Privacy Policy

---

Effective Date: 13 October 2026

Policy Owner: Jonathan Reid, Privacy Officer

Review Frequency: At least every 12 months, and following significant changes to legislation, systems or privacy practices.

1. Introduction

At Ruckus Rehab, your privacy is important to us. This Privacy Policy explains how we collect, use, store, disclose and protect your personal information when you visit our website, contact us, make an enquiry, purchase products or personalised programs, or use our physiotherapy services.

Ruckus Rehab operates in Australia and handles personal information in accordance with applicable Australian privacy laws, including the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), as applicable.

We take reasonable steps to protect the confidentiality, integrity and security of your information and to ensure that it is only accessed and used for appropriate purposes.

2. What Information We Collect

Depending on how you interact with Ruckus Rehab, we may collect the following information.

Personal Information

This may include:

• Your name, email address and telephone number.
• Your residential address or suburb.
• Appointment, booking and service enquiry details.
• Information you provide when purchasing products or personalised programs.
• Communication preferences and relevant correspondence.
• Information you voluntarily provide to us.
• Health Information

When you contact us or use our physiotherapy services, we may collect information about your health, injuries, physical condition, medical history, treatment needs, rehabilitation goals, functional abilities and progress.

Health information is sensitive information under Australian privacy law and receives additional protection.

We collect health information where reasonably necessary to assess and treat you, manage your care, coordinate appropriate services, maintain clinical records or for another purpose permitted or required by law.

Purchase and Payment Information

If you purchase products or personalised programs, we may collect billing, delivery and transaction information needed to process and fulfil your purchase.

Payment details are processed through third-party payment providers. Ruckus Rehab does not intentionally store complete payment card details on its own systems.

Website and Device Information

When you visit our website, certain information may be collected automatically, including your IP address, browser and device information, pages visited, approximate geographic location, date and time of visits, website interactions and referring website or advertising source.

This information may be collected through cookies, pixels, tags and similar technologies.

3. How We Use Your Information

We may use your information to:

• Respond to enquiries and arrange appointments.
• Provide physiotherapy, assessment, treatment and rehabilitation services.
• Develop and deliver personalised exercise programs.
• Maintain clinical records and monitor your progress.
• Coordinate care with other health professionals and relevant service providers.
• Process payments and fulfil purchases.
• Communicate with you about appointments, services and enquiries.
• Operate, maintain and improve our website and business systems.
• Measure advertising and marketing effectiveness where permitted.
• Manage complaints, incidents, quality improvement and professional obligations.
• Meet legal, regulatory and record keeping requirements.
• Protect the safety of patients, practitioners and other people where permitted or required by law.

We do not use website information to make automated decisions about whether an individual is eligible for physiotherapy treatment or other services.

4. Primary and Secondary Purposes for Health Information

Primary purpose

The primary purpose for collecting your health information is generally to provide physiotherapy and related healthcare services. This includes assessing your needs, planning and delivering treatment, monitoring outcomes, maintaining clinical records and coordinating your care.

We may collect, use and disclose your health information for this primary purpose, subject to applicable privacy and confidentiality requirements.

Secondary purposes

A secondary purpose is a purpose other than the main purpose for which information was collected.

We may use or disclose your information for a secondary purpose where permitted by applicable law. Depending on the circumstances, this may include:

• Your consent: You have given informed consent to the relevant use or disclosure. For example, you authorise us to prepare and send a clinical report to your GP or provide a report to WorkCover.
• Reasonable expectation and direct relationship: You would reasonably expect the use or disclosure, and the secondary purpose is directly related to the original purpose of collecting your sensitive health information.
• Legal requirements: The use or disclosure is required or authorised by Australian law or a court or tribunal order.
• Serious threats: A permitted legal exception applies, such as where obtaining consent is unreasonable or impracticable and the use or disclosure is reasonably necessary to lessen or prevent a serious threat to a person's life, health or safety.
• Enforcement-related activities: A permitted exception applies to information reasonably believed to be necessary for relevant enforcement-related activities conducted by or on behalf of an enforcement body.

Other legal exceptions may also apply in specific circumstances.

Where we rely on consent, we will explain the intended disclosure where appropriate and seek consent that is informed, voluntary and sufficiently specific. We will disclose only information reasonably necessary for the relevant purpose.

GP, WorkCover and other reports

Where a report, referral response or other communication is requested by a GP, insurer, employer, rehabilitation provider, support coordinator or another party, we will consider the purpose, the information required, the patient's reasonable expectations and the applicable legal basis before disclosing information.

Where required, we will obtain the patient's consent before preparing or sending the report. A referral or funding arrangement does not automatically authorise unrestricted access to a patient's clinical record.

5. How We Store and Protect Your Information

Ruckus Rehab takes reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification or disclosure.

Our privacy and security practices may include:

• Using access-controlled clinical and business systems.
• Restricting access to information to authorised people who need it for their work.
• Using individual accounts, strong passwords, device passcodes and multi-factor authentication where available.
• Keeping devices and software updated.
• Securing computers, phones, tablets and paper documents during mobile and home visits.
• Verifying recipients before sending clinical documents or reports.
• Using secure transmission methods where appropriate.
• Reviewing the privacy and security arrangements of third-party service providers.
• Securely disposing of information when it is no longer required and may lawfully be destroyed.

No electronic storage or transmission method can be guaranteed to be completely secure.

Clinical records — Nookal

Ruckus Rehab uses Nookal as its primary clinical practice management and patient record system.

Clinical records, including assessments, progress notes, treatment details and relevant clinical correspondence, are maintained in Nookal wherever appropriate.

Nookal publishes information about its security measures, including encryption and access controls. Nookal states that client data for Australian accounts is stored in Sydney data centres. The storage arrangements and contractual terms applicable to our account should be confirmed with the provider.

Nookal is a third-party service provider. Its own security measures do not remove Ruckus Rehab's responsibility to manage access to our account appropriately and handle patient information in accordance with applicable privacy obligations.

Other systems

Depending on the purpose, Ruckus Rehab may also use:

• Heidi: AI-assisted voice transcription and clinical note-taking.
• TrainHeroic: Exercise programming and delivery.
• OneDrive and Google Drive: Storage of authorised business documents and files.
• Email and SMS services: Appointment communications, administration and relevant clinical correspondence.
• Google Sheets: Legacy exercise programming or business records being reviewed for secure transition or archiving.
• Website, payment, analytics and advertising providers: Website operation, enquiries, purchases, analytics and marketing.

We aim to minimise duplication of clinical information and restrict health information stored in secondary systems to what is reasonably necessary. Access permissions and security settings should be appropriate to the sensitivity of the information.

Referral documents and paper records

Referral letters, medical reports and other documents received from GPs, specialists, insurers or other providers may contain sensitive health information.

Where appropriate, we will:

• Receive and handle the document securely.
• Scan or upload the document into the authorised Nookal clinical record, or another approved secure system where necessary.
• Check that the document has been uploaded correctly and is accessible to the authorised practitioner.
• Securely destroy the paper copy when it is no longer required, provided retention of the original is not required by law, a contractual obligation or another legitimate need.

Paper documents that must be retained will be stored securely and accessed only by authorised people.

AI-assisted clinical note-taking — Heidi

Ruckus Rehab may use Heidi to assist with transcribing appointment conversations and preparing clinical notes.

Where Heidi is used, we will explain its purpose to the patient and seek consent before using the tool to capture or process their appointment conversation. Patients may decline its use and still receive physiotherapy treatment. Clinical notes will be documented without Heidi when the patient does not consent.

Information processed through Heidi may include health information discussed during an appointment. Its handling may be subject to Heidi's applicable privacy policy, service terms, data storage arrangements and account settings.

Ruckus Rehab will take reasonable steps to assess the provider's privacy and security arrangements, including applicable retention, access, processing and data-use settings. AI-generated transcripts or notes must be reviewed by the treating physiotherapist for accuracy and clinical appropriateness before being relied upon as part of the clinical record.

6. Referral and Care Coordination

Ruckus Rehab may receive referrals and relevant clinical information from GPs, specialists, hospitals, insurers, rehabilitation providers, support coordinators and other parties.

We use this information to understand your needs, assess whether our services are appropriate, plan treatment and coordinate care.

We may share relevant information with other health professionals or parties involved in your care where you have consented or another lawful basis applies. We will consider the purpose of the disclosure and limit the information provided to what is reasonably necessary.

Where a referral document is received electronically, it will be handled through approved business systems. Paper copies will be scanned into the secure clinical record and securely destroyed when appropriate, subject to retention requirements.

7. Cookies, Pixels and Analytics

Our website may use cookies, pixels, tags and similar technologies operated by Ruckus Rehab and third-party providers to understand website usage, improve functionality, measure advertising effectiveness and support permitted marketing activities.

Google Analytics

We may use Google Analytics to understand website visits, page views, session activity, browser and device information, approximate geographic location, website interactions and referral sources.

We configure Google Analytics to avoid intentionally sending directly identifying information, such as names, email addresses or telephone numbers. We will take reasonable steps to prevent sensitive health information from being transmitted through analytics technologies.

Meta Pixel and Meta Advertising

We may use Meta Business Tools, including the Meta Pixel, to measure advertising performance, understand general website interactions and improve advertising campaigns.

We take reasonable steps to configure these tools so that diagnoses, injuries, treatment details, medical history and other sensitive health information are not intentionally transmitted to Meta through tracking technologies.

We do not intentionally use health information to create advertising audiences, conversion events or advertising criteria. We will not knowingly use tracking practices that disclose sensitive health information in a manner inconsistent with applicable law or platform requirements.

Other tracking technologies

We may use other analytics or advertising technologies in the future. If our practices materially change, we will review this policy and update it where appropriate.

8. Advertising and Marketing

We may use website interactions and other permitted information to measure and improve marketing campaigns.

Where permitted, general website activity may be used to understand advertising performance or support remarketing. We take care to ensure that audience criteria do not reveal, imply or rely upon sensitive health information.

We do not sell or rent personal information. We do not intentionally disclose health information to advertising platforms for advertising purposes.

9. Sharing Your Information

We may disclose personal information where reasonably necessary to provide services, operate our business or comply with legal obligations.

Recipients may include:

• Technology and business providers: Nookal, Heidi, website hosting providers, cloud storage providers, email and SMS services, payment processors, analytics providers and exercise-programming platforms.
• Health professionals and care providers: GPs, specialists, allied health professionals and other providers involved in your care.
• Funding and rehabilitation parties: WorkCover, insurers, rehabilitation providers, support coordinators, plan managers or other relevant parties, where authorised or otherwise permitted by law.
• Representatives and carers: Family members, carers, guardians or nominated representatives where authorised or otherwise permitted.
• Authorities and regulators: Government agencies, courts, tribunals, professional regulators or enforcement bodies where disclosure is required or permitted by law.

We take reasonable steps to limit disclosures to the information necessary for the relevant purpose.

10. Overseas Disclosure

Some third-party providers may store, access or process information outside Australia. The location and arrangements may depend on the provider, service and account settings.

Before adopting or materially changing a system that processes personal or health information, Ruckus Rehab will consider the provider's privacy policy, security controls, data location, access arrangements and applicable overseas disclosure requirements.

Where personal information is disclosed overseas, we will take the steps required by applicable Australian privacy law.

11. Data Retention and Secure Disposal

We retain personal information for as long as reasonably necessary to provide services, maintain appropriate records, meet legal and professional obligations, resolve disputes and fulfil legitimate business purposes.

Clinical records will be retained in accordance with applicable legal and professional recordkeeping requirements. Information will not be deleted simply because it is no longer actively used.

When information is no longer required and can lawfully be destroyed, we will take reasonable steps to securely delete, destroy or de-identify it.

Legacy records stored in Google Sheets or other systems will be reviewed for secure transition, archiving or disposal. Records will not be deleted until relevant retention requirements and ongoing business needs have been considered.

12. Privacy and Security Audits

Ruckus Rehab will maintain a documented process for reviewing its privacy and information security practices.

At least annually, and following significant system changes or privacy incidents, the Privacy Officer will coordinate a review of matters such as:

• Who has access to clinical and business information.
• Password, multi-factor authentication and account security settings.
• Nookal and other third-party system access and security arrangements.
• Use of Heidi and other services that may process health information.
• Storage and sharing of referral documents and clinical records.
• OneDrive, Google Drive and legacy Google Sheets permissions.
• Website cookies, analytics, Meta tracking and enquiry forms.
• Data retention, secure disposal and backup arrangements.
• Privacy complaints, suspected breaches and corrective actions.

The review may be conducted internally or with assistance from an appropriately qualified external provider, depending on the risks and complexity of the systems involved.

Findings, identified risks, corrective actions and completion dates will be documented. Any significant unresolved risks will be prioritised and escalated to the Privacy Officer.

13. Data Breaches and Privacy Incidents

A privacy incident may include lost devices, misdirected emails, unauthorised access to clinical records, compromised accounts, lost paper documents or accidental disclosure of health information.

If a suspected incident occurs, Ruckus Rehab will take reasonable steps to:

• Contain the incident and prevent further unauthorised access or disclosure.
• Assess what information was affected and the potential harm to individuals.
• Take appropriate steps to reduce or remediate the risk.
• Determine whether notification to affected individuals or the Office of the Australian Information Commissioner is required under the Notifiable Data Breaches scheme or other applicable laws.
• Document the incident, actions taken and lessons learned.

Where notification is legally required, it will be carried out in accordance with the applicable requirements.

14. Your Privacy Choices and Cookie Controls

You may manage or restrict cookies through your browser settings. Depending on the technologies used on our website, you may also be offered choices about particular categories of cookies or tracking technologies.

You may be able to manage advertising personalisation through the privacy settings provided by platforms such as Meta and Google.

You may also ask questions about how your information is handled, request access or correction, or raise concerns about a particular use or disclosure.

You can decline the use of Heidi during your appointment. Doing so will not prevent you from receiving physiotherapy treatment.

15. Accessing and Correcting Your Information

You may request access to personal information Ruckus Rehab holds about you and request correction of information that is inaccurate, out of date, incomplete, irrelevant or misleading.

We will respond to requests in accordance with applicable privacy requirements. In some circumstances, access may be limited or refused where the law permits or requires this.

You may also request deletion of information, subject to applicable retention obligations and circumstances in which we are required or permitted to retain it.

To make a request, contact the Privacy Officer using the details in Section 18.

16. Marketing Communications

Where permitted by law, we may use your contact details to communicate with you about our services, products, promotions or other relevant information.

You can unsubscribe from marketing communications at any time using the unsubscribe mechanism provided or by contacting us.

Unsubscribing from marketing will not prevent communications necessary to provide services you have requested, such as appointment confirmations or relevant administrative messages.

17. Children's Privacy and Third-Party Websites

Children's privacy

Ruckus Rehab may provide services to children and young people where appropriate. We handle their personal and health information with care and seek consent or authority from a parent, guardian or other legally authorised decision-maker where required.

Our website is not specifically directed towards children under 13. We do not knowingly collect personal information from children under 13 through our website for advertising or analytics purposes. If we become aware that information has been collected in circumstances where it should not have been, we will take reasonable steps to address the issue.

Third-party websites

Our website may contain links to third-party websites or services. We are not responsible for the privacy practices, security or content of those websites. We encourage you to review their privacy policies before providing information.

18. Changes to This Privacy Policy and Contact Us

We may update this Privacy Policy to reflect changes to our services, systems, privacy practices or legal obligations. The latest version will be published on our website with its effective date.

If you have questions about this policy, wish to access or correct your information, or have a privacy concern or complaint, please contact:

Ruckus Rehab

Privacy Officer: Jonathan Reid

Email: jonathan@ruckusrehab.com.au

Phone: 0421 374 680

We will consider privacy concerns seriously and work to resolve them as promptly as reasonably possible. You may also contact the Office of the Australian Information Commissioner if you are unable to resolve a privacy complaint with us.