Privacy Policy

2. What This Policy Covers

This policy explains how we collect, hold, use and disclose your personal information, including health information, whether you are a client of our exercise physiology services, a gym member, a visitor to this website, or someone who contacts us.

3. The Information We Collect

Your name, date of birth, address, phone number, email address, emergency contact details, and your next of kin where you provide them.

Health information is treated as sensitive information under the Privacy Act and is given a higher level of protection. This includes your medical history, current conditions and symptoms, injuries, medications, GP and specialist details, referral information, assessment results (including VALD ForceDecks and Dynamo testing data), clinical notes, exercise programs, and your progress over time.

Your Medicare number, DVA card details, NDIS participant number, private health fund details, WorkCover or insurer claim details, and payment card information where you pay by card.

Membership type, billing details, access records showing when you enter the facility, and health screening responses you provide before using the gym.

When you visit our website we collect your IP address, browser and device type, the pages you view, how you arrived at our site, and how you interact with it. This is collected through Google Analytics and Google Ads and is generally not used to identify you personally.

4. How We Collect It

• Directly from you — in person, by phone, by email, through our website contact form, or through our online booking system.
• From your GP or referring practitioner, where you have been referred to us.
• From your insurer, WorkCover claims manager, rehabilitation consultant or NDIS plan manager, where they are funding your care.
• From other health practitioners involved in your care, with your consent.
• Automatically, through cookies and analytics when you use our website.

Wherever it is reasonable and practicable, we collect your information directly from you.

5. Why We Collect It

• To assess your condition and design and deliver a safe, appropriate exercise program.
• To keep accurate clinical records of your care.
• To communicate with you about appointments, including reminders.
• To bill you and to claim on your behalf from Medicare, DVA, NDIS, your private health fund, an insurer or WorkCover.
• To report on your progress to your referring GP, insurer or plan manager where that is part of your care or funding arrangement.
• To manage your gym membership and facility access.
• To meet our legal, professional and insurance obligations.
• To improve our services and our website.

6. Consent

We collect health information only with your consent, or where the law otherwise permits or requires it. You can withdraw your consent at any time by contacting us, although this may affect our ability to continue providing you with services.

7. Who We Share It With

We do not sell your personal information. We may share it with:

• Your referring GP or specialist — progress reports and treatment summaries, as part of your care.
• Funders — Medicare, the Department of Veterans' Affairs, the NDIS, your private health fund, WorkCover WA or an insurer, for the purpose of claiming and reporting.
• Rehabilitation providers and claims managers, where they are coordinating your return to work.
• Other health practitioners involved in your care, with your consent.
• Our software and service providers — listed in section 8.
• Anyone else you direct us to, or where we are required or authorised by law to disclose, including where there is a serious threat to someone's life, health or safety.

8. Our Service Providers and Overseas Storage

We use the following platforms to run our services. Some are operated by companies outside Australia, which means your information may be stored or accessed overseas.

Your clinical records are held in Australia. Before disclosing personal information overseas we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles.

9. How We Protect Your Information

We take reasonable steps to protect your information from misuse, interference, loss, and unauthorised access, modification or disclosure. This includes password-protected and access-controlled systems, encryption of clinical data in transit and at rest, restricting staff access to what each person needs for their role, secure storage of any paper records, and confidentiality obligations for all staff and contractors.

10. How Long We Keep It

We retain clinical records for at least seven years from your last appointment. Where you were under 18 at your last appointment, we retain your records until you turn 25. Other records are kept only as long as we need them for the purpose they were collected or to meet our legal obligations, after which they are securely destroyed or de-identified.

11. Direct Marketing

We may send you information about our services, classes, programs and offers. Every marketing message includes an unsubscribe option, and you can opt out at any time by contacting us. We will not use your health information for marketing without your consent.

12. Cookies and Website Tracking

Our website uses cookies and similar technologies through Google Analytics and Google Ads to understand how people use the site and to measure our advertising. This may include remarketing, which means you may see our ads on other websites after visiting ours.

You can control or disable cookies through your browser settings, and you can opt out of personalised Google advertising through Google's Ads Settings. Disabling cookies may affect how parts of our website work.

13. Accessing and Correcting Your Information

You can ask for a copy of the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date, incomplete or misleading. Contact us using the details in section 16.

We will respond within a reasonable time, normally 30 days. There is no fee to request access, though we may charge a reasonable fee for the time and materials involved in providing it. In limited circumstances we may refuse access or correction — if we do, we will explain why in writing and tell you how to complain.

14. Complaints

If you believe we have breached the Australian Privacy Principles, please contact us first. We will acknowledge your complaint within 7 days and aim to resolve it within 30 days.

If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

15. Data Breaches

If a data breach occurs that is likely to result in serious harm, we will notify you and the Office of the Australian Information Commissioner as required under the Notifiable Data Breaches scheme.

16. Contact Us

17. Changes to This Policy

We may update this policy from time to time. The current version is always available at valenhealth.com.au/privacy, and the date at the top shows when it was last updated.