Tandem Physio Privacy Policy

Full Privacy Policy

Who we are

Tandem Physio is a private physiotherapy and health service in NSW, operated by Chris Burgess. This policy covers personal information, including health information, handled through enquiries, referrals and our services. The Australian Privacy Principles and NSW health privacy requirements apply to our handling of this information.

Information we collect and how we collect it

Depending on the enquiry or service, we may collect identity and contact details; referral, health, clinical and functional information; funding and scheme details; representative and authority information; communications; and service, billing and administrative records.

We collect information directly from you through forms, email, telephone, direct communication and service provision. Where appropriate, we also receive information from authorised representatives, referrers and healthcare or support professionals. We seek information directly from you where reasonable and practicable, and take reasonable steps to make you aware when information comes from someone else.

We collect health information with consent where required, or otherwise where collection is permitted or required by law. Referrers must have appropriate authority and, where required, your consent to share information. We may check that authority before taking further action or sharing information. You can make a general enquiry without identifying a participant; identifying details may be needed to assess a formal referral or provide care.

Why we collect and use information

We use information to assess referral suitability, arrange and deliver physiotherapy, maintain clinical records, communicate and coordinate care where authorised, prepare reports, manage funding approvals and billing, administer the service, and meet legal, professional and regulatory obligations.

When we share information

Relevant information may be shared with your authorised representatives, treating professionals, support coordinators, case managers, funding bodies or insurers where you have consented or the sharing is otherwise permitted by law. Service and funding administration disclosures must be for the purpose of collection or a directly related purpose you would reasonably expect, unless another lawful basis applies. We limit sharing to what is needed for that purpose.

Our technology providers handle information to supply their services. We may also disclose information when required or authorised by law. Making a referral is not blanket permission to share information with anyone.

Systems and overseas handling

PracSuite collects and manages online referral information and is our authoritative clinical record. Submissions are reviewed in PracSuite Form Triage and processed into patient profiles where appropriate. Gmail is used for communication and referral notifications, which do not include completed referral PDFs. Google Forms was used for earlier referrals; any retained legacy submissions remain subject to the retention and deletion rules below. PandaDoc may hold identifiable information in practice documents.

PracSuite describes Australian data hosting, but its privacy policy and service terms also describe overseas handling through background services and integrations. Published locations include the United States, Canada, Ireland, the Netherlands, New Zealand, Singapore and the United Kingdom; which apply depends on the service or feature involved.

Google's privacy policy describes processing on servers around the world. PandaDoc offers hosting in the United States or Germany, depending on the account region, and uses service providers described in its subprocessor list.

These services may store or process information outside Australia or make it accessible to overseas service providers. Not all information is handled in every listed country. A complete country list cannot reliably be given for every feature or processing activity. We do not promise that all Tandem information stays in Australia. Contact us if you want to discuss these arrangements before providing sensitive information.

Holding and protecting information

Information is held in electronic records and communications in the systems described above. Our policy is to limit access to authorised purposes, use appropriate access controls and take reasonable steps to protect information from misuse, loss and unauthorised access, alteration or disclosure. No electronic service can guarantee absolute security. Please avoid unnecessary sensitive information in an initial email or enquiry; we can discuss how to provide documents that are needed.

Retention and deletion

Clinical records: relevant referral and clinical information becomes part of the PracSuite record when a referral proceeds. We retain health records for applicable legal and professional periods. NSW requirements generally mean at least seven years from the last health service for information collected while a person was an adult, and until age 25 for information collected while they were under 18. Longer retention may be needed for another legal obligation or a complaint, dispute or legal hold.

Duplicate intake copies: our policy is to delete duplicate identifiable intake information, including retained legacy Google Forms submissions and Gmail copies, once intake is complete and those copies are no longer operationally required, after checking the necessary information is preserved in the clinical record and no retention obligation or hold applies.

Referrals that do not proceed: our business policy is to delete identifiable referral information, including PracSuite intake submissions, retained legacy Google Form submissions and email referrals, within 90 days after the referral is closed, unless retention is required or authorised by law, or reasonably necessary for a complaint, dispute, funding matter or other legitimate legal or administrative purpose. This is Tandem's policy, not a statutory 90-day period. Health-record retention requirements may still apply even if no appointment takes place; these requirements take priority.

We are introducing periodic reviews to apply these rules to outstanding intake information, including older referrals. Deletion is reviewed manually, not automated. Where health information is disposed of, we keep the disposal record required by NSW law. These rules do not promise immediate removal from every service-provider backup.

Access and correction

You can ask Chris for access to information we hold about you or ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading. Contact us by email or telephone below. We may need to verify your identity or a representative's authority.

We respond promptly and within applicable legal timeframes. If access or correction is refused under an applicable exception, we will explain the decision and complaint options in writing where required. If we do not agree to a correction, you can ask for a statement of your concern to be associated with the record. There is no fee to request access or correction or to correct information; any permitted reasonable charge for providing access will be explained beforehand.

Privacy contact and complaints

Contact Chris Burgess at chris@tandemphysio.com.au or 0410 048 142. Please describe the issue and how you would like us to contact you, without sending unnecessary clinical detail. We will consider your concern, investigate as appropriate and explain the outcome and any proposed action. If more time or information is needed, we will let you know.

You can contact the Office of the Australian Information Commissioner (OAIC) about Commonwealth privacy matters. The OAIC asks you to complain to the organisation first; you can then complain to the OAIC if you are unhappy with the response or have not received one within 30 days.

For NSW health privacy matters, you can also contact the NSW Privacy Commissioner through the Information and Privacy Commission NSW (IPC). Its complaint guidance explains the process for private health providers. These external avenues have their own jurisdiction and time limits.

Policy updates

We may update this policy when our practices or relevant requirements change. The current version and update date will be available on this page. Contact us if you need a copy or help understanding it.