services that deliver the site:

• Website hosting (Netlify): like all web servers, our host automatically records basic technical information when you visit, such as your IP address, browser type, the pages requested and the time of the request. This is used for security and to keep the site running, not to identify you.
• Online booking (Cliniko): our booking section shows Cliniko's booking system within the page. Information you enter when booking goes directly to Cliniko, which may use cookies needed for the booking process. See Cliniko's privacy policy.
• Expression of interest (Google Forms): the HPC Rehab “register your interest” form is hosted by Google. Information you submit is stored in Google Forms and is subject to Google's Privacy Policy.
• External links: this website links to other sites, such as Instagram, which have their own privacy practices.

If we add analytics or other tracking tools in future, we will update this section first.

14. Direct marketing

We may use your contact details to send relevant service information, educational content or marketing communications where you have consented or where otherwise permitted by law.

You can opt out of marketing at any time by using the unsubscribe link or contacting us. Opting out will not stop necessary communications about appointments, payments, clinical care, safety or changes to a service you use.

We will not use sensitive health information for direct marketing without your consent.

15. Anonymity and pseudonyms

Where lawful and practicable, you may deal with us anonymously or using a pseudonym, for example when making a general enquiry.

It is usually not practicable to provide physiotherapy services anonymously, because we need accurate identifying and health information to provide safe care, keep clinical records, communicate with you and meet our professional obligations.

16. Data quality

We take reasonable steps to make sure the personal information we use or disclose is accurate, up to date, complete and relevant. Please tell us if your contact, health, medication, insurer or other relevant information changes.

17. Storage and security

Personal information is held electronically, mainly in Cliniko. We take reasonable steps to protect it from misuse, interference, loss and unauthorised access, modification or disclosure, including:

• password protection and multi-factor authentication;
• need-to-know access only;
• device security, updates and encryption;
• secure clinical and booking systems, and encrypted messaging with current clients;
• backups and secure document storage;
• confidentiality requirements for contractors and service providers;
• identity checks before releasing information, and secure disposal; and
• processes for responding to suspected privacy or cybersecurity incidents.

No electronic system can be guaranteed to be completely secure. We will respond appropriately if a security incident occurs.

18. Retention and disposal

We keep clinical records for as long as required by law, professional standards and our insurer. As a general guide, we keep records:

• for adults: for at least 7 years after the last service; and
• for people treated under 18: at least until they turn 25.

Records may be kept longer if there is an active complaint, claim or legal requirement. When information is no longer needed and there is no lawful reason to keep it, we securely destroy it or permanently de-identify it.

Finishing treatment or cancelling a membership does not automatically mean your clinical record is deleted.

19. Accessing your personal information

You can ask to access the personal information we hold about you by contacting us (see section 25).

We may ask you to verify your identity and clarify what you are asking for. We will respond within 30 days. Where reasonable and practicable, we will give access in the form you request. We may charge a reasonable cost for providing access, but we will never charge you just for making the request.

Access may be refused or limited where permitted by law, for example where providing it would unreasonably affect another person's privacy or create a serious threat to health or safety. If we refuse access, we will generally give you written reasons and explain how to complain, unless it would be unreasonable or unlawful to do so.

20. Correcting your personal information

You can ask us to correct personal information you believe is inaccurate, out of date, incomplete, irrelevant or misleading.

If we agree that a correction is needed, we will take reasonable steps to make it. If we do not agree, you can ask us to attach a statement to the record noting that you consider it inaccurate.

We will respond within 30 days, and we will not charge you for making a correction request or for correcting the information.

21. Privacy incidents and data breaches

If we become aware of a suspected privacy or data security incident, we will take reasonable steps to contain it, assess what happened and reduce potential harm.

If a data breach is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches scheme.

22. Privacy complaints

If you have a question or concern about how we have handled your personal information, please contact us (see section 25), giving enough detail for us to understand and look into the issue.

We will acknowledge your complaint within 5 business days and aim to give you a full response within 30 days. If a complex matter needs more time, we will keep you informed.

If you are not satisfied with our response, you can contact:

• the Office of the Australian Information Commissioner (OAIC): www.oaic.gov.au, 1300 363 992;
• the Health and Disability Services Complaints Office (HaDSCO), Western Australia: www.hadsco.wa.gov.au; or
• for concerns about a practitioner's professional conduct, the Australian Health Practitioner Regulation Agency (Ahpra): www.ahpra.gov.au.

23. Minors and people requiring assistance

We may collect information about a person under 18 or a person who needs decision-making support.

How consent, access and disclosure are managed depends on the person's age, maturity, capacity, circumstances and applicable law. We may communicate with a parent, guardian, substitute decision-maker or authorised representative where appropriate, while respecting the client's privacy and autonomy.

24. Changes to this policy

We may update this policy to reflect changes to our services, systems, legal obligations or information-handling practices. The current version is always available on this page, with its “Last updated” date. Where appropriate, we may also tell you about significant changes directly.

25. Contact us

For questions, requests or complaints about privacy, please contact:

Velocity Physio
Privacy contact: Brandon Hughes-Philpott
Email: brandon@velocityphysiotherapy.com