Privacy Policy

This policy is current as of Oct 2026.

1. About this policy

Melbourne Podiatry Clinic Pty Ltd (ABN 73 967 893 388) (“MPC”, “we”, “us”) protects the privacy of every patient, website visitor, job applicant and business contact. This policy explains what personal and health information we collect, why we collect it, how we use, store and share it, and how you can access or correct it.

We run clinics in Essendon, Blackburn and Malvern East. We are part of Melbourne Sports Health Group (MSHG), alongside Essendon Sports Medicine and Melbourne Sports Physiotherapy.

We handle your information under the Privacy Act 1988 (Cth), including the Australian Privacy Principles (APPs), and the Health Records Act 2001 (Vic), including the Health Privacy Principles (HPPs). We also follow the privacy obligations of the Podiatry Board of Australia and AHPRA.

We review this policy at least once a year and whenever our services or systems change.

2. What information we collect

We only collect information that is reasonably necessary to care for you, run our clinics, or respond to your enquiry.

Health information is sensitive information. We only collect it with your consent, or where the law allows it. You may choose not to give us some information, but we may then be unable to treat you safely or claim rebates for you.

3. How we collect it

Wherever we can, we collect information directly from you. We collect it:

• when you book online, by phone, by email or at reception
• through the online new-patient intake form we send before your first visit
• during your consultation, in person or by telehealth video, from your podiatrist’s notes, photos and assessment
• from testing equipment in the clinic: strength and force plates, in-shoe pressure sensors, video cameras and 3D foot scanners
• when you fill in a website form, a Facebook or Instagram lead form, or a webinar or event registration
• when you answer a feedback survey after your appointment
• from cookies and pixels when you visit our website or see our ads

We may also collect information from others, with your consent or where the law allows. This includes your GP, specialists, other health practitioners, Essendon Sports Medicine and Melbourne Sports Physiotherapy, Medicare, DVA, health funds, WorkCover or TAC insurers, and a parent or guardian for patients under 18.

If someone gives us information about you that we did not ask for, we will decide whether we could have collected it ourselves. If not, we will destroy or de-identify it when it is lawful to do so.

4. How we use and share your information

We use your information mainly to give you safe, high-quality podiatry care. We also use it for purposes you would reasonably expect:

• assessing, treating and managing your condition, and tracking your progress over time
• preparing your test reports and results, and sending them to you
• booking appointments and sending reminders by SMS or email
• billing, and making claims with Medicare, DVA, NDIS, WorkCover, TAC and private health funds
• writing to your GP or referrer, including Medicare Chronic Disease Management (CDM) letters
• following up enquiries you make, and checking in if you have not booked yet
• asking for feedback, and improving our services
• training, supervision and peer mentoring of our clinicians
• quality and safety reviews, audits, insurance and legal matters
• business reporting, using de-identified or summarised data where we can

Who we share it with. We only disclose health information for the reason we collected it, for a directly related purpose you would expect, with your consent, or where the law requires or allows. This may include:

• your GP, specialists and other practitioners involved in your care
• Essendon Sports Medicine and Melbourne Sports Physiotherapy, where you are seen across MSHG and share a reception and clinical record
• Footwork, the Australian lab that makes your custom orthotics (your foot scan and prescription)
• Medicare, DVA, NDIS, health funds, WorkCover or TAC insurers, for claims
• a parent, guardian or person responsible, where you are under 18 or cannot consent
• our IT and software providers, who store and process data on our behalf (section 6)
• government agencies, courts or others when the law requires, or to lessen a serious threat to someone’s life, health or safety

We do not sell your personal information. We never share your clinical records or test results with advertisers or social media platforms.

5. Technology, automation and AI

We use secure software and some automation so our team spends more time with patients and less on admin. A person stays responsible for every clinical decision.

Your clinical record. Appointments, notes, letters, test reports and intake answers are kept in our practice management system. Test equipment stores its results in its own secure software, and we also attach your reports to your clinical record.

Automated reports and emails. After some tests, our systems match the report to your record using your name and date of birth, attach it to your file, and email it to the address we hold for you. If a match is unclear, the system stops and a staff member checks it by hand. Emails come from our clinic address.

RunIQ results portal. We may offer you online access to your strength, pressure and gait results through our RunIQ portal. You will only get portal access if you agree to it. You log in with a private access code and your birth year. Portal data is stored in Australia, and pages are only shown through short-lived secure links. Please do not share your access code.

Lead follow-up and reminders. If you enquire through our website or social media, your contact details go into our customer relationship management (CRM) system. We use it to follow up your enquiry and to note when you have booked, so we stop contacting you.

Feedback. Survey scores and comments are stored with your record. Our team is notified about lower scores so we can follow up.

AI scribe in consultations. Some of our podiatrists use PatientNotes, an AI scribe, to help write clinical notes. With your permission, it records the audio of your consultation and drafts a note from it. Your podiatrist checks and edits the note before it is saved to your record, and stays responsible for it.

• We will ask for your consent before recording, on a consent form and again verbally at the start of your consultation. You can say no, or ask us to stop at any time, and your care will not be affected.
• The audio is used to create your note and is not kept in your clinical record. PatientNotes stores it securely in Australia and deletes it automatically after 30 days.
• PatientNotes may use consultation data to improve its AI models. Our consent form explains this, and you can decline the scribe if you are not comfortable with it.

Artificial intelligence. We use AI tools to help with admin, for example to summarise intake forms, draft plain-English explanations of test results, and produce business reports. When we do:

• a clinician reviews any AI-assisted content about your health before it is used in your care or sent to you
• AI is never used to diagnose you, decide your treatment, or decide whether you can receive a service
• where we can, the AI runs on our own secure server, or we remove identifying details first
• apart from our AI scribe (above), where we use an external AI provider, we only use business services that do not use our data to train their models, and that are bound by confidentiality and security terms
• staff may not enter identifiable patient details into public or personal AI tools

Automated decisions. We do not make decisions about you that significantly affect your rights or interests by computer alone. If that changes, we will update this policy first.

6. Service providers and overseas storage

We use trusted providers to store and process information for us. They may only use it to provide their service to MPC, and must keep it secure and confidential.

So some of your information may be stored or processed overseas, mostly in the United States. Before we send information overseas, we take reasonable steps to make sure the provider handles it consistently with the APPs and HPPs. Where we can, we choose Australian data storage for health information. We stay responsible for how our providers handle your information.

7. Marketing, website and cookies

Marketing messages. With your consent, we may email or text you about running workshops, webinars, offers and health tips. We follow the Spam Act 2003 (Cth). Every message has an unsubscribe option, and we act on opt-outs within 5 business days. Opting out of marketing does not stop appointment reminders or messages about your care.

Website, cookies and pixels. Our website uses cookies, Google Analytics, and advertising pixels from Meta and Google. They show us how people use the site and how our ads perform, and let us show relevant ads to people who have visited it. They collect browsing data such as pages viewed and device type. They do not collect your clinical records. You can block or delete cookies in your browser settings, and adjust ad settings in your Google and Meta accounts.

Social media. If you contact us through Facebook or Instagram, or fill in a lead form there, those platforms’ own privacy policies also apply. Please do not post health details on our public pages. Send them to us privately instead.

Testimonials, photos and video. We will only use your name, photo, video or story in marketing with your written consent. You can withdraw it at any time for future use.

De-identified data. We may use summarised, de-identified information (for example, average strength improvements across patients) to improve our services, in education and in marketing. You cannot be identified from it.

8. Storage, security and retention

We store information electronically. Any paper records are scanned into your file and then securely destroyed. We protect it with:

• password and two-factor protected accounts, with each staff member only able to see what their role needs
• encrypted connections, a secure private network between our clinic computers, and regular encrypted backups
• confidentiality agreements and privacy training for all staff and contractors
• systems that check identity before sending results, and flag anything unclear for a person to review

How long we keep it. As the Health Records Act 2001 (Vic) requires, we keep health records for at least 7 years after your last visit. For patients under 18, we keep them until at least age 25. After that, we securely destroy or de-identify them. We keep enquiries from people who never became patients only as long as we need them to follow up, and we keep unsuccessful job applications for up to 12 months.

Data breaches. If a data breach is likely to cause serious harm, we will notify you and the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches scheme. We will also tell you what we are doing about it, and what you can do to protect yourself.

9. Your rights, complaints and contact

Access and correction. You can ask for a copy of your health record, including your test results and reports, or ask us to correct anything inaccurate. Please put your request in writing to our Privacy Officer. We will respond within 30 days. We may charge a reasonable fee for copies, as the Health Records Act allows, but never for making the request. If we refuse access, we will tell you why in writing.

Anonymity. You may use a pseudonym or stay anonymous for general enquiries. We need your real identity to treat you and to process claims.

Identifiers. We do not use government identifiers such as your Medicare or DVA number as our own patient identifier. We only use or disclose them as the law permits.

Complaints. If you are worried about how we have handled your information, please contact our Privacy Officer first, in writing if possible. We will acknowledge your complaint within 5 business days. Our Privacy Officer will review your records and the circumstances, speak with the staff involved, and may contact you for more information. We will give you a written response within 30 days, explaining what we found and what we will do to fix the problem. If it will take longer, we will tell you why and when to expect our answer. If you are not satisfied with our response, you can contact:

• the Office of the Australian Information Commissioner: 1300 363 992
• the Victorian Health Complaints Commissioner: 1300 582 113

Contact our Privacy Officer

Andrew Maitland, Director
Melbourne Podiatry Clinic
1069 Mt Alexander Road, Essendon VIC 3040
Email: info@melbournepodiatryclinic.com.au
Phone: (03) 9993 0461

Changes to this policy. We may update this policy as our services, systems or the law change. The latest version will always be on our website.