1. About This Policy
Elevate Health Care (ABN: 13 632 674 246) is committed to protecting your privacy. This policy explains how we manage personal information, including health information, in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), and the Health Records Act 2001 (Vic).
Health information is classified as sensitive information under the APPs and attracts a higher standard of protection. We collect and use health information only where it is necessary to provide you with care, or where you have given explicit consent.
By using our website or attending our clinic, you agree to the collection and use of your information as described in this policy. If you do not agree, please do not use our services or provide us with your personal information.
2. What Information We Collect
Personal information
- Name, date of birth, address, phone number, and email address
- Emergency contact details
- Health fund membership details
- Payment information (processed securely — we do not store full card details)
Health information
- Medical history, current symptoms, medications, and previous treatments
- Clinical notes, assessment findings, and treatment records
- Referral letters and reports from other health practitioners
- Imaging reports and results
Website information
- Browser type, device type, and IP address (collected automatically via analytics)
- Pages visited, time on site, and referral source
- Information submitted via contact forms or booking enquiries
3. How We Collect Information
We collect information directly from you where possible — through intake forms completed before or at your appointment, during consultations, via our online booking system (Pracsuite), through our website contact forms, and by telephone.
We may also collect information from third parties with your consent, including referring practitioners, specialists, or diagnostic imaging providers.
4. Why We Collect and Use Your Information
We use your personal and health information to:
- Provide chiropractic and related health care services to you
- Communicate with you about appointments, treatment plans, and clinical progress
- Process payments and manage health fund claims
- Comply with legal and regulatory obligations (including AHPRA registration requirements)
- Improve the quality and safety of the care we provide
- Contact you about clinically relevant information or services (you may opt out at any time)
We will not use your health information for marketing purposes without your explicit consent.
5. Direct Marketing
We will not use your health information for direct marketing purposes.
Communications that are part of your care. We may use your contact details (name, email and mobile number) to send appointment confirmations, reminders, and information relevant to the care you are receiving. These are part of our care relationship with you rather than marketing, and are sent through our practice management system.
Our newsletter and free online programs. Separately from the above, we publish an email newsletter (Fascianating) and a number of free online courses and rehabilitation programs. These are marketing communications. You will only receive them if you have opted in — by subscribing, or by enrolling in a program — and we will not add you to them simply because you are a patient. Every email carries an unsubscribe link, and you may also opt out by contacting us. We will action your request promptly and at no cost to you.
Our newsletter, course enrolments and the member portal at portal.elevatehealthcare.com.au are delivered using Go High Level, a customer relationship management platform. Only your contact details and your engagement with those emails and programs are held there. No clinical records are stored in that platform. Consent for these communications is handled separately from your consent to treatment, consistent with the Spam Act 2003 (Cth).
We will never sell, share, or disclose your contact details to third parties for marketing purposes.
6. Disclosure of Your Information
We may disclose your information to:
- Other treating health practitioners involved in your care (with your knowledge or consent)
- Your nominated emergency contact (in an emergency)
- Health funds, Medicare, or other insurers as required to process claims
- Government agencies or regulators where required by law (e.g. mandatory reporting obligations)
- Our software and service providers (e.g. practice management software, secure cloud storage) — these providers are bound by confidentiality obligations and are not permitted to use your information for any purpose other than providing services to us
We will not sell, rent, or otherwise disclose your personal information to third parties for commercial purposes.
7. Overseas Disclosure
Some of the service providers we use are based overseas, or store and process information on servers located outside Australia. Where this applies it is limited to website and communication data.
Your clinical records are not part of that. They are held in Pracsuite, our practice management system, which stores data in an Australian data centre, encrypted at rest and in transit. Appointment reminders and confirmations are sent by SMS through MobileMessage, whose servers are also in Australia.
The overseas recipients we are aware of are:
- Google LLC (United States) — website analytics, and the Google Business Profile on which our listing and reviews appear.
- HighLevel Inc., trading as Go High Level (United States) — our newsletter, free online courses and member portal, as described in section 5. Contact details and engagement data only.
- Cloudflare, Inc. (United States) — hosting and delivery of this website, operated through a global network of servers.
- VALD Pty Ltd (Australia, with data held in the United States, the United Kingdom and the European Economic Area) — the VALD MoveHealth platform, where a prescribed exercise program may be stored and shared with you. VALD is an Australian company, but its privacy policy states that personal information may be transferred to, held in or accessed from those countries. This applies only where you are given a program through that platform.
- Web3Forms — the service that delivers messages submitted through our contact form to our email. Its operator does not publish a data-residency location; we treat it as an overseas recipient.
Before disclosing personal information to an overseas recipient, we take such steps as are reasonable in the circumstances to ensure the recipient does not breach the Australian Privacy Principles, as required by APP 8.
If you would prefer that your information were not handled by these providers, you are welcome to contact us by telephone rather than through this website, and to decline our newsletter and online programs. Neither affects the care you receive.
8. Storage and Security
Your health records are stored securely in our practice management system (Pracsuite). We take reasonable steps to protect your information from misuse, loss, and unauthorised access, including password protection, encryption, and access controls limited to treating practitioners and authorised clinic staff.
Patient records are retained for a minimum of seven years from the date of last entry, or until the age of 25 for patients who were minors at the time of treatment, in accordance with Victorian legislative requirements.
In the event of a data breach that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches scheme (Privacy Act 1988, Part IIIC).
9. Patients Under 18
Where a patient is under 18 years of age, we collect health information with the consent of a parent or legal guardian. A parent or guardian must be present at the initial consultation.
Health records for patients who were minors at the time of treatment are retained until that patient reaches the age of 25, in accordance with Victorian requirements.
A parent or legal guardian may request access to the health records of a child in their care. Where a young person is of sufficient maturity to understand the nature of their health information, we may exercise discretion in providing access to the parent — consistent with the young person's right to confidentiality.
10. Access and Correction
You have the right to request access to the personal and health information we hold about you, and to request corrections if the information is inaccurate, incomplete, or out of date. To make a request, contact us at the details below. We will respond within 30 days. There is no charge for making an access or correction request.
In some circumstances we may decline to provide access — for example, where access would pose a risk to another person's health or safety, or where we are required by law to withhold the information. If we decline, we will explain why in writing.
11. Website Analytics and Cookies
Our website may use cookies and analytics tools (such as Google Analytics) to understand how visitors use the site. This data is aggregated and does not identify individuals. You can disable cookies through your browser settings, though this may affect some website functionality.
Our patient forms are hosted at a separate address (elevatehealthcare.forms.pracsuite.com) provided by our practice management system. Analytics on that address is kept entirely separate from our main website, is not used for advertising or marketing purposes, and does not collect the answers you provide on a form.
12. Links to Third-Party Websites
Our website contains links to third-party websites, including our online booking and patient forms system (Pracsuite) and Google Maps. We are not responsible for the privacy practices of those websites and encourage you to review their privacy policies.
13. Complaints
If you believe we have not handled your personal information in accordance with this policy or the Australian Privacy Principles, please contact us in the first instance. We will investigate and respond within 30 days.
If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or by calling 1300 363 992.
For complaints relating to health records specifically, you may also contact the Health Complaints Commissioner (Victoria) at hcc.vic.gov.au.
14. Changes to This Policy
We may update this policy from time to time. The current version will always be available on this page. Material changes will be notified to active patients by email where reasonably practicable.
15. Contact Us
For privacy-related enquiries, access requests, or complaints:
- Elevate Health Care
- Suite 30, Level 1, 93 Wells Road, Chelsea Heights VIC 3196
- (03) 9787 0600
- hello@elevatehealthcare.com.au — marked for the attention of the Privacy Officer