Privacy policy
1. Who we are
FlexFusionX (ABN 81 239 476 840) is a physiotherapy practice run by Cyriac Kallarakkal, an AHPRA-registered physiotherapist (PHY0004039512). We see clients at 101 Portrush Rd, Evandale SA 5069, which is inside Balance Physiotherapy, as well as at home, at your gym or training ground, and online. Balance Physiotherapy is a separate business, and we do not share your records with them unless you agree.
This policy explains how we handle your personal information, including health information, under the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Health providers must follow these rules whatever their size.
2. What we collect
- Contact details: your name, date of birth, address, phone, email and emergency contact.
- Health information: your medical history, symptoms, injuries, training and activity, assessment findings, treatment notes, exercise programs, goals, and any imaging or reports you share.
- Funding details: Medicare, private health fund, DVA, WorkCover or CTP claim details, and for NDIS participants your NDIS number, plan management type, and plan manager or support coordinator details.
- Payment details: what you paid and how. Card details are handled by our payment provider, and we don't store full card numbers.
- Enquiries: what you tell us when you call, email or message us.
- Website usage: basic, non-identifying data about how the site is used.
3. How we collect it
Mostly from you: through our online booking and intake forms, in sessions, and by phone, email, SMS or video call. With your consent, or where the law allows, we may also receive information from your GP or specialist, other health providers, your insurer or claims manager, your NDIS support coordinator, plan manager or guardian, or a coach you ask us to work with.
You can make a general enquiry without giving your name. To assess or treat you, we need to know who you are.
4. Why we use it
- To assess, treat and plan your care, including programs between sessions.
- To contact you about appointments, including reminders by SMS or email.
- To issue invoices and process claims with Medicare, health funds, DVA, WorkCover, CTP insurers or the NDIS.
- To write reports you or your funding body need, such as NDIS progress reports.
- To meet our legal and professional obligations, including AHPRA and insurance requirements.
- To send occasional updates or offers, only if you've agreed. You can opt out at any time.
We do not sell your information.
5. Who we share it with
We share only what is needed, and with your consent unless the law allows otherwise:
- Your GP, specialist or other health providers involved in your care.
- Medicare, your health fund, DVA, WorkCover or CTP insurers, to process claims you make.
- For NDIS participants: the NDIA, your plan manager and your support coordinator.
- Family members, carers, guardians or support workers you nominate.
- A coach or trainer, only if you ask us to.
- Service providers who help us run the practice: our practice software (Cliniko, which also runs our online bookings, SMS reminders and telehealth video), email (Google Workspace) and website hosting (Cloudflare). They may only use your information to provide their service to us.
- Anyone we are legally required to tell, or where needed to lessen a serious threat to someone's life, health or safety.
6. Overseas disclosure
Our patient records are stored with Cliniko on servers in Australia. Some of our service providers, including parts of Cliniko's, Google's and our website host's services, may process limited information in other countries, mainly the United States. We use providers with strong security and privacy commitments.
7. How we keep it safe
Records are kept in Cliniko, a secure, encrypted practice management system. Only Cyriac can access clinical records, and accounts are protected by strong, unique passwords. We don't keep paper records. If we receive any, we scan and securely destroy them. Telehealth sessions use a secure video service and are not recorded without your consent.
8. How long we keep it
We keep health records for at least 7 years after your last appointment. If you were under 18 at your last appointment, we keep them until you turn 25. After that, we securely delete or de-identify them. Enquiries that don't lead to an appointment are deleted after 12 months.
9. Accessing and correcting your information
You can ask for a copy of your records, or ask us to correct anything that's wrong, by emailing ck@flexfusionx.com.au or calling 0449 969 060. We will respond within 30 days. There's no charge to make a request, though we may charge a reasonable fee for copying large records, and we will tell you first. If we can't give you access, for example where the law allows us to refuse, we will tell you why in writing.
10. Our website
- Enquiries: the site has no contact form. If you call or email us, we use what you tell us only to reply and arrange your care.
- Online booking: bookings and intake forms are run by Cliniko and covered by this policy and Cliniko's privacy policy.
- Cookies and analytics: this site doesn't use analytics or advertising cookies. The booking widget is provided by Cliniko and the fonts by Google Fonts, which receive basic technical information such as your IP address.
- Links: our site links to other sites, such as Instagram and Google Maps, which have their own privacy policies.
11. Automated decisions
We don't use automated decision-making. Every decision about your care is made by your physiotherapist.
12. Data breaches
If a data breach is likely to cause you serious harm, we will tell you and the Office of the Australian Information Commissioner (OAIC), as the Notifiable Data Breaches scheme requires, and explain what you can do.
13. Complaints
If you're unhappy with how we've handled your information, please contact us first at ck@flexfusionx.com.au or 0449 969 060. We will respond within 30 days. If you're not satisfied, you can contact:
- Office of the Australian Information Commissioner: oaic.gov.au, 1300 363 992 (privacy complaints).
- Health and Community Services Complaints Commissioner (SA): hcscc.sa.gov.au, 1800 232 007 (complaints about health services).
- NDIS Quality and Safeguards Commission: ndiscommission.gov.au, 1800 035 544 (NDIS participants).
14. Changes to this policy
We may update this policy. The current version is always at flexfusionx.com.au/privacy, with the date it was last updated.
15. Contact
FlexFusionX · Cyriac Kallarakkal · 101 Portrush Rd, Evandale SA 5069 · ck@flexfusionx.com.au · 0449 969 060