P1 Physiotherapy and P1 Pilates Privacy Statement
Effective date: 9 September 2026
C.M Health Solutions Pty Ltd (ABN 38 654 300 937), trading as P1 Physiotherapy and P1 Pilates (“P1”, “we”, “our” or “us”), respects your privacy and is committed to protecting your personal and health information.
This Privacy Statement explains how we collect, hold, use, disclose and protect your information, and how you can request access to or correction of that information.
We manage personal and health information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles, the Health Records and Information Privacy Act 2002 (NSW) and other applicable laws and professional obligations.
1. Information we collect
The information we collect depends on the services you receive and may include:
Your name, date of birth, address, telephone number and email address.
Emergency contact, parent, guardian or authorised representative details.
Medicare, Department of Veterans’ Affairs, NDIS, workers compensation, compulsory third-party insurance, private health insurance or other funding details.
Medical history, medications, allergies, diagnoses, symptoms and relevant lifestyle information.
Clinical assessments, treatment plans, appointment notes, progress reports, referrals, correspondence, imaging and investigation results.
Information provided by your general practitioner, specialist, insurer, employer, support coordinator or another healthcare provider.
Payment, billing and transaction information.
Appointment, attendance and communication records.
Information submitted through our websites, online booking systems, forms, email, SMS, telephone or social media.
Where appropriate and with your knowledge, photographs, videos, audio recordings or other information relevant to your assessment, treatment or participation.
Technical information collected when you use our websites, such as your IP address, browser type, device information and website activity.
Where practical, you may interact with us anonymously or using a pseudonym. However, we will usually require accurate identifying and health information to provide clinical or exercise services, process claims and maintain appropriate records.
2. How we collect information
We generally collect information directly from you or from your parent, guardian or authorised representative.
We may also collect relevant information from:
Referring doctors and other healthcare providers.
Hospitals, pathology providers and imaging providers.
Medicare, DVA, the NDIS, insurers and funding organisations.
Employers, rehabilitation providers, solicitors or government agencies where relevant to your treatment or claim.
Online booking, practice management, membership, payment and communication platforms.
Other people or organisations where you have authorised collection or where collection is permitted or required by law.
If you provide us with personal information about another person, you should ensure that you have authority to provide it.
3. Why we collect and use information
We collect and use personal and health information to:
Assess your condition and provide safe and appropriate healthcare.
Develop, provide and review treatment, rehabilitation and exercise programs.
Manage your participation in Pilates classes, memberships and related services.
Communicate with you about appointments, classes, treatment and services.
Coordinate your care with other healthcare providers.
Process payments, rebates, insurance and funding claims.
Prepare reports, certificates, referrals and correspondence.
Maintain clinical, attendance, payment and membership records.
Manage our business and administrative operations.
Respond to enquiries, feedback and complaints.
Meet our legal, regulatory, insurance and professional obligations.
Improve the quality, safety and delivery of our services.
Send information about our services, programs or promotions where you have consented or where otherwise permitted by law.
Protect the safety and legal rights of our patients, clients, members, staff and business.
If you do not provide the information we reasonably require, we may be unable to provide certain services, process a claim or communicate effectively with you.
4. AI-assisted clinical documentation
P1 Physiotherapy may use approved artificial intelligence-assisted technology to support clinical documentation, including transcribing consultations and preparing draft clinical notes.
Before using an AI documentation tool during your consultation, we will explain its proposed use and obtain your consent. You may decline or withdraw your consent without affecting your access to treatment.
AI-generated material is used only as an administrative aid. Your treating clinician remains responsible for reviewing, correcting and approving the final clinical record and for all clinical decisions.
Personal and health information will only be processed through systems that P1 has assessed and approved for the intended purpose. Staff must not enter identifiable patient information into public or unapproved AI tools.
Where a consultation is recorded or temporarily processed, we will provide information about how the recording is handled and whether it is retained.
5. When we may disclose information
We may disclose information where reasonably necessary for your care, participation or the operation of our services, including to:
Your treating practitioners, Pilates instructors and authorised P1 staff.
Your general practitioner, specialist or another healthcare provider involved in your care.
Hospitals and emergency services.
Medicare, DVA, the NDIS, private health insurers and other funding bodies.
Workers compensation and compulsory third-party insurers, rehabilitation providers, employers or legal representatives where relevant and authorised.
Laboratories, imaging providers and medical suppliers.
Practice management, online booking, membership, payment, communications, information technology, secure storage and approved AI documentation providers.
Accountants, auditors, insurers, lawyers and professional advisers.
Government agencies, regulators, courts or law-enforcement bodies where required or authorised by law.
We may also disclose information where:
You have provided consent.
It is necessary to lessen or prevent a serious threat to someone’s life, health or safety.
It is reasonably necessary for an enforcement-related activity.
Disclosure is otherwise permitted or required by law.
P1 does not sell patient or member information.
6. Electronic systems and overseas handling
P1 uses third-party technology providers to support practice management, online bookings, Pilates memberships, payments, communications, document storage and clinical administration.
Some providers may use infrastructure, personnel or subcontractors located outside Australia, including in the United States or other countries in which those providers operate.
Where information may be accessible overseas, we take reasonable steps to assess the provider’s privacy and security arrangements and manage the information in accordance with applicable Australian privacy obligations.
Further information about the service providers we use and the locations in which information may be handled is available by contacting us.
7. Direct marketing
With your consent, or where otherwise permitted by law, we may send you information about services, classes, health programs, events, educational content or promotions.
You can opt out at any time by:
Selecting the unsubscribe option in an email.
Replying “STOP” to an SMS where that option is provided.
Contacting P1 directly.
Opting out of marketing will not prevent us from sending appointment reminders, class notifications, payment notices, clinical communications or other messages required to provide your services.
We will not use sensitive health information for direct marketing without your consent.
8. Websites and cookies
Our websites may use cookies and similar technologies to support website functionality, understand website use and improve our services.
You may adjust your browser settings to restrict cookies, although some website features may not function correctly as a result.
Our websites may contain links to third-party websites. P1 is not responsible for the privacy practices or content of external websites.
9. Security and retention
We take reasonable administrative, physical and technical measures to protect information from loss, misuse, interference, unauthorised access, modification or disclosure.
These measures may include:
Role-based access controls.
Passwords and multi-factor authentication.
Secure electronic practice management and membership systems.
Confidentiality obligations and staff training.
Secure storage and disposal processes.
Technology-provider security assessments.
Data backup and incident-response procedures.
No electronic transmission or storage system can be guaranteed to be completely secure. If a data breach occurs, we will investigate and respond in accordance with applicable notification requirements.
We retain health and business records for the periods required by law, professional standards, funding arrangements and legitimate clinical or operational needs. When information is no longer required, we take reasonable steps to securely destroy or permanently de-identify it, unless continued retention is required by law.
10. Accessing your information
You may request access to the personal or health information we hold about you.
We may need to verify your identity or the authority of a person acting on your behalf. Access may be provided through an electronic or printed copy, inspection of the record, a summary or another appropriate method.
We will respond within a reasonable period, generally within 30 days. We may charge a reasonable fee for the cost of providing access, but we will not charge you simply for making a request.
In limited circumstances, access may be refused or restricted where permitted by law. If this occurs, we will generally provide written reasons and explain the available complaint options.
11. Correcting your information
Please tell us if you believe information we hold about you is inaccurate, incomplete, out of date, irrelevant or misleading.
We will take reasonable steps to review and, where appropriate, correct the information. We will not charge you for requesting a correction.
If we do not agree to make a requested correction, we will explain our decision and, where required, allow you to have a statement associated with the record noting your position.
12. Children and people requiring assistance
Where a patient or participant is a child or does not have capacity to make a particular privacy decision, we may collect information from and communicate with a parent, guardian, authorised representative or other responsible person.
We will consider the person’s maturity, capacity, safety, preferences and legal rights when deciding who may access or receive their information.
13. Privacy enquiries and complaints
If you have a privacy question, wish to access or correct your information, or believe your privacy has been breached, please contact:
Privacy Officer
C.M Health Solutions Pty Ltd
Trading as P1 Physiotherapy and P1 Pilates
ABN: 38 654 300 937
Address: Suite 1.01, 3 Fordham Way, Oran Park NSW 2570
Email: oranpark@p1physio.com.au
Telephone: 1300 774 949
Please provide enough information for us to understand and investigate your request or complaint. We will handle privacy complaints fairly and confidentially and aim to provide a response within 30 days.
If you are not satisfied with our response, you may contact:
The Office of the Australian Information Commissioner at www.oaic.gov.au
The Information and Privacy Commission NSW at www.ipc.nsw.gov.au
14. Changes to this statement
We may update this Privacy Statement when our services, practices, technology or legal obligations change.
The current version will be published on our website and made available free of charge upon request.
Last updated: 9 September 2026