How we look after your information

Healing Hands Health, Kalkallo and Wollert, Victoria. Last updated 18 October 2026.

We collect and keep health information so we can treat you safely. The law treats health information as sensitive, and so do we. This policy explains what we hold, why, who can see it, and your rights under the Privacy Act 1988 (Cth), the Australian Privacy Principles and the Health Records Act 2001 (Vic).

What we collect

• Your name, contact details and date of birth.
• Your health history, the answers on your health form, and your signed consents.
• Assessment and treatment notes, results, letters, and documents such as referrals and scans.
• Exercises we give you, and the exercise and pain records you add in the client portal.
• Appointments, invoices and payments, and health fund, Medicare, DVA, WorkSafe, TAC or NDIS details when we claim for you.
• Messages you send us in the portal, and the fact that a video or phone call happened. Calls are not recorded.

How we collect it

Mostly from you: in person, by phone, and through the client portal. With your agreement we may also get information from your GP or another practitioner who refers you, or from an insurer or scheme paying for your care.

Why we use it

• To assess and treat you, and to keep accurate clinical records, as the Osteopathy Board of Australia requires.
• To book and remind you of appointments, send invoices and receipts, and make claims for you.
• To meet our legal obligations, and to improve the safety and quality of our care.

We never sell your information, and we don't use it for marketing without your permission.

Who can see it

• Your osteopath sees your full clinical record.
• Our clinic coordinator manages bookings, accounts, care plan visit counts and portal messages. They can't open your health form, notes, results, exercises or documents. They can read portal messages, so please keep detailed health information for your appointment or a call with your osteopath.
• Other health professionals, such as your GP, see it only with your consent, or when the law allows it, for example in an emergency.
• Funders (health funds, Medicare, DVA, WorkSafe, TAC, NDIS) receive what a claim needs.

Where it's stored

Our clinic system and its database run on servers in Sydney. Our booking system (Nookal) and payment terminals (Tyro, HICAPS) are Australian services. Some of the companies we use are based overseas. For video and phone calls (Daily) the call itself goes through Sydney servers, but the company is in the United States. Our email (Zoho Mail) is stored in Zoho's Australian data centre. Your health record is not sent overseas. These companies can only use what they handle to provide their service to us.

How we protect it

• Everything is encrypted when it's sent, and stored encrypted.
• Each person on our team sees only what their job needs.
• Staff sign in with a password and can use a code from their phone (two-step sign-in). Everyone is signed out automatically after a period of no use. Your portal signs you out after 30 minutes without use.
• We keep a log of who opens your record and files.

Seeing or correcting your record

You can ask to see or get a copy of your record, or to correct anything that's wrong, by calling or emailing us. We'll respond within 30 days. Asking is free. If you want copies, we may charge a fee, but only up to the limit set by Victorian law. We can only refuse in the limited cases the law allows, and we'll tell you why in writing.

How long we keep it

Victorian law requires us to keep health records for at least 7 years after your last visit. If you were under 18 when we last saw you, we keep them until you turn 25. After that, we destroy them securely. Turning off your portal account stops you signing in, but it doesn't delete your record.

If something goes wrong

If your information is lost or seen by someone who shouldn't see it, and that could seriously harm you, we'll tell you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

Questions and complaints

Please contact us first: 1300 337 339 or info@healinghandshealth.com.au. If you're not happy with our answer within 30 days, you can contact:

• The Office of the Australian Information Commissioner: oaic.gov.au, 1300 363 992.
• The Health Complaints Commissioner (Victoria): hcc.vic.gov.au, 1300 582 113.
• For concerns about a practitioner's conduct, Ahpra: ahpra.gov.au, 1300 419 495.