PRIVACY POLICY FOR AMBER HEALING THERAPIES

Effective Date: 5 June 2026

1. Introduction

Amber Healing Therapies ("we," "our," or "us") is operated by a sole trader committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and protect your personal and sensitive health information in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth).

2. Types of Information We Collect

To provide safe and effective massage therapy treatments and process your insurance rebates, we collect:

• Personal Details: Full name, date of birth, phone number, email, and emergency      contact details.
• Sensitive Health Information: Medical history, current symptoms, medications,      injuries, allergies, pregnancy status, and lifestyle factors.
• Financial & Private Health Fund Details: Your private health fund name,      membership number, patient code, payment card details, and transaction history.
• Treatment Notes: Clinical records made during or after each session.

3. How We Collect Your Information

We collect information directly from you through manual and face-to-face means, including:

• Physical, paper-based client intake and consultation forms filled out at the clinic.
• Face-to-face discussions during your consultation and treatment.
• Phone calls, text messages, or direct emails initiated by you.
• The physical swiping or scanning of your health fund card via our HICAPS terminal.

4. Purpose of Collection and Use

Your information is collected and used strictly to:

• Assess your physical health and safely deliver tailored massage therapy treatments.
• Manage your bookings and manually send appointment reminders via text message or email.
• Process on-site private health fund rebates via the HICAPS terminal and manage payments.
• Comply with professional codes of conduct, health regulations, and professional      indemnity insurance requirements.

5. Disclosure of Your Information

As a sole trader, your information is handled exclusively by your therapist. We do not sell, rent, or trade your personal information. Your details are only disclosed to third parties in the following limited circumstances:

• Health Insurance Providers: To HICAPS and your private health fund to process your electronic rebate at the time of treatment.
• With Your Consent: To your GP, physiotherapist, or other healthcare providers to coordinate your care.
• Legal Obligations: Where required by law, subpoena, or to defend a professional indemnity insurance claim.

6. Data Storage and Security

We take the security of your physical and digital data very seriously. Because we do not utilize automated, cloud-based booking software, your data is secured via strict manual protocols:

• Paper Records & Receipts: All physical intake forms, treatment notes, and printed HICAPS merchant receipts (which may contain partial card or membership details) are filed away securely in a locked cabinet accessible only by the business owner.
• Mobile & Digital Security: Client contact details, booking communications, and manually sent SMS/email appointment reminders are managed on a dedicated business mobile device. This device is strictly secured with biometric authentication (fingerprint/facial recognition) and a strong alphanumeric password.
• HICAPS Transactions: Health fund card data is encrypted instantly by the HICAPS terminal during processing. We do not store your full health fund card or credit card numbers digitally.

7. Retention and Destruction of Records

In accordance with Australian health regulations and professional indemnity insurance policies, your health records must be retained for:

• A minimum of 7 years from the date of your last treatment.
• If the client is a minor (under 18), records must be kept until the client turns 25 years of age.

Once this retention period expires, paper records and merchant receipts will be securely shredded, and digital correspondence on mobile devices will be permanently deleted.

8. Accessing and Correcting Your Information

You have the right to request access to the personal and health information held about you. You may also request corrections if you believe the information is inaccurate or out of date. Please submit your request to us in writing.

9. Complaints and Enquiries

If you have any questions about this policy or wish to make a complaint about a potential breach of your privacy, please contact us directly. If you are not satisfied with our response, you can lodge a formal complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

10. Contact Details

• Business Name: Amber Healing Therapies
• Contact Person: Amber Dias
• Email: info@amberhealingtherapies.com.au
• Phone: 0403 152 182
• Address: Balgownie Drive Peregian Springs QLD 4573