Privacy Policy
MyBody Movement is committed to protecting your personal and health information. This policy explains what we collect, why we collect it, how we use it, and your rights under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
Who We Are
MyBody Movement is a mobile physiotherapy and personal training service based in Melbourne, Victoria, Australia. We provide in-home and on-site physiotherapy, rehabilitation, and physio-guided personal training services to clients across the Melbourne metropolitan area.
For the purposes of this policy, “we”, “us”, and “our” refer to MyBody Movement. “You” refers to any person whose personal information we handle, including clients, prospective clients, and website visitors.
What Information We Collect
We collect two categories of information: general personal information and sensitive health information.
Personal Information
- Full name and date of birth
- Contact details including phone number, email address, and home or work address
- Emergency contact details
- Payment and billing information
- Appointment booking records and communication history
- Occupation and workplace details where relevant to your treatment
Health Information
Health information is classified as sensitive information under the Privacy Act and receives the highest level of protection. We collect:
- Medical history, past injuries, and previous surgeries
- Current and past medications
- Clinical assessment findings, diagnoses, and treatment notes
- Exercise and rehabilitation program records
- Referral letters and reports from other health practitioners
- Workers compensation, Medicare, and private health insurance details where applicable
- GP or specialist contact details where provided
Website and Technical Information
- IP address and browser type when you visit our website
- Pages visited and time spent on our site (via analytics tools)
- Form submission data from booking and enquiry forms
How We Collect Your Information
We collect personal information only by lawful and fair means. We will typically collect information:
- Directly from you when you complete an intake form, booking form, or enquiry
- During physiotherapy or personal training sessions
- Through email, phone, or SMS communication with you
- From your GP, specialist, or other treating health practitioners with your consent
- From insurers or WorkCover authorities where relevant to your claim
- Through our website when you submit a contact or booking form
Where it is reasonable and practical to do so, we will collect information directly from you rather than from third parties. We will always tell you why we are collecting your information at or before the time of collection.
Why We Collect Your Information
We collect and use your information only for the purposes for which it was collected or directly related purposes. These include:
Primary Purposes
- Providing physiotherapy assessment, treatment, and rehabilitation services
- Providing physio-guided personal training services
- Managing your appointments, bookings, and billing
- Communicating with you about your treatment, progress, and appointments
- Referring you to other health practitioners where required
- Maintaining accurate and up-to-date clinical records
- Processing insurance, Medicare, or WorkCover claims on your behalf
Secondary Purposes
- Improving the quality of our services
- Sending you appointment reminders and follow-up communications
- Sending service-related updates where you have opted in
- Complying with our legal, regulatory, and professional obligations
Disclosure of Your Information
We treat your personal and health information with strict confidentiality. We do not sell, rent, or trade your information to third parties. We may disclose your information only in the following circumstances:
With Your Consent
- To your GP, specialist, or other treating health practitioners to coordinate your care
- To other allied health professionals we refer you to
Required or Permitted by Law
- To Medicare, private health insurers, or WorkCover authorities to process your claims
- To regulatory bodies such as AHPRA where required under the Health Practitioner Regulation National Law
- Where disclosure is required by a court order, subpoena, or other legal obligation
- To the Office of the Australian Information Commissioner (OAIC) in the event of a notifiable data breach
- Where we believe disclosure is necessary to prevent a serious threat to your life, health, or safety, or that of another person
Service Providers
We may share limited information with trusted third-party service providers who assist us in operating our business, including:
- Practice management and booking software providers
- Cloud storage and data backup services
- Payment processing providers
- Website hosting and analytics providers
All third-party providers are required to handle your information in accordance with Australian privacy law and are bound by confidentiality obligations. We take reasonable steps to ensure they do not use your information for any purpose other than providing services to us.
Overseas Disclosure
Some of our third-party service providers may store or process data on servers located overseas, including in the United States. Where this occurs, we take reasonable steps to ensure those providers are bound by standards substantially similar to the Australian Privacy Principles. By using our services, you consent to potential overseas transfer of your data for these limited operational purposes.
Storage and Security of Your Information
We take the security of your personal and health information seriously. Under the Privacy and Other Legislation Amendment Act 2024, we are required to implement both technical and organisational measures to protect your information from misuse, interference, loss, and unauthorised access, modification, or disclosure.
Security Measures
- Clinical records are stored in password-protected, encrypted practice management software
- Physical documents are stored securely and accessible only to authorised personnel
- Our website uses SSL encryption for all data transmissions
- Access to client records is restricted to the treating practitioner
- Staff and contractors are bound by confidentiality agreements
Retention Periods
We retain your health records in accordance with applicable Australian laws and professional guidelines:
- Adult client health records are retained for a minimum of 7 years from the date of last service
- Records for clients who were minors at the time of treatment are retained until they turn 25, or for 7 years from last service, whichever is longer
- Financial and billing records are retained for 7 years as required by the Australian Taxation Office
- Where records are no longer required, they are securely destroyed or de-identified
Notifiable Data Breaches
We are subject to the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988 (Cth). If we become aware of a data breach that is likely to result in serious harm to one or more individuals, we are required to:
- Notify the Office of the Australian Information Commissioner (OAIC) as soon as practicable
- Notify all affected individuals directly
- Provide details of the breach and the steps taken in response
We maintain an internal data breach response procedure and will act promptly in the event of any suspected or confirmed breach.
Your Rights
Under the Australian Privacy Principles, you have the following rights regarding your personal information:
You have the right to request access to the personal information we hold about you. We will respond within a reasonable time and in the format you request, subject to any lawful exemptions.
If you believe information we hold about you is inaccurate, incomplete, or out of date, you may request that we correct it. We will respond within a reasonable time.
You may request deletion of your personal information where we are no longer required by law or legitimate purpose to retain it. Clinical health records must be retained for minimum periods set by law.
You may opt out of receiving non-clinical marketing or promotional communications from us at any time by contacting us directly or using the unsubscribe link in any email we send.
If you believe we have handled your information in breach of the Australian Privacy Principles, you have the right to make a complaint. See Section 10 for how to do so.
Where lawful and practicable, you may interact with us anonymously or using a pseudonym. However, we may not be able to provide clinical services without knowing your identity.
Complaints and How to Contact Us
If you have a question, concern, or complaint about the way we have handled your personal information, please contact us in the first instance. We take all privacy complaints seriously and will respond within 30 days.
- hello@mybodymovement.com.au
- Melbourne, Victoria, Australia
- Response time: within 30 days
If You Are Not Satisfied
If you are not satisfied with our response to your complaint, you have the right to escalate the matter to the Office of the Australian Information Commissioner (OAIC):
- enquiries@oaic.gov.au
- 1300 363 992
- www.oaic.gov.au
Updates to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal obligations, or the services we offer. The most current version will always be available on our website. Continued use of our services following any update constitutes your acceptance of the revised policy. We encourage you to review this page periodically.
This policy was last reviewed and updated on 22 February 2026 and reflects the requirements of the Privacy Act 1988 (Cth) including amendments introduced by the Privacy and Other Legislation Amendment Act 2024.