Privacy Policy

1. Who we areAPP 1

HealthLocate operates a referral service that connects people recovering from injury with allied health professionals and workplace rehabilitation providers. In this policy, "we", "us" and "our" mean HealthLocate, and "you" means any person whose personal information we hold.

We are bound by the Australian Privacy Principles set out in the Privacy Act 1988 (Cth). Because we handle health information, we also have obligations under state health records legislation, including the Health Records and Information Privacy Act 2002 (NSW).

This policy is available free of charge on our website. We can also provide it in an alternative format on request.

2. What information we collectAPP 3

Personal information

• Your name, phone number, email address and postal or residential address
• Your date of birth, where relevant to a referral
• Your employer and occupation, where relevant to a workplace rehabilitation referral

Health-related information

We do not ask for, collect, or store medical documents. You do not need to send us a referral, certificate of capacity, or any medical report — keep those for your provider, who will request them directly.

The limited health-related information we do hold is:

• The service you have told us you are looking for (for example, physiotherapy)
• Anything you choose to write in the optional free-text field of our form

Technical information

• Your IP address, browser type and device information
• Pages visited and actions taken on our website

This technical information is collected automatically through Google Analytics — see section 13.

3. How we collect itAPP 3

Wherever it is reasonable and practicable, we collect personal information directly from you — usually through our online referral form, or by phone or email if you contact us that way.

We may also collect information about you from other people where you have consented to this, or where it is otherwise permitted by law. This may include:

• Your treating doctor or specialist, where they make a referral on your behalf
• Your employer or their representative, where they arrange a referral for you
• Your insurer or case manager
• An allied health or rehabilitation provider already involved in your care

If we receive information about you that we did not ask for, and we could not have collected it ourselves under the APPs, we will destroy or de-identify it if it is lawful and reasonable to do so.

4. Why we collect itAPP 3, APP 6

We collect, hold and use your information for the following purposes:

• To understand which service you are looking for
• To identify providers on our panel who offer that service in your area and have availability
• To pass your contact details and the service you are seeking to that provider so they can contact you
• To communicate with you about your referral and respond to your enquiries
• To meet our legal, regulatory and record-keeping obligations
• To improve our service, using de-identified or aggregated information

We will not use your information for an unrelated purpose unless you would reasonably expect it, you have consented, or the law requires or permits it.

If you don't provide the information

You are not obliged to give us your information. However, if you choose not to, we may not be able to allocate your referral or arrange the service you are seeking.

5. ConsentAPP 3

Before we process your referral, we ask you to confirm that you consent to us collecting your personal and health information and disclosing it to the provider allocated to your referral. We will not send your information to a provider without that consent.

You may withdraw your consent at any time by contacting us using the details in section 17. Withdrawing consent will not affect anything we have already done in reliance on it, and may mean we are unable to continue arranging your service.

If you are providing information on behalf of another person — for example, as their carer, guardian, or authorised representative — you confirm that you are authorised to do so and that the person is aware of this policy.

6. Who we disclose your information toAPP 6

We may disclose your personal and health information to:

• The provider we connect you with — the allied health professional or workplace rehabilitation provider who offers the service you are seeking in your area. This is the primary reason we collect your information.
• Your treating practitioners, where relevant to coordinating your care and where you have consented
• Your insurer or case manager, where disclosure is necessary for approval or payment of your treatment
• Our service providers — including IT, document storage, and communications providers who host or support our systems, and who are bound by confidentiality obligations
• Regulators, courts or law enforcement, where required or authorised by law

We do not sell your personal information, and we do not disclose it to any third party for their own marketing purposes.

Providers in our network are independent businesses. Once your information is disclosed to a provider, their own privacy policy also applies to how they handle it. We encourage you to ask the allocated provider for a copy of their policy.

7. Overseas disclosureAPP 8

Our website and enquiry form are hosted by Netlify, Inc., a service provider based in the United States. This means the information you submit through our form — your name, contact details, the area you are seeking a service in, the service you have selected, and anything you write in the optional free-text field — is transmitted to and stored on servers located outside Australia.

We also use Google Analytics, which collects technical information about your visit and is processed by Google LLC outside Australia, including in the United States — see section 13. Apart from Netlify and Google, we do not disclose your information to any other overseas recipient. The provider we connect you with is located in Australia.

Before disclosing information overseas, we take reasonable steps to ensure the recipient handles it in a way consistent with the Australian Privacy Principles. In Netlify's case this includes their published privacy commitments and contractual data processing terms. You should be aware that we may not be able to control how your information is handled once it is outside Australia, and that overseas recipients may be subject to foreign laws that differ from Australian privacy law.

By submitting our form, you consent to your information being stored outside Australia on this basis. If you would prefer not to have your information stored overseas, contact us by email instead and we will assist you directly.

8. How we store and protect itAPP 11

We take reasonable steps to protect your information from misuse, interference and loss, and from unauthorised access, modification or disclosure. These steps include:

• Encryption of information in transit and at rest
• Access limited to those who need the information to connect you with a provider
• Password-protected, access-controlled storage of enquiry records
• Collecting only the minimum information needed — we do not collect or store medical documents
• Deleting enquiry records once they are no longer needed
• Regular review of our security practices

No method of transmission or storage is completely secure. While we work to protect your information, we cannot guarantee absolute security.

9. How long we keep itAPP 11

We keep your information only as long as we need it for the purposes described in this policy, or as long as the law requires us to.

Because we act only as a connector and do not hold clinical records, we keep enquiry records for as long as needed to connect you with a provider and to deal with any follow-up or complaint about that connection. We review records regularly and delete them once they are no longer needed for that purpose, unless the law requires us to keep them longer.

When we no longer need your information and are not required to keep it, we destroy it securely or de-identify it.

10. Accessing and correcting your informationAPP 12, APP 13

You have the right to ask for a copy of the personal information we hold about you, and to ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading.

To make a request, contact us using the details in section 17. We may ask you to verify your identity. We will respond within 30 days.

We provide access free of charge, though we may charge a reasonable fee for the cost of retrieving and copying a large volume of material. We will tell you about any fee before proceeding.

In limited circumstances we may refuse access or correction — for example, where giving access would pose a serious threat to someone's life, health or safety, or where the law requires us to refuse. If we refuse, we will tell you why in writing and explain how to complain.

11. Dealing with us anonymouslyAPP 2

You can contact us anonymously or under a pseudonym to ask general questions about our service. However, we cannot connect you with a provider without knowing how to reach you, as the provider needs your contact details to get in touch.

12. Direct marketingAPP 7

We do not use your health information for direct marketing.

We may occasionally send you information about our services where you would reasonably expect it, or where you have consented. Every such message will include a simple way to opt out, and we will action any opt-out request promptly. You can also opt out at any time by contacting us.

13. Our website and cookies

We use Google Analytics to understand how visitors use our website — for example, which pages are viewed and how people move through the site. This helps us improve it. Google Analytics uses cookies and collects technical information such as your IP address, browser type, device and approximate location.

This information is collected and processed by Google LLC, which may store and process it outside Australia, including in the United States. Google's handling of this data is governed by its own privacy policy, available at policies.google.com/privacy.

We do not use advertising trackers, and we do not link analytics information to the details you submit through our enquiry form.

You can opt out of Google Analytics by installing Google's browser opt-out add-on, or by setting your browser to refuse cookies. Some parts of the site may not work as intended if you block cookies.

Our website may link to other sites. We are not responsible for the privacy practices of those sites, and we encourage you to read their policies.

14. Data breaches

We have procedures for identifying, containing and assessing suspected data breaches. If a breach occurs that is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches scheme.

15. ComplaintsAPP 1

If you believe we have mishandled your personal information or breached the Australian Privacy Principles, please tell us. You can make a complaint using the contact details in section 17.

We will acknowledge your complaint promptly, investigate it, and respond in writing within 30 days. If we need longer, we will let you know why and agree a new timeframe with you.

If you are not satisfied with our response, you can contact:

16. Changes to this policy

We may update this policy from time to time to reflect changes in our practices or the law. The current version is always available on this page, and the effective date is shown at the top. We encourage you to review it periodically.

17. Contact us

For any question, request or complaint about privacy, contact our Privacy Officer by email. We respond to all privacy enquiries in writing.

If you would prefer to write to us by post, email us and we will provide a postal address.