Privacy Policy
Last updated: July 2026
At People's Physiotherapy, we take your privacy seriously and are committed to ensuring that your personal and health information is handled securely and in accordance with Australian privacy law, including the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), and the Health Records and Information Privacy Act 2002 (NSW).
This Privacy Policy explains how we collect, use, disclose, and protect your personal information — including how we use artificial intelligence tools such as our clinical documentation assistant, Preve, in the course of your care.
Privacy Officer and Contact Details
Our Privacy Officer is Mitch Wilson. If you have any questions, requests, or concerns about how your personal information is handled, please contact:
● Email: mitch@peoplesphysiotherapy.com
● Phone: (02) 43910278
● Address: Lot 14, 21–23 North Avoca Parade, North Avoca NSW 2260
1. Collection of Personal Information
We collect personal information to provide high-quality physiotherapy services, manage appointments, and communicate with you effectively. The types of personal information we may collect include:
● Identification Information: name, date of birth, gender, address, and contact details (phone number, email).
● Health Information: medical history, current health conditions, injuries, treatment plans, medications, and any other relevant information related to your care.
● Session Recordings and Transcripts: with your consent, audio recordings and AI-generated transcripts or summaries of your appointments, created using our clinical documentation software, Preve.
● Exercise Videos and Photos: with your consent, video or photo recordings of exercises demonstrated during your session, used to support your home exercise program.
● Payment Information: credit card details and billing information for appointment fees, insurance claims, and other financial transactions.
● Demographic Information: your occupation, lifestyle factors, and other background details that may impact your treatment.
We collect this information directly from you when you provide it, such as when you make an appointment, fill out forms, attend a session, or communicate with us.
Patients under 18
Where a patient is under 18, a parent or guardian provides consent to treatment, and to any use of Preve or exercise video/photo recording, on the patient's behalf. Depending on the young person's age and maturity, we may also seek their own agreement before recording a session or filming an exercise.
2. Use of AI in Your Care — Preve
We use Preve, a physiotherapy-specific AI platform, to help transcribe appointments and generate clinical notes, treatment summaries, and home exercise documentation. This reduces administrative time so we can focus on your care. Here's how it works and what it means for you:
What Preve is used for
● Transcribing spoken conversation during your appointment to help generate clinical notes and treatment plans.
● Drafting summaries and letters (e.g. GP referral letters) for practitioner review before they are finalised or sent.
● Recording short exercise demonstration videos so you can refer back to correct technique at home.
What Preve is not used for
● Preve does not make clinical decisions, diagnoses, or treatment decisions on its own — all clinical judgement remains with your treating practitioner, who reviews and approves any AI-drafted notes.
● Your identifiable health information is not used to train Preve's underlying AI models.
● Your information is not sold, rented, or used for marketing by Preve or by us.
Your choice — no penalty
Use of Preve during your appointment is optional. You can ask that it not be used for your session, or withdraw consent at any time, and this will not affect the quality of care you receive or result in any penalty. If you don't wish for a session to be recorded or transcribed, simply let your practitioner know and we will take clinical notes manually instead.
3. Video and Photo Recordings of Exercises
Where you consent to an exercise demonstration being filmed for your home program, the recording is captured directly within the Preve app and is not stored on the device it was filmed on. Instead, it is uploaded and stored securely on Preve's servers, protected by end-to-end encryption both in transit and at rest. Recordings are only accessible to you and your treating practitioner(s) at our clinic through your Preve-linked account, and are retained only for as long as needed to support your treatment, after which they are securely deleted or de-identified.
These will not be used for any social media posting.
4. Use of Personal Information
We use your personal and health information for the following purposes:
● Provision of Physiotherapy Services: to assess your condition, plan and deliver treatments, and track your progress.
● Appointment Management: to schedule, confirm, and remind you of your appointments.
● Billing and Payments: to process payments for services rendered and manage insurance claims where applicable.
● Communication: to provide you with relevant updates, health advice, and information related to your treatment or appointments.
● Clinical Record Keeping: to maintain accurate and up-to-date medical records in accordance with regulatory requirements, including AI-assisted notes reviewed by your practitioner.
We will not use your information for any purpose that is unrelated to the above, unless we obtain your consent.
5. Disclosure of Personal Information
We respect your privacy and will not disclose your personal or health information to third parties without your consent, except in the following circumstances:
● Healthcare Providers: with your consent, we may share your information with other healthcare providers involved in your care (e.g. doctors, specialists, hospitals, or allied health professionals).
● Health Insurance Providers: if you are claiming through your health insurance, we may disclose relevant information to your insurer for billing purposes.
● Legal or Regulatory Requirements: we may be required to disclose your information to comply with legal obligations, such as responding to subpoenas, warrants, or government requests.
● Service Providers: we share information with trusted third-party service providers who assist us in operating our business. These currently include: Preve (AI clinical documentation and exercise video platform), Cliniko (practice management software), Tyro HealthPoint (health fund and payment processing), Xero and our bookkeeper (billing and accounts), and Yours Truly Services (remote reception). These providers are bound by confidentiality obligations and are prohibited from using your information for any other purpose.
Overseas storage
Preve has disclosed to us that patient information may be stored or processed on servers located in the United States, as well as in Australia. Where any of our service providers store or process information overseas, we take reasonable steps to ensure your information continues to be protected in line with the Australian Privacy Principles, including through encryption and contractual data-handling obligations with those providers.
6. Automated Decision-Making
From December 2026, Australian privacy law requires businesses to disclose where automated systems are used to make decisions that could reasonably affect an individual. To be clear: Preve and any other AI tools we use assist with administrative and documentation tasks only. They do not make decisions about your diagnosis, treatment, billing, or eligibility for care — every clinical and business decision affecting you is made by a person at our clinic.
7. Storage and Security of Personal Information
We are committed to ensuring the security of your personal and health information. All personal and health information is stored securely, either in physical form or electronically. We implement appropriate technical and organisational security measures, including encryption, access controls, and regular reviews, to protect your information from unauthorised access, alteration, or disclosure.
Under the Health Records and Information Privacy Act 2002 (NSW), we retain health records for a minimum of 7 years from the date of your last consultation. Where the patient was under 18 at their last consultation, we retain records until they turn 25. Non-clinical records (e.g. billing) are retained only as long as needed to meet our accounting and legal obligations. When no longer needed, we securely dispose of or de-identify your information.
Data breach notification
If we become aware of a data breach likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme.
8. Access to Your Personal Information
You have the right to request access to the personal information we hold about you. If you wish to view, correct, or update your information, please contact us using the details below. We may require proof of identity before processing your request to ensure the security of your information.
In some cases, we may not be able to provide you with access to all of your personal information (for example, if it relates to legal proceedings or is subject to a confidentiality agreement). If access is denied, we will explain why.
Correcting your information
If you believe any personal information we hold about you is inaccurate, out of date, incomplete, or misleading, you can ask us to correct it. We will take reasonable steps to correct the information, or, where we disagree with the requested correction, will note your request against the record and explain our reasons.
9. Consent
By providing your personal and health information to us, you consent to the collection, use, and disclosure of that information as outlined in this Privacy Policy. Certain uses — such as AI transcription via Preve or exercise video recording — require your separate, specific consent and can be declined or withdrawn at any time without penalty or impact to your care.
If you do not wish for us to collect, use, or share your information for any of the purposes mentioned above, please let us know. Please note that if you withdraw consent for core clinical record-keeping, we may not be able to provide you with the full range of physiotherapy services.
10. Our Website and Newsletter
Separately from your clinical records, our website may use cookies or similar analytics tools to understand how visitors use our site. If you subscribe to our newsletter, we collect your email address for that purpose only, and you can unsubscribe at any time using the link in any newsletter email. Website and newsletter data is not linked to your clinical file and is handled independently of the health information covered elsewhere in this policy.
11. NAISDA Dance Artists
Dance artists receiving physiotherapy through our contracted role at NAISDA Dance College are also covered by our separate NAISDA AI Documentation Policy (NAISDA-PHYSIO-POL-001), which addresses Indigenous Data Sovereignty considerations specific to that context. Where the two policies overlap, the NAISDA-specific policy applies to information collected as part of that engagement.
12. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, the tools we use, or legal requirements. Any updates will be posted on our website, and the revised policy will apply to all personal information held by us at the time.
13. Complaints
If you believe that your privacy rights have been violated or you have any concerns regarding the handling of your personal information, please contact us immediately. We will investigate your complaint and respond to you promptly.
If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC), which is the body responsible for protecting your privacy rights under Australian law. Individuals may also have a right to bring a claim directly under the statutory tort for serious invasions of privacy, in force since June 2025.