Mundaring Physio Pty Ltd Privacy Policy
Who we are and how to contact us
Mundaring Physio Pty Ltd provides allied-health services at Shop 8, 5 Nicol Street, Mundaring WA 6073. Contact our Privacy Officer through reception@mundaringphysio.com.au or telephone (08) 9295 6622. Please do not include unnecessary clinical information in ordinary email.
We handle personal information under the Privacy Act 1988 (Cth), the Australian Privacy Principles, relevant professional standards and other requirements applicable to the service. Health information is sensitive information.
Information we collect
We collect only information reasonably necessary for the relevant service. This can include your identity and contact details, date of birth, authorised-representative information, appointment and attendance details, relevant clinical or treatment information, practitioner referrals, applicable funding or insurance information, and payment or business records.
Information is ordinarily collected directly from you or your authorised representative. With an appropriate basis we may receive necessary information from a referring or treating practitioner, insurer, funding body or another party involved in your care.
Why we use information
We use information to identify and support you safely, provide and coordinate care, administer bookings and attendance, communicate about appointments, manage authorised referrals and payment, maintain records, respond to requests, and satisfy applicable legal, professional, insurance or contractual obligations.
We do not sell patient information or use the check-in service for advertising, profiling, third-party marketing analytics or session replay. Optional marketing communications are managed separately and can be declined.
Optional digital check-in
The Mundaring clinic has its own location-specific QR code, privacy contact and privacy-policy link. A patient, or an authorised parent, guardian or representative, may provide the patient’s surname and date of birth to locate one eligible Mundaring appointment in Cliniko and record arrival. The public application does not show patient, practitioner or appointment details.
Digital check-in is optional. If you do not wish to provide information online, cannot use the form, or are uncertain about capacity or representative authority, ask the Mundaring clinic team for assisted check-in or telephone (08) 9295 6622. Declining digital check-in does not deny you care.
The service creates a short-lived coded identifier derived from the device network address to limit abuse. A restricted attendee identifier prevents duplicate arrivals for approximately 24 hours. Limited operational records include the clinic, time, result, request reference and accepted notice version; they expire under the approved retention schedule, initially 90 days. Automatic deletion can take additional days and disaster-recovery backups may retain expired information temporarily.
The surname and date of birth are used in memory for the request and are not intentionally written to the check-in application’s operational database or ordinary logs. A separate restricted ledger records only monthly clinic totals for service usage and estimated staff-time and wage savings.
Selecting the check-in button after the displayed notice is the affirmative consent to use the supplied information to locate the appointment and record arrival. An authorised representative may act only within their authority. You can decline future optional digital check-in and request assisted check-in instead.
Recipients, hosting and overseas service providers
Information may be handled by authorised Mundaring clinic personnel, treating or referring professionals, authorised representatives, permitted insurers or funding bodies, professional advisers, and contracted practice-management, hosting, communications or payment providers where relevant and appropriately authorised.
Cliniko manages appointment records and Amazon Web Services hosts the check-in application in the Sydney region. These suppliers and their service or support providers may operate in Australia, the United States or the United Kingdom. Before production activation, the privacy owner must approve the vendor and subprocessor assessment, contractual safeguards, effective-control position, breach-notification arrangements and any cross-border disclosure required under Australian Privacy Principle 8.
Information may also be disclosed where required or authorised by Australian law or another applicable Privacy Act exception.
Security and retention
We apply risk-appropriate controls including encryption, secure transport, restricted staff access, multi-factor administrative access, secure supplier configuration, monitoring, staff confidentiality and incident response.
Clinical information is retained according to the approved health-record schedule and applicable professional, legal, insurance and contractual obligations. Short-lived check-in security records, duplicate-prevention records, operational audits, recovery backups and aggregate business reports have separate approved retention periods. Information is securely destroyed or de-identified when no longer required, subject to lawful preservation obligations.
Access and correction
Contact the Privacy Officer to request access to or correction of information. We may verify identity or representative authority and aim to respond within 30 days. We do not charge a fee for requesting or making a correction or for attaching a statement of disagreement where required.
If a lawful exception prevents access or a requested correction is declined, we explain the reasons and complaint options and consider attaching a statement of disagreement to the relevant record.
Privacy complaints
Contact reception@mundaringphysio.com.au, telephone (08) 9295 6622, or ask clinic staff to arrange an accessible or representative-assisted complaint. We aim to acknowledge complaints within five business days and respond within 30 days or explain any extension.
If you remain dissatisfied, contact the Office of the Australian Information Commissioner at https://www.oaic.gov.au/privacy/privacy-complaints or 1300 363 992. NDIS participants may also contact https://www.ndiscommission.gov.au/complaints where relevant.
Review
We review this policy when services, suppliers, legal obligations or privacy risks change. Material changes to digital-check-in collection require an approved notice version matched by the public application and server before check-in continues.