Last updated: July 2026

​

1.  PRIVACY POLICY
1.1  Introduction
Exercise Healthcare Australia (EHA) is committed to protecting the privacy of individuals and handling personal information responsibly. This Privacy Policy outlines how we collect, use, store, and disclose personal information in accordance with the Privacy Act 1988 (Cth), the Privacy and Other Legislation Amendment Act 2024 (Cth), and the Australian Privacy Principles (APPs).

A full copy of our Privacy and Information Management Policy and Procedures is available to clients on request by contacting admin@exercisehealthcare.com.au or calling 1300 034 248.

1.2  What Personal Information We Collect and Hold
We collect and hold the following types of personal information:

• Name, date of birth, and contact details (phone, email, address)

• Health and medical history, including symptoms, medications, diagnoses, and treatment history

• Exercise assessment results, treatment plans, and clinical progress notes

• Referral correspondence and reports from other health providers

• NDIS plan details and funding information (where applicable)

• Photographs and video footage (where consent has been provided)

• Payment and billing information

• Emergency contact details

 

Health and medical information is sensitive information under the Privacy Act and is afforded a higher level of protection. We only collect sensitive information where it is reasonably necessary for the provision of our Exercise Physiology services, and with your knowledge or consent.

1.3  How We Collect Personal Information
We collect personal information:

• Directly from you during consultations, assessments, or when you complete forms

• From referring health professionals, with your knowledge

• From NDIS plan managers, support coordinators, or the NDIA where required for service delivery

• Through our practice management system, Clinic to Cloud

 

Where possible, we collect personal information directly from you. If we collect it from a third party, we will take reasonable steps to notify you.

Persons making an initial enquiry with EHA are not required to provide personal information and may do so anonymously. However, once a decision is made to proceed with services, personal and sensitive information will need to be collected to deliver safe, appropriate care.

1.4  How We Hold and Protect Personal Information
EHA takes the security of your personal information seriously. We use the following measures to protect it:

• Clinic to Cloud — our practice management system, used for clinical records, appointment management, and billing. Clinical records are stored on secure servers located in Australia, encrypted at rest and in transit.

• Lyrebird Health — an AI clinical scribe used to assist our clinicians with generating session notes. Audio is transcribed in real time on Australian servers and no audio is permanently stored. Generated notes are held for up to 7 days before permanent deletion and are encrypted using 256-bit encryption.

• Paper records — stored in locked, fireproof cabinets and accessed only by authorised staff.

• All computer systems are protected by firewalls, password access, and multi-factor authentication.

• Devices are set to automatically log out after periods of inactivity.

• Staff access to personal information is limited to what is necessary for their role.

 

Clinical records, treatment notes, and identifiable client information are not stored in Google Drive or other general cloud file-sharing services. Exercise programs that reference a client only by the PMS reference number may be stored on Google Drive (Google Workspace), with access restricted to staff on a need-to-know basis and protected by multi-factor authentication and regular access reviews.

Personal information is retained for a minimum of seven years from the date of last service. For clients under 18 years of age, records are retained until their 25th birthday or seven years after last service, whichever is longer. When information is no longer required, it is securely destroyed by shredding (paper) or permanent deletion (electronic).

1.5  Our Use of Artificial Intelligence
EHA uses Lyrebird Health, an AI clinical scribe, to assist Exercise Physiologists in generating session notes during or after consultations. Before Lyrebird is used in any consultation, your verbal or written consent will be requested. You are free to decline.

Key facts about how Lyrebird handles your information:

• No audio is permanently stored — your voice is transcribed in real time and audio is deleted immediately after the session

• Generated notes are stored on Australian servers for up to 7 days and then permanently deleted

• Your data is never used to train AI models and is never sold or disclosed to third parties

• All data is processed and stored in Australia

• All notes generated by Lyrebird are reviewed and approved by your treating clinician before being saved to your record

 

EHA's current assessment is that Lyrebird Health does not constitute an automated decision-making tool requiring disclosure under the Privacy and Other Legislation Amendment Act 2024 (Cth), as all clinical decisions are made by the treating Exercise Physiologist. We will review this position as further guidance is released, and will update this policy by 10 December 2026 if required.

1.6  How We Use Personal Information
We use personal information to:

• Provide Exercise Physiology and allied health services

• Coordinate care with other health professionals (with your consent)

• Process payments and manage NDIS funding claims

• Communicate appointment details and treatment plans

• Meet our legal and regulatory obligations

• Improve the quality of our services

 

We will not use your personal information for any purpose beyond those listed above without your specific written consent.
 

1.7  Disclosure of Personal Information
We do not sell or rent personal information to third parties.
We may share personal information in the following circumstances:

• With other health professionals involved in your care, where you have given consent or where it is directly related to your treatment

• With NDIS plan managers, support coordinators, or the NDIA where required for your service delivery

• With our practice management provider, Clinic to Cloud, to the extent necessary to operate our clinical systems

• With Lyrebird Health, to the extent necessary to generate clinical session notes with your consent

• Where required or authorised by law, including mandatory reporting obligations

 

1.8  Access and Correction of Your Information
You have the right to access or request correction of the personal information EHA holds about you. To make a request, please contact us at:

​

Email: admin@exercisehealthcare.com.au
Phone: 1300 034 248
Mail: 458 Enoggera Road, Alderley QLD 4051

​

We will respond within 30 days. In limited circumstances we may decline access where required by law, and will provide written reasons if we do so.

1.9  Privacy Complaints
If you have a concern about how we have handled your personal information, please contact us in the first instance using the details above. We will acknowledge your complaint within five business days and aim to resolve it within 30 days.

If you are not satisfied with our response, you may contact:

• Office of the Australian Information Commissioner (OAIC): oaic.gov.au  |  1300 363 992

• NDIS Quality and Safeguards Commission: ndiscommission.gov.au  |  1800 035 544

 

1.10  Policy Availability
This policy is available free of charge on our website at exercisehealthcare.com.au. If you require a copy in an alternative format (such as large print or hard copy), please contact us at admin@exercisehealthcare.com.au or 1300 034 248 and we will accommodate your request.
 

2.  TERMS OF USE

2.1  Acceptance of Terms
By accessing and using the Exercise Healthcare Australia website (www.exercisehealthcare.com.au) or engaging with our services, users agree to comply with these Terms of Use.

2.2  Services and Content

• The information on this website is for general guidance only and should not be considered medical advice.

• EHA reserves the right to modify or discontinue any services at its discretion.

• Users should seek professional medical advice before acting on any website content.

 

2.3  User Responsibilities
Users agree not to:

• Use the website for unlawful, misleading, or fraudulent activities

• Disrupt the website's functionality or security

• Provide false or misleading information

 

2.4  Intellectual Property
All content, including text, graphics, and logos, is the intellectual property of Exercise Healthcare Australia and is protected by copyright laws. Unauthorised reproduction or distribution is prohibited.

2.5  Limitation of Liability
Exercise Healthcare Australia is not liable for:

• Any inaccuracies or omissions in website content

• Loss, damage, or injury resulting from the use of our website or services

 

2.6  Third-Party Links
The website may contain links to third-party sites. Exercise Healthcare Australia is not responsible for the content or privacy practices of external websites.

2.7  Termination of Use
Exercise Healthcare Australia reserves the right to suspend or terminate website access if a user violates these Terms of Use.
 

3.  COMPLAINTS POLICY
3.1  Lodging a Complaint
Exercise Healthcare Australia is committed to addressing concerns promptly and fairly. Complaints can be submitted through the following channels:

​

Email: admin@exercisehealthcare.com.au
Phone: 1300 034 248
Mail: 458 Enoggera Road, Alderley QLD 4051

3.2  Complaint Handling Process

• Acknowledgment: Complaints will be acknowledged within five business days.

• Investigation: All complaints will be reviewed, and necessary information will be gathered.

• Resolution: Efforts will be made to resolve complaints within 30 business days. If additional time is required, the complainant will be informed.

• Outcome Notification: A written response will be provided outlining the outcome and any actions taken.

 

3.3  Confidentiality and Fairness
All complaints will be handled confidentially, and only relevant staff will have access to complaint details.

3.4  External Review
If the complainant is not satisfied with the resolution, they may escalate their complaint to:

• Office of the Australian Information Commissioner (OAIC): oaic.gov.au  |  1300 363 992

• NDIS Quality and Safeguards Commission: ndiscommission.gov.au  |  1800 035 544
   

 

 

For any inquiries, please contact:

Exercise Healthcare Australia
Email: admin@exercisehealthcare.com.au
Phone: 1300 034 248
Address: 458 Enoggera Road, Alderley QLD 4051