Privacy
Privacy Policy
Peak Physiology handles personal and health information. This policy explains what we collect, why, who we share it with, and how you can access, correct or complain about it.
Last updated 10 September 2026 · Version 1.0
The short version
We collect only what we need to provide occupational health services and to send you resources you asked for. We don’t sell your information. We don’t share your individual health information with your employer without your consent. You can ask to see what we hold, ask us to correct it, or ask us to stop emailing you at any time.
Who this policy covers
This policy applies to Peak Physiology (ABN 94 664 339 146), operating in the Hunter, Lake Macquarie, Newcastle and surrounding regions of New South Wales.
Because we provide a health service and hold health information, we are bound by the Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles regardless of our size — the small business exemption does not apply to health service providers. As a health service provider in New South Wales we are also bound by the Health Records and Information Privacy Act 2002 (NSW).
What we collect
What we collect depends on how you deal with us.
If you sign up for our resource program or contact us
- Your name, work email address and business name
- Approximate number of employees at your workplace
- Optionally, your role, phone number and industry
- What you asked us about, and our correspondence with you
If you book a workplace assessment or engage us for services
- Business and site details, contact people and their roles
- Information about the tasks, workstations and work areas we assess
- Injury and incident information you choose to share with us
- Billing and payment details
If you are a worker we assess or support
This is health information and is treated as sensitive information under the Privacy Act. It may include:
- Your name, contact details, date of birth and employer
- Your reported symptoms, injury history and physical capacity
- Information from your treating practitioners, with your consent
- Certificates of capacity, restrictions and return-to-work information
- Our assessment findings and recommendations
We collect health information only with your consent, or where we are required or authorised by law to do so.
When you visit our website
- Standard server log information — IP address, browser, pages viewed, referring page
- Cookies used for site function and, where enabled, analytics
- Whether you opened or clicked a link in an email we sent you
How we collect it
Usually directly from you — through a form on our website, by email or phone, or in person during an assessment. Sometimes we collect information about a worker from their employer, their treating practitioner, or an insurer, where the worker has consented or where the law permits it.
If we receive information about you that we did not ask for and do not need, we will destroy or de-identify it if it is lawful to do so.
Why we collect it, and what we do with it
| Information | What we use it for |
|---|---|
| Program sign-up details | Sending you the resources you asked for, and the quarterly resource packs. Nothing else. |
| Business and site information | Delivering the services you engaged us for, quoting, and invoicing. |
| Worker health information | Conducting the assessment you consented to, and reporting the findings as agreed with you. |
| Website and email analytics | Understanding which resources are useful, and improving the site. |
What we do not do
- We do not sell, rent or trade your personal information
- We do not use your information for automated decision-making — no system of ours makes or substantially influences a decision about you without a person involved
- We do not combine website analytics data with your client or health records
- We do not use your health information for marketing
- We do not add you to a mailing list because you enquired about a service. Marketing emails go only to people who asked for them
Health information and your employer
This is the part workers most often ask about, so we are explicit.
Where we assess you at your employer’s request, we will tell you before we start what will be reported to them and what will not. Ordinarily we report functional capacity and workplace recommendations — what you can and cannot safely do, and what should change about the work.
We do not disclose your clinical details, diagnosis or personal medical history to your employer without your consent, unless we are required or authorised to do so by law.
If you are not comfortable with what is proposed to be reported, tell us before the assessment.
Who we share it with
We disclose personal information only where it is necessary, and only to:
- Your employer, on the terms set out above
- Insurers, claims managers or workplace rehabilitation providers, where you have consented or where the workers compensation scheme requires it
- Your treating practitioners, with your consent
- Our service providers, listed below, who host our systems and send our emails
- Others where required by law — for example a court order, a subpoena, or a regulator exercising a statutory power
Service providers
We use third-party providers to host our website, send our emails, manage our accounts, and store our records. They can access personal information only to the extent needed to provide those services to us, and they are not permitted to use it for their own purposes. If you would like to know which providers we currently use, ask us and we will tell you.
Where your health information is held
Client and clinical records are kept in Halaxy, practice management software built for health practitioners, separate from our general business systems. Halaxy stores Australian practitioners’ data in Australia. Access is restricted and protected by encryption.
Overseas disclosure
Our website is hosted on Australian servers, and health information is stored in Australia. We do not disclose health information overseas.
Two website functions rely on providers outside Australia, and neither involves health information or anything you have given us directly:
- Google Analytics — website usage data, including your IP address, is processed by Google in the United States. See the cookies section below for how to opt out.
- Google Fonts — our site loads typefaces from Google, which receives your IP address when a page loads. This happens on most websites.
Where we disclose personal information to an overseas recipient, we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles.
How we keep it secure
- Records are held in access-controlled systems with multi-factor authentication where available
- Devices are password protected and encrypted
- Paper records, where they exist, are kept secured and are digitised or destroyed
- Access is limited to people who need it to do their job
- We review our systems and access periodically
No system is completely secure. If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required under the Notifiable Data Breaches scheme.
How long we keep it
| Health records — adults | At least 7 years from the date of last service, as required for health records in NSW |
| Health records — under 18 | Until the person turns 25 |
| Business and client records | At least 7 years, consistent with tax and business record requirements |
| Resource program subscribers | Until you unsubscribe or ask us to delete your details |
| Website analytics | Retained by Google Analytics according to the retention period set in our account [[ CHECK — GA4 default is 14 months; set it deliberately ]] |
When information is no longer needed and we are not required to keep it, we destroy or de-identify it.
Marketing and unsubscribing
We send resource program emails only to people who asked for them. Every email includes an unsubscribe link. You can also reply to any email, or email us, and we will remove you.
We do not send marketing to workers whose health information we hold, in that capacity.
Cookies
Our website uses two kinds of cookies.
Necessary cookies make the site work — remembering that you submitted a form, for example. The site cannot function properly without them.
Analytics cookies. We use Google Analytics to understand which pages and resources people actually use, so we can make the useful ones better. It tells us things like which posters get downloaded and which articles get read. Google Analytics collects your IP address, device and browser type, and the pages you visit, and this information is processed by Google in the United States.
You can opt out of Google Analytics across all websites using Google’s browser opt-out add-on, or by blocking cookies in your browser settings. Blocking analytics cookies will not stop you using this site or downloading anything.
We do not currently use advertising or remarketing cookies — we don’t track you across other websites or build advertising profiles. We may introduce advertising cookies in future. If we do, we will update this policy before turning them on, tell our resource program subscribers, and provide a way to decline them.
Accessing and correcting your information
You can ask us for a copy of the personal or health information we hold about you, and ask us to correct anything that is wrong. Email info@peakphysiology.com.au.
We will respond within 30 days. We may need to verify your identity first. Access is usually free; if a request is complex we may charge a reasonable cost and will tell you before proceeding.
In limited circumstances we may refuse access — for example where giving access would pose a serious threat to someone’s life or health, or where it would unreasonably affect another person’s privacy. If we refuse, we will tell you why in writing and how to complain.
Complaints
If you think we have mishandled your information, please tell us first — most issues are resolved quickly.
Email: info@peakphysiology.com.au
Phone: 0434 430 945
We will acknowledge your complaint within 5 business days and respond within 30 days.
If you are not satisfied with our response, you can complain to:
- Office of the Australian Information Commissioner — 1300 363 992, oaic.gov.au
- NSW Information and Privacy Commission (for health information in NSW) — 1800 472 679, ipc.nsw.gov.au
- Health Care Complaints Commission (NSW), for complaints about a health service — 1800 043 159, hccc.nsw.gov.au
Changes to this policy
We may update this policy from time to time. The current version is always on this page, with the date it was last updated at the top. If we make a change that materially affects how we handle your information, we will tell program subscribers by email.
Contact
Peak Physiology
Brock McInerney, Accredited Exercise Physiologist
ABN 94 664 339 146
info@peakphysiology.com.au
0434 430 945
Servicing the Hunter, Lake Macquarie, Newcastle and surrounding regions of NSW