Privacy Policy

Version 1.0 · Last updated 6 November 2026

The short version

• We collect the information we need to assess, treat and support you, run your membership and look after our clinic. That includes health information, which the law treats as sensitive.
• We use your information for your care and for running the practice. We don't sell it and we don't use it for unrelated purposes.
• We share it only with people who need it for your care or for billing and claims, with your consent, or when the law requires us to.
• We use an AI note-taking tool only if you agree, and a clinician reviews everything it drafts. You can say no at any time and your care won't change.
• We take reasonable steps to keep it secure, and we keep clinical records for the period Victorian law requires before destroying them securely.
• You can ask to see or correct your information at any time, and you can complain if you think we've handled it badly.

Who we are and the laws that apply

This policy applies to Olympus Lifestyle Co (ABN 18 675 017 802), 27 McDowalls Road, East Bendigo VIC 3550. In this policy, "we", "us" and "our" mean Olympus Lifestyle Co, and "you" means anyone whose information we handle: patients, gym members, people who contact us, and visitors to this website.

We provide physiotherapy and performance services and run a private gym. Because we provide a health service and hold health information, we handle your information under:

• the Privacy Act 1988 (Cth), including the Australian Privacy Principles (APPs), and the Notifiable Data Breaches scheme under that Act; and
• the Health Records Act 2001 (Vic), including the Health Privacy Principles (HPPs).

Our Privacy Officer is responsible for how we handle personal information and for answering your questions. You can reach them on 0427 312 204 or at admin@olympuslifestyleco.com.au, or by post to the address above, marked "Privacy Officer".

What information we collect

If you are a patient or client

• Identity and contact details: name, date of birth, address, phone, email, and an emergency contact.
• Health information: your medical and injury history, symptoms, examination and assessment findings, diagnoses, treatment and rehabilitation notes, referrals, imaging and test reports, medications you tell us about, your goals and your progress.
• Performance data: measurements from tests we run with you, such as force plate and strength testing.
• Exercise programs: the exercise programs we prescribe to you through VALD Hub, and any completion or feedback you record there.
• Consultation audio and transcripts (only if you agree): if you consent, an AI note-taking tool listens to your appointment to produce a transcript and a draft note or letter. See AI note-taking, gym and payment systems.
• Claim and funding details: private health fund, Medicare, DVA, WorkCover, TAC or NDIS details, claim numbers, employer or insurer contact details where a claim is involved, and referral information from your doctor or another provider.
• Payment details: a record of what you've paid and how. Payments, and any health fund or Medicare claims, are processed through HaltH, which works inside our practice software, and through our HICAPS terminal. Card details you give are processed by HaltH, HICAPS and their payment partners.
• Communications: messages, emails and call notes between you and us.

If you are a gym member

• Your name, contact details, emergency contact and membership type, collected when you join through our online member portal (GymMaster).
• Billing details for your weekly direct debit, and your payment history. Card and bank details you enter are handled by Ezypay, our direct debit provider, and our membership system.
• Health or exercise-readiness information you give us when you join, such as injuries or conditions that affect how you train, so we can keep you safe.
• Records of your training and testing, and the exercise programs we prescribe to you, where we work with you on a program. For Perform members this includes the individualised program delivered through the Lumin Sports app and the training and wellbeing information you enter there.

If you contact us or visit our website

• The name, email, phone number and message you send through our contact form, by email or by phone.
• Technical information collected automatically when you use our website. See Our website, cookies and analytics.

Health information is "sensitive information" under the Privacy Act. We only collect it with your consent, or where the law allows, and only when it's reasonably necessary for the service we provide to you.

How we collect it

We collect information directly from you wherever we can: in person at the clinic, through online booking and intake forms, by phone, and by email or our contact form.

Sometimes we collect information about you from someone else, such as:

• your GP, specialist or another health provider who refers you or shares your results;
• an insurer, WorkCover agent, TAC, NDIS or your employer, where you're treated under a claim;
• a parent, guardian or carer, where the patient is a child or can't give information themselves.

Where we can, we'll tell you when we collect information from someone else. For children, we ask a parent or guardian to provide information and consent on their behalf, and we involve the young person in decisions as appropriate for their age and maturity.

You can deal with us anonymously or under a pseudonym when you make a general enquiry. We can't do that for treatment, claims or memberships, because we need to know who you are to treat you safely and keep accurate records.

Why we collect, use and share it

We use your information to:

• assess your condition, plan and deliver your care, and keep a clinical record;
• write your clinical notes and letters, with the help of an AI note-taking tool if you agree, and prescribe your exercise programs through VALD Hub;
• communicate with you, including appointment reminders and follow-up;
• communicate with your referrer and other treating providers, where that's part of your care;
• process payments and claim from health funds, Medicare, DVA, insurers and other funders;
• run your gym membership, including keeping you safe while you train;
• manage the practice, including scheduling, record keeping, quality improvement, audits and training of our staff;
• meet our legal, professional and insurance obligations; and
• respond to your enquiries and, where we have your consent or the law permits, tell you about our services. You can opt out of marketing at any time.

We use and share your information for the purpose we collected it, for closely related purposes you'd reasonably expect, with your consent, or where the law requires or permits it. We don't sell personal information and we don't use health information for unrelated purposes.

Who we share it with

We share information only as far as it's needed for the purposes above. Depending on your situation, that may include:

• your GP, referrer and other health providers involved in your care;
• health funds, Medicare, DVA, WorkCover and other insurers, TAC, NDIS and similar funders, and your employer or their representatives only where you've agreed or the claim requires it;
• the service providers that help us run the practice: our practice management and booking software (Cliniko), AI note-taking (Heidi), exercise prescription and testing (VALD Hub), gym memberships and billing (GymMaster), program delivery for Perform members (Lumin Sports), website hosting and form handling (Netlify), analytics and advertising measurement (Google), payments and claiming (HaltH), direct debit (Ezypay), and our accountants and IT support. They may handle information only to provide their service to us;
• our professional advisers and insurers, and regulators such as AHPRA, where needed;
• other people you've asked us to share it with, in writing or in person;
• anyone we're required or authorised to share it with by law, such as under a court order or to prevent a serious threat to someone's life, health or safety.

Information that goes overseas

We aim to keep your clinical information in Australia, but some of our service providers may handle information outside Australia. Here is where:

• Clinical records (Cliniko). Our clinical records and booking system is Cliniko. Cliniko states that data for Australian accounts is stored in Australia, on Amazon Web Services infrastructure, and is encrypted in transit and at rest. See Cliniko's security page.
• AI note-taking (Heidi). Heidi states that it uses Australian-hosted services and, where needed for performance, services outside Australia. It does not name the countries. We only use Heidi with your consent, and you can decline.
• Exercise prescription and testing (VALD Hub). VALD states that it may access or process personal information in Australia, the United Kingdom, the United States and the European Economic Area. See VALD's privacy policy.
• Gym memberships (GymMaster). GymMaster is based in New Zealand, and states that it keeps backups of its data at its New Zealand head office. See GymMaster's privacy policy.
• Perform programs (Lumin Sports). Lumin Sports may store and process information outside Australia. We only use it to deliver individualised programs to Perform members.
• Payments (HaltH and Ezypay). HaltH is a Sydney-based company. Ezypay provides our direct debits. Both rely on banking and payment partners that may process information outside Australia.
• Website contact form (Netlify). Our website is hosted by Netlify, a United States company, and messages sent through our contact form are processed and stored by Netlify, which may be outside Australia, including in the United States.
• Analytics and maps (Google). Google Tag Manager, Google Analytics, Google Ads measurement and Google Maps may process technical information about your visit in the United States and other countries.

Please don't put health details in our website contact form or in email. Because that route may be handled overseas, we ask you to call us or book online for anything clinical. Before we disclose your personal information to an overseas recipient, we take reasonable steps to make sure they handle it in line with the Australian Privacy Principles, or we rely on one of the exceptions the law allows.

AI note-taking, gym and payment systems

AI note-taking (Heidi)

We use Heidi, an AI scribe, to help our clinicians write clinical notes and letters. Here is how it works and what you can expect:

• It's your choice. We ask for your consent before we use it, and we record your answer in your file. You can say no, or change your mind at any time, and we'll write the notes ourselves. Your care and your fees stay the same.
• What it does. Heidi processes the conversation in your appointment to create a transcript and a draft note or letter. Heidi states that it does not store audio recordings of consultations.
• A clinician is always in charge. Your clinician reads and edits every draft before it's saved to your clinical record, and is responsible for what it says. The AI doesn't make any decisions about your care.
• Your record stays in Cliniko. The finalised note is saved to your Cliniko record. We delete the draft and transcript from Heidi once that's done.
• Training and sale. Heidi states that it does not use sensitive health information to train its AI models and does not sell patient data.
• Security. Heidi states that it holds ISO 27001 and SOC 2 Type 2 certifications and encrypts data.

Exercise prescription and testing (VALD Hub)

We use VALD Hub to store your test results and to prescribe and track your exercise programs. We may send you an invitation by email or through the VALD Hub app so you can see your program. VALD handles this information on our behalf, and under our instructions. For information we hold in VALD Hub, GymMaster, Lumin Sports or our payment providers, please send access and correction requests to us first, and we'll deal with them as described below. VALD's own policy is at vald.com/privacy-policy.

Gym memberships (GymMaster)

When you join the gym online, you're taken to our member portal, which is run by GymMaster. GymMaster collects your name, contact details, membership choice and billing details, and passes your weekly direct debit to Ezypay. GymMaster states that it doesn't store card details itself. We use this information to run your membership, take payment and keep you safe in the gym, and we can see it in our GymMaster account. GymMaster's policy is at gymmaster.com/members-app-privacy-policy.

Payments (HaltH and Ezypay)

We use two payment services. HaltH processes payments and health fund and Medicare claims for appointments, from inside our practice software. Ezypay processes the weekly direct debits for gym memberships. Both receive the details needed to take payment or lodge a claim, such as your name, the amount, the service, and your card, bank or health fund details. Ezypay states that it stores payment details in a secure vault that meets the Payment Card Industry Data Security Standard (PCI DSS).

Perform programming (Lumin Sports)

Perform members receive an individualised program through the Lumin Sports app. We may invite you by email to create an account. The app holds your program and the training and wellbeing information you choose to enter, and your coach can see it. Lumin Sports handles this information on our behalf, and under our instructions.

Our website, cookies and analytics

When you visit this website, we and our service providers automatically collect technical information such as your IP address, device and browser type, the pages you view, how you arrived at the site and how long you stay. We use it to understand how the site is used and to measure the effectiveness of our advertising.

To do this we use Google Tag Manager, which loads Google Analytics (GA4) and Google Ads conversion measurement. These tools use cookies and similar identifiers. We don't use them to collect health information, and we don't knowingly create advertising audiences based on health conditions.

• Symptom search. The "What brings you in?" search on our home page runs entirely in your browser. What you type is not sent to us or stored.
• Strength calculators. Anything you enter in our calculators stays in your browser and isn't sent or stored.
• Online booking. When you book, you're taken to Cliniko, which collects and stores what you enter under its own privacy terms and our instructions.
• Maps and social links. Our embedded map is provided by Google. Links to Instagram and Facebook take you to those services, which have their own privacy policies.

You can block or delete cookies in your browser settings, use Google's Analytics opt-out add-on, and manage ad personalisation in your Google ad settings. The site works if you do.

How we keep information safe

We take reasonable steps to protect information from misuse, interference, loss, and unauthorised access, modification or disclosure. Our measures include:

• Electronic records: your clinical record is kept in Cliniko, which uses encryption in transit and at rest, daily backups, and individual logins with two-factor authentication available. Exercise and test data are kept in VALD Hub, membership and billing details in GymMaster, Perform programs in Lumin Sports, card and direct debit payments in HaltH and Ezypay, and AI drafts are held in Heidi only until your note is finalised. Staff have their own logins and access only what their role needs.
• Staff: everyone who works with our records is bound by confidentiality obligations and trained in how to handle personal and health information.
• Devices and premises: our devices are password protected and our premises are secured outside opening hours. Paper records, where we have them, are stored securely.
• Suppliers: we choose service providers that offer appropriate security, and we limit what they can do with your information.
• Review: we review our privacy and security practices regularly, and whenever we change systems or suppliers.

No system is perfectly secure, and email and website forms are less secure than the channels above. That's why we ask you to keep health details out of them.

How long we keep it

Victorian law requires us to keep health records for a minimum period. We keep clinical records for at least 7 years after your last appointment. For a patient who was a child when we collected the information, we keep them until the patient turns 25, or for 7 years after the last appointment if that is longer. Membership records that include health screening information, and exercise programs and test results in VALD Hub and Lumin Sports, are kept on the same basis. Membership and billing records are kept for as long as you're a member and for as long afterwards as our tax and legal obligations require. Drafts and transcripts created by our AI note-taking tool are deleted once the final note is saved to your record.

When the period ends and we no longer need the information, we destroy it securely or de-identify it. Other information, such as a website enquiry that doesn't lead to a booking, is kept only as long as we need it to deal with the enquiry and for our own records. We keep a record of the health records we destroy or transfer, as the Health Records Act requires.

Seeing and correcting your information

You have the right to:

• ask for access to the personal and health information we hold about you;
• ask us to correct information that's inaccurate, out of date, incomplete or misleading; and
• ask us to transfer your records to another health provider, or to give a copy to a person you nominate.

Make your request in writing to our Privacy Officer using the details above. We'll need to confirm who you are before we release anything, to protect your privacy. We'll respond promptly, within the timeframes set by law, and we aim to respond within 30 days. We may charge a reasonable fee for the cost of providing access, but not for making the request, and we'll tell you the cost before we proceed.

In limited circumstances the law allows us to refuse or limit access, for example where access would seriously threaten someone's life or health, or would unreasonably affect another person's privacy. If we do, we'll give you written reasons and tell you how to complain. If we don't agree to correct a record, you can ask us to attach a statement of your view to it.

If something goes wrong

If we suspect a data breach, we act quickly to contain it and assess the risk. If a breach is likely to result in serious harm to you, we'll notify you and the Office of the Australian Information Commissioner (OAIC) as the Notifiable Data Breaches scheme requires. We tell you what happened, what information was involved and what you can do to protect yourself.

Questions and complaints

If you have a question or think we've mishandled your information, please tell our Privacy Officer first at admin@olympuslifestyleco.com.au or on 0427 312 204. We'll acknowledge your complaint, investigate it and reply in writing, usually within 30 days. Making a complaint won't affect the care we provide to you.

If you're not satisfied with our response, you can contact:

• the Office of the Australian Information Commissioner: oaic.gov.au, 1300 363 992; or
• the Health Complaints Commissioner (Victoria): hcc.vic.gov.au, 1300 582 113.

Automated decisions

We use an AI scribe to draft notes and letters, but our clinicians review them and make every decision. We don't use computer programs or artificial intelligence to make decisions that could significantly affect your rights or interests, such as deciding what care you receive, whether you're accepted as a patient or member, or how much you're charged. If that changes, we'll update this policy first and tell you how it works.

Changes to this policy

We review this policy regularly and update it when our practices or the law change. The current version is always on this page, with the version number and date at the top. You can ask us for a printed copy, or for this policy in another format, at any time.