Privacy Policy

Carlingford Physiotherapy and Rehabilitation
ABN 36 676 063 738
Last updated: 14 August 2026

Carlingford Physiotherapy and Rehabilitation, operated by Ivan Tsz-Kuen Lo as a sole trader, respects your privacy and is committed to protecting the personal and health information entrusted to us.

This Privacy Policy explains how we collect, use, disclose, store and protect personal information, including health information, in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

1. Who we are

Carlingford Physiotherapy and Rehabilitation is the registered business name of Ivan Tsz-Kuen Lo (ABN 36 676 063 738).

We provide physiotherapy and rehabilitation services from:

2 Plympton Road, Carlingford NSW 2118

For privacy enquiries, requests for access or correction, or privacy complaints, please contact us:

Email:carlingfordphysiorehab@outlook.com
Phone: 0498 086 996

2. What personal information do we collect?

Depending on the services you receive and how you interact with us, we may collect and hold personal information including:

  • your name and contact details, including telephone number, email address and residential address;

  • date of birth;

  • information relating to your medical history and current health concerns;

  • information about your physical condition, symptoms, assessment findings, diagnosis and treatment;

  • information about your previous or current healthcare providers and referrals;

  • information contained in reports, correspondence and other documents provided to us;

  • appointment and attendance information;

  • payment and billing information;

  • private health insurance information where required to process a claim;

  • Medicare information where required for an applicable service or claim;

  • workers compensation or CTP claim information where applicable; and

  • any other information reasonably necessary for us to provide physiotherapy and related services.

Health information is sensitive information under the Privacy Act and is handled with additional care.

3. How do we collect personal information?

We may collect personal information in a number of ways, including:

  • when you contact us by telephone or SMS;

  • when you attend the clinic;

  • when you complete registration, consent or other forms;

  • during physiotherapy consultations and assessments;

  • when you provide information verbally or in writing;

  • when we receive referrals or correspondence from your GP, specialist or another healthcare provider;

  • when you provide information relating to workers compensation, CTP, Medicare or private health insurance claims;

  • when you make payments or submit health insurance claims; and

  • when you communicate with us by email.

We may also collect limited technical information when you visit our website, such as information collected through cookies, analytics or similar technologies.

4. Why do we collect and use your information?

We collect, hold, use and disclose personal information where reasonably necessary for purposes including:

  • providing physiotherapy, rehabilitation and related healthcare services;

  • assessing your condition and developing and reviewing your treatment;

  • maintaining accurate clinical and administrative records;

  • managing appointments and communicating with you;

  • communicating with your GP, specialist, referrer or other healthcare providers involved in your care;

  • processing payments and private health insurance claims;

  • administering workers compensation and CTP claims where applicable;

  • complying with legal, regulatory and professional obligations;

  • responding to enquiries, requests and complaints;

  • managing the operation and administration of our practice;

  • maintaining and improving our services; and

  • protecting the health, safety and wellbeing of patients and others.

We will generally only use or disclose your health information for the purpose for which it was collected, a directly related purpose that you would reasonably expect, where you have consented, or where otherwise permitted or required by law.

5. Disclosure of personal information

We may disclose relevant personal information where reasonably necessary for your care, practice administration or other purposes permitted by law.

Depending on your circumstances, information may be disclosed to:

  • your GP, specialist or other treating healthcare providers;

  • other healthcare professionals involved in your care;

  • workers compensation insurers, CTP insurers or relevant claim administrators where applicable;

  • Medicare or other government bodies where required for an applicable claim or service;

  • private health insurers and health fund claims processors;

  • HICAPS and relevant payment or claims processing services;

  • service providers that assist us with information technology, communications, data storage, practice management or other business functions; and

  • government, regulatory or law enforcement authorities where disclosure is required or authorised by law.

We do not sell your personal or health information.

We do not use health information for direct marketing unless permitted by law and, where required, with your consent.

6. Third-party service providers

We use third-party services to assist with the operation and administration of our practice. These currently include:

  • Cliniko for practice management, appointments and electronic patient records;

  • HICAPS for eligible private health insurance claims and related transactions;

  • Microsoft Outlook for email communication, including receiving referrals and clinical correspondence where applicable; and

  • telecommunications services for telephone and SMS communication.

Information received by email, such as referral letters or clinical correspondence from healthcare providers, may contain personal and health information. Relevant clinical information and documents may be transferred to the patient's clinical record in Cliniko as appropriate.

These providers may process or store information on our behalf. Some third-party providers may use infrastructure or service providers located outside Australia.

We take reasonable steps to select and use service providers in a manner consistent with our privacy obligations.

7. Overseas disclosure

Some service providers we use may store, process or provide access to information outside Australia.

Where personal information is disclosed to an overseas recipient, we take reasonable steps to ensure that the disclosure is handled in accordance with applicable Australian privacy requirements.

The location and arrangements of third-party services may change from time to time. We will update our practices where reasonably necessary to reflect material changes.

8. How we store and protect your information

We take reasonable steps to protect personal and health information from misuse, interference, loss, and unauthorised access, modification or disclosure.

Electronic patient records are primarily maintained using Cliniko, our practice management and clinical record system.

Depending on the type of information and system involved, safeguards may include:

  • individual user accounts and access controls;

  • multi-factor authentication, including two-factor authentication where available and appropriate;

  • restricting access to patient information to authorised personnel who require it for their role;

  • secure electronic systems and cloud-based services;

  • confidentiality obligations for practitioners and administrative personnel; and

  • secure disposal or destruction of information when it is no longer required to be retained.

Access to patient information is limited to authorised practitioners and administrative personnel who require the information to provide healthcare services or perform their authorised duties.

9. Accuracy and retention of information

We take reasonable steps to ensure that personal information we hold is accurate, complete, relevant and up to date.

We retain personal and health information for as long as reasonably necessary and as required by applicable legal, regulatory and professional record-keeping requirements.

When information is no longer required to be retained, we take reasonable steps to securely destroy or de-identify it.

10. Access to your information

You generally have a right to request access to personal information and health information we hold about you.

To request access, please contact us using the details provided in this Privacy Policy. We may ask you to provide information necessary to verify your identity.

We will generally respond to access requests within a reasonable period and aim to respond within 30 days where practicable.

In some circumstances, access may be refused where permitted or required by law. If access is refused, we will explain the reason where we are able to do so.

11. Correction of your information

If you believe that personal or health information we hold about you is inaccurate, incomplete, out of date, irrelevant or misleading, you may ask us to correct it.

Please contact us using the details in this Privacy Policy and explain what information you believe requires correction.

We will take reasonable steps to correct information where appropriate and generally aim to respond to correction requests within 30 days.

There is no charge for requesting correction of health information.

12. Privacy complaints

If you believe that we have handled your personal information or health information in a way that does not comply with this Privacy Policy or the Australian Privacy Principles, you may make a privacy complaint.

Please contact:

Carlingford Physiotherapy and Rehabilitation
Email:carlingfordphysiorehab@outlook.com
Phone: 0498 086 996

Please provide sufficient information for us to understand and investigate your concern.

We will acknowledge and investigate privacy complaints and endeavour to respond within a reasonable period.

If you are not satisfied with our response, or believe your privacy complaint has not been adequately addressed, you may contact the Office of the Australian Information Commissioner (OAIC).

13. Website, cookies and Google Maps

Our website is hosted using Squarespace.

When you visit our website, certain information may be collected automatically by the website platform or third-party services used on the website. This may include information such as:

  • IP address;

  • browser and device information;

  • pages visited;

  • approximate location information;

  • referring website;

  • website usage information; and

  • information collected through cookies or similar technologies.

We may use this information to operate, maintain, secure and improve our website and understand how visitors use it.

Our website does not currently provide an online patient booking system, contact form or newsletter subscription service.

Our website includes an embedded Google Maps feature to help visitors locate our clinic. When you interact with an embedded Google Maps feature, Google may collect information in accordance with its own privacy practices. Further information is available through Google's privacy policy.

14. Communications by telephone, SMS and email

Patients may contact the clinic by telephone, SMS or email.

Information provided through these communication channels may be collected and used for purposes such as appointment management, responding to enquiries and communicating about healthcare services.

Where appropriate, we may use other suitable methods for transmitting particularly sensitive information.

15. Children and authorised representatives

Where a patient is a child or another person is legally authorised to act on behalf of a patient, we may collect and disclose information to a parent, guardian, carer or authorised representative where permitted or required by law.

We may take reasonable steps to verify the identity and authority of a person requesting access to another person's information.

16. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our services, information-handling practices, technology or legal requirements.

The current version will be made available on our website.

Last updated: 10 August 2026

17. Contact us

If you have any questions about this Privacy Policy or how we handle personal information, please contact:

Carlingford Physiotherapy and Rehabilitation
ABN 36 676 063 738
2 Plympton Road, Carlingford NSW 2118
Phone: 0498 086 996
Email:carlingfordphysiorehab@outlook.com