Who I am

Drop By Physio is my physiotherapy practice. I'm Viktor Kaaz, a registered physiotherapist (ABN 58 776 458 132), and I'm responsible for the information the practice holds. I handle it under the Australian Privacy Principles in the Privacy Act 1988 (Cth).

What I collect

• Your details: name, date of birth, address, phone and email.
• Health information: your medical history and medications, why you're seeing me, what I find when I assess you, your treatment notes, reports, and letters from other health professionals.
• Funding details: Medicare, NDIS, Support at Home or Department of Veterans' Affairs details when they pay for your care, and your health fund if you claim a receipt.
• People involved in your care: your GP, other health professionals, support coordinator or care provider, and any family member, carer or emergency contact you name.
• Payments: card payments go through Square or Halaxy. I don't see or keep your full card number.
• From this website: what you send through a form, and visit statistics that don't identify you.

How I collect it

Mostly from you: at appointments, by phone or email, when you book online, or through a form on this website.

Sometimes from others, with your agreement or where you'd reasonably expect it: your GP or another health professional who refers you, your support coordinator, Support at Home provider or plan manager, or a family member or carer.

Why I use it

• To assess and treat you safely.
• To keep your GP and care team informed and to write reports.
• To arrange appointments and send reminders.
• To invoice and claim payment for your care.
• To meet my legal and professional duties, such as keeping clinical records.
• To answer your messages, and to send you the one email you asked for if you join a guide waitlist.

Who I share it with

Only as much as is needed, and only with:

• your GP and other health professionals involved in your care;
• your Support at Home provider, NDIS plan manager or support coordinator, for your care and its payment;
• Services Australia (Medicare) or the Department of Veterans' Affairs, when I claim for your care;
• anyone you ask me to share it with, such as a family member or carer;
• my professional indemnity insurer and legal advisers, if there is a claim or complaint;
• others when the law requires or allows it, for example a court order, or to lessen a serious threat to someone's life, health or safety.

I never sell your information, and I don't use it for advertising.

The services I use

A few trusted services help me run the practice. They handle your information on my behalf:

• Halaxy: clinical records, appointments, online booking and invoices.
• Google Workspace: the practice email.
• Cloudflare: this website, delivery of website forms to my inbox, and visit statistics.
• Apple iCloud: the recordings of notes I dictate, end-to-end encrypted.
• Square: card payments.
• Payhip: checkout and download for guides, once they're on sale.

Some of these services may store or process information outside Australia, including in the United States and the United Kingdom. I choose services with strong security and privacy commitments.

My clinical notes

I dictate some of my clinical notes with Apple's Voice Memos app, which also turns the recording into text. The recordings are kept in my Apple iCloud account with end-to-end encryption, so Apple can't read them. Software on my own computer then turns the text into a draft note, and I check and complete every note myself before it goes into your record. I don't use your information to train artificial intelligence.

Keeping it safe

Your records are kept electronically in Halaxy, not on paper. Only I can access them, and my devices and accounts are protected by passwords.

If a data breach is likely to cause you serious harm, I'll tell you and the Office of the Australian Information Commissioner, as the law requires.

How long I keep it

I keep health records for at least seven years after your last appointment, or until a child turns 25, whichever is later. After that I destroy them securely. Website messages are deleted once they're dealt with, and waitlist email addresses are deleted once I've sent the email you asked for.

This website

• The site doesn't use advertising or tracking cookies. Cloudflare may set a strictly necessary security cookie that protects the site from abuse.
• I count visits with Cloudflare Web Analytics, which works without cookies and doesn't identify you.
• The contact form, referral form and guide waitlist are delivered to my practice inbox. They aren't stored on the website.
• Online booking happens on Halaxy's website and guide checkout on Payhip's. Their own privacy policies apply there.

Staying anonymous

You can ask me general questions without giving your name. To assess or treat you, I need to know who you are.

Seeing and correcting your information

You can ask for a copy of the information I hold about you, or ask me to correct it. Call or email me. I'll reply within 30 days.

Asking costs nothing. If providing a copy takes significant time, I'll tell you about any fee before I go ahead. In the rare cases where the law lets me refuse, I'll explain why in writing.

News and offers

I only send you news about guides or services if you've agreed to it, and every message includes a way to unsubscribe.

Questions and complaints

If you have a question or a concern about your privacy, please tell me first: email admin@dropbyphysio.com or call 0451 025 284. I'll respond within 30 days.

If you're not satisfied, you can contact the Office of the Australian Information Commissioner on 1300 363 992 or at oaic.gov.au. For complaints about health care in Queensland, contact the Office of the Health Ombudsman on 133 OHO (133 646) or at oho.qld.gov.au.

Changes to this policy

I'll update this policy when the way I handle information changes. The date at the top shows the current version.