Privacy Policy

Who this policy covers

This policy explains how M2 Physiotherapy & Allied Health, trading as M2 Physio (“we”, “us”), handles your personal information. We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and as a Victorian health service provider we are also bound by the Health Records Act 2001 (Vic).

It applies to information we collect when you contact us, attend an appointment, or use this website.

What we collect

Personal information: your name, date of birth, contact details, emergency contact, and payment or health fund details.

Health information: your medical history, the reason for your visit, assessment findings, treatment notes, referrals, imaging and correspondence with other practitioners. Health information is “sensitive information” under the Privacy Act and we collect it only with your consent and only where it is reasonably necessary for your care.

Website information: we do not require you to create an account to browse this site. If you book an appointment here, the booking form collects your name, email address, phone number and — only if you choose to write one — a short reason for your visit. Those details are sent to Halaxy, the practice management system we use to run the clinic, where they create your patient record and your requested appointment. Halaxy stores this information in Australia. Nothing you type is used for any other purpose, and the form asks for nothing clinical: please do not enter medical history or sensitive details, and call us instead if a matter is urgent.

Dealing with us anonymously

You may ask general questions about our services anonymously or under a pseudonym. We cannot provide physiotherapy treatment anonymously: an accurate clinical record is a professional and legal requirement, and treating you safely depends on it.

How we collect it

We collect information directly from you wherever possible — in person, by phone, by email, or through this website. We may also receive information about you from your GP, a specialist, another physiotherapist, a hospital, your health fund, or an insurer such as the TAC or WorkSafe, where you have consented to that referral or claim.

Why we collect it and how we use it

We use your information to:

• assess, diagnose and treat you, and to plan your care
• keep an accurate clinical record as required of us
• communicate with you about appointments, reminders and your treatment
• bill you and, where applicable, process claims through Medicare, your private health fund, or a third-party insurer
• meet our legal, professional and insurance obligations

We do not use your information for any purpose you would not reasonably expect without asking you first.

Who we disclose it to

We may disclose your information to:

• other practitioners involved in your care, with your consent — your GP, a specialist, or a hospital
• Medicare, your private health fund, or an insurer, where you are claiming a rebate or benefit
• our practice management and secure IT providers, who are bound to protect it and may only use it to provide those services to us
• anyone else where you have consented, or where we are required or authorised by law

We do not sell your information, and we do not disclose it for marketing by anyone else.

Overseas disclosure

We do not send your health information or your clinical records overseas. The one routine overseas disclosure is the anonymous website traffic data described under This website, which is processed in the United States and cannot identify you. Some of the other software we use to run the practice may also store data on servers located outside Australia. Where that is the case we take reasonable steps to ensure the provider handles your information consistently with the APPs. If this changes materially, we will update this policy.

Direct marketing

If we send you clinic updates or health information by email, every message will include an unsubscribe link and we will act on it promptly. We will not use your sensitive health information to target marketing to you. Appointment reminders and treatment-related messages are not marketing and will continue while you are a patient.

Storage, security and retention

Records are held in secure practice management software with access restricted to authorised staff. Paper records, where they exist, are kept in locked storage. We take reasonable steps to protect your information from misuse, loss, and unauthorised access, modification or disclosure.

We retain health records for at least seven years from your last appointment, or, if you were under 18 at your last appointment, until you turn 25 — whichever is longer. This reflects the minimum period required of Victorian health service providers. Once a record is no longer needed and the retention period has passed, we destroy or de-identify it securely.

Accessing and correcting your information

You may ask to see the information we hold about you, and to have it corrected if it is inaccurate, out of date or incomplete. Write to us at admin@m2physio.com.au and we will respond within 30 days.

We may ask you to verify your identity. In rare cases we may decline access — for example where giving it would pose a serious threat to someone’s life or health, or would unreasonably affect another person’s privacy. If we do, we will tell you why in writing and explain how to complain. A reasonable fee may apply to cover the cost of retrieving and copying a large record; we will tell you before any cost is incurred.

Data breaches

If a data breach occurs that is likely to result in serious harm, we will notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

This website

This site does not set advertising or tracking cookies, and does not follow you across other websites. The only information it collects is what you enter into the booking form, described under What we collect.

We use Vercel Analytics to count page views and see which pages are read. It records the page visited, the referring site, and the approximate country, device type and browser. It sets no cookie and stores no identifier that persists between visits, so it cannot build a profile of you or recognise you on a later visit. We cannot identify an individual from it.

This data is processed by Vercel Inc., which is based in the United States, so it is disclosed overseas within the meaning of Australian Privacy Principle 8. No health information is included in it.

Complaints

If you believe we have mishandled your information, please tell us first at admin@m2physio.com.au or (03) 9111 5514. We will acknowledge your complaint and respond within 30 days.

Contact us

M2 Physiotherapy & Allied Health
126 Ballarat Rd, Hamlyn Heights VIC 3215
(03) 9111 5514
admin@m2physio.com.au