Effective 14 September 2026
Nordic Physio (“we”, “us”, “our”) is a physiotherapy practice in Gladstone, Queensland. We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Because we provide a health service and hold health information, the Privacy Act applies to us regardless of our size.
This policy explains what information we collect, why we collect it, who we share it with, how we look after it, and how you can access it, correct it or complain. It applies to everything we do — in the clinic, over the phone, on our website, and through our online booking and patient forms.
1. The information we collect
Personal information
Your name and preferred name, date of birth, gender, address, phone numbers, email address, occupation and employer, emergency contact or next of kin, and how you heard about us.
Health information
Health information is sensitive information under the Privacy Act and attracts extra protection. For us it includes your reason for attending, symptoms and history, relevant medical conditions, medications and allergies, past injuries and surgery, assessment findings, treatment notes, correspondence with your doctor or specialist, imaging and test results you give us, and your progress over time.
Photographs and video
Sometimes a photograph or short video helps with your treatment — a posture or movement screen, a record of swelling or a wound, or a recording of an exercise so you can copy it at home. A photograph or video of you is health information and we treat it exactly like the rest of your record.
We will always ask you first and explain what it is for, and you can say no without it affecting your care. We will not use an image of you for teaching, training, our website or social media unless you have separately and specifically agreed to that use in writing — your consent to treatment is not consent to publish.
Funding and payment information
Your Medicare number, DVA number and card type, NDIS participant number and plan dates, private health fund and membership number, WorkCover Queensland or CTP claim details, and your account and invoice history with us.
Medicare, DVA and NDIS numbers are government related identifiers. We collect them only because we need them to claim for your treatment, and we use and disclose them only for that purpose or where the law requires it. We do not use a government identifier as our own reference for you — your record in our system has its own patient number.
Card details
Where you choose to keep a card on file with us, the card is entered directly into a secure form provided by our payment processor, Stripe. Stripe holds the card. We never see or store your full card number — our system shows only the card type and its last four digits, along with a secure token that lets us process a charge you have authorised.
Website information
When you visit nordicphysio.com.au we collect standard analytics data through Google Analytics — pages visited, approximate location, device and browser type, and how you arrived at the site. This is used to understand how the site is used. You can block it through your browser settings or an ad blocker without affecting your ability to use the site or book with us.
2. How we collect it
Wherever it is reasonable and practicable, we collect information directly from you — on our new patient form, when you book online, at reception, or during your appointment.
Sometimes we collect information about you from someone else: a referral or report from your GP or specialist, correspondence from an insurer, an employer or a plan manager, or details from a parent, guardian or carer. If we receive information about you from a third party and you would not reasonably expect it, we will tell you that we have it and why, unless doing so would be unlawful or unreasonable.
If we receive information about you that we did not ask for and could not have collected ourselves, we destroy it or de-identify it, unless it forms part of a record we are required by law to keep.
Children, and people who need help deciding
Where we treat a child, we normally take consent from a parent or guardian, and their information is held and protected in exactly the same way as an adult’s. As a young person matures we take their own views into account, and an older teenager who clearly understands what is proposed can consent for themselves. Where someone has a guardian, attorney or substitute decision-maker, we deal with that person on the same footing.
A parent or guardian can normally see their child’s record, but not always — where a young person has given information in confidence, or where release would not be in their interests, we may decline, and we will explain why. If you are supporting someone else, tell us and we will record the authority on their file.
3. Why we collect it, and your consent
We collect your information so that we can:
- assess, diagnose and treat you safely, and keep an accurate clinical record;
- communicate with you about your appointments and your care;
- write to, and receive reports from, your doctor, specialist or other treating practitioners;
- bill you and claim from whoever funds your treatment;
- meet our legal, professional and insurance obligations; and
- run and improve the practice.
Because health information is sensitive information, we collect it with your consent. You give that consent on our new patient form. You can withdraw it at any time, though we may not be able to continue treating you if we cannot hold the information we need to treat you safely.
Dealing with us anonymously
You have the right to deal with us anonymously or under a pseudonym where it is lawful and practicable. In practice this is rarely workable for physiotherapy treatment — we cannot treat you safely without a health history, and we cannot claim from Medicare, DVA, NDIS or a health fund without your identity — but you are welcome to make a general enquiry without identifying yourself.
4. Who we share it with
We disclose your information only for the purposes above, and only to:
| Who | What and why |
|---|---|
| Your referring GP or specialist | Reports and correspondence about your care, where you have been referred or where a funding programme requires it. |
| Other treating practitioners | Where your care is shared, and with your consent. |
| Medicare, DVA, the NDIA or your plan manager | To claim for services delivered under those programmes. |
| WorkCover Queensland, CTP and other insurers | Where your treatment is funded through a claim. |
| Your private health fund | To process a rebate. |
| Our software and service providers | Nookal (our practice management system, which holds your record), Stripe (payments), and our email, SMS and accounting providers. They are bound to protect your information and may only use it to provide the service to us. |
| Our professional advisers and insurers | Where necessary, for example in relation to a claim or complaint. |
| Anyone you have told us to | A family member, carer, employer or advocate you have authorised. |
We will also disclose information where the law requires or permits it — for example under a subpoena or court order, to a regulator such as Ahpra, or where disclosure is necessary to lessen or prevent a serious threat to someone’s life, health or safety.
We do not sell your information, and we do not give it to anyone for their own marketing purposes.
5. Sending your information overseas
Your clinical record does not leave Australia. Some payment and website data does. Specifically:
| Provider | Where your data is held |
|---|---|
| Nookal — your patient record, clinical notes, appointments and invoices | Sydney, Australia. Nookal holds data for Australian accounts in its Sydney region. It is encrypted in transit and at rest to AES-256, and Nookal holds SOC 2 Type 2 certification. |
| Stripe — your card details and payment records, if you keep a card on file | Overseas, including the United States and Ireland. Stripe Payments Australia Pty Ltd provides the payment service, but Stripe processes and stores payment and authentication data across its global infrastructure and does not offer Australian data residency. Stripe is PCI DSS Level 1 certified. |
| Google Analytics — website usage data only, never your health information | Overseas, including the United States. Google LLC. |
Before disclosing your information to an overseas recipient we take reasonable steps, as APP 8 requires, to ensure they handle it consistently with the Australian Privacy Principles — in practice by choosing providers who are contractually bound to protect it and independently certified. If you would rather not have a card held on file, simply don’t provide one; it makes no difference to your care.
6. Messages and marketing
We keep two kinds of messaging separate, and you choose each one yourself:
- Appointment reminders — SMS and email reminders about your upcoming appointments.
- Clinic updates and feedback requests — occasional clinic news, health information, and an invitation to leave a review of the clinic.
You set both on our new patient form, and you can change either at any time by telling us. Every marketing SMS carries an opt-out; you can reply STOP, or email or phone us. We will action an opt-out within five working days.
We do not switch marketing on for you, and whether you accept or decline it makes no difference to your care. You can also ask us where we got your contact details, and we will tell you.
7. How we keep it safe
Your record is held in Nookal, our practice management system, which is access-controlled and encrypted in transit. Access is limited to the people who need it to do their job. Paper documents are kept secure and are destroyed securely once they have been scanned into your record. Card details are held by Stripe, not by us.
If we ever have a data breach that is likely to cause you serious harm, we will contain and assess it, notify you and the Office of the Australian Information Commissioner as required under the Notifiable Data Breaches scheme, and tell you what you can do about it.
8. How long we keep it
Queensland has no separate health records statute for private practices, so our retention is governed by the Privacy Act. Under APP 11.2 we must destroy or de-identify personal information once we no longer need it for any purpose we are permitted to use it for — we are not allowed to keep your record indefinitely.
Balancing that against the period in which a claim could still be brought, and against national professional guidance, our policy is:
- Adults: at least seven years from the date of your last service with us.
- Children: until the person turns 25 — because a person treated as a child may bring a claim until then.
After that, records are destroyed securely or permanently de-identified. We may keep a record longer where a claim, complaint, insurance matter or legal proceeding makes it necessary, and only for as long as that reason lasts.
9. Accessing and correcting your information
We take reasonable steps to keep what we hold about you accurate, up to date and complete, because treating you safely depends on it. Please tell us when your contact details, funding arrangements, medications or health circumstances change.
You can ask to see the information we hold about you, and you can ask us to correct anything that is wrong, out of date, incomplete or misleading. Just ask us — in person, by phone or by email.
We will respond within 30 days. For a straightforward request, such as a copy of recent notes or a correction to your contact details, we will usually do it much sooner and at no charge. For a large or complex request we may charge a reasonable fee to cover our time and copying costs, and we will tell you what it will be before we start.
There are limited circumstances where we may refuse access — for example where giving it would pose a serious threat to someone’s life or health, unreasonably affect another person’s privacy, or where the law requires or authorises us to refuse. If we refuse, we will tell you why in writing and explain how to complain. Where we cannot give you direct access, we will look for a way to meet your needs, such as providing a summary or releasing the record to another health practitioner.
If we have already passed on information that we later correct — to your GP or an insurer, say — tell us and we will notify them of the correction, unless it would be impracticable or unlawful to do so.
If we disagree with a correction you have asked for, you can ask us to attach a statement of your view to the record, and we will.
10. Complaints
If you think we have mishandled your information, please tell us first. We take it seriously and most things are quickly sorted out.
Eric Wahlander — Principal Physiotherapist and Privacy Officer
Nordic Physio, Shop 11, Palms Shopping Fair, 172 Goondoon Street, Gladstone QLD 4680
(07) 4962 1255 · info@nordicphysio.com.au
We will acknowledge your complaint within 7 days and give you a written response within 30 days. If you are not satisfied with how we have handled it, you can take it further:
- Office of the Australian Information Commissioner (OAIC) — 1300 363 992, oaic.gov.au
- Office of the Health Ombudsman (Queensland) — 133 646, oho.qld.gov.au
11. Automated decision-making
We do not use computer programs to make, or to substantially assist in making, decisions that significantly affect your rights or interests. Decisions about your assessment, treatment, referral and fees are made by your physiotherapist and by our staff. The software we use schedules appointments, sends reminders you have asked for, and processes payments you have authorised — it does not decide anything about your care.
If that ever changes we will say so here, and we will describe what information the system uses and what kinds of decisions it makes, as the Privacy Act requires from 10 December 2026.
12. Changes to this policy, and getting a copy
We review this policy from time to time and will publish any updated version on our website with a new effective date. If we make a change that materially affects how we handle your information, we will tell you.
This policy is always available at nordicphysio.com.au/privacy-policy. Ask us and we will give you a copy free of charge, in print or any other reasonable form you need.