Last updated: November 2026
This privacy policy applies to Hydrotherapy Studio, operated by Koaben Pty Ltd (ACN 603 302 450, ABN 40 603 302 450), located at 1/55 Lofter St, Tennyson QLD 4105. We handle your personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), and the record-keeping requirements that apply to registered physiotherapists.
1. Information we collect
We collect only the personal information we need to provide aquatic physiotherapy and pool hire services and to bill for them. This includes:
- your name, date of birth, contact details and emergency contact
- health information: your history, current conditions, medications, referral letters, GP clearance letters, consent forms and the clinical notes we write about your treatment
- funding details: NDIS plan and plan-manager details, Medicare number and care plan, WorkCover QLD or CTP claim numbers, DVA card details, Home Care Package provider and case-manager details, private health fund details
- booking, attendance and payment records
- anonymised website usage data (see Cookies, below)
Health information is sensitive information under the Privacy Act. We collect it with your consent as part of your assessment and treatment, and we collect it from you directly wherever possible. We may also receive it from your referring doctor, specialist, support coordinator, plan manager or insurer. For clients under 18 we collect information from, and communicate with, a parent or guardian. If you choose not to provide health or funding information we may be unable to treat you safely or bill your funder.
2. How we use your information
We use your personal information to assess and treat you, to write and keep clinical records as required by AHPRA, to manage bookings and send appointment reminders, to bill you or your funding body, to communicate with the other health professionals involved in your care, and to meet our legal and insurance obligations. Your health information is used only for your treatment and for our legal and funding obligations. We do not use it for marketing. Appointment reminders are sent by SMS and email through Splose; you can opt out of reminders at any time by telling us.
3. Who we share your information with
Your care and funding. With your consent we share relevant information with your referring GP, specialist or other treating practitioners; with your NDIS plan manager or support coordinator, Home Care Package provider, WorkCover QLD, CTP insurer, DVA, Medicare or private health fund, as needed to process claims and reports; and with government bodies or regulators where the law requires it. We never sell, rent or trade your personal information.
Service providers we use. To run the clinic we share limited information with providers who act on our instructions and may not use it for their own purposes:
- Splose — practice management software: clinical records, online bookings, reminders and invoicing (hosted on Amazon Web Services in Australia)
- Splose AI — an AI scribe that may record and summarise your consultation to help write your clinical notes (see section 4)
- Tyro — in-clinic card payments and on-the-spot HICAPS private health claims
- Stripe — online card payments for bookings and purchases. Stripe processes payment data in the United States and other countries under its own privacy policy. We never see or store your full card number.
- Xero — accounting and invoicing (name, invoice and payment details only; no clinical information)
- Google — Analytics, Ads conversion tracking and Tag Manager on this website (anonymised usage data only)
- Website and email hosting providers — to run hydrotherapy.studio and deliver our email
- AI assistants such as Claude (Anthropic) — used for administrative tasks, drafting and analysis of de-identified data only. We do not enter identifiable health records into general-purpose AI tools.
Overseas disclosure. Some of these providers store or process data outside Australia (Stripe, Google, Anthropic and Splose AI’s model provider in particular). We take reasonable steps to ensure they protect your information to a standard comparable with Australian privacy law, and we limit what they receive to the minimum needed for their function.
4. Use of AI in your care
We may use an AI scribe (Splose AI) during consultations to record and summarise the conversation so that your physiotherapist can spend more time with you and less time typing. The recording is used only to produce your clinical notes, which your physiotherapist reviews and approves before they are saved. We will tell you before the scribe is used and ask for your consent. You can decline or withdraw consent at any time, and your care will not be affected. Recordings are not saved to your file once your notes are approved, and Splose does not use them to train AI models. Other AI tools are used only for administrative work and never with identifiable health information.
5. Storage, security and retention
Your records are stored in Splose, which encrypts data at rest and in transit on Amazon Web Services in Australia. Access is restricted to your treating physiotherapist. We take reasonable steps to protect your information from misuse, interference, loss and unauthorised access, modification or disclosure.
In line with AHPRA and Australian Physiotherapy Association guidance, health records are kept for at least 7 years from the date of your last visit, or, for clients under 18, until they turn 25 — whichever is later. After that they are securely destroyed or de-identified.
Data breaches. If a data breach occurs that is likely to result in serious harm, we will notify the affected clients and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.
6. Cookies and website analytics
hydrotherapy.studio uses cookies and similar technologies through Google Analytics, Google Ads and Google Tag Manager to understand how the site is used and to measure the performance of our advertising. This data is anonymised and does not identify you personally. You can disable cookies in your browser settings, and you can opt out of Google Analytics at tools.google.com/dlpage/gaoptout. Disabling cookies may affect some features of the site. Online bookings and the referral form are provided by Splose and are covered by Splose’s own privacy policy as well as this one.
7. Access, correction and deletion
Access. You can ask for a copy of the personal and health information we hold about you. Put the request in writing to info@hydrotherapy.studio; we will confirm your identity and respond within 30 days, usually with a copy of your records in the form you ask for. There is no charge to make a request, and we don’t normally charge for a copy, though we may charge a reasonable cost for large or repeated requests. We can refuse access only in limited circumstances allowed by the Privacy Act — for example where it would pose a serious threat to someone’s safety or unreasonably affect another person’s privacy — and we will tell you why in writing. On your written request we will send a copy of your records to another treating practitioner.
Correction. If anything we hold is inaccurate, out of date or incomplete, tell us and we will correct it. Clinical notes record your physiotherapist’s assessment at the time and are not rewritten, but if you disagree with something in them we will attach a note of your request to the record.
Deletion. We are required by law and professional standards to keep your clinical record for at least 7 years from your last visit (or until age 25 for clients under 18), so we cannot delete clinical records earlier than that, even at your request. After the retention period they are securely destroyed or de-identified. Information we are not required to keep — for example contact details held only for reminders — we will delete on request. You can also withdraw consent for the AI scribe, or for sharing with a particular practitioner, at any time.
Who can ask. Requests can be made by you, by a parent or guardian for a client under 18, or by someone you have authorised in writing (such as an attorney under an enduring power of attorney). We do not release records to lawyers, insurers, employers or family members without your written authority, unless the law requires it (for example a subpoena).
8. Complaints
If you have a concern about how we have handled your information, contact us first and we will investigate and respond within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or 1300 363 992.
9. Changes to this policy
We review this policy at least annually and whenever our systems change. The current version is always at hydrotherapy.studio/privacy-policy.
10. Contact us
Email: info@hydrotherapy.studio
Phone: (07) 3132 2785
Address: 1/55 Lofter St, Tennyson QLD 4105
This document was last reviewed November 2026.