Privacy Policy

Our commitment to your privacy

SpinePass Pty Ltd ("SpinePass", "we", "us", "our") is committed to protecting your personal information and handling it in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This Privacy Policy explains how we collect, use, store, disclose and protect your personal information — including sensitive health information — when you interact with our clinic, website, and related services.

By using our services or providing us with your personal information, you agree to the terms of this Privacy Policy.

What information we collect

Personal information

• Full name, date of birth, gender
• Contact details — phone number, email address, home address
• Occupation and emergency contact details
• Private health insurance details
• Payment information (processed securely via Stripe — we do not store card details)

Sensitive health information

• Health history, current conditions, medications and allergies
• Clinical notes, treatment records and progress assessments
• Outcome measures (ODI, NDI) and postural assessment results
• Details of your presenting complaint and clinical findings

Website and marketing information

• Name, email address and phone number submitted via our waitlist or contact form
• Suburb and area of interest submitted via advertising lead forms
• Website usage data collected via analytics (pages visited, time on site)

How we collect your information

We collect personal information in the following ways:

• Directly from you — via our new patient intake form, in-clinic consultations, or when you contact us by phone or email
• Through our website — when you submit the waitlist form or booking form at spinepass.com.au
• Through our booking system — PracticeHub, which manages appointments and clinical records
• Through advertising platforms — Meta (Facebook/Instagram) lead forms when you express interest in SpinePass
• Through our payment processor — Stripe, when you set up a membership subscription

Why we collect your information

We use your personal information for the following purposes:

• Providing chiropractic examination, diagnosis and treatment
• Managing your SpinePass membership — billing, scheduling and communication
• Sending appointment reminders and confirmations
• Processing payments and managing your subscription via Stripe
• Communicating with you about your care, your membership and SpinePass generally
• Sending marketing communications where you have consented to receive them
• Complying with our legal and professional obligations as a registered health practitioner
• Improving our services and understanding patient outcomes

How we store and protect your information

Your information is stored securely using the following systems:

• Clinical records — stored in PracticeHub, a secure cloud-based practice management system with encrypted data storage
• Signed documents — stored in Google Drive under your Google Workspace account (admin@spinepass.com.au), with access restricted to authorised personnel only
• Payment information — processed and stored by Stripe in accordance with PCI DSS standards. SpinePass does not store your card details
• Marketing data — stored in Google Sheets and processed via Twilio (for SMS communications) in accordance with their respective privacy and data processing policies

We take reasonable steps to protect your personal information from misuse, interference, loss, unauthorised access, modification or disclosure. Access to your records is restricted to authorised clinical and administrative staff only.

Retention of records

Clinical records are retained for a minimum of 7 years from the date of your last consultation, or for 7 years after a child patient turns 18, in accordance with Queensland health records legislation and professional standards.

Who we share your information with

We do not sell, rent or trade your personal information. We may share your information in the following limited circumstances:

• With your consent — for example, when referring you to another health practitioner or providing a report at your request
• Other treating practitioners — GPs, specialists or allied health practitioners involved in your care, where clinically necessary and with your knowledge
• Service providers — third-party technology providers including PracticeHub, Stripe, Google Workspace and Twilio, who process data on our behalf and are bound by appropriate data processing agreements
• Legal requirements — where required or permitted by law, including mandatory reporting obligations under the National Law
• AHPRA or regulatory bodies — where required in connection with our professional registration obligations

We do not disclose your health information to insurance companies, employers or third parties without your express consent, except where required by law.

Marketing communications

If you have submitted your details via our waitlist form or a Meta lead form, we may contact you by email or SMS with information about SpinePass, including our opening, membership options and health information.

You can unsubscribe from marketing communications at any time by:

• Clicking the unsubscribe link in any email we send
• Replying STOP to any SMS we send
• Emailing us at admin@spinepass.com.au

Unsubscribing from marketing communications does not affect our ability to contact you about your clinical care or membership.

Your rights

Under the Australian Privacy Principles, you have the right to:

• Access your personal information held by SpinePass — submit a written request to admin@spinepass.com.au
• Correct any inaccurate or out-of-date information we hold about you
• Request deletion of your personal information, subject to our legal retention obligations
• Make a complaint if you believe we have mishandled your personal information

We will respond to access or correction requests within 30 days. In some circumstances we may charge a reasonable fee for providing access to records.

Complaints

If you have a complaint about how we have handled your personal information, please contact us in the first instance:

We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or by calling 1300 363 992.

For complaints relating to the handling of your health information by a registered health practitioner, you may also contact AHPRA at ahpra.gov.au or 1300 419 495.

Cookies and website analytics

Our website may use cookies and analytics tools to understand how visitors use the site. This may include information about pages visited, time spent on the site and general location. This data is collected in aggregate and is not linked to your personal identity.

You can disable cookies through your browser settings, however this may affect the functionality of the website.

Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The current version will always be available at spinepass.com.au/privacy.html. We encourage you to review this policy periodically.

Contact us

For any questions or concerns about this Privacy Policy or the way we handle your personal information, please contact us: