Privacy Policy

JET Physio Pty Ltd trading as SANO Physio (ABN 58 167 248 464, "SANO," "we," "us," "our") is committed to protecting your privacy. This policy explains how we collect, use, store and disclose your personal information, including your health information, in accordance with the Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs).

As a health service provider, we are bound by the Privacy Act and the APPs regardless of our annual turnover.

This policy applies to SANO Physio and to our Run Pure running performance programs, both operated by JET Physio Pty Ltd.

What we collect

We collect information necessary to provide you with safe, effective care, including:

  • Your name, address, date of birth, phone number and email

  • Emergency contact or advocate details

  • Medicare, DVA or health fund details, collected for claiming purposes only

  • Your health information, including symptoms, medical history, diagnosis, treatment notes and progress

  • Referrals and reports from your GP, specialists or other treating practitioners

  • Objective testing results (for example, from VALD Force Decks, Dynamo HHD or Ochy gait analysis)

  • Appointment and billing records

How we collect it

We usually collect information directly from you — in person, by phone, or through our online booking and intake forms. We may also collect information:

  • From your referring GP or another treating practitioner, with your consent or as otherwise permitted by law

  • From your health fund, Medicare, WorkCover Queensland or another funding body, in connection with your claim

  • If you receive massage or remedial therapy at our premises, a therapist may pass a brief clinical observation to our reception team if they believe you'd benefit from a physiotherapy assessment. This is recorded against your file with your knowledge at the time. Beyond this, client records for massage and remedial therapy services at our premises are held entirely separately from your SANO Physio clinical file.

Why we use your information

We use your information to:

  • Provide and coordinate your treatment and communicate with your care team

  • Manage appointments, billing, and claims with Medicare, health funds, WorkCover Queensland and other funding bodies

  • Meet our reporting obligations under programs such as GPCCMP and WorkCover

  • Maintain quality and safety through internal audits

  • Communicate with you about your care, and, where you've agreed, send you marketing communications

We use an AI clinical documentation tool (Heidi) to transcribe and summarise your consultations, solely for the purpose of creating your clinical notes. Heidi does not use your consultation data to train or improve its underlying AI model. You will be asked for your specific consent to this at your first appointment.

Who we share your information with

We share information with contracted service providers who help us run the practice and deliver your care — including our practice management, billing, secure messaging and exercise-program systems. These providers are required to protect your information to the same standard we do and do not use it for their own purposes.

VALD Performance. Objective testing data collected using VALD Force Decks and Dynamo HHD is entered into VALD's software to generate your results. VALD Performance may use this data in anonymised form to improve and develop its products. This does not identify you personally.

WorkCover Queensland. If you are being treated under an accepted WorkCover claim, we disclose your name and employee number (matched to your client code), and session invoices showing the broad reason for attendance, for the purposes of claims processing, recovering statutory treatment costs, and financial auditing.

We may also disclose your information where required or authorised by law — for example, to comply with a court order, to lessen or prevent a serious threat to someone's life, health or safety, or to our professional advisers such as our accountant or insurer.

We do not sell your personal information.

Advocates and emergency contacts

Anyone nominated by you as an advocate, emergency contact, or person authorised to receive information on your behalf must be at least 18 years of age.

Patients under 18

If you are under 18, we require the consent of a parent or guardian before we provide treatment and collect information about you, obtained at the time of your first appointment.

Photography, video and social media

We will only photograph or film you during a session, and use that content for promotional purposes, with your specific consent, given at intake. You can withdraw this consent at any time by telling our reception team, and we will stop using the relevant material in any new promotional material from that point.

CCTV

CCTV operates at our premises for the safety and security of patients, staff and visitors. Footage is retained for 30 days and then automatically deleted, unless required for an active investigation or legal process.

Direct marketing

We may send you newsletters and promotional communications if you have provided your contact details for this purpose. You can opt out at any time by using the unsubscribe link in any marketing email or by contacting us directly. This does not affect clinical communications relating to your care, such as appointment reminders.

Cookies and our website

Our website may use cookies to help us understand how visitors use the site. You can disable cookies in your browser, though some website features may not work as intended if you do.

Storing and protecting your information

We take reasonable steps to protect your personal information from misuse, loss, unauthorised access, modification or disclosure. Information is held securely in both physical and electronic form, accessible only to authorised staff.

We retain your health records for at least 7 years from your last treatment, in line with our professional and legal obligations.

Data breaches

If a data breach occurs that is likely to result in serious harm to you, we will respond in accordance with our internal data breach response procedure, consistent with the Notifiable Data Breaches scheme under the Privacy Act.

Overseas disclosure

We do not currently disclose personal information to overseas recipients, except where a service provider we use stores data outside Australia. This still needs a direct answer: where does Heidi physically host consultation data? "Transcription only, no training" answers whether Heidi needs VALD-style named treatment (it doesn't) — it does not answer where the servers sit, which is a separate APP 8 question. If Heidi's data centres are onshore (Australia), delete this bracket and the sentence above stands as written. If offshore, this section needs to name the country and recipient specifically.

Accessing and correcting your information

You have the right to access and request correction of the personal information we hold about you. To make a request, contact us using the details below. We will respond within 30 days. We may need to verify your identity before providing access.

Privacy complaints

If you have a concern about how we've handled your personal information, please contact us in writing using the details below. We take all complaints seriously and will respond within 30 days. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner:

Phone: 1300 363 992 Email: enquiries@oaic.gov.au Web: oaic.gov.au/privacy/privacy-complaints

Changes to this policy

We may update this policy from time to time. The current version will always be available on our website.

Contact us

JET Physio Pty Ltd trading as SANO Physio 7 Bayswater St, Paddington QLD 4064 Phone: 07 3368 2207 Email: info@sanophysio.com.au

Last updated: 24/08/2026