Privacy Policy 

Yodgee's Health & Fitness (“I”, “me”, “my business”) is a sole trader practice operated by Joshua Freedman, committed to providing quality exercise science, movement therapy, remedial massage, clinical Pilates, physical conditioning, and NDIS support & capacity-building services.

This policy explains how I collect, hold, use, and disclose personal and health information in line with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Commonwealth). A copy of the Australian Privacy Principles can be accessed from the website of The Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

This policy applies to all clients, NDIS participants, prospective clients, and visitors to my website or studio.

My main functions and activities involving personal information are:

  • Providing exercise science, movement assessment, remedial massage, clinical Pilates, and NDIS support & capacity-building services.
  • Managing client health records, bookings, invoicing, and payments.
  • Operating my business website https://www.yodgeeshealth.com).au.
  • Communicating appointment reminders, follow-up care instructions, or exercise programs.

If you have a concern about how I have handled your information, please contact me first using the contact details at the end of this policy.

Summary

  • I collect personal information, including detailed health information, to deliver movement therapy, exercise, and remedial massage services to you safely and effectively.
  • I keep your information secure using password-protected and multi-factor authenticated digital systems.
  • I respect your control over your data. I only share your health information with third parties (such as your GP, Support Coordinator, Plan Manager, WorkSafe, or insurer) with your explicit consent or where required by law.
  • I store digital data securely using reputable cloud-based website and practice management tools.
  • You can request access to or correction of your personal information at any time.

What Information I Collect

Depending on how you interact with me, I collect:

Personal Information

  • Full name, date of birth, and contact details (phone number, email address, residential address).
  • Emergency contact name and phone number.
  • Occupation and daily lifestyle activities.
  • Payment, billing, and invoicing details (I do not store credit card details).
  • NDIS participant number, Support Coordinator contact email, or Plan Manager billing details (where applicable).
  • Booking history and appointment preferences.

Sensitive Information (Health Information)

I collect detailed health information because it is necessary to provide safe and effective treatment and movement prescription. This includes:

  • Relevant medical history, current injuries, past surgeries, chronic conditions, joint restrictions, medications, undiagnosed pain areas, allergies, and pregnancy status.
  • Physical assessment results, posture and movement observations, and treatment goals.
  • Clinical notes made during and after your consultations.
  • Referrals, Chronic Disease Management (EPC) plans, or medical reports from doctors and referring health practitioners shared with your consent.

I only collect health information that is directly relevant to providing you with safe treatment. I will never ask for more information than needed.

How I Collect Personal and Sensitive Information

I collect information directly from you through:

  • Online intake and registration forms via my website.
  • Conversations and physical assessments during consultations and treatment sessions.
  • Phone calls, text messages, and email correspondence.

I may also collect information indirectly, for example:

  • Via a referring medical practitioner or allied health professional, where you have authorised them to share information.
  • Via NDIS Support Coordinators, Plan Managers, or authorised representatives acting on your behalf.

I will always try to collect information directly from you unless it is unreasonable or impractical to do so. When collecting personal information, I will explain why it is being collected and how I plan to use it.

How I Hold and Protect Your Information

Storage

I store your personal and health information using a secure, cloud-based practice management and web database system. Any legacy or hard-copy paper forms are kept in a securely locked filing location not accessible to the public.

Your personal and health information will be retained in your client record for a minimum of 7 years after your last appointment (or until a minor client turns 25 years of age), in accordance with Australian health record-keeping statutory requirements. After this period, records will be permanently de-identified or destroyed securely.

Security

I take all reasonable steps to protect your personal information from misuse, loss, unauthorised access, or disclosure, including:

  • Password-protecting all digital devices, accounts, and clinical databases using multi-factor authentication (MFA).
  • Restricting access to clinical data strictly to myself as the primary practitioner.
  • Utilising reputable software providers that maintain rigorous industry-standard cybersecurity protocols.

How I Use Your Personal and Health Information

I use your personal and health information to:

  • Assess your physical suitability for exercise, movement therapy, or massage, and identify any health contraindications.
  • Plan, deliver, and adjust your treatment, exercise programs, and clinical Pilates plans.
  • Manage bookings, schedule sessions, and send appointment reminders.
  • Process payments, issue tax invoices, and provide official receipts for Private Health Insurance, WorkSafe, or NDIS claims.
  • Communicate with you regarding appointment follow-up care, home exercise programs, or essential practice updates.
  • Comply with legal, professional association (ESSA / AMT), insurance, and regulatory obligations.

I do not sell, rent, or disclose your health information for third-party marketing purposes.

Who I Share Your Information With

I respect your right to privacy and control over your health information. I will never sell, trade, or share your data with third parties without your permission, except in the limited, necessary circumstances outlined below:

  • Medical & Allied Health Professionals (Consent-Based): I will only share progress notes, assessments, or treatment plans with your GP, specialist, physiotherapist, or other health providers if you explicitly authorize or request me to do so. You can specify or limit which practitioners I am permitted to contact at any time.
  • NDIS Network & Support Team (Client-Directed): For NDIS participants, information is shared with Plan Managers or Support Coordinators strictly for billing purposes or as agreed upon in your signed Service Agreement. You may instruct me in writing if you wish to restrict specific details shared with your support network.
  • Third-Party Insurers (WorkSafe / Health Funds): If you are claiming through WorkSafe Victoria or Private Health Insurance, minimum necessary treatment details and receipts are shared only as required to process your claims or meet statutory scheme requirements.
  • Essential Administrative & Legal Operations:
    • Financial Services: My professional accountant or bookkeeper, strictly limited to financial data necessary for invoicing and tax auditing.
    • Legal & Statutory Obligations: In the rare event of a court subpoena, mandatory health reporting law, or an official request from my professional indemnity insurer if a legal claim arises.

Overseas Disclosure

I utilise cloud-based software platforms (such as Webador for website intake forms, Google Workspace for business communications, and secure practice management software) to handle scheduling, data collection, and administration.

Some of these platforms store or process data on secure servers located overseas (such as in the United States or European Union). I take reasonable steps to ensure that all third-party software providers maintain data privacy and security standards consistent with the Australian Privacy Principles.

Accessing and Correcting Your Information

You have the right to request access to the personal and health information I hold about you, or to request corrections if the information is inaccurate, out of date, or incomplete.

To make a request, please contact me in writing using the contact details below. I will respond within a reasonable timeframe (usually within 30 days). There is no fee for submitting a request, though a small administrative fee may apply if compiling extensive physical copies involves significant time or printing costs. Identity verification will be required prior to releasing any health records.

How to Make a Privacy Complaint

If you believe I have breached your privacy or mishandled your personal information, please contact me directly so I can resolve the issue. I will:

  1. Acknowledge receipt of your complaint promptly.
  2. Investigate the matter and provide a formal written outcome, generally within 30 days.
  3. Take all necessary actions to rectify any identified issues.

If you are not satisfied with my response, you may escalate your complaint to the Office of the Australian Information Commissioner (OAIC):

Contact Details

For any questions, access/correction requests, or privacy concerns regarding this policy, please contact:

Joshua Freedman

Founder & ESSA Accredited Exercise Scientist | Yodgee's Health & Fitness

Phone: 0412 956 246

Email: movement.josh@gmail.com

Website: www.yodgeeshealth.com.au

Location: Carnegie Studio & Mobile Services across Melbourne

Changes to This Policy

This policy will be updated periodically to reflect changes in business practices, technology, or legal requirements. The most current version will always be published on the website or made available upon request.