Privacy Policy: Upside Health + Movement

Privacy Policy — Upside Health & Movement

Effective Date: 26 October 2026
Last Updated: 26 October 2026

Upside Health & Movement ("we", "us", "our") is dedicated to protecting your privacy and treating your personal and sensitive health information with the highest degree of confidentiality and security.

This Privacy Policy explains how we collect, use, store, disclose, and protect your personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), the Health Records Act 2001 (Vic), and the Health Privacy Principles (HPPs).

1. The Types of Information We Collect

To provide safe, professional clinical services and operate our clinic, we collect the following categories of information:

A. Personal Information

  • Full name, date of birth, and gender
  • Contact information: residential address, email address, and mobile phone number
  • Emergency contact name and phone number
  • Billing and transaction records (processed securely via our integrated third-party payment providers)
  • Private health fund membership details (e.g., for HICAPS claiming) or claim identifiers for WorkCover / TAC (where applicable)

B. Sensitive & Health Information

Because we provide clinical myotherapy, remedial massage, sports massage, and compression recovery services, we collect health information necessary to assess, treat, and monitor your physical condition, including:

  • Medical history, surgical history, past and present injuries, medications, and general health status
  • Physical symptoms, pain mapping, movement assessments, and functional limitations
  • Clinical consultation notes, treatment plans, exercise prescriptions, and progress reports
  • Referral letters, imaging reports, or diagnostic information provided by you or other healthcare practitioners (e.g., GPs, physiotherapists, chiropractors)

C. Website & Device Usage Information

When you access our website (https://www.upsidehealth.com.au), we automatically collect limited technical data:

  • Internet Protocol (IP) address, browser type and version, device identifiers, and operating system
  • Site engagement data (pages visited, referral links, visit timestamps, and dwell time) collected via cookies and web analytics tools

2. How We Collect Your Information

We collect information directly from you wherever reasonable and practical:

  • Intake & Clinical Consultations: When you complete our physical or digital new patient intake form, undergo an initial assessment, or participate in follow-up treatments.
  • Online Bookings & Purchases: When you schedule an appointment via our online booking engine or purchase treatment packs, recovery sessions, or digital gift cards through our online store.
  • Direct Communications: When you contact us via phone, email, website enquiry forms, or direct messages on social media.
  • Third-Party Health Providers: Where clinically necessary and with your consent, from your treating GP, medical specialist, physiotherapist, or allied health professional.

3. Why We Collect, Hold, and Use Your Information

We collect and use your personal and health information for the following primary purposes:

  • Clinical Treatment & Care: Delivering personalized myotherapy, remedial massage, sports massage, and recovery therapy, ensuring treatments are safe and counter-indications are avoided.
  • Practice Administration: Scheduling appointments, managing therapist calendars, issuing automated SMS and email reminders, invoicing, and processing health insurance or third-party claims.
  • Store Orders: Fulfilling online purchases of multi-session treatment packs, recovery boots sessions, and digital gift cards.
  • Practice Improvement & Security: Auditing clinical documentation, maintaining data integrity, troubleshooting site issues, and enhancing website performance.
  • Client Communications: Responding to inquiries and, where permitted by law, delivering clinic news or educational updates (you may unsubscribe from marketing emails at any time).

4. Third-Party Service Providers and Cloud Systems

We will never sell, rent, or trade your personal or health data to advertisers or data brokers. We share information only with trusted third-party service providers who assist us in managing our clinic and operating our website under strict contractual duties of confidentiality and security:

  • Practice Management & Online Bookings: Third-party clinical management software (such as Fresha or our integrated booking portal) to manage client profiles, consultation notes, therapist scheduling, and automated reminders.
  • Website Platform & E-Commerce: Squarespace hosts our website, online shop, web forms, and cookie preference framework.
  • Payment Processing & Health Rebates:
    • Stripe: Securely processes online transactions for gift cards and treatment packs without Upside Health & Movement ever viewing or storing your raw payment card numbers.
    • HICAPS / Tyro (or in-clinic EFTPOS): Processes private health insurance rebates and point-of-sale payments at the clinic counter.
  • Analytics: Google Analytics and Squarespace Analytics collect de-identified browsing metrics to help us understand traffic patterns and optimize user experience.

Cross-Border Transfers

Some of our cloud software providers (including Squarespace, Stripe, and Google) store data on secure international servers located overseas, predominantly in the United States and the European Union. Where your personal information is hosted or transferred outside Australia, we take reasonable steps to ensure the recipient adheres to security and data handling standards substantially similar to the Australian Privacy Principles (APPs).

5. Cookies, Analytics, and Tracking Technologies

When you visit https://www.upsidehealth.com.au, we use cookies, tracking pixels, and related technologies:

A. Categories of Cookies We Use

  • Essential Cookies: Necessary for website navigation, user sessions, security, and completing transactions in our online store (such as purchasing treatment packs or gift vouchers). These cannot be disabled via our cookie banner.
  • Analytics & Performance Cookies: Used by Google Analytics and Squarespace Analytics to collect aggregated, de-identified metrics regarding visitor volume, bounce rates, and traffic sources.
  • Functional Cookies: Remember your settings and preferences to provide a smoother browsing experience.

B. Google Analytics

Google Analytics generates statistical insights using cookies. Data generated by these cookies regarding your website use may be transmitted to and stored by Google on servers located outside Australia. Google processes this data to compile activity reports for our site. Google will not associate your IP address with any other data held by Google.

C. Managing Your Cookie Choices

  • Cookie Banner: When visiting our website, you can select "Accept all" or click "Manage cookies" to opt out of non-essential analytical cookies at any time.
  • Browser Settings: You can configure your browser to reject all or specific cookies. Please note that disabling essential cookies may impact your ability to check out on our online store.
  • Google Opt-Out: You can permanently opt out of Google Analytics tracking across all websites by installing the Google Analytics Opt-out Browser Add-on.

6. Storage, Security, and Record Retention

We take reasonable technical, physical, and administrative safeguards to prevent the loss, unauthorized access, misuse, or alteration of your records:

  • All digital patient intake forms, booking records, and clinical treatment notes are stored within secure, encrypted, password-protected systems with role-based staff access controls.
  • Any paper documentation is kept in secure, restricted-access clinical areas.

Retention Obligations

In compliance with the Health Records Act 2001 (Vic) and Victorian medical record retention standards:

  • Adult Health Records: Retained for a minimum of 7 years following the date of your last clinical treatment.
  • Minor Health Records: For clients who received treatment while under the age of 18, records are retained until the individual reaches 25 years of age.
  • After the mandatory retention period expires, records that are no longer clinically or legally required will be securely destroyed or permanently de-identified.

7. Treatment of Minors

We provide myotherapy and remedial massage services to minors (under the age of 18) only with the informed consent and participation of a parent or legal guardian. A parent or guardian must review and approve the initial health history intake form before treatment can commence.

8. Accessing and Correcting Your Information

Under the Australian Privacy Principles and the Victorian Health Records Act, you have the right to request access to the personal and health information we hold about you, and to request corrections if you believe the information is inaccurate, out of date, or incomplete.

To submit a request, contact our Privacy Lead in writing using the details provided below. We will respond within 30 days. In certain legal or clinical circumstances specified by law, access may be withheld (for example, where disclosure would pose a serious threat to the life or health of an individual). If an exception applies, we will provide a written explanation.

9. Privacy Enquiries and Complaints

If you have questions about this policy, or if you believe your privacy rights have been breached, please contact us directly:

Upside Health & Movement
Attention: Privacy Lead / Practice Manager
Address: 125A Buckley Street, Essendon VIC 3040
Phone: (03) 8597 0085
Email: info@upsidehealth.com.au

We treat complaints seriously and will investigate and respond to your inquiry in writing within 30 days.

If you are unsatisfied with our response, you have the right to lodge a formal complaint with independent statutory authorities:

  • Office of the Australian Information Commissioner (OAIC)
    Website: www.oaic.gov.au
    Phone: 1300 363 992
    Post: GPO Box 5288, Sydney NSW 2001

  • Health Complaints Commissioner (Victoria)
    Website: www.hcc.vic.gov.au
    Phone: 1300 582 113
    Address: Level 26, 570 Bourke Street, Melbourne VIC 3000

10. Modifications to this Policy

We review and update this Privacy Policy periodically to reflect changes in our clinical operations, software systems, and applicable legislation. Any revised policy will be posted on this page with an updated "Effective Date" and "Last Updated" date at the top.