Privacy policy and collection notice

We handle your health information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Part A explains what happens when your information is collected; Part B describes how it is handled and protected.

Part A: Collection notice

Who we are. Arlovo Health is a mobile physiotherapy practice in Adelaide. Your physiotherapist's full name and Ahpra registration number are given to you in writing before your first visit.

Contact. Phone 0495 021 852. Email hello@arlovohealth.com.au.

What we collect. Your contact details, health information relevant to your care, funding details (for example, NDIS plan dates and plan manager, or private payment details), and details of your support people, emergency contact and any substitute decision-maker.

Referrals. When someone sends a referral through our online form, we collect the client's name, date of birth if given, email if given, suburb, funding type and plan manager, preferred contact method, the reason for referral and any health, mobility, falls and safety information the referrer chooses to include, and preferred visit times. We also collect the referrer's name, profession, organisation or role, phone and email, and their confirmation that the client knows about the referral and is happy to be contacted. We use this to respond to the referral and, if the client goes ahead, to provide care. We don't ask for NDIS or Medicare numbers at this stage, and we don't accept reports or letters by ordinary email: if there's a relevant document, we arrange a secure way to receive it. Referrals that don't go ahead are deleted within 12 months.

Why. To assess and treat you safely, keep accurate clinical records, communicate with people involved in your care (with your consent), issue invoices and support funding claims, keep visits safe, and meet our legal and professional obligations.

Where from. Mostly from you. Sometimes from referrers, your GP, support coordinator, plan manager or representative, with your consent or as the law allows.

If you don't provide it. We may be unable to provide safe care or to process funding claims.

Who we may share it with.

• People you consent to, such as your GP, support coordinator, plan manager (invoices only) and other providers.
• Your substitute decision-maker, if you cannot make a decision yourself.
• Our practice software provider, Halaxy (clinical records, appointments, forms and invoices), and our email provider, Google Workspace, only as needed to provide care and manage records.
• Safety: for home visits we use a lone-worker safety procedure. A nominated safety contact holds only a visit code and suburb. Your address is disclosed to them or to emergency services only if there is a serious threat to someone's life, health or safety.
• Others where the law requires or permits, for example a court order, or to lessen or prevent a serious threat.

Overseas handling. We keep client records in Halaxy, an Australian practice management system that says it stores practice data in Australia, on Amazon Web Services. Halaxy uses some overseas service providers, mainly in the United States, to send emails and text messages, process payments and monitor its systems, and some Halaxy staff work in Canada and Ireland, so some of your information may be sent to or accessed from those countries. Our email provider, Google Workspace, may store and process email outside Australia, including in the United States. Because of this, we keep health details out of email wherever possible and ask referrers to use the secure referral form. We remain responsible for how your information is handled.

Access and correction. You can ask to see or correct your information at any time.

Complaints. Contact us first. If you are not satisfied, you can contact the Office of the Australian Information Commissioner (oaic.gov.au, 1300 363 992).

Part B: Privacy policy

1. About this policy

This policy explains how Arlovo Health manages personal information, including health information. It applies to clients, their representatives, referrers and other contacts. Last reviewed: October 2026. We review it at least once a year.

2. Information we collect

• Identity and contact details, including emergency contacts, support people and substitute decision-makers.
• Health information: history, diagnoses, medications, assessments, notes, reports, outcome measures and correspondence. Photos or video only with separate consent.
• Funding and billing details. We do not store card numbers.
• Referrer and professional contacts: organisation-level details and work contact details.
• Safety information needed for home visits.

3. How we collect it

Directly from you wherever possible. From others with your consent or where the law permits. For general enquiries you may remain anonymous, but treatment and claims require identification.

4. How we use and disclose it

• To provide, coordinate and document your care.
• To communicate with people involved in your care, with your consent.
• To issue invoices, and to support NDIS claims made by plan managers or self-managing participants.
• To keep visits safe, under the lone-worker procedure described in Part A.
• To meet legal and professional obligations (for example, Ahpra, insurers, courts, mandatory notifications).
• Where you cannot consent, health information may be shared with a 'responsible person' (as defined in the Privacy Act) where this is necessary for your care, or for compassionate reasons, and not against your known wishes.
• We do not sell personal information, use client information for marketing, or use testimonials.

5. Storage, security and retention

• Clinical records are kept in Halaxy, which requires multi-factor sign-in for every account. Completed clinical notes are locked, so later changes can only be added as dated comments, and earlier versions are kept.
• Practice devices use encryption, automatic locking and multi-factor sign-in where supported.
• No client information is kept in personal messaging apps, unencrypted spreadsheets or our referral-source records.
• Paper forms are scanned into the clinical record, then shredded.
• We keep health records for at least 7 years after your last appointment, and longer where you may not have been able to make your own decisions or where a claim or complaint is possible. Billing records, including invoices, payment records and NDIS claim records, are also kept for at least 7 years. Records are then destroyed securely.

6. Access and correction

Contact us to request access or correction. We respond within 30 days. Any refusal will be explained in writing. There is no charge to make a request; we will tell you in advance about any reasonable cost of copies.

7. Data breaches

We follow our Data Breach Response Plan. If a breach is likely to cause serious harm, we will notify you and the OAIC under the Notifiable Data Breaches scheme.

8. Overseas disclosure

See "Overseas handling" in Part A. If we change providers, or our providers change where they hold or access information, we will update this policy.

9. Computer programs and artificial intelligence

We do not use computer programs to make decisions about you, or to do things substantially and directly related to making such decisions, where the decision could significantly affect your rights or interests. Decisions about accepting a referral, scheduling, your care and fees are made by your physiotherapist. Our practice software records information, schedules appointments, sends reminders and produces invoices.

We do not enter your personal information into publicly available artificial intelligence (AI) tools. The optional AI features in our practice software are switched off. If we ever propose to use one, we will update this policy first and ask for your consent.

10. Marketing

We do not send marketing to clients. If we ever offer a newsletter, it will be sent only with your consent, and you can unsubscribe at any time.

11. Complaints

Contact Arlovo Health at hello@arlovohealth.com.au or 0495 021 852. We will acknowledge within 2 business days and aim to resolve within 30 days. If you are not satisfied, contact the OAIC (oaic.gov.au, 1300 363 992). You can also contact the Health and Community Services Complaints Commissioner (hcscc.sa.gov.au) and, for NDIS participants, the NDIS Quality and Safeguards Commission.

About this website

This website does not use cookies, analytics, advertising tags, tracking pixels or session recording, and it does not load fonts from other services. It is hosted by Netlify, which processes standard technical information such as IP addresses to deliver pages and protect the site.

The referral form is provided by our practice software, Halaxy, and loads from Halaxy's website. What you enter goes over an encrypted connection straight into our clinical records in Halaxy, not into this website or ordinary email. Halaxy's form page uses its own service providers, as described in Halaxy's privacy policy. Any notice we receive that a referral has arrived contains no clinical details. If you email or phone instead, the details you give are used to respond and, if a referral goes ahead, are handled as described in this policy.