Privacy Policy

1.1 In this Privacy Policy, we will refer to Not Just Bendy Pty Ltd as “NJB”, “we”, or “us”. We will refer to anyone who may use our services or our website as “patients”, “clients”, or “you”.

2.1 We are committed to protecting your privacy and handling your personal information, including sensitive information (primarily this will be health information), in accordance with the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs).

2.2 This Privacy Policy explains:

2.2.1 What personal information we collect and hold

2.2.2 How and why we collect, hold, use and disclose it

2.2.3 Whether we disclose it overseas

2.2.4 How you can access and correct your information

2.2.5 How to make a privacy complaint.

3.1 We may collect and hold the following types of personal information:

3.1.1 Your name, date of birth, address, email, phone number;

3.1.2 Your emergency contact / next of kin;

3.1.3 Appointment times, attendance history;

3.1.4 Financial information such as billing details, invoices, receipts, payment status, and details of your health insurer;

3.1.5 Social, personal and employment history where it is relevant to your case;

3.1.6 Other identifiers such as your Medicare number;

3.1.7 Communications with you;

3.1.8 Information you submit via online forms; and

3.1.9 Limited website and online booking technical data, including data necessary for you to use our website (such as cookies).

4.1 In addition to the above, we may collect and hold sensitive information about you. This is a type of personal information, but it is given greater protection under the Privacy Act and the APPs.

4.2 Most of the sensitive information we hold about you will be health information, including:

4.2.1 Details of your symptoms and health history;

4.2.2 Assessment findings, clinical notes, diagnosis/impressions, treatment plans, progress notes, test results, referral information, and similar information; and

4.2.3 Correspondence and reports from/to other practitioners, or appropriate agencies (such as reports for the NDIS, workers compensation claims, and the like).

4.3 We might also have other sensitive information about you that is not health information. We will generally not collect and hold that information unless you expressly give it to us.

5.1 We collect personal information in a number of ways, including:

5.1.1 Directly from you (in person, by phone, email/SMS, telehealth, online bookings, and online forms);

5.1.2 Indirectly from you, such as technical information transmitted by your computer if you access our website (e.g. cookies);

5.1.3 From third parties you authorise or where permitted by law, such as:

5.1.3.1 Your general practitioner, specialist, imaging provider, insurer, government agencies (where appropriate), employer/claims manager (for relevant claims), and other treating practitioners involved in your care; or

5.1.3.2 Other individuals who may provide us with information (e.g. a parent or guardian, where appropriate).

5.2 We will seek not to collect personal information from you if you engage with us on social media. If you do engage with us in that manner, we will request that you engage with us formally through our clinic, so that we can ensure that your personal and sensitive information is collected in a methodical, safe and appropriate manner.

6.1 We generally collect, hold, use and disclose personal information to:

6.1.1 Provide you with our services safely and effectively;

6.1.2 Maintain clinical records and manage your treatment plan;

6.1.3 Communicate with you (appointments, reminders, clinical follow-up, administrative queries);

6.1.4 Coordinate care with other people and organisations involved in your care;

6.1.5 Process payments and, where relevant, claims with insurers/third-party payers;

6.1.6 Manage our business operations (quality assurance, training, accreditation, audits, IT support, risk management);

6.1.7 Marketing our services to you, where you have consented, such as providing you with a newsletter (you can opt out of this at any time);

6.1.8 Conduct research; and

6.1.9 Comply with legal and regulatory obligations.

6.2 In very limited circumstances we may use or disclose generalised, de-identified information for marketing beyond just marketing directly to you, but we will never use or disclose directly identifiable information or sensitive information.

6.3 However, where the personal information we are using or disclosing is sensitive information, we will only so where it is directly relevant to providing you care (or where there is a legal requirement for us to do so). We do not use your sensitive information for marketing purposes.

7.1 We may disclose your personal information (including sensitive information to the extent necessary), where you have consented, to:

7.1.1 People and organisations involved in your care (such as your general practitioner, other treating practitioners, NDIS, and the like);

7.1.2 Third-party payers/insurers (such as your health insurer or WorkCover) where relevant to billing/claims and with your authority where required;

7.1.3 Our service providers who support our operations (see below for details);

7.1.4 Any other person where you have provided express consent for that person to receive your personal information.

7.2 We may also disclose your personal information, including sensitive information, where it is required by law (for example, to regulators, courts, tribunals, law enforcement agencies, or for the purposes of child protection). We do not require your consent for this, and we may be required by law to disclose the information even if you actively withhold your consent.

7.3 We may disclose your personal information, including sensitive information, as part of research studies that we are involved in. This will only occur in circumstances where you have provided express consent for this to occur. Any information provided to a third party as part of a research study will be de-identified to the extent possible.

8.1 We use a range of systems to deliver care and operate the clinic, including:

8.1.1 Nookal – practice management software;

8.1.2 PhysiApp / Physitrack – a home exercise app;

8.1.3 HotDoc – for online bookings;

8.1.4 Snapforms – for receiving information in forms from you;

8.1.5 ClickUp – task/workflow management;

8.1.6 Zoom – online videoconferencing; and

8.1.7 OnForm – a platform designed for movement assessment and clinical education, including video-recording.

8.2 Although some of the above systems are international (e.g. ClickUp and Zoom), we do not store any of your sensitive information overseas. For example, we do not record Zoom sessions and we do not input sensitive information into ClickUp.

8.3 In the case of Nookal, it is necessary that we use Nookal to provide our services. We cannot provide services to you without using it.

8.4 In the case of the other services, we may be able to provide services to you without using the particular service. You will generally be able to opt out of usage of those services (for example, by booking by phone rather than through HotDoc).

8.5 In the case of Zoom, and OnForm, we will seek your express consent before using that particular system.

8.6 With respect to OnForm:

8.6.1 Recordings are securely stored within the OnForm platform and are accessible only to authorised staff.

8.6.2 Clients will never be recorded in inappropriate attire, gym wear is acceptable.

8.6.3 Recordings will not be used for marketing or education without separate written consent.

8.6.4 Consent is confirmed verbally at each session and may be withdrawn at any time.

8.7 Where we are using an AI tool (other than those embedded in software) to record personal or sensitive information, the use of that tool will be subject to our AI Policy (currently under development). That policy forms part of this Privacy Policy.

8.8 We are satisfied that each of the above systems take reasonable steps to protect your data. If you want further information about these systems, you can ask us, or you can look on the particular system’s website for more information.

9.1 We seek to provide general educational information on our website.

9.2 If you use our website or any of our information on the website, you are consenting to the application of this Privacy Policy.

9.3 The information provided on our website, and on any associated websites or platforms operated by Sharon Hennessey or The Hypermobility Project, is intended for general educational purposes only.

9.4 It does not constitute medical advice, physiotherapy advice, diagnosis, or treatment, and should not be relied upon as a substitute for personalised assessment from a qualified health professional.

9.5 You must not interpret any information on our website as specific to their individual circumstances.

9.6 All medical, health, or treatment decisions should be made in consultation with an appropriate member of their own medical or allied health team.

9.7 We make no representations that the information on the website is suitable for any particular individual, condition, or clinical situation.

9.8 Reliance on any website content is at the user’s own risk, and you agree that you by using any of the information on this website, we (including our staff, directors, and officers) will not be liable (to the extent permitted by law) for any loss or damage that you or another person may suffer.

9.9 All content on the website, including written materials, images, videos, downloadable resources, graphics, handouts, and all digital or educational content, is our intellectual property unless otherwise stated.

9.10 No part of our public website or social media may be copied, reproduced, distributed, modified, republished, uploaded, or used for commercial, clinical, educational, or training purposes without attribution or express written permission.

9.11 Users are granted a limited right to view the website for personal, non-commercial use only. No licence or rights to the underlying intellectual property are transferred to the user.

9.12 We reserve the right to take whatever steps may be necessary to ensure that our intellectual property is not misused or distributed without our express written consent.

10.1 Where lawful and practical, you may interact with us anonymously or using a pseudonym. However, in most clinical contexts this will not be practical.

11.1 We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification, or disclosure.

11.2 Controls may include access restrictions, staff confidentiality obligations, secure systems, and security monitoring.

11.3 We retain clinical records for as long as required for care and as required for legal, regulatory, and insurance purposes. In most cases, that will be seven years from the date of creation of the record. For some groups, that will be different. For example, health records relating to those under 18 at the time of the service will be kept until the patient is 25 years old.

11.4 When information is no longer required, we take reasonable steps to destroy or de-identify it.

12.1 You may request access to, or correction of, the personal information we hold about you. We will respond within a reasonable time and as required by the Privacy Act. In most cases, this will be within two weeks, although we may require longer for more complex matters.

12.2 We may need to verify your identity before providing access or making corrections.

12.3 We may charge a fee for providing access or making corrections. This will be limited to the anticipated actual cost of providing access or making corrections.

13.1 admin@notjustbendy.com

13.2 If you have a complaint, please contact us first and we will investigate and respond within a reasonable time.

13.3 If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner:

Phone: 1300 363 992  Email: enquiries@oaic.gov.au  Website: https://www.oaic.gov.au/privacy/privacy-complaints/

14.1 We may update this policy from time to time. The current version will be available on our website and/or at reception.