Privacy policy

Effective date: 15 September 2026

1. About this policy and our contact details

Melbourne Sports Health Clinic respects your privacy. This policy explains how we collect, hold, use and disclose personal information, including health information, when you contact us, receive care, make a booking or use our website.

The clinic is operated by BEO Health Solutions Pty. Ltd., ABN 73 684 185 251, trading as Melbourne Sports Health Clinic.

We handle information under the Privacy Act 1988 (Cth), including the Australian Privacy Principles, and the Health Records Act 2001 (Vic), including the Health Privacy Principles. Our use of My Health Record is also subject to the My Health Records Act 2012 (Cth).

For privacy questions, access or correction requests, or complaints, contact Dr Rebecca Beaton, Privacy and Complaints Contact, Melbourne Sports Health Clinic:

• Phone: 0437 407 854
• Email: admin@melbournesportshealthclinic.com.au
• Post: 312 Mount Dandenong Road, Croydon VIC 3136

We can provide a copy of this policy free of charge and help you access it in another suitable format.

2. The information we collect

We collect information reasonably necessary to provide care and operate the clinic. Depending on your circumstances, this may include:

• Your name, date of birth, address and contact details; emergency-contact and authorised-representative details.
• Symptoms, injury and medical history, medicines, allergies, examination findings, diagnoses, treatment plans, imaging, reports, referrals and clinical correspondence.
• Relevant activity, occupation and sport information that helps us understand your health needs and goals.
• Medicare and other relevant eligibility details, appointment information, billing records and payment-related information.
• Your communications, consent choices, requests, feedback and complaints.
• Technical and usage information generated when you visit our website, as explained below.

Government identifiers, such as Medicare numbers, are used only for purposes permitted by law. We do not use your Medicare number as our own general patient identifier.

3. How we collect information and your choices

We usually collect information from you during appointments, telephone conversations, bookings and written communications. Where appropriate and lawful, we may also obtain relevant information from your referring or treating practitioners, hospitals, imaging or pathology providers, or an authorised representative.

We seek consent to collect health information unless the law permits or requires collection without it. We explain relevant collection purposes and information-sharing arrangements when information is collected. This policy does not replace that explanation or consent to treatment.

You may make a general enquiry anonymously or using another name where lawful and practicable. For clinical care, identification will usually be needed for safe treatment, record matching and billing. If you prefer not to provide information, tell us; we will explain whether that limits the care or service we can provide.

If we receive information we did not request, we assess whether we are permitted to retain it. Information that should not be held is dealt with securely and lawfully, including any health-record retention obligations.

4. How we use and share information

We use information to assess and treat you, coordinate care, arrange appointments, communicate about your care, process fees and eligible claims, manage requests and complaints, and meet professional and legal obligations. We limit access and sharing to information relevant to the purpose.

Relevant information may be shared with members of your treating team, including your referrer, other clinicians, hospitals, and imaging or pathology providers. We explain the care-related sharing you can reasonably expect. Tell us if you have concerns about sharing with a particular person so we can discuss the implications and any consent needed.

For other purposes, we share health information with your consent, for a directly related purpose you would reasonably expect, or where otherwise permitted or required by law. This may include legally required reporting or responding to a serious threat to health or safety where the legal conditions are met.

Service providers supporting our bookings, IT, communications and administration may handle information needed for those tasks. Relevant information may also be provided to authorised payment or claims services and to professional advisers where lawfully necessary. We do not sell patient information.

Being a family member, employer, coach, sporting organisation or insurer does not itself authorise access to your health information. We require your authority or another lawful basis. Referrers' correspondence preferences do not override the patient's privacy rights.

5. Children and people who need assistance

We consider a young person's understanding and ability to make their own privacy decisions. A parent does not automatically have unrestricted access to every young person's information. Where someone acts for a patient, we check their authority, the patient's capacity and wishes, and any relevant legal restrictions. Patients may ask for an interpreter, support person or assistance making a request.

6. Clinical systems, bookings and online services

Clinical records and bookings: we use cloud-based Zedmed for practice management and clinical records. Our website links to the clinic's Zedmed booking portal. Information is handled through these services for care, appointments and administration. See Zedmed's privacy policy. Our clinic policy continues to apply to information we hold or control.

My Health Record: we use the national My Health Record system to support your healthcare. Authorised staff may view relevant information and upload clinical documents where lawfully permitted or required. We respect applicable access controls and your right to ask us not to upload a document. Tell your clinician before an upload if you have concerns. You can manage record and document access through My Health Record; lawful emergency-access exceptions may apply. These controls are separate from the clinical records we must keep. See My Health Record privacy and access information.

Website: Squarespace hosts this website and provides site analytics. Technical information may include your IP address, browser and device details, referring pages, pages viewed and interaction times. It is used to deliver and secure the website and understand its use. Squarespace analytics and non-essential cookies are currently enabled without a cookie-consent banner. You can block or delete cookies through your browser settings; restricting necessary cookies may affect functionality. See Squarespace's privacy policy.

Fonts and external links: our website loads Google Fonts, which involves your browser requesting font resources from Google. Following our Google Maps or Instagram links takes you to those providers' services, where their privacy practices apply. Please do not post health information in public comments or send clinical documents through social media.

Online referrals: we use Snapforms to collect patient and referrer details, clinical information, signatures and supporting documents through our secure online referral form. The form includes a collection notice before submission. Rebecca reviews submissions through the authenticated Snapforms portal, and relevant referral records are filed in Zedmed. Email alerts to our clinic inbox contain a notification only, without patient answers or attachments. Call us if you need another referral pathway. See Snapforms' privacy policy.

Payments: we use Tyro to process payments. Payment and transaction information needed to complete and reconcile a payment is handled through Tyro and relevant financial institutions. See Tyro's privacy policy.

Email: we use Google Workspace, arranged through Squarespace, for clinic email. Messages and attachments are handled through Google's service. Use our general email address for enquiries; ordinary email is not a secure clinical-document portal. Tell us your preferred communication method. Website and email enquiries are not an emergency service.

We do not use AI consultation recording or transcription.

7. Information handled outside Victoria or Australia

Our clinical records are held in Zedmed Cloud. Zedmed states that its Cloud servers and backups are stored in Australian data centres. This does not mean that every service the clinic uses processes all information only in Australia.

Email, website delivery, technical support and payments may involve overseas handling. Based on the providers' published information:

• Google Workspace: email content, attachments and service data may be stored or processed through Google's international infrastructure. Locations for core services and support include the United States, Ireland, Belgium, Brazil, Canada, Chile, Denmark, Finland, France, Germany, Hong Kong, India, Israel, Italy, Japan, South Korea, Mexico, the Netherlands, New Zealand, Poland, Singapore, Spain, Sweden, Switzerland, Taiwan and the United Kingdom. Third-party support locations also include Argentina, Bulgaria, Colombia, El Salvador, Malaysia, the Philippines and Romania. Actual handling depends on the service, account configuration and support involved. See Google's service and subprocessor locations.
• Squarespace: website and usage information may be processed in the United States and Ireland, with other international processing described in its privacy policy. Google Fonts also involves requests to Google's international services.
• Tyro: its published policy identifies overseas recipients in the United States, India, New Zealand, Ireland, the Netherlands, Singapore and China. Which information is involved depends on the payment service and related processing.
• Snapforms: the provider identifies Australian hosting for form responses. Its published support/incident arrangements also identify limited metadata processing in the United States, Germany, Ireland and Singapore. Any onward sharing through email or integrations is a separate data flow.

These are provider processing locations, not a statement that every patient's information is sent to every listed country. Provider arrangements can change; contact us if you need more information about a service used for your care.

Before transferring health information outside Victoria or disclosing personal information overseas, we assess the applicable requirements and take the protective steps required by law. This includes appropriate provider arrangements and safeguards, or another lawful basis where applicable. This policy is not a request for you to waive your privacy rights.

8. Security and retention

We take reasonable steps to protect information from misuse, interference, loss and unauthorised access, alteration or disclosure. Access is limited to authorised people who need it for their work. Our safeguards include individual logins, two-factor authentication, password-protected computers, secure paper-record storage and backups with responsibility for recovery. We maintain procedures for complaints and My Health Record access. No internet service can guarantee absolute security.

We retain health records for the periods required by Victorian law. Generally, this means more than seven years after the last health service we provide. Information collected while a patient was under 18 must be kept until after they turn 25 or more than seven years after their last service, whichever is later. Records may need to be kept longer where another legal requirement applies.

We do not automatically delete clinical records when you stop attending or ask to close an online account. Referral documents will be filed in Zedmed before copies are lawfully removed from Snapforms. When information can lawfully be disposed of and is no longer needed, we arrange secure destruction or permanent de-identification as appropriate, including required disposal records. If the practice transfers or closes, we follow the applicable notification and record-custody requirements.

If a privacy incident occurs, we take steps to contain and assess it and make any notifications required by law. Where the Notifiable Data Breaches scheme requires notification, we notify affected individuals and the OAIC and provide relevant protective advice. For incidents involving My Health Record, we also follow its separate reporting rules, including notifying the OAIC and System Operator and requesting patient notification through the System Operator where required.

9. Access to your records

You can ask to inspect your information, receive a copy or explanation, or have relevant information sent to another health service provider. Contact us using the details above. We may reasonably check identity and authority and help clarify what is requested; you do not have to use a special clinic form.

We respond promptly and aim to respond within 30 calendar days. We meet applicable statutory time limits, including the Victorian 45-day access-response requirement. If a permitted access fee applies, we explain it in advance and follow the statutory limits and payment-related access timeframes. There is no fee merely to make a request.

Access may be restricted only where the law permits. If we refuse all or part of a request, we provide the required written reasons and complaint options, and consider other suitable ways to provide access, including through another health professional where appropriate.

10. Keeping information accurate and correcting it

Please tell us when your details change or if you believe a record is inaccurate, incomplete, outdated, irrelevant or misleading. We take reasonable steps to maintain accurate information and to correct it when required.

Correction requests are free. We respond within a reasonable period, generally within 30 calendar days. Corrections preserve the integrity of the clinical record; they do not necessarily involve deleting the original entry. Where required, we notify other recipients of a correction. You can also ask us to do so.

If we decline a correction, we explain why in writing and tell you how to complain. You may ask us to attach a statement of your disagreement to the record so it is apparent when the information is used.

11. Care communications and marketing

We may contact you about your appointments, care, follow-up and related administration. Tell us which contact details and communication methods are suitable, including any confidentiality concerns about messages or reminders.

We do not currently send marketing emails. If we introduce direct marketing involving health information, we will seek your consent and provide a straightforward opt-out. Declining marketing will not affect your access to care. A booking or agreement to these website terms is not blanket consent to marketing.

12. Questions, feedback and complaints

Dr Rebecca Beaton handles privacy and service complaints. You can contact her by telephone, email, post or in person using the clinic details in section 1. You may use an authorised representative or ask for assistance. We accept anonymous feedback, although that may limit investigation or our ability to respond. Making a complaint will not result in unfair treatment or affect your right to appropriate care.

We acknowledge complaints as soon as practicable and within three working days. We identify who is handling the complaint, discuss the concern and outcome you seek, and agree how to keep you informed. We handle information confidentially and keep complaint-management records separate from your clinical record. Relevant clinical facts still need to be documented in the clinical record.

We aim to provide a clear response within 30 calendar days. If more time is needed, we explain the delay and expected response date. Our response explains the findings, reasons, any remedial action and your review or external complaint options. You can ask us to reconsider a response or contact the appropriate regulator.

Health Complaints Commissioner (Victoria): for complaints about health services or the handling of health information in Victoria, call 1300 582 113 or visit hcc.vic.gov.au/public/about-complaints. You can contact the HCC for advice or assistance; this policy does not require you to exhaust an internal appeal first.

Office of the Australian Information Commissioner: for complaints under the Privacy Act, call 1300 363 992 or visit the OAIC privacy complaints page. The OAIC generally asks you to complain to the organisation first and allow 30 days for a response. You may then complain if you are dissatisfied or have not received a response.

13. Changes to this policy

We review this policy when our services, systems or legal obligations change. The current version and effective date will be available on our website. We provide further notice or seek consent when required; updating this policy does not retrospectively authorise an otherwise unlawful use of your information.