Privacy Policy

About this policy

Specialist Sports Medicine (operated by Specialist Sport and Exercise Medicine Network Pty Ltd, ABN 77 696 596 175) is committed to protecting the privacy and confidentiality of all personal and health information we collect. This policy explains how we collect, use, store and disclose personal information, and your rights in relation to that information.

We are bound by the Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs). This policy applies to all patients, prospective patients, referrers, and other individuals whose information we hold.

1. Information we collect

Personal information

We collect personal information including name, date of birth, address, contact details, Medicare details, and emergency contacts.

Health information

We collect health and sensitive information including medical history, current conditions, medications, investigation results, imaging and pathology reports, clinical notes, treatment plans, and correspondence with other treating practitioners.

How we collect it

• Directly from you at the time of booking or during your consultation.
• From referral letters sent by your GP or other treating practitioners.
• From other health providers involved in your care (with your consent where required).
• From Medicare and health fund systems during billing.
• Via electronic intake forms, which we request through Consentic (consentic.com) and which integrate with our Gentu practice management system; forms may also be completed on paper. From 1 July 2026, these include an assignment-of-benefit consent form, completed through Consentic, which records your consent for the Medicare benefit for eligible services to be claimed and paid directly to the practice.
• Via telehealth platforms when consultations are conducted remotely.
• Via the contact form on our website, for non-booking enquiries only (see section 7).

2. Why we collect and use your information

Your information is collected and used to:

• Provide medical assessment, treatment and management.
• Communicate with other practitioners involved in your care.
• Process Medicare billing.
• Meet legal and regulatory obligations including mandatory reporting requirements.
• Respond to complaints, legal claims or regulatory enquiries where relevant.
• Conduct quality improvement and clinical audit activities (using de-identified data where practicable).

3. Disclosure of your information

We will not disclose your personal or health information to a third party without your consent, except where required or permitted by law. Circumstances where we may disclose without consent include a serious and imminent threat to health or safety, a court order or legal obligation, mandatory reporting requirements, or Medicare and insurer billing.

We share information with other members of your treating team as part of your ongoing care. You may request that we do not share your information with particular practitioners.

4. Storage and security

Your clinical records are stored in Gentu, a cloud-based practice management system operated by Magentus Pty Ltd, on Australian servers. We take reasonable steps to protect personal information from misuse, loss, and unauthorised access through password-protected systems, role-based access controls, encrypted data transmission, and secure messaging via Medical Objects.

Retention. We keep your clinical records for the periods required by law and our professional obligations. In Queensland this is generally at least seven years from the date of your last attendance for an adult, and, for a patient who was a child at the time of treatment, until they reach 25 years of age. When records are no longer required to be kept, they are securely destroyed or de-identified.

5. Telehealth consultations

We offer telehealth consultations via video or telephone using platforms that comply with Australian privacy obligations. The same documentation and confidentiality standards apply as for in-person consultations.

6. AI-assisted clinical note-taking (Heidi Health)

Heidi Health processes audio from your consultation to generate a draft clinical note. The treating clinician reviews and edits the note before it is saved to your medical record.

Topic	Detail
Audio retention	According to Heidi Health, audio is deleted once the note is generated and is not retained.
Server location	Heidi Health states that clinical note data is encrypted in transit and at rest and stored on servers in Australia, and that some processing may occur on overseas services where necessary for performance, using pseudonymised data. Heidi Health states that it holds ISO 27001 and SOC 2 Type II security certification.
Secondary use	Heidi Health advises that de-identified data may be used to improve the tool, and that no identifiable health information is sold or otherwise disclosed to third parties for their own purposes.
Your rights	You may decline the use of Heidi Health at any time. Let your clinician or reception know before or during your consultation. Your care is not affected.

From December 2026, the Privacy Act will require practices to disclose details of personal information used in automated processes. This policy will be updated at that time.

For a plain-language explanation of how Heidi Health is used in consultations, see How We Use AI.

7. Website: contact form, cookies and analytics

The contact form on our website lets you send a non-clinical message to the clinic. Bookings are not made via the form (phone bookings only). If you choose to use the form, the following applies.

What is collected

• The name, email address, and (optionally) phone number you provide.
• The topic you select (general enquiry, referrer enquiry, privacy or records request, feedback, media, careers, or other).
• The text of your message.
• Basic technical information automatically captured by the form provider for spam protection (such as IP address and timestamp).

How it is processed

Form submissions are processed by Web3Forms, a third-party form-handling service operated by Web3Forms LLC. Web3Forms receives your submission, applies spam protection (hCaptcha), and forwards the message by email to enquiries at noosassm.com.au. The website itself does not store form submissions in any database.

Topic	Detail
Server location	Web3Forms processes data on servers located outside Australia (United States). See web3forms.com/privacy for their full privacy commitments.
Retention	Submissions are held briefly by Web3Forms to enable email delivery. The clinic's copy is retained in our email system in line with general business correspondence retention.
Spam protection	hCaptcha may apply automatically to detect and block automated submissions. hCaptcha is operated by Intuition Machines, Inc. and processes minimal data for the purpose of bot detection.
What we do with the message	Form submissions are read by clinic administrative staff and replied to where appropriate. Where a message contains health information despite the warning above, the message is treated with the same confidentiality as other patient communications and managed under this policy.

If you would prefer not to use the form, you may contact the clinic by phone on (07) 5415 0428 or in person.

Cookies, local storage and website analytics

Our website uses a small amount of browser local storage to remember your choices (for example, dismissing a notice, or your cookie-consent selection). This is essential to the website working as expected and does not track you.

We do not currently run website analytics or advertising cookies. If analytics is introduced in future (for example, Google Analytics), it will load only after you accept analytics via the cookie-consent banner. You may decline, and you may change your choice at any time via the "Cookie settings" link; declining does not affect your care or your use of the website. Where analytics data is processed overseas, section 8 applies.

8. Overseas disclosure

Some technology systems we use may store or process data on servers outside Australia. This includes Heidi Health (AI-assisted clinical notes, see section 6) and Web3Forms with hCaptcha (website contact form, see section 7). Where personal information is disclosed overseas, we take reasonable steps to ensure it is handled in accordance with the Australian Privacy Principles, or we obtain your consent.

9. Accessing and correcting your information

You have the right to access personal information we hold about you and to request corrections where information is inaccurate or incomplete. Contact us at admin at noosassm.com.au or in writing. We will respond within 30 days. A reasonable fee may apply for record retrieval.

10. Data breaches

We are subject to the Notifiable Data Breaches scheme under the Privacy Act. If a data breach is likely to cause serious harm, we will notify you and the OAIC as soon as practicable. To report a suspected privacy issue, contact admin at noosassm.com.au.

11. Privacy complaints

If you have a concern about how we have handled your personal information, please contact us first:

We aim to respond within 30 days. If you are unsatisfied, you may contact the Office of the Australian Information Commissioner (OAIC):

• Web: oaic.gov.au
• Phone: 1300 363 992
• Post: GPO Box 5218, Sydney NSW 2001

12. Changes to this policy

This policy is reviewed annually and updated when practices, technology or obligations change. The current version is available at reception and on our website. Next review: May 2027.

Update history

• Version 1.2 (7 July 2026): named the Consentic assignment-of-benefit consent form (from 1 July 2026) in section 1; added a cookies, local storage and website analytics subsection to section 7.
• Version 1.1 (9 May 2026): added section 7 covering the website contact form, including Web3Forms processing and overseas disclosure. Web3Forms reference added to section 8 (Overseas disclosure). Reception bullet added to section 1 (How we collect it).
• Version 1.0 (May 2026): initial publication.

---

Version 1.2 · July 2026 · last updated 7 July 2026 · Specialist Sport and Exercise Medicine Network Pty Ltd ABN 77 696 596 175 · Next review: May 2027