Privacy policy

Last updated: October 2026

The short version

This is a summary. The sections below give the detail.

• We collect what we need to care for you, manage any claim and run the clinic
• Your clinical records are kept in our practice management system, which stores them in Australia
• We share your information only for your care or your claim, with the services that help us run the clinic, or where the law requires or allows it
• Some services we use, such as our email and our AI phone assistant, store or process information overseas
• We never sell your information
• You can ask to see or correct your information at any time
• Questions or concerns? Call (02) 8105 6506 or email [email protected]

Who we are and who this covers

This policy is for PACT Health Pty Ltd (ABN 27 699 851 799), which trades as PACT Physio & Rehab, PACT Virtual Care and RADAR by PACT. In this policy, we, us and our mean PACT Health.

It explains how we handle the personal information of our patients, people who contact us, visitors to our website, and the referrers, insurers, case managers, employers, job applicants and others we deal with.

We are bound by the Privacy Act 1988 (Cth), including the Australian Privacy Principles, and by the NSW Health Records and Information Privacy Act 2002, including the Health Privacy Principles.

What we collect

To care for you safely and manage your appointments and any claim, we may collect:

• Your name, date of birth, address, phone number and email address
• Your Medicare or private health fund details, when you use them to pay for or claim your care
• For a workers compensation or motor vehicle (CTP) claim, or an early intervention program arranged by your employer: your claim number, insurer, case manager, employer, rehabilitation provider, work duties and injury details
• Your health and medical history, including information from your doctor and other treating practitioners, imaging reports and certificates of capacity
• Details of your assessment and treatment with us, including clinical notes and your answers to questionnaires about your pain, mood and confidence
• Your answers to the safety screening questions on our consent form, and your signature
• Appointment, invoice and payment records
• Your phone number, and the recording, transcript and message from any call you make to our AI phone assistant
• Emails, texts and forms you send us
• Whether you want to receive practice updates
• Information about how you use our website, collected by Google Analytics

Health information is sensitive information under privacy law. We collect it with your consent or where the law allows, and only what we reasonably need. For the referrers, insurers, case managers, employers and job applicants we deal with, we usually hold only names, roles, contact details and what is needed for the matter at hand.

How we collect and hold it

Usually directly from you: in person, by phone, by email, through our online booking, and through our online consent form, outcome questionnaires and enquiry forms.

With your consent, or where the law allows, we also receive information from others involved in your care or claim, such as your doctor or referrer, other treating practitioners, imaging providers, your insurer or case manager, your rehabilitation provider and your employer. Faxes sent to the clinic are received electronically. If you book through another booking website, that website's own privacy policy also applies to what you give it.

If we receive personal information we did not ask for and could not have collected ourselves, we will destroy it or remove anything that identifies you, as soon as it is practical, lawful and reasonable to do so.

We hold your information mainly electronically: in our practice management system, in our clinic email, in files on clinic computers, and in the other services described in this policy.

How we use it

We use your information to:

• assess and treat you, and plan and manage your care
• keep accurate clinical records
• talk with your doctor and other treating practitioners about your care
• manage and report on a workers compensation or CTP claim, or an early intervention program arranged by your employer, including treatment requests, progress reports and certificates
• book appointments and send confirmations, reminders and aftercare messages
• issue invoices, take payments and make claims to your health fund, Medicare or your insurer
• check how your treatment is going, using outcome questionnaires
• answer your questions, feedback and complaints
• run, improve and secure the clinic and our website
• send practice updates and review requests, which you can stop at any time (see below)
• meet our legal and professional obligations

We do not sell your information.

When we share it

We share your information only as needed for your care or your claim, to run the clinic, or where the law requires or allows it. This can include:

• your doctor, referrer and other practitioners involved in your care
• for a workers compensation or CTP claim: your insurer, case manager and rehabilitation provider, and your employer for return to work planning, as your claim and your consent allow
• for an early intervention program arranged by your employer: your employer, or the provider running the program for them, as the program and your consent allow
• Medicare or your private health fund, when a claim is made for your care
• a person you authorise to act for you, such as a parent or guardian, or someone you name in writing
• the services we use to run the clinic, such as our practice management system, email, phone, payment, website, AI and IT services
• our accountant and other professional advisers, and our insurers, where needed for our accounts, a legal claim or a complaint
• courts, regulators and government bodies where the law requires it, for example under a subpoena or court order, and anyone who needs it to lessen or prevent a serious threat to someone's life, health or safety

We do not give your information to anyone for their own marketing.

Information sent overseas

Some of the services we rely on store or process information outside Australia. We remain accountable for your information when they do. We take reasonable steps to make sure it is handled properly, and we keep what is sent overseas to the minimum needed.

Our practice management system and your clinical records are stored in Australia. Emails, text message reminders and telehealth video calls sent from that system may be delivered with help from service providers based in the United States.

The overseas services that apply to most people are listed below.

Email. Our clinic email is provided by Google. Emails and attachments you send us, and reports we send about your care, may be stored in the United States, Canada, Chile, Mexico, Belgium, Denmark, Finland, Ireland, the Netherlands, Japan, Singapore or Taiwan, where Google keeps its data centres.

Our AI phone assistant. Calls to the clinic are carried by Twilio and answered by an assistant run by ElevenLabs and the language model provider it uses. ElevenLabs stores the call recording and transcript in the United States.

Text message alerts. After a call, the assistant sends our team a text message through Twilio, in the United States. It usually carries your name, your callback number and the general nature of your call. For an urgent or same day call it may include a short note of what you said.

Call records and consent forms. A summary and transcript of each call, and a copy of each signed online consent form, are emailed to the clinic through Resend, which stores its records in the United States.

AI tools that help run the practice. We use AI tools from Anthropic (Claude) to help with administration, such as drafting reports and letters, sorting email and keeping our records up to date. Information used this way is processed by Anthropic, including in the United States. We have turned off the setting that lets Anthropic use our information to improve its AI models. Any letter, report or email these tools draft is checked by our physiotherapist before it is sent.

Online forms. Our outcome questionnaires and our enquiry and referral forms are delivered by Web3Forms, which operates from India and uses hosting providers that may process data in several countries.

Fax. Faxes sent to the clinic are received by eFax, whose service providers may be located outside Australia.

Website and internal systems. Our website, our online consent form, the booking service behind our phone assistant and our internal staff dashboard are hosted by Cloudflare on its global network, which may process this information in many countries. Copies of our internal dashboard are kept by GitHub in the United States.

If you would prefer your information not to go overseas, tell us. We will explain what we can do instead, such as dealing with you in person rather than by phone or email, and whether that affects your care or your claim.

Our AI phone assistant

When you call the clinic your call is answered by an automated AI assistant. At the start of every call, before it asks for any details, it tells you that it is an AI and that the call is recorded and transcribed.

The assistant can answer general questions, take a message, and book or cancel an appointment. To do that it connects to our practice management system: it can look up your record by your name and date of birth, create a record for a new patient, see and book appointment times, cancel an appointment, and add or update your mobile number and email address. It does not give clinical advice, and it does not read your clinical notes. To make a booking it asks only for your name, date of birth, email address and mobile number, and whether you have been to us before.

Calls are recorded and transcribed so the team receives an accurate message. If you tell the assistant you would rather not be recorded, it will give you our email address and online booking link and end the call without asking for your details, although the call up to that point is still recorded. You can also visit the clinic.

ElevenLabs, which runs the assistant, is set to delete each call recording and transcript 60 days after the call. A summary and the full transcript of every call are also emailed to the clinic, and that email is kept with our clinic records. The booking service behind the assistant keeps short working copies of call and booking details, which it deletes automatically within 90 days.

Every message and booking the assistant takes is emailed to our team. The assistant does not make decisions about your care or your treatment.

After a call, the assistant sends our team a short text message so we can return your call promptly. It usually carries your name, your callback number and the general nature of your call. For an urgent or same day call it may also include a short note of what you said. The full detail of your message travels by email.

Telehealth appointments

PACT Virtual Care video appointments use the secure video feature in our practice management system. You join from a link we send you, with no app to install. The provider of that system says it does not keep a copy of the video call. Your physiotherapist keeps clinical notes, just as for a visit to the clinic. For your own privacy, join from a place where others cannot overhear.

Our website and online forms

Our website uses Google Analytics to understand how it is used, such as which pages are visited and when someone taps a link to book, call or email us, or sends a form. Google Analytics uses cookies and collects information about your device and browser, and Google may process this information outside Australia. Our setup does not send what you type into a form to Google, and Google says Google Analytics 4 does not log or store IP addresses. It is not used on our online consent form or our outcome questionnaire pages. You can block or delete cookies in your browser settings, or use Google's Analytics opt out browser add on.

Some pages show a Google map or a video, which Google provides.

Online consent form. This collects your name and date of birth, your signature, an optional tick box for practice update emails, and, if you are having dry needling, your answers to the safety screening questions and any details you add. When you submit it we also record the date and time, your internet (IP) address, the country it was sent from and your browser and device type, as evidence of your signature. The signed form is saved as a PDF on your record in our practice management system and emailed to the clinic. The form page itself does not keep your answers.

Online outcome questionnaires. These ask for your name and date of birth, and about your pain, how it affects your work and daily life, your confidence and your mood. Your answers are scored on your device and emailed to the clinic, and we file a copy on your record. Until you send them, your answers are saved in your own browser so a refresh does not lose them, and they are cleared once the form has sent them.

Enquiry and referral forms. These collect the details you or your referrer enter, such as name, phone number, email address and message, and for a referral the claim number, insurer and type of injury. They are emailed to the clinic.

AI and automated decisions

We do not use computer programs to make decisions that could significantly affect your rights or interests. Decisions about your care are made by your physiotherapist. Our AI phone assistant books and cancels appointments for callers, and every booking and message it takes is emailed to our team. If a booking could not be confirmed to you during the call, the booking service may cancel it automatically and alert our team to call you back. Any letter, report or email our AI tools help draft is checked by our physiotherapist before it is sent.

Practice updates and review requests

From time to time we may email patients we have seen at the clinic in the last two years with practice news, such as clinic updates, recovery tips or an offer. Our online consent form also has an optional tick box for these emails.

A few days after an appointment at the clinic, if you have no further appointment booked, our practice management system may send you a text message inviting you to leave a Google review. This message follows the marketing preference on your patient record. We may also occasionally ask a patient directly. Leaving a review is always your choice. So we do not ask twice, we may note on our list when a patient has already left us a public Google review.

To stop any of these, contact us or reply to one of our practice update emails, and we will take you off the list. We keep a record so you are not contacted again. Saying no never affects your care.

Dealing with us without giving your name

You can ask us general questions, such as about our services or fees, without telling us who you are, or by using another name. To assess or treat you, bill you, or manage a claim, we need your real name and details, so we cannot do those things anonymously. If you choose not to give us information we ask for, we may not be able to treat you safely, book your appointment or make a claim for your care.

Medicare and other government numbers

We do not use your Medicare number, or any other number given to you by a government agency, as our own way of identifying you. We use and share these numbers only where we need to, such as for the claim or payment they belong to, or where the law allows.

Keeping your information accurate

Please tell us if your details change. Before our systems file a signed consent form or make a phone booking against an existing record, they check that your name and date of birth match.

Keeping your information secure

We take reasonable steps to protect your information from misuse, interference and loss, and from unauthorised access, change or disclosure. Your clinical records are held mainly in our practice management system, which stores them in Australia and encrypts them. Only our physiotherapist can sign in to it. A small number of connected services, such as our AI phone assistant, our online consent form, our online booking services and the tools we use to prepare reports and keep our records up to date, can look up or add information in it to do their job. Our other systems are protected by passwords and access controls.

If there is a data breach that is likely to cause serious harm, we will tell the people affected and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

How long we keep it

We keep health records for at least as long as NSW law requires: for an adult, 7 years from your last visit; if your information was collected while you were under 18, until you turn 25. We may keep them longer, for example while a claim or legal matter is still open. When we delete health records, we do it securely and keep a note of whose records were deleted, the period they covered and the date, as NSW law requires.

Call recordings and transcripts held by ElevenLabs are set to be deleted 60 days after each call. The transcript emailed to the clinic is kept with our clinic records.

If we transfer your records to another health service provider, we keep a note of who they went to and when. If we ever close the practice, we will arrange for your records to be stored for the time the law requires, or transferred with your consent to another provider you choose, and we will take reasonable steps to tell you how to get them.

Seeing and correcting your information

You can ask to see the personal and health information we hold about you, and ask us to correct anything that is wrong, out of date, incomplete or misleading. Ask us in person, by phone or by email. NSW law asks for requests to see health information to be in writing, so an email is enough. Someone with authority to act for you, such as the parent or guardian of a child or a person you authorise in writing, can ask on your behalf.

We may ask you to confirm who you are. We will respond within 30 days. We do not charge you for asking, or for correcting your information. If you would like copies of a large record, we may ask for a reasonable fee to cover our costs, and we will tell you the amount first.

In rare cases the law allows us to refuse access, for example where giving it would pose a serious threat to someone's health or safety, or would unreasonably affect someone else's privacy. If we refuse access or a correction, we will tell you why in writing and how to complain. If we do not agree to correct your record, you can ask us to attach a statement of your view to it.

Concerns and complaints

If you are worried about how we have handled your information, please tell our Privacy Officer first so we can put it right (contact details below).

We will look into your concern, talk with you about it, and give you our response in writing within 30 days. If we need longer, we will tell you why and when to expect an answer. Raising a concern will never affect your care.

If you are not satisfied with our response, you can complain to either of these bodies:

• Office of the Australian Information Commissioner (OAIC), under the Privacy Act: online at oaic.gov.au, phone 1300 363 992, or post to GPO Box 5288, Sydney NSW 2001. The OAIC usually expects you to complain to us first and give us 30 days to respond.
• NSW Information and Privacy Commission (IPC), for health information under the NSW Health Records and Information Privacy Act: online at ipc.nsw.gov.au, phone 1800 472 679, email [email protected], or post to GPO Box 7011, Sydney NSW 2001. A complaint to the NSW Privacy Commissioner should be made within 6 months of when you first became aware of the problem, or the Commissioner may decline to deal with it.

If you go to the IPC, it will ask whether you want it to handle your complaint or would prefer to go to the OAIC. Concerns about your care itself, rather than your privacy, can go to the NSW Health Care Complaints Commission, as set out in our feedback and complaints policy.

Contact us

Our Privacy Officer is our physiotherapist, Andrew Ellis. Email [email protected], call (02) 8105 6506, or write to the Privacy Officer, PACT Health Pty Ltd, Unit 1, 196 Sylvania Road, Miranda NSW 2228.

Changes to this policy

We update this policy when the way we handle information changes. The date at the top of this page shows the latest version. You can ask us for a free copy in another form, such as on paper.