Your Privacy and Our Commitment
At Box Hill Osteopathy, your privacy is our priority. We are committed to protecting your personal and health information you share with us. This policy explains how we collect, use, store, and disclose your information in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth) and other relevant privacy laws.
1. Why We Collect Personal Information
Osteopaths are legally required to keep accurate and complete clinical records as part of providing safe, effective, and evidence-based care. We collect information about your personal and medical history to enable appropriate assessment, diagnosis, and treatment.
By using our services and providing your personal information, you consent to its collection, use, and disclosure as described in this policy.
2. Information We Collect
We may collect the following types of information:
- Full name, address, and contact details (email and phone number)
- Date of birth
- Medical and family health history relevant to your care
- Payment information (credit card or bank details, if applicable)
- Appointment history, treatment notes, and correspondence
Information is collected through:
- Online bookings and forms (via Cliniko)
- Emails, phone calls, and SMS communication
- In-person consultations and paper forms
- Postal mail or other direct correspondence
Except as described in this policy, Box Hill Osteopathy is the sole custodian of the information collected. We do not sell, rent, or trade your personal data.
3. Information from Third Parties
With your consent, we may collect or share information with other healthcare professionals to assist in your ongoing care.
Occasionally, legal entities (such as courts, insurance companies, or government agencies) may request access to your records. We will inform you wherever possible if such a request is made.
4. How We Store and Protect Your Information
Your records are stored in an encrypted electronic system that meets Australian privacy and security standards.
We retain your health records for as long as required by law—typically seven (7) years from your last visit, or longer when clinically or legally necessary.
If our clinic changes ownership, merges, or closes, you will be notified and advised on how to access or transfer your medical records.
5. Use of Google Workspace
At Box Hill Osteopathy, we use Google Workspace (Gmail, Google Drive, and related tools) for secure communication and document management.
- Google Workspace is a HIPAA-compliant and GDPR-aligned platform with encryption in transit and at rest.
- It is used to communicate with patients, other healthcare providers, and administrative partners.
- Emails and documents are stored securely within our Google Workspace domain and can only be accessed by authorised staff members.
- No personal health information is shared outside of Google Workspace or Cliniko without your consent, except where required by law.
You can view Google’s privacy and data protection policies here:
https://policies.google.com/privacy
6. Use of Heidi AI
Box Hill Osteopathy uses Heidi AI, a secure, healthcare-specific artificial intelligence platform that assists with patient communication, note management, and clinical documentation.
- Heidi AI helps improve efficiency and consistency in administrative and clinical processes.
- Any data shared with Heidi AI is processed under strict confidentiality and privacy controls.
- Heidi AI does not sell or share patient information with unauthorised third parties.
- All information processed through Heidi AI is encrypted and used solely for clinical and administrative purposes by authorised staff.
You can review Heidi AI’s privacy policy here: www.heidihealth.com/privacy-policy.
7. Third-Party Services We Use
We partner with secure, reputable third-party systems to help manage your care:
Cliniko – for appointment bookings and electronic health record management. View Cliniko’s Privacy Policy.
All third-party platforms used by Box Hill Osteopathy comply with strong privacy, encryption, and data protection standards.
8. Cookies and Website Analytics
Our website may use cookies or analytics tools (such as Google Analytics) to understand how visitors use our site.
These tools collect anonymous data such as browser type, device, and pages visited. This information helps us improve our website and user experience.
No personally identifiable information is collected through these tools, and you can disable cookies through your browser settings if you prefer.
9. Access to Your Information
You have the right to access the personal and health information we hold about you.
To request access, correction, or a copy of your records, please contact our clinic directly. A small administrative fee may apply to cover the cost of processing your request, as permitted under Australian privacy law.
10. Privacy Complaints and Resolution
If you have a concern, or believe your privacy has been breached, please contact Box Hill Osteopathy in writing so we can investigate and respond promptly.
If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or by calling 1300 363 992.
11. Updates to This Policy
This policy may be updated periodically to reflect changes in privacy regulations or clinic procedures. The most recent version will always be available on our website or at reception.
Last updated: November 2025
12. Contact Us About Privacy
If you have any questions, concerns, or requests regarding your privacy or medical records, please contact us via email at hello@boxhillosteopathy.com.au.