Privacy Policy
Ben Weavell - Osteopath
Version: 1.0
Effective: 14/10/2026
About this policy
BEN WEAVELL - OSTEOPATH is committed to protecting your privacy and handling your personal and health information responsibly.
This policy explains how I collect, use, store and share personal information in the course of providing osteopathic care and operating the practice.
The practice is operated by Ben Weavell, an osteopath practising as a sole trader.
I handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), as well as other applicable legal and professional requirements.
What information I collect
The information I collect depends on your circumstances and the services being provided. It may include:
your name, date of birth, address and contact details;
health and medical history;
information about your current symptoms, injuries, health concerns and treatment;
clinical notes and records of your consultations;
medications, allergies, previous treatment and other relevant health information;
referrals, medical reports, imaging and other clinical documents;
details of your GP, specialists and other healthcare practitioners;
Medicare, DVA, WorkCover or private health insurance information where relevant;
claim, billing and payment information;
occupation or work information where relevant to your care or a claim;
emergency contact details, where you choose to provide them;
correspondence between you, the practice and other people or organisations involved in your healthcare;
information provided by a parent, guardian or other authorised representative; and
other information reasonably necessary to provide your care or administer the practice.
Payment and claiming information may be processed through third-party providers such as Tyro Health. I do not intentionally record or retain complete payment card details within your clinical record.
I aim to collect only information that is reasonably necessary to provide your healthcare or operate the practice.
How I collect information
Where practicable, I collect personal and health information directly from you.
This may happen when you:
make an appointment;
complete a patient or health history form;
attend a consultation;
communicate with me by telephone, email or SMS;
provide a referral, report, imaging or another clinical document;
make a payment or health insurance claim; or
otherwise communicate with the practice.
I may also receive information about you from other sources where appropriate, including:
your GP, specialist or other healthcare practitioner;
a parent, guardian or authorised representative;
Medicare;
the Department of Veterans' Affairs;
WorkCover Queensland or another insurer;
private health insurers;
imaging, pathology or other healthcare providers; or
previous healthcare providers.
Information received from another person or organisation will be handled in accordance with this policy and applicable privacy requirements.
Why I collect and use your information
I collect and use personal and health information primarily to provide you with healthcare and maintain an appropriate clinical record.
This may include:
assessing and treating you;
understanding your health history and current concerns;
planning and reviewing your care;
documenting your consultations;
communicating with you about your care;
arranging appointments and sending appointment reminders or relevant follow-up communications;
communicating with other healthcare practitioners involved in your care;
processing payments and, where you have provided the necessary permission, electronic claims;
administering Medicare, DVA, WorkCover and private health insurance arrangements;
meeting legal, regulatory, professional and insurance requirements;
responding to requests for access to or correction of records;
managing complaints; and
administering and operating the practice.
If you choose not to provide information that is reasonably necessary, I may be unable to provide some services safely or effectively, communicate with other practitioners where necessary, or process a relevant claim.
When I may share your information
Your personal and health information is not sold.
Information may be shared where reasonably necessary for your healthcare or the administration of your care, where you have given permission, or where disclosure is otherwise permitted or required by law.
Depending on the circumstances, this may include sharing relevant information with:
your GP, specialist or another healthcare practitioner involved in your care;
a referring practitioner;
Medicare;
the Department of Veterans' Affairs;
WorkCover Queensland or another relevant insurer;
private health insurers;
payment and claiming providers such as Tyro Health;
technology and service providers used to operate the practice;
professional advisers or insurers where reasonably necessary;
a person or organisation you have authorised me to communicate with; or
government agencies, regulators, courts, law-enforcement bodies or other organisations where disclosure is required or authorised by law.
I aim to share only the information reasonably necessary for the relevant purpose.
For disclosures that would not ordinarily be expected as part of your healthcare or its administration — for example, some requests from lawyers, employers, schools, sporting organisations or other third parties — I will generally seek or verify appropriate authority before releasing your information unless another legal basis for disclosure applies.
Communication with other healthcare practitioners
Healthcare often involves communication between practitioners.
If you have been referred by a GP or another healthcare practitioner, or another practitioner is involved in your care, relevant clinical information may be communicated to that practitioner where this is reasonably necessary or expected as part of your healthcare.
For example, some Medicare referral arrangements require correspondence with the referring GP.
Where appropriate, I will discuss this communication with you.
Electronic claiming and Tyro Health
The practice may use Tyro Health to process eligible Medicare, DVA and private health insurance claims.
If you would like me to process eligible claims for you through Tyro Health, I will ask for your permission to share the personal and health information needed to process those claims.
Electronic claiming is optional. If you choose not to provide this permission, you may still receive treatment and can pay for your appointment and pursue any available rebate yourself.
Individual claims may also require your approval through Tyro Health or the relevant claiming process.
Email, SMS and electronic communication
I may use email or SMS to communicate with you about appointments, forms, administrative matters and relevant follow-up.
Electronic communication carries some inherent privacy and security risks. I avoid intentionally including detailed or unnecessarily sensitive clinical information in ordinary SMS messages.
Email may be used for administrative or clinical correspondence where appropriate, taking into account the nature and sensitivity of the information. Where practicable, clinical correspondence with other healthcare practitioners may be sent through the practice management system or another appropriate method.
If you send clinical information to the practice by email or SMS, that information will be treated as health information and may be added to your clinical record where relevant.
If you have concerns about receiving information electronically, please let me know.
Children and young people
I may provide healthcare to children and young people.
Information relating to a child or young person is handled with regard to their age, maturity, capacity, circumstances and applicable legal and professional requirements.
A parent, guardian or other representative may provide or receive information where appropriate. However, access to a young person's health information is considered according to the individual circumstances and is not necessarily unrestricted.
How your information is stored and protected
Clinical records are primarily maintained electronically using Cliniko, a cloud-based practice management system.
I take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification and disclosure.
These measures include, where appropriate:
password-protected systems and devices;
multi-factor authentication and other account security measures;
restricting access to patient information;
securing devices used to access clinical information;
keeping clinical information within the practice management system rather than creating unnecessary copies; and
deleting temporary downloaded copies of clinical information when they are no longer required.
The practice does not routinely maintain paper clinical records.
Third-party service providers used by the practice maintain their own privacy and security arrangements.
Service providers and overseas disclosure
The practice uses third-party technology and service providers to operate, including services for practice management, payment and claiming, website hosting and electronic communication.
The practice's principal clinical record is maintained in Cliniko. Cliniko states that account data for Australian practices is stored in Australia, although it uses some service providers or subprocessors in Australia and the United States.
Tyro Health states that sensitive information and payment information provided to it are processed and stored in Australia. It may use or disclose other personal information to service providers or processing partners located overseas, including in the United States, Ireland and the United Kingdom.
The practice website is operated using Squarespace. Squarespace may process or transfer website-related personal information outside Australia, including to the United States.
Accordingly, some personal information handled through service providers used by the practice may be disclosed to or processed by recipients outside Australia, including recipients in the United States, Ireland and the United Kingdom.
I take reasonable steps when selecting and using service providers and consider their privacy and security arrangements where they will handle personal information.
Service providers and their information-handling arrangements may change over time. This policy will be reviewed and updated where a material change affects how the practice handles your personal information.
Website information and analytics
When you visit the practice website, limited technical information may be collected automatically by the website platform, such as information about your browser, device and use of the website.
At launch, the practice does not intentionally use extensive advertising tracking or profiling technologies.
If you voluntarily provide information through the website — for example, by providing an email address to receive an update — that information will be used for the purpose explained when it is collected.
The practice does not intentionally collect detailed health information through ordinary website analytics.
If the practice materially changes its website analytics, advertising or tracking practices, this policy will be reviewed and updated where appropriate.
Marketing communications
The practice may in future offer optional updates, articles or other communications.
Health information will not be used for direct marketing unless permitted by law and any required consent has been obtained.
Where you have chosen to receive optional marketing or practice communications, you will be able to unsubscribe from them.
Choosing not to receive marketing communications will not affect your healthcare.
How long I keep your information
Health and other personal information is retained for as long as it is reasonably required for the purpose for which it was collected and in accordance with applicable legal, professional, insurance and record-keeping requirements.
When personal information is no longer required to be retained, I take reasonable steps to securely destroy or de-identify it where appropriate.
Accessing your information
You may request access to personal information I hold about you.
Requests can be made using the contact details below. You do not need to use a particular form.
Before releasing information, I may take reasonable steps to verify your identity or the authority of a person requesting information on your behalf.
I will generally provide access in the manner requested where it is reasonable and practicable to do so. There are limited circumstances in which access may be refused or provided in another way, as permitted by law.
There is no charge for making an access request. If providing access would involve significant administrative costs, a reasonable charge may apply where permitted by law. Any proposed charge will be discussed with you beforehand.
Correcting your information
If you believe personal information I hold about you is inaccurate, out of date, incomplete, irrelevant or misleading, please contact me.
I will take reasonable steps to consider your request and correct the information where appropriate.
There is no charge for requesting or making a correction.
Requests from third parties
If another person or organisation requests your clinical records or other health information, I will consider whether there is appropriate authority or another lawful basis for disclosure before providing the information.
Where your authority is relied upon, I may verify your identity, the identity of the person requesting the information and the scope of the authority before releasing information.
Requests made under a subpoena, court order or another legal requirement will be handled according to the applicable legal obligations.
Privacy incidents and data breaches
If I become aware of a privacy incident or suspected data breach involving personal information, I will take reasonable steps to contain and assess the incident and reduce the risk of harm.
Where a data breach meets the requirements of the Notifiable Data Breaches scheme, I will notify affected individuals and the Office of the Australian Information Commissioner as required by law.
Privacy questions and complaints
If you have a question, concern or complaint about how your personal information has been handled, please contact me:
BEN WEAVELL - OSTEOPATH
Email: hello@yourosteoben.com.au
Address: Shop 302/15 Wharf Street, Hamilton, QLD 4007
I will consider privacy complaints and respond within a reasonable period.
Changes to this policy
I may update this policy to reflect changes to the practice, technology, service providers or applicable privacy requirements.
The current version will be available on the practice website.
Version: 1.0
Effective: 14/10/2026