Privacy Policy

1. About this policy

4D Sportsmed Pty Ltd (ABN 76 606 914 989), trading as 4D Health & Performance ("4D", "we", "us"), is committed to protecting the privacy and confidentiality of your personal and health information. This policy explains what we collect, why, how we protect it, and your rights.

This policy applies to both our clinics:

• Sydney CBD: Level 2, 160 King Street, Sydney NSW 2000
• Norwest: A2/12–14 Columbia Way, Norwest NSW 2153

It also covers our website (4dhp.com), online programs, email and SMS communications, and social media channels.

We handle your information in line with:

• the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs)
• the Health Records and Information Privacy Act 2002 (NSW) and its Health Privacy Principles (HPPs)
• the Health Practitioner Regulation National Law and the confidentiality and privacy obligations in the Ahpra and National Boards' shared Code of conduct, which apply to our registered chiropractors, physiotherapists and other registered practitioners
• the professional standards of Exercise & Sports Science Australia (ESSA) for our accredited exercise physiologists

All 4D practitioners and staff must keep your information confidential. This duty continues after you stop attending the clinic and after a staff member leaves 4D.

2. Information we collect

We only collect information that is reasonably necessary to provide safe, effective care and to run our clinics. This may include:

• Identity and contact details: name, date of birth, gender, address, phone, email and emergency contact
• Health information: medical history, current and past injuries, symptoms, medications, allergies, test and imaging results, referral letters, clinical notes, assessment results, treatment plans, exercise programs and outcome measures
• Funding and billing details: Medicare number, private health fund details, DVA details, workers compensation, CTP or NDIS claim information, and payment records
• Performance and training data: strength, fitness and movement testing results, training history and program data (for example, from our training app)
• Referrer and third-party details: your GP, specialist, coach, employer or insurer, where relevant to your care
• Website and marketing data: enquiry and form submissions, booking history, purchases, email and SMS engagement, and technical data such as IP address, browser, device and pages visited
• Images and video: posture photos or movement videos taken for clinical assessment, only with your consent

Health information is "sensitive information" under the Privacy Act. We will only collect it with your consent, or where the law requires or permits it.

3. How we collect it

Wherever practical, we collect information directly from you. This includes:

• new patient intake forms, online or in the clinic
• online booking and discovery call forms
• consultations, assessments and treatment sessions
• phone calls, emails, SMS and website enquiry forms
• online program purchases, downloads and sign-ups

Sometimes we collect information from others, such as your GP or specialist, another health provider, a parent or guardian, an insurer, a workers compensation or CTP scheme, NDIS, or a sporting organisation. We only do this with your consent or where the law permits it.

Consent. By completing our intake forms and attending treatment, you consent to us collecting and using your information as described in this policy. You can withdraw or limit your consent at any time, but this may affect our ability to treat you safely.

Children. For patients under 18, we usually collect information from, and seek consent from, a parent or guardian. Young people who are mature enough to make their own health decisions may give their own consent.

Unsolicited information. If we receive information we did not ask for and do not need, we will destroy or de-identify it where lawful and reasonable.

4. Why we collect, use and disclose it

We use your information for the main purpose you gave it to us: assessing, treating and managing your health and performance. We may also use it for directly related purposes you would reasonably expect, including:

• coordinating care between 4D practitioners, since our chiropractors, physiotherapists, exercise physiologists, massage therapists and coaches work as one team
• communicating with your GP, specialist or other treating providers
• booking appointments and sending reminders by SMS or email
• processing payments, invoices, Medicare, private health, DVA, NDIS, workers compensation and CTP claims
• meeting our legal, regulatory, professional and insurance obligations, including Ahpra and National Board requirements
• internal quality assurance, clinical audit, training and supervision
• running and improving our clinics, website and online programs

Marketing. With your consent, we may send you newsletters, health tips, program offers or event invitations. Every marketing message includes a way to unsubscribe. We never use your health information for marketing without your express consent.

Testimonials. In line with the Health Practitioner Regulation National Law and Ahpra's advertising guidelines, we do not use patient testimonials about clinical aspects of our services in our advertising. We will never publish your name, image, story or results without your express written consent.

Research and case studies. We will only use your information for research, education or case studies if it is de-identified, or if you have given express consent.

5. Who we share it with

We do not sell, rent or trade your personal information. We only share it where needed for the purposes above, with your consent, or where the law requires or permits it. This may include:

• other 4D practitioners involved in your care
• your GP, specialists and other treating health professionals
• Medicare, private health funds, DVA, NDIS, workers compensation insurers and CTP insurers, when you claim through them
• pathology, imaging and other diagnostic providers
• your parent or guardian, or a person you have nominated
• trusted service providers who help us run the clinic (see the table below), under strict confidentiality terms
• our professional advisers, insurers and auditors
• Ahpra, National Boards, courts, tribunals or government agencies, where the law requires it

We may also share information without consent where it is needed to lessen or prevent a serious threat to someone's life, health or safety, or where the law otherwise permits it.

Coaches, employers and sporting clubs. We will not share your health information with a coach, club, school or employer unless you have given express consent, or the law requires it (for example, in a workers compensation claim).

Service providers and overseas disclosure

We use trusted third-party systems to run our clinics. Some of these providers store or process data outside Australia. Before disclosing information overseas, we take reasonable steps to make sure the provider handles it in line with the APPs.

We keep clinical notes in Cliniko and aim to keep detailed health information out of our marketing and analytics systems. Our CRM may hold limited health-related information you choose to give us, for example when you sign up for a women's health or pelvic floor guide.

6. Website, cookies, analytics and marketing

Our website uses cookies, pixels and similar technologies to make the site work, understand how people use it, and measure our advertising. These include:

• Essential cookies that run the website, shopping cart and checkout
• Analytics tools such as Google Analytics and Microsoft Clarity. Clarity may record how you move, scroll and click on our pages so we can improve the site. We configure it to mask form fields and text you type.
• Advertising pixels from Meta and Google, which help us show relevant ads and measure how they perform

You can block or delete cookies in your browser settings, and manage ad preferences in your Google and Meta accounts. Some parts of the site may not work properly without cookies.

Email and SMS. If you subscribe, download a resource or buy an online program, we may send you related emails or SMS messages. We comply with the Spam Act 2003 (Cth). You can unsubscribe at any time using the link in any email, by replying STOP to an SMS, or by contacting us.

Social media. If you message us on Instagram or Facebook, that platform's privacy policy also applies. Please don't share detailed health information through social media or public comments. Book an appointment or call us instead.

Automated decisions. We do not use computer programs to make decisions about your care or treatment that significantly affect you. Our practitioners make all clinical decisions. We may use automated tools for things like appointment reminders and email sequences. If this changes, we will update this policy.

7. Storage, security, retention and data breaches

We take reasonable steps to protect your information from misuse, interference, loss, and unauthorised access, change or disclosure. These steps include:

• secure, password-protected practice management software, with access limited to staff who need it
• multi-factor authentication on key business systems where available
• encrypted data transfer and reputable cloud providers
• confidentiality agreements and privacy training for all staff and contractors
• secure storage and destruction of any paper records

Retention. Under the NSW Health Records and Information Privacy Act 2002, we keep health records for at least 7 years after your last visit. For patients under 18, we keep them until you turn 25, whichever is later. When records are no longer needed, we securely destroy or de-identify them.

Data breaches. If a data breach is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches scheme. We will also take prompt steps to contain the breach and reduce any harm.

8. Access, correction and anonymity

Access. You can ask for a copy of the personal and health information we hold about you. Please make your request in writing to our Privacy Officer. We will respond within 30 days. We may ask you to confirm your identity, and we may charge a reasonable fee to cover the cost of providing copies. There is no fee for making the request.

In limited cases, the law allows us to refuse access. For example, we may refuse if giving access would pose a serious threat to someone's life, health or safety, or would unreasonably affect another person's privacy. If we refuse, we will tell you why in writing and explain how to make a complaint.

Transfer to another provider. With your written consent, we will send a copy or summary of your records to another health provider.

Correction. If you believe any information we hold is inaccurate, out of date, incomplete or misleading, tell us and we will take reasonable steps to correct it. If we don't agree with the requested change, you can ask us to attach a statement to your record.

Anonymity. You can use a pseudonym or stay anonymous for general enquiries. Because we need to identify you to treat you safely, keep accurate clinical records and process claims, this is usually not possible for appointments.

9. Complaints, contact and changes

If you have a question or concern about your privacy, please contact our Privacy Officer first. We will acknowledge your complaint within 7 days and aim to resolve it within 30 days.

If you are not satisfied with our response, you can contact:

• Office of the Australian Information Commissioner (OAIC): oaic.gov.au, 1300 363 992
• NSW Information and Privacy Commission (IPC): ipc.nsw.gov.au, 1800 472 679
• Health Care Complaints Commission (HCCC) NSW: hccc.nsw.gov.au, 1800 043 159, for concerns about a practitioner's conduct or care
• Ahpra: ahpra.gov.au, 1300 419 495, for concerns about a registered health practitioner

Changes to this policy. We may update this policy from time to time. The latest version will always be on our website and available at reception. Please ask us if you would like a printed copy.