Effective date: 31 July 2026

1. About this policy

Eurobodalla Health & Fitness respects your privacy and is committed to handling personal information responsibly.

This policy explains how we collect, hold, use and disclose personal information when you receive or enquire about our allied-health, exercise physiology, physiotherapy, fitness, gym or class services; are referred to us or make a referral; use our website, online forms, booking options or other digital services; communicate with us, attend an event or participate in a program; or otherwise deal with our team.

We aim to manage personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles, the Health Records and Information Privacy Act 2002 (NSW) and other laws that apply to our services.

Where it is lawful and practical, you may interact with us anonymously or using a pseudonym. We will usually need your correct identity and contact details when providing health services, arranging appointments, processing payments or funding, responding to a referral, or meeting legal and safety obligations.

2. Personal information we may collect

The information we collect depends on how you deal with us. It may include:

• identity and contact details, such as your name, date of birth, address, telephone number and email address;
• emergency contact, parent, guardian, carer or authorised representative details;
• health information, including health history, current conditions, disability, injuries, medications, assessments, treatment or exercise plans, progress notes and information relevant to providing safe services;
• referral information and reports from health practitioners, support coordinators, case managers, insurers, funders or other authorised parties;
• appointment, attendance, membership, program and communication records;
• payment, invoice, funding and claim information, including details needed to manage Medicare, private health, NDIS, aged care, DVA, workers compensation or other relevant arrangements;
• feedback, complaints, incident and consent records;
• recruitment, contractor and business-contact information; and
• website and device information, such as IP address, browser type, pages viewed, referral source, approximate location and cookie or similar identifiers.

We only collect information that is reasonably necessary for our functions and activities, or as otherwise authorised or required by law. Health information and other sensitive information are collected with consent where required, or where another lawful basis applies.

3. How we collect information

We may collect information directly from you; from a parent, guardian, carer, authorised representative or referrer; from practitioners and organisations involved in your care or funding where authorised or lawful; when you use our website or digital services; and from public sources or third parties where this is lawful and reasonably necessary.

If you provide us with another person’s information, please make sure you are authorised to do so and, where practical, that the person knows about this policy.

If we cannot collect information that is reasonably necessary, we may not be able to provide a service, process a referral or claim, respond fully to an enquiry, or ensure that an activity is appropriate and safe.

4. Why we collect, hold, use and disclose information

We may handle personal information to:

• assess your needs and provide safe, appropriate health, exercise, fitness and related services;
• manage referrals, appointments, attendance, programs, memberships and waiting lists;
• communicate with you, your authorised representative and others involved in your care or support;
• prepare records, reports, plans, invoices, claims and funding documentation;
• process payments and manage accounts;
• coordinate services with practitioners, referrers, funders and authorised support people;
• respond to enquiries, feedback, complaints, incidents and access or correction requests;
• improve service quality, safety, training, operations and client experience;
• maintain and secure our website, systems, premises and records;
• manage staff, contractors and business relationships;
• communicate news, programs or services where permitted; and
• comply with professional, funding, insurance, public-health, safety, reporting and other legal obligations.

We generally use or disclose health information for the purpose for which it was collected, for a directly related purpose you would reasonably expect, with your consent, or as otherwise permitted or required by law.

5. Who we may disclose information to

Depending on the circumstances, we may disclose relevant information to our practitioners, staff and contractors; authorised representatives and support people; treating practitioners, referrers and organisations involved in your care; payment processors, funders and claims managers; professional advisers, auditors, accreditation bodies and insurers; technology, communications, booking, payment, cloud and records-management providers; regulators, courts, law-enforcement bodies and government agencies; and another person or organisation with your consent or where disclosure is otherwise lawful.

We seek to limit disclosures to information that is reasonably necessary for the relevant purpose.

6. Direct marketing

We may use your contact details to tell you about relevant services, programs, classes, events or health and fitness information where you have consented or where the law otherwise permits.

You can opt out at any time by using an unsubscribe link or contacting us. We will action the request within a reasonable period. Opting out of marketing will not stop service, appointment, safety, billing or other necessary communications.

We do not sell personal information.

7. How we protect information

We take reasonable steps, appropriate to the nature of the information and the risks involved, to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure.

These steps may include role-based access, staff confidentiality obligations and training, authentication controls, device and network protections, secure premises, backups, vendor review and procedures for responding to privacy or security incidents.

No method of storage or transmission is completely risk free. If we become aware of a suspected data breach, we will take steps to contain and assess it and will make notifications where required by the Notifiable Data Breaches scheme or another applicable law.

8. Access and correction

You may ask for access to personal information we hold about you or ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading.

Please contact our Privacy Officer using the details below. We may need to verify your identity or authority before acting. We will respond within a reasonable period and provide access in a suitable form where reasonably practicable.

In some circumstances, the law permits or requires us to refuse access or correction. If that happens, we will explain the decision and available complaint options unless it would be unlawful to do so. Where appropriate, you may ask us to associate a statement with a record you believe is incorrect.

9. Privacy complaints

If you have a concern or complaint, contact our Privacy Officer and provide enough information for us to understand the issue. We will acknowledge the complaint, investigate it fairly and respond within a reasonable period. We may ask for more information and will explain the outcome and any steps we propose to take.

If you are not satisfied, you may contact the Office of the Australian Information Commissioner or, for health information handled by a NSW private health service provider, the Information and Privacy Commission NSW.

10. Cloud services and overseas disclosure

We use technology and cloud service providers to support activities such as practice administration, communications, payments, website operation, analytics and secure record storage.

Eurobodalla Health & Fitness is not likely to disclose personal information to overseas recipients. We may, however, use technology and cloud service providers whose systems, support services or data pathways operate across more than one country. This may involve personal information being stored, processed or transmitted outside Australia in circumstances that do not amount to disclosure to an overseas recipient under Australian privacy law.

If our practices change and we become likely to disclose personal information to overseas recipients, we will update this policy and take the steps required by law.

11. Retention and secure disposal

We keep personal information only for as long as reasonably necessary for our services, legal and professional obligations, funding and insurance requirements, dispute management and legitimate business needs.

For health information held by a private health service provider in NSW, legal minimum periods generally require records collected while a person was an adult to be kept for at least seven years after the last health service, and records collected while a person was under 18 to be kept until the person turns 25. Longer periods may apply in particular circumstances.

When information is no longer required and lawful retention periods have ended, we take reasonable steps to securely destroy it or permanently de-identify it. We also maintain records of certain transfers or disposals where NSW law requires this.

12. Cookies and website information

Our website may use cookies, pixels and similar technologies. These are small files or identifiers stored on or read from your device.

Depending on the website feature and configuration, we may use:

• essential cookies to operate, secure and deliver the website;
• preference cookies to remember choices;
• analytics and performance technologies to understand how the website is used and improve it; and
• advertising and measurement technologies to understand campaign performance and present more relevant communications.

Website information may include IP address, device and browser information, approximate location, pages viewed, links used, visit times and campaign or referral information. We do not intentionally place clinical notes or the content of health enquiries into advertising cookies.

You can control cookies through your browser or device settings and, where available, website consent controls. Blocking some cookies may affect how parts of the website work. Third-party sites and services linked from our website have their own privacy practices.

13. Policy updates

We may update this policy when our services, systems or legal obligations change. The current version will be available on our website and will show its effective date. Material changes may also be communicated in another appropriate way.

14. Contact us

Privacy Officer
Eurobodalla Health & Fitness
Email: admin@eurobodallaep.com
Phone: 02 4472 8008
Website: eurobodallahealthandfitness.com.au/contact