Privacy Policy

How Burwood Podiatry and Lower Limb Rehab collects, uses, discloses and protects your personal and health information.

Burwood Podiatry and Lower Limb Rehab (“we”, “us”, “our”) is operated by Medcentre Podiatry Pty Ltd (ABN 79 604 620 117). This policy explains how we handle your information and your rights.

1. About this policy

This policy covers patients, carers, representatives, referrers, website visitors, people who apply or express interest in working with us, contractors and suppliers, and information collected in person, by phone, email, online booking or website.

2. The information we collect

For patients, this is generally:

• Personal details — name, date of birth, address, phone number, email, occupation and emergency contact.
• Health information — your reason for attending, symptoms, medical and podiatric history, medications and allergies, relevant conditions (for example diabetes or circulatory conditions), gait and biomechanical findings, diagnoses, treatment and management plans, clinical notes, clinical images or photographs of your feet and lower limbs (see section 8), orthotic prescriptions, and correspondence with other practitioners about your care.
• After-hours calls — if you call outside clinic hours, recordings and transcripts of the call made by our automated phone assistant (see section 9).
• Funding and billing details — Medicare, private health fund, DVA, NDIS, SIRA/workers-compensation or aged-care scheme details relevant to your funding pathway; any GP referral or care-plan information; appointment history, invoices and payment records.

For other people we deal with, this is generally:

• Referrers and suppliers — name, practice or business, provider number and contact details, and what you send us about a patient you refer.
• Website visitors — the analytics data described in section 9; the website itself does not ask for your name or contact details.
• Job applicants — see section 9.

Health information is “sensitive information” under privacy law and receives a higher level of protection. We generally collect health information with your consent and only as reasonably necessary. Collection without consent occurs only where permitted or required by law.

3. How we collect it, and being anonymous

We collect directly from you where practicable, including intake forms, bookings and conversations. Where expected or necessary for care, we also collect from treating clinicians, imaging or pathology providers, authorised representatives, Medicare, DVA, health funds, NDIS plan managers, support coordinators, aged-care case managers or SIRA insurers.

The website does not collect enquiries through a web form. General enquiries can be made by phone or email. Please do not include medical history, referral documents or other sensitive health information in a general email.

General enquiries may be anonymous or use a pseudonym. Clinical care, accurate records and funded claims generally require your true identity, making anonymous treatment impracticable.

4. Why we collect and use it

We use information for assessment, diagnosis, treatment and continuity of care; appointments and results; care-team communication; orthotics, imaging and related services; claims and payment; reminders and recalls; quality, safety, training and administration, including the software and AI-assisted workflows described in section 11; complaints or legal claims; and legal obligations.

5. Who we share it with

We do not sell your personal information. We share it, only as reasonably necessary, with: the podiatrists and staff involved in your care; your GP, referrers, specialists and other treating practitioners; imaging, pathology and orthotic laboratories and suppliers involved in your treatment; Medicare, your health fund (via HICAPS), DVA, an NDIS plan manager, support coordinator or aged-care case manager, or a SIRA/workers-compensation insurer, for claims and funding; our contracted service providers (for example our practice-management and booking software, our after-hours phone assistant, IT support and accounting providers, and, only for patients who say Yes to AI-assisted care, the AI tools Claude by Anthropic and ChatGPT by OpenAI) for the services they provide to us; a parent, guardian, carer or authorised representative where appropriate; our professional advisers, insurers and, where required, regulators or courts; and others where you consent or where the disclosure is required or authorised by law (for example to lessen or prevent a serious threat to life, health or safety).

6. Reminders, recalls and marketing

Care-related reminders, check-ins, recalls and information may arrive by SMS, phone, email or mail. You choose which of SMS, phone and email we use and can opt out of any of them, but we need at least one so we can remind you about appointments and follow up your care. Letters can be sent as well. Reminders and check-ins never contain offers or promotional links.

News and educational messages are opt-in, with an unsubscribe option, and are never sent to anyone under 18. If you agree on our registration form or at your orthotic fitting, we may also text you about options and occasional offers related to your orthotics, such as a backup pair; every such message includes an unsubscribe option, and choosing No to SMS overrides it. We never send offers to anyone under 18, and we never sell details for marketing. Opting out of news or offers does not stop care-related reminders or recalls through the channels you have chosen.

7. Storage, security and how long we keep records

We hold records mainly electronically, in our practice-management system (Nookal, which hosts our records in Australia) and in our clinic email account, protected by access controls and passwords. We take reasonable steps against misuse, interference, loss and unauthorised access, modification or disclosure. Contact us about information access or service security before sharing sensitive details.

Under NSW health-records law, records are generally kept at least 7 years after an adult’s last service, or until 25 for patients treated under 18, and longer where necessary. Once no longer needed and retention periods have passed, records are securely destroyed or de-identified.

8. Clinical images

Clinical photographs require your consent, are securely stored in your record and used only as agreed. Teaching or promotional use requires separate, express consent. You may decline or withdraw that consent without affecting care.

9. Third-party systems and overseas disclosure

Some systems we use to run the clinic are provided by third parties:

• Bookings and records: Nookal handles practice management and online bookings. Details entered on its booking page are collected and stored under its privacy policy and ours. Our Google Analytics measurement also runs on that booking page — see ‘Website and booking-page analytics’ below.
• Website enquiries: The website does not collect enquiries through a web form. General enquiries can be made by phone or email. Do not include sensitive health information in a general email.
• Job applications: If you apply or express interest in working with us, we collect what you send — usually your contact details, CV, experience, availability and any referee details — so we can consider you for current and future opportunities. Applications are received in our Google (Gmail) account, which may store information outside Australia. They are seen only by our clinic team, are not shared outside the clinic without your consent, and are deleted when no longer needed for recruitment. Please do not include health information, and only include referees who have agreed to be contacted.
• Website and booking-page analytics: This website uses Google Analytics 4 to understand how visitors use it — for example, which pages are viewed, how visitors found the site, and approximate location and device type. We also record when the phone number or the booking button is selected on a page — that the link was selected, its wording and which page it was on, not the call or what is said. Depending on our settings, Google Analytics may also record scrolling, file downloads and links you follow to other websites. This includes the pages you visit, which can relate to particular foot conditions. Google Analytics sets first-party cookies (_ga and _ga_5JCX1VMPKP, lasting up to two years) holding a random identifier used to distinguish browsers. We have reduced what is collected: Google signals and advertising features are switched off, we do not use User-ID, and on this website we remove search terms and other URL parameters before page addresses are sent. We do not combine analytics with patient records, and we do not use it to identify you. The same measurement also runs on our online booking page at bookings.nookal.com, which Nookal hosts for us, so that a visit beginning on the website and continuing to a booking is counted once rather than twice; cookies with the same two names are set there, belonging to that booking address. On the booking page it records which steps of the booking you reach and, when a booking is completed, that it completed, together with the appointment type and the fee shown for it — the name, contact details, date of birth and reason for visiting that you type into the booking form are not sent to Google Analytics. Because that page is Nookal’s rather than ours, advertising storage is not set to “denied” there and the web address is recorded as it appears; Google signals, advertising features and User-ID remain off for both. Google may process this information outside Australia, including in the United States. You can opt out using Google’s opt-out browser add-on or a tracker-blocking browser setting or extension; clearing cookies only resets the identifier. See our Cookie Policy for details.
• Professional referrals: Health professionals may choose to email referrals to the clinic’s general email address. Email is available but is not a secure referral portal. The referring professional or organisation is responsible for deciding whether email is appropriate, confirming authority and consent, and applying any secure-email or document-protection measures required by their policies. Referrers may call the clinic first if they prefer another transfer method. Once received, referrals are moved into the patient’s record and handled securely under this policy.
• After-hours and closed-day calls: after hours and on the days we are closed, calls are answered by an automated phone assistant (BookedSolid AI), a third-party service, so the phone line is answered 24/7. It can book or change appointments and help with basic enquiries, and collects your name, number and reason for calling. Calls may be recorded and transcribed. Avoid sensitive health details; discuss clinical matters during opening hours or at your appointment.
• AI tools: only for patients who say Yes to AI-assisted care, your podiatrist may use Claude (Anthropic) and ChatGPT (OpenAI) to help draft clinical notes, letters and treatment information. We use paid accounts with model training switched off. The providers may still keep information for a limited time under their own terms, so we remove names and other identifying details first and include only what each task needs. Your podiatrist reviews all output.
• Website hosting: Cloudflare hosts this website and processes technical data (such as your IP address, browser and the pages requested) to deliver and secure it.

Likely overseas locations. Google (Gmail and Google Analytics): the United States and other countries where Google operates. Nookal hosts our records in Australia, but its support and service providers may access them from the United States. Cloudflare (website hosting and security) operates a global network, including in the United States. Our automated phone assistant’s provider may also process call details outside Australia. Anthropic (Claude) and OpenAI (ChatGPT) may process information in the United States and other countries where they operate. Where we do disclose personal information to an overseas recipient, we take reasonable steps under Australian Privacy Principle 8 to ensure it is handled consistently with the Australian Privacy Principles.

Outside NSW. Some health information is held or sent outside New South Wales, for example to Services Australia (Medicare), the Department of Veterans’ Affairs, interstate insurers and our software providers. We do this only as Health Privacy Principle 14 permits, for example with your consent or where the recipient is bound by similar privacy law.

10. Data breaches

We contain and assess suspected or actual breaches. If serious harm is likely, we notify you and the OAIC as required by the Notifiable Data Breaches scheme, Part IIIC of the Privacy Act 1988 (Cth).

11. Automated decision-making

We use software, including artificial intelligence (AI), across our business and clinical workflows to help us provide efficient, high-quality care:

• Appointments and messages: our online booking system shows available times, and our after-hours phone assistant (BookedSolid AI) books or changes appointments and takes messages for staff to follow up. These use your contact and appointment details and the reason you give for calling.
• AI-assisted care (only if you say Yes): your podiatrist may use Claude (Anthropic) and ChatGPT (OpenAI) to help draft clinical notes, letters and treatment information. These use relevant health information, such as your symptoms, assessment findings and treatment plan.

For AI-assisted care, your podiatrist reviews all AI output. Your podiatrist makes every decision about your diagnosis and treatment. No computer program decides whether or how you are treated, or how urgently you are seen. Your podiatrist asks for your Yes or No to AI-assisted care at the start of your consultation, and you can change your choice at any time; saying No does not affect your care. We will update this section if the way we use these tools changes.

12. Cookies, this website and the booking page

The Cookie Policy explains the cookies this website and our online booking page use, including Google Analytics, what we have switched off, and how to opt out. Neither uses advertising cookies and neither shows a cookie banner; Google Analytics runs on every page of this website, and on the booking page, in the reduced set-up described above.

13. Accessing and correcting your information

You may request access or correction of inaccurate, outdated, incomplete or misleading information. Requests are free; retrieval or copying may attract a reasonable fee disclosed beforehand. We verify identity, usually respond within 30 days and provide your preferred access where reasonable. The law allows limited refusals, including serious safety threats or unreasonable impacts on others’ privacy. We explain any refusal and review options.

14. Complaints and how to contact us

Contact our Privacy Officer with questions. Please make a complaint in writing to our Privacy Officer (details below). We will acknowledge it within 7 days, look into it, and give you a written response within 30 days. If we need longer, we will tell you why.

If you are not satisfied with our response, you can contact either privacy regulator (for health records, the NSW Privacy Commissioner usually expects a complaint within 6 months):

For concerns about clinical care specifically, you can also contact the Health Care Complaints Commission (NSW) or the Australian Health Practitioner Regulation Agency (AHPRA).

15. Changes to this policy

We may update this policy as practice or law changes. The dated current version is available here and at the clinic.