Improve Your Move Physiotherapy
ABOUT THIS PRIVACY POLICY
Last updated: 10 September 2026
IYM Physiotherapy Pty Ltd (ABN 46 600 526 298), trading as IYM Physiotherapy ("IYM", "we", "us" or "our"), respects your privacy and is committed to protecting the personal information and health information we collect from and about our patients, prospective patients, website visitors and other individuals who interact with us.
This Privacy Policy explains how we collect, hold, use, disclose, store and protect personal and health information, and how you may access or correct information we hold about you or make a privacy complaint.
We handle personal and health information in accordance with applicable Australian and New South Wales privacy laws, including the Privacy Act 1988 (Cth) and Australian Privacy Principles (APPs), where applicable, and the Health Records and Information Privacy Act 2002 (NSW) (HRIP Act) and Health Privacy Principles (HPPs).
Our registered physiotherapists are also expected to comply with applicable professional standards, including requirements concerning patient confidentiality and privacy.
WHO WE ARE
IYM Physiotherapy provides physiotherapy and related healthcare services at our clinics, through home visits where offered, and through other service-delivery methods we may make available.
Legal entity: IYM Physiotherapy Pty Ltd
ABN: 46 600 526 298
Registered address: 711/39 Cooper Street, Strathfield NSW 2135
Phone: (02) 9599 9510
Email: admin@iymphysiotherapy.com.au
Website: www.iymphysiotherapy.com.au
WHAT INFORMATION WE COLLECT
The information we collect depends on your relationship with IYM and the services you receive.
Personal information
We may collect information including:
• your name, date of birth, gender or preferred pronouns where relevant;
• residential and postal address, telephone number and email address;
• emergency contact and next-of-kin details;
• appointment and booking information;
• communications between you and IYM;
• payment and billing information;
• Medicare, private health insurance or other funding information;
• details of your GP, specialist or other healthcare providers;
• referral information;
• employer and employment information where relevant;
• insurer, claims manager, rehabilitation provider or claim information;
• NDIS and plan-management information where relevant;
• information supplied through our website, registration forms or other systems; and
• other information reasonably necessary to provide or administer our services.
Health information
Health information is sensitive information and receives additional protection under Australian and NSW privacy laws. We may collect health information reasonably necessary to assess, provide, coordinate and manage your care, including:
• current symptoms, injuries and health conditions;
• past injuries, illnesses and medical conditions;
• treatment and rehabilitation history;
• medications and allergies;
• relevant family, social or lifestyle history;
• physical activity, exercise and sporting history;
• occupation and work demands where clinically relevant;
• medical and diagnostic reports, referrals, imaging and investigation results;
• physiotherapy assessments, clinical notes and observations;
• physical measurements and objective testing results;
• strength, movement and functional-testing information;
• rehabilitation and exercise programs;
• progress and outcome measures;
• photographs or video recordings taken for legitimate clinical purposes where appropriate; and
• other information reasonably relevant to your care.
HOW WE COLLECT INFORMATION
Where practical, we collect information directly from you. We may collect information when you make or change an appointment; attend an IYM clinic; receive a home-visit or other IYM service; complete a new-patient, consent or other form; provide information during assessment or treatment; telephone, email, SMS or otherwise communicate with us; communicate with us through Podium or another communication system; use our website or online booking facilities; provide documents, images, reports or correspondence to us; make a payment or claim; interact with our social-media accounts; or otherwise provide information to us.
Where permitted and reasonably necessary, information may also be obtained from third parties including GPs, specialists, hospitals, allied health practitioners, other healthcare providers, parents or guardians, authorised representatives, insurers and claims managers, workers compensation or CTP scheme participants, rehabilitation providers, employers where appropriate and authorised, NDIS participants or representatives, plan managers or support coordinators, Medicare or other government agencies, and other parties involved in your care, funding or claim.
WHY WE COLLECT AND USE YOUR INFORMATION
We may collect, use and disclose information for purposes including providing physiotherapy and healthcare services; assessing, diagnosing, treating and managing your condition within the practitioner's scope of practice; developing and monitoring rehabilitation programs; conducting clinical and objective assessments; coordinating your healthcare; communicating with healthcare practitioners involved in your care; managing appointments and reminders; maintaining clinical records; responding to enquiries; processing payments; processing Medicare and private-health claims; managing Workers Compensation, CTP, NDIS or other third-party funded services; communicating appropriately with insurers, rehabilitation providers and other authorised parties; managing accounts and debtors; operating and administering IYM; quality assurance and service improvement; appropriately conducted internal clinical review, professional development and training; responding to complaints; meeting insurance and legal requirements; complying with professional and regulatory obligations; protecting our systems and preventing fraud or misuse; and other purposes permitted or required by law.
We aim to collect only information reasonably necessary for our functions and activities and the healthcare we provide.
SHARING INFORMATION AS PART OF YOUR HEALTHCARE
We respect the confidentiality of your health information. Where appropriate, authorised or permitted by law, relevant information may be disclosed to your GP or referring practitioner; medical specialists; allied health practitioners; hospitals and other healthcare providers; Medicare; private health insurers; Workers Compensation insurers and claims managers; CTP insurers and claims managers; workplace rehabilitation providers; NDIS plan managers and other authorised NDIS parties; employers where appropriately authorised or legally permitted; government agencies; legal representatives or professional advisers; emergency services where necessary; other parties you authorise; or other persons or organisations where disclosure is required or authorised by law.
We seek to limit disclosures to information reasonably necessary for the relevant purpose.
CONSENT
Where consent is required, we will seek appropriate consent before collecting, using or disclosing personal or health information. Consent may be express or implied where permitted by law and appropriate to the circumstances.
You may withdraw a consent you have provided for a particular use or disclosure by contacting us. Withdrawal will not affect uses or disclosures already lawfully undertaken. In some circumstances, limiting or withdrawing consent may affect our ability to provide or coordinate healthcare or administer a claim or funding arrangement. Certain information may also be collected, retained, used or disclosed without consent where authorised or required by law.
CLINICAL PHOTOGRAPHS, VIDEO & OTHER RECORDINGS
Where clinically appropriate, IYM practitioners may use photographs, video or other recordings for purposes such as assessment, documenting clinical findings, movement analysis, monitoring rehabilitation or demonstrating progress. These materials form part of health information and will be handled accordingly.
Clinical photographs or recordings will not automatically be authorised for advertising, social media or promotional use merely because you consent to treatment or acknowledge this Privacy Policy.
Where IYM wishes to use identifiable patient information, photographs, video, testimonials or other patient material for marketing, promotional or social-media purposes, we will obtain appropriate separate consent.
INTERNAL EDUCATION, QUALITY IMPROVEMENT & RESEARCH
IYM may undertake internal activities intended to improve healthcare quality, clinical practice, administration and staff education. Where practicable and appropriate, information used for these purposes will be de-identified or limited to what is necessary.
Use or disclosure of health information for research, training or health-service management will only occur where permitted under applicable privacy laws and any applicable consent, ethics or statutory requirements. Acceptance of this Privacy Policy does not constitute blanket consent for identifiable health information to be used for external research or publication.
CHILDREN AND YOUNG PEOPLE
IYM provides healthcare to children and young people. We take additional care when handling their personal and health information. Depending on the child's age, maturity, capacity and circumstances, information and consent may appropriately involve the child or young person, their parent, guardian or another authorised representative. We will handle access to and disclosure of a child's health information in accordance with applicable law and professional obligations.
SYSTEMS AND SERVICE PROVIDERS
IYM uses third-party technology and service providers to operate the practice and provide healthcare. Depending on the circumstances, information may be processed using systems or providers associated with practice management and clinical records; online patient forms; appointment booking; patient communications and reminders; clinical testing and rehabilitation technology; payment and claiming; accounting and administration; website hosting; cloud and information-technology services; analytics; advertising and marketing; and professional services.
Systems currently used by IYM may include services such as Cliniko, Finger-Ink, VALD/DynaMo and MoveHealth, Podium, HICAPS, Medicare/PRODA and Xero, together with other service providers used in operating the practice. Providers and systems may change from time to time. We take reasonable steps appropriate to the circumstances to protect personal and health information handled through service providers.
PAYMENTS
IYM accepts payments through payment, EFTPOS, banking and health-claiming systems. Payment transactions may be processed by third-party financial institutions, payment processors or claiming providers. IYM does not itself store patients' complete payment-card details.
Payment and transaction information reasonably required for billing, accounting, reconciliation, refunds and legal recordkeeping may nevertheless be retained.
WEBSITE, COOKIES AND ANALYTICS
When you visit the IYM website, information may be collected automatically, including IP address; browser and device information; operating system; approximate location derived from technical information; pages visited; referring website or source; interactions with pages, links or buttons; date and time of visits; and other website usage information.
Our website uses, or may use, cookies, pixels, tags and similar technologies. IYM currently uses technologies associated with Google Analytics, Google Ads and Meta for purposes including website analytics, measuring advertising effectiveness, understanding website usage and improving our services and marketing. These third parties may process information in accordance with their respective privacy practices.
You can control some cookies and tracking technologies through browser, device or applicable consent/privacy settings, although disabling them may affect some website functionality.
ONLNE FORMS, BOOKINGS AND COMMUNICATIONS
Information submitted through our online registration, booking or enquiry processes may be handled through third-party systems acting on our behalf. This can include health information where you complete a patient-registration or clinical form.
IYM currently uses systems including Cliniko and Finger-Ink in connection with aspects of patient administration and records. Patient communications may be sent using Cliniko, Podium or other authorised communication systems. Please avoid sending unnecessary sensitive health information through general website enquiries or public social-media channels.
DIRECT MARKETING
Where permitted by law, IYM may communicate with you about services, educational information, events, promotions or other information that may be relevant to you. Where consent is required, we will seek it. You may opt out of marketing communications at any time using the unsubscribe or opt-out mechanism provided or by contacting IYM.
Opting out of marketing does not prevent IYM from sending necessary service communications, such as appointment information, administrative messages, billing information or communications relating to your healthcare.
OVERSEAS PROCESSING AND DISCLOSURE
Some technology and service providers used by IYM may operate infrastructure, personnel or data-processing facilities outside Australia. Where personal or health information is disclosed or processed overseas, IYM will take reasonable steps as required by applicable privacy law in relation to the handling of that information. The location of overseas processing may vary depending on the service provider, infrastructure and services used from time to time.
SECURITY
We take reasonable steps to protect personal and health information against misuse, interference, loss, unauthorised access, unauthorised modification and unauthorised disclosure. Depending on the circumstances, safeguards may include access controls and user permissions; passwords and authentication controls; secure clinical and administrative systems; staff confidentiality requirements; physical security; appropriate storage and disposal practices; system security measures; and processes for managing suspected privacy or security incidents.
No electronic system can be guaranteed to be completely secure. We nevertheless take reasonable measures appropriate to the sensitivity of the information we hold.
RETENTION OF HEALTH RECORDS
IYM retains health records in accordance with applicable legal, professional, insurance and business requirements. Under NSW health-record requirements, a private health service provider must generally retain health information where the information was collected while the patient was an adult for at least 7 years from the last occasion on which the provider provided a health service to that patient; and where the information was collected while the patient was under 18, until the patient reaches 25 years of age.
Information may be retained for longer where another legal, insurance or professional requirement applies or where otherwise reasonably required or permitted by law. When information is no longer required and may lawfully be destroyed, we take reasonable steps to securely destroy or de-identify it.
ACCESSING YOUR INFORMATION AND TRANSFERRING YOUR HEALTH RECORDS
You may request access to personal or health information IYM holds about you. We may require appropriate proof of identity and authority before providing access. Access may be provided in a suitable form, such as electronically, in hard copy or another appropriate manner.
In limited circumstances, access may be restricted or refused where permitted or required by law. Where applicable, we will explain the basis for a refusal and available complaint or review mechanisms. You may also request that appropriate health information be transferred to another healthcare provider.
CORRECTING YOUR INFORMATION
We take reasonable steps to ensure that information we hold is accurate, complete, relevant and up to date as appropriate. If you believe information we hold about you is inaccurate, incomplete, out of date or misleading, please contact us. We will consider requests for correction in accordance with applicable privacy and health-record laws.
ANONYMITY AND PSEUDONIMITY
Where lawful and practicable, you may have the option of interacting with IYM anonymously or using a pseudonym. However, this will generally not be practicable where we need to establish your identity to provide healthcare, maintain appropriate clinical records, process Medicare, private-health or third-party claims, manage an insurance or compensation matter, process payments, or comply with legal or professional requirements.
DATA BREACHES
If IYM becomes aware of a suspected data breach, we will take appropriate steps to contain, assess and respond to the incident. Where the Notifiable Data Breaches scheme or another applicable legal requirement requires notification, we will notify affected individuals and/or the relevant regulator as required.
PRIVACY COMPLAINTS
If you believe IYM has not handled your personal or health information appropriately, please contact us. Please provide sufficient information for us to understand and investigate your concern. We will consider the complaint and respond within a reasonable period.
If your complaint concerns Commonwealth privacy obligations and you are dissatisfied with our response, you may be entitled to contact the Office of the Australian Information Commissioner (OAIC). Issues concerning NSW health-privacy obligations may also fall within the jurisdiction of the Information and Privacy Commission NSW (IPC).
CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy from time to time to reflect changes in our services, systems, practices or legal requirements. The current version will be published on our website and will show the date it was last updated.
CONTACT IYM PHYSIOTHERAPY
For questions about privacy, requests for access or correction, requests concerning your records, or privacy complaints, please contact:
IYM Physiotherapy Pty Ltd
ABN 46 600 526 298
Email: admin@iymphysiotherapy.com.au
Phone: (02) 9599 9510
Registered address: 711/39 Cooper Street, Strathfield NSW 2135
Website: www.iymphysiotherapy.com.au
Privacy regulators
Office of the Australian Information Commissioner (OAIC)
Phone: 1300 363 992
Website: www.oaic.gov.au
Information and Privacy Commission NSW (IPC)
Phone: 1800 472 679
Website: www.ipc.nsw.gov.au
