Privacy Policy
Last updated: 19 October 2026
1. About this policy
ModPod Podiatry respects your privacy. This policy explains how we collect, hold, use and disclose your personal information, including your health information.
We are bound by:
- the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs)
- the Health Records and Information Privacy Act 2002 (NSW) and its Health Privacy Principles (HPPs)
- our professional obligations as podiatrists registered with the Podiatry Board of Australia, including confidentiality.
In this policy, “ModPod Podiatry”, “we”, “us” and “our” means the following entities, which together operate our clinics in Sydney CBD, Dee Why, Mosman, Rose Bay, North Ryde and Morisset:
| Entity | ABN | Clinics |
|---|---|---|
| ModPod Podiatry Pty Limited | 12 122 046 995 | Sydney CBD, Dee Why, Mosman, Rose Bay |
| The Trustee for ModPod Podiatry Trust | 41 816 366 091 | Sydney CBD, Dee Why, Mosman, Rose Bay |
| ModPod Podiatry Ryde Pty Ltd | 47 634 264 887 | North Ryde |
| ModPod Hunter Pty Ltd | 47 622 276 439 | Morisset |
This policy covers patients, parents and guardians, referrers, suppliers, job applicants, and visitors to our website and online booking system.
2. What information we collect
We only collect information that is reasonably necessary to provide our services and run our practice.
Patients
- Identity and contact details: name, date of birth, gender, address, phone, email, emergency contact
- Health information: medical history, medications, allergies, symptoms, assessment findings, clinical notes, treatment plans, photos, gait and video analysis, imaging, pathology results, and referral letters and reports
- Funding details: Medicare number, private health fund, NDIS, DVA, workers compensation or CTP claim details, and referring practitioner details
- Payment details: billing records and payment method details, including card, HICAPS and Afterpay transactions. Card details are processed by our payment providers and we do not store full card numbers
- Communications: emails, messages, call records, call recordings and notes of conversations with us
Health information is “sensitive information” under the Privacy Act. We collect it only with your consent, which is usually given when you book or attend an appointment, or where the law allows.
Others
- Parents and guardians: contact details and consent records for patients under 18
- Job applicants: CV, qualifications, AHPRA registration, referee details, and information from SEEK or similar platforms
- Suppliers and referrers: business contact details
- Website visitors: device, browser and usage information (see section 8)
3. How we collect it
We collect information directly from you wherever practicable. This happens when you book online, complete intake forms, attend an appointment, call, email or message us.
We may also collect information from:
- your GP, specialist or other health practitioner, for example through a referral, report or results
- a parent, guardian, carer or family member, with your consent or where you cannot provide it yourself
- your health fund, Medicare, NDIA, DVA, insurer or employer, where they fund your treatment
- referees and recruitment platforms, for job applicants.
If we receive information we did not ask for, we decide whether we could have collected it lawfully. If not, we destroy or de-identify it where lawful to do so.
Anonymity and pseudonyms. You can ask to deal with us anonymously or under a pseudonym for general enquiries. For treatment this is usually impracticable. Medicare, health funds and safe clinical care all require us to identify you.
4. How we use your information
We use your information to:
- assess, diagnose and treat you, and keep accurate clinical records
- communicate with you about appointments, results and follow-up care, including by SMS and email reminders
- communicate with your referring practitioner and other providers involved in your care
- process payments and claims with Medicare, health funds, NDIS, DVA and insurers
- order and supply orthotics, footwear and other products you need
- manage our practice, including quality improvement, training, accreditation, audits and insurance
- recruit and manage staff and contractors
- meet our legal obligations.
We use or disclose your information for another purpose only where you consent, you would reasonably expect it and it is directly related to your care, or the law requires or allows it. Examples include a serious threat to someone’s life, health or safety, or a court order.
Marketing. We send newsletters, health tips or offers only with your consent. Every message includes a free way to unsubscribe, and we stop promptly once you do. We never use your health information for marketing, and we never sell or rent your information.
5. Who we share it with
We share your information only as described in section 4. This may include:
- our practitioners and staff, on a need-to-know basis
- your GP, specialists and other health providers involved in your care
- Medicare, health funds, NDIA, DVA, workers compensation and CTP insurers, for claims you ask us to make
- orthotic laboratories and product suppliers, for items made or supplied for you
- your parent, guardian or authorised representative
- our auditors, insurers, accreditation bodies and legal advisers
- government bodies or courts, where the law requires.
Service providers. We use trusted providers to run our practice. They may only use your information to provide services to us, and they must keep it secure.
| Provider | What it does | Where data is stored |
|---|---|---|
| PracSuite (Smartsoft Pty Ltd) | Patient records, clinical notes, AI-assisted notes, online booking, reminders, billing | Australia |
| HealthLink | Secure exchange of referrals, reports and results | Australia |
| HICAPS | Health fund claims and card payments | Australia |
| Visa, Mastercard and American Express | Card networks that process card payments | Australia and other countries |
| Afterpay | Buy now, pay later payments | Australia and the United States |
| Google Workspace | Email and documents | United States and other countries |
| CallRail | Call tracking and call recording | United States |
| Google Analytics and Google Ads | Website analytics and advertising | United States and other countries |
| Meta (Facebook and Instagram) pixel | Advertising measurement | United States and other countries |
6. Overseas disclosure
Your clinical records are stored in Australia. Our practice management system, PracSuite, keeps all patient data onshore in Australia.
Some of our non-clinical service providers store information overseas, mainly in the United States. These are Google Workspace (email), CallRail (call tracking), Google and Meta (website analytics and advertising), and Afterpay and the card networks (payments). They may hold contact details, emails, call records, call recordings and website usage data. Our clinical records stay in PracSuite and HealthLink in Australia.
Before we use an overseas provider, we take reasonable steps to make sure it handles information consistently with the APPs. We will not send your health records overseas without your consent unless the law requires or allows it.
7. How we store and protect it
We hold your records electronically in PracSuite, a cloud practice management system built for Australian allied health practices. PracSuite:
- is ISO 27001 certified for information security management
- stores data in an Australian data centre, encrypted at rest and in transit
- requires two-factor authentication for every user
- lets us restrict each staff member to the records and features their role needs
- keeps multiple backups, including offsite backups.
We also protect your information by training staff in confidentiality, restricting access to our systems, locking away any paper records, and requiring our contractors to keep information confidential.
How long we keep it. We keep health records for at least the periods required by NSW law:
- adults: 7 years from your last appointment
- patients first seen under 18: until they turn 25, or 7 years from the last appointment, whichever is later.
We may keep records longer where there is a legal reason. Once records are no longer needed, we securely destroy or de-identify them and keep a record of what was destroyed and when.
8. Technology we use
AI-assisted clinical notes. Some of our practitioners use PracSuite AI to help write clinical notes and letters from your consultation. Your practitioner will ask for your verbal consent before using it and will record your answer in your notes. You can say no or change your mind at any time, and it will not affect your care. Here is how it works:
- Audio is transcribed within PracSuite’s Australian cloud and deleted immediately afterwards. No recording is kept.
- The transcript is processed by AI services hosted in Australia that do not store your data or use it to train AI models.
- Your practitioner reviews and approves every note. The AI does not make clinical decisions.
Automated decisions. We do not use computer programs to make decisions about you that could significantly affect your rights or interests. Automated tools such as appointment reminders and online booking availability help us run the practice. A person makes every decision about your care, treatment and fees.
Phone calls. We use CallRail to track which of our phone numbers and adverts patients call from. Calls to our clinics are recorded for training, quality and record-keeping purposes, and a message at the start of each call tells you this. Recordings are stored by CallRail in the United States. If you prefer not to be recorded, please email us instead or ask to be called back.
Website and cookies. Our website uses cookies and similar tools, including Google Analytics, Google Ads and the Meta pixel. These help us understand how visitors use the site and measure our advertising. They collect device, browser, location and browsing information, not your health records. You can block or delete cookies in your browser settings, or opt out of Google Analytics using Google’s browser add-on. Online bookings are handled by PracSuite’s secure booking page.
9. Your rights and how to contact us
Access and correction. You can ask to see or get a copy of your records, or to correct information that is wrong, out of date or incomplete. Contact our Privacy Officer. We will need to confirm your identity and will respond within 30 days. Access is free to request, but we may charge a reasonable fee for copies, and we will tell you the cost first. In limited cases the law lets us refuse access, for example where it would pose a serious threat to someone’s health or safety. If so, we will explain why in writing. If we decline a correction, you can ask us to attach a statement to your record.
Data breaches. If a data breach is likely to cause serious harm, we will notify you and the Office of the Australian Information Commissioner (OAIC), as the Notifiable Data Breaches scheme requires.
Complaints. Send privacy complaints in writing to our Privacy Officer. We will acknowledge your complaint within 7 days and aim to resolve it within 30 days. If you are not satisfied, you can contact:
- the OAIC: oaic.gov.au, 1300 363 992
- the NSW Information and Privacy Commission, for health information: ipc.nsw.gov.au, 1800 472 679.
Contact our Privacy Officer
Brent Goddard, Privacy Officer
Email: brent@modpodpodiatry.com.au
Phone: (02) 9960 3981
Post: 59 Harbour St, Mosman NSW 2088
Changes to this policy. We review this policy at least once a year and whenever our practices change. The current version is always on our website, and we will give you a free copy on request.