Penshurst Podiatry Centre Privacy Policy

Penshurst Podiatry Centre (ABN 54 636 563 203) is committed to maintaining robust privacy protections for our patients, website visitors and other users. This Privacy Policy is designed to help you understand how we collect, use, disclose and safeguard your information, and to assist you in making informed decisions when using our services and website.

For purposes of this Policy:

“Service” refers to the podiatry services we provide and our website at www.penshurstpodiatry.com.au and any related online tools (e.g. online booking).
“We”, “us”, “our” refers to Penshurst Podiatry Centre.
“You” refers to you, as a patient, visitor or user of the Service.

By using our Service and website, you consent to the collection, storage, use and disclosure of your personal information as described in this Privacy Policy.

1. Who we are

We are Penshurst Podiatry Centre, operating at 9 Bridge St, Penshurst NSW 2222.
You can contact our Practice Manager at:

Phone: 02 9570 5708
Post: Practice Manager, Penshurst Podiatry Centre, 9 Bridge St, Penshurst NSW 2222

We are an “APP entity” under the Privacy Act 1988 and comply with the Australian Privacy Principles (APPs).

2. Information we collect

We collect both Personal Information and Non‑Personal Information.

2.1 Personal Information

“Personal Information” means information that can be used to identify you or relates to an identifiable individual. This includes:

Patient and client information:

Name, date of birth, address, phone, email.
Medicare number, private health fund details, concession card details.
Referral details (GP, specialist, allied health).
Medical history, diagnoses, medications, allergies, immunisations.
Podiatry‑specific information: foot/leg assessments, biomechanical data, wound photos, orthotic prescriptions and device details, treatment notes, progress notes.
Pathology and imaging results relevant to your care.
Payment and billing information.

Website and online users:

Name, email, phone, postcode and other contact details you provide via contact forms, online booking, newsletters or enquiries.
Preferences and interests you submit (e.g. communication preferences).

Other individuals:

Referrers, contractors, job applicants, suppliers (e.g. contact details, professional information, employment history).

2.2 Non‑Personal Information

“Non‑Personal Information” means information that does not directly identify you, such as:

Anonymous usage data, device and browser information, platform types.
General demographic information (e.g. aggregated postcode data).
Referring/exit pages and URLs, number of clicks, pages viewed, time spent on site.
Preferences generated based on your activity on our website.

We may collect Non‑Personal Information automatically through cookies, analytics tools and similar technologies when you use our website.

3. How we collect your information

We usually collect Personal Information directly from you (in person, by phone, email, online forms, patient portal, or via our website).

We may also collect information from:

Your GP, specialists, allied health providers, hospitals.
Your private health fund or Medicare (for claims).
Third‑party services we use (e.g. online booking, payment processors, email/SMS providers).
Your authorised representative (e.g. parent/guardian, carer, attorney).

If we collect sensitive information (including health information) from someone other than you, we will only do so where it is reasonable and lawful, and usually with your consent or where an exception under the Privacy Act applies.

Non‑Personal Information is collected automatically as you browse our website and interact with our online services.

4. How we use your information

4.1 Uses of Personal Information

We use Personal Information primarily to provide and improve our podiatry services and to communicate with you. This includes:

Clinical and administrative purposes:

To assess, diagnose and treat your foot and lower‑limb conditions.
To create and maintain your clinical record.
To communicate with you about your appointments, treatment plan and follow‑up.
To coordinate care with your GP, specialists and other health providers involved in your treatment.
To process payments, claims and refunds (Medicare, private health funds, WorkCover, TAC, DVA, etc.).

Communication and support:

To respond to your enquiries and feedback.
To provide technical support for online booking and website functions.
To inform you about promotional offers, practice updates or educational material (where you have consented or where otherwise permitted).

Quality, compliance and business purposes:

Quality improvement, clinical audit and accreditation activities.
Staff training and supervision (with appropriate de‑identification where possible).
Responding to legal obligations (e.g. subpoenas, mandatory reporting, public health requirements).
In the event of a business transaction (e.g. merger, acquisition, sale of assets), your Personal Information may be transferred as part of that transaction, subject to appropriate privacy safeguards.

We do not sell, trade or rent your Personal Information to third parties for their marketing purposes without your consent.

4.2 Uses of Non‑Personal Information

We use Non‑Personal Information to:

Improve our website and Service.
Customise the user experience.
Track trends and analyse use patterns on our site.
Provide aggregated insights to our partners, advertisers and other third parties.

This Privacy Policy does not limit our use or disclosure of Non‑Personal Information, and we reserve the right to use and disclose such information at our discretion, provided it does not identify you personally.

5. How we share and disclose your information

5.1 Disclosure of Personal Information

We may disclose your Personal Information to:

Clinicians and staff within our practice involved in your care.
Your GP, specialists, allied health providers, hospitals, pathology and imaging services.
Your private health fund, Medicare, insurers, WorkCover/TAC/DVA and similar bodies for claims and billing.
Our third‑party service providers, such as:
- Cliniko (practice management and clinical software provided by Red Guava Pty Ltd).
- Email/SMS providers and servers used for communications.
- Cloud storage and backup providers used by Cliniko.
- IT support, cybersecurity, website hosting and analytics providers.
- Payment processors and banks.
- Accountants, auditors and legal advisers.
- Advertising and marketing providers (e.g. Google) where permitted by law and this Policy.

These vendors use your Personal Information only at our direction and in accordance with our Privacy Policy and applicable laws.

5.2 Overseas disclosure

We use Cliniko to manage appointments, clinical records, forms, communications and billing. Cliniko is operated by Red Guava Pty Ltd (an Australian company) and, for Australian accounts, patient data is primarily hosted on servers in Australia (via Amazon Web Services).

However, Cliniko uses approved subprocessors located in Australia and the United States for functions such as web hosting, data backup, email/SMS, payments and support. This means some of your personal information may be accessed or processed in the United States when you use Cliniko‑related services.

We may also use other service providers (e.g. email, website hosting, analytics, advertising including Google) that store or access data outside Australia, including in countries such as the United States and, where applicable, Ireland or other countries where those providers operate.

Before disclosing information overseas, we take reasonable steps to ensure the recipient is bound by contractual or other obligations to protect your information in line with the APPs.

6. How we protect your information

We implement reasonable security measures designed to protect your information from unauthorised access, misuse, interference, loss, modification or disclosure, including

Storing electronic records in password‑protected, access‑controlled clinical software (Cliniko) and secure cloud systems.
Using role‑based access so staff only see information they need for their role.
Encrypting data in transit and at rest where feasible.
Maintaining physical security of paper records and devices.
Using technological security measures such as encryption, firewalls and secure server software for our website and communications.
Training staff in privacy and information security.
Having procedures to respond to data breaches, including notifying affected individuals and the OAIC where required.

While we strive to protect your information, no method of transmission over the internet or electronic storage is completely secure. By using our Service, you acknowledge that you understand and accept these inherent risks.

We retain patient records in line with legal and professional requirements (generally at least 7 years from last entry for adults, and for children until at least age 25, or longer if required by law or our indemnity insurer).

7. Your rights regarding your Personal Information

Under the Privacy Act and APPs, you have rights in relation to the Personal Information we hold about you.

7.1 Access and correction

You may request access to, or correction of, your Personal Information by contacting our Practice Manager in writing (letter or email). We will respond within a reasonable time (usually 30 days) and let you know if any exceptions apply. We may charge a reasonable fee for providing copies (e.g. for large files or printed records), but not for making the request.

7.2 Direct marketing and opt‑out

You have the right at any time to prevent us from contacting you for marketing purposes. When we send a promotional communication, you can opt out by:

Using the “unsubscribe” link in emails.
Asking reception or contacting our Practice Manager.
Emailing us.

We will stop sending marketing material within a reasonable time after you opt out.

7.3 Anonymity and pseudonymity

Where it is lawful and practicable, you may interact with us anonymously or using a pseudonym (for example, general enquiries). However, for clinical care, billing and legal obligations, we generally need to know your identity and accurate details.

8. Cookies, analytics and advertising (including Google AdWords)

Our website uses cookies and similar technologies to:

Support site functionality (e.g. online booking via Cliniko).
Collect analytics about how the site is used (e.g. Google Analytics).
Support advertising and remarketing.

8.1 Google AdWords and remarketing

This website uses the Google AdWords service (including remarketing) to advertise on third‑party websites (including Google) to previous visitors to our site. This may include advertising to previous visitors who have not completed a task on our site, such as making an enquiry via the contact form. Ads may appear on the Google search results page or on sites in the Google Display Network.

Third‑party vendors, including Google, use cookies to serve ads based on past visits to the Penshurst Podiatry Centre website. Any data collected in this process will be used in accordance with this Privacy Policy and Google’s privacy policy.

You can:

Set preferences for how Google advertises to you using Google’s Ads Settings.
Opt out of a third‑party vendor’s use of cookies by visiting the Network Advertising Initiative opt‑out page.

You can also manage cookie settings in your browser. Our website may display a cookie banner or consent tool where required.

9. Links to other websites

As part of the Service, we may provide links to or compatibility with other websites or applications. We are not responsible for the privacy practices or content of those third‑party sites. This Privacy Policy applies solely to information collected by us through our website and Service. When you access a third‑party site via a link on our site, the privacy policy of that other website or application will apply. We encourage you to read the privacy statements of other websites before using them.

10. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology or the law.

The latest version will be available on our website and at reception.
If our information practices change in the future, we will post the updated policy on our website so you can review any new practices and, where appropriate, opt out. We suggest that you check this page periodically if you are concerned about how your information is used.

11. Complaints about privacy

If you have a complaint about how we handle your Personal Information:

Contact our Practice Manager in writing with details of your concern (phone: 02 9570 5708; post as above; email).
We will acknowledge your complaint and aim to resolve it within a reasonable time (e.g. 30 days).
If we cannot resolve it to your satisfaction, you may contact the Office of the Australian Information Commissioner (OAIC):
- Website: www.oaic.gov.au
- Phone: 1300 363 992

12. Contact us

If you have any questions regarding this Privacy Policy or the practices of our website and Service, please contact:

Practice Manager
Penshurst Podiatry Centre
9 Bridge St, Penshurst NSW 2222
Phone: 02 9570 5708