Our Privacy Policy

Last updated: 7 October 2026

About this policy

Your health information is personal, and we treat it that way. This policy explains what information Up! Chiropractic collects, why we collect it, how we keep it safe, and what choices you have.

Up! Chiropractic is a health service provider bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy applies to everyone who visits our clinic, uses our website, responds to our advertising, or contacts us.

Who we are

Up! Chiropractic
318 Vincent St, Leederville WA 6007
Phone: 08 9201 2000
Email: health@upchiropractic.com.au
Website: https://upchiropractic.com.au

Our Privacy Officer is Meagan Upfold, Practice Manager. You can contact them about anything in this policy using the details above.

What information we collect

We only collect what we need to look after you properly and run the practice. That usually includes:

  • Contact and identity details: your name, date of birth, gender, address, phone number and email

  • Health information: your health history, symptoms, examination findings, x-rays and imaging reports, treatment notes, progress and outcomes

  • Billing details: Medicare, DVA, private health fund and payment information needed to process your accounts

  • Emergency contact and referrer details: including your GP or other practitioners involved in your care

  • Enquiry details: anything you tell us when you book, fill in a form, message us or respond to an ad

  • Website and advertising data: information about how you use our website and interact with our ads (see Advertising, cookies and tracking below)

Health information is "sensitive information" under the Privacy Act. We only collect it with your consent and when it is reasonably necessary for your care.

We do not store full card numbers on our systems. Card payments are handled by our payment providers, Stripe and HICAPS.

You don't have to give us the information we ask for. If you choose not to, we may not be able to treat you safely, book your appointments or process your health fund and Medicare claims.

How we collect it

Wherever possible, we collect information directly from you. This happens when you:

  • Book an appointment online, by phone or in person

  • Complete our new patient intake forms

  • Attend a consultation, examination or treatment

  • Fill in a form on our website or landing pages

  • Submit an enquiry through a Facebook or Instagram lead form

  • Message us on social media, by email or by SMS

Sometimes we receive information from others, such as your GP, a specialist, a radiology provider, another practitioner involved in your care, your health fund, or a parent or guardian. We only do this with your consent or where the law allows.

If you give us information about someone else, such as a family member or emergency contact, please make sure they know and are happy for you to share it.

Meta lead forms

If you submit a form inside one of our Facebook or Instagram ads, Meta Platforms, Inc. collects the details you enter and passes them to us. We use those details only to respond to your enquiry and help you book. Meta's handling of your information is covered by Meta's Privacy Policy.

Comments and messages on social media

Comments on our posts and ads are public, and anyone can see them. Please don't share health details in a comment. Send us a private message or call us instead. To protect your privacy, we may hide or remove public comments that include personal health information.

Advertising, cookies and tracking

Our website uses cookies and similar tools to keep it working, understand how people use it, and measure our advertising.

Meta Pixel and Conversions API

We use the Meta Pixel and Meta Conversions API, provided by Meta Platforms, Inc. These tools tell us when someone who saw our Facebook or Instagram ads visits our website, starts a booking or submits an enquiry. Meta may use this to measure ad performance and show our ads to people more likely to find them useful.

We do not send your health information, symptoms, conditions or treatment details to Meta. We only share general website activity, such as a page being viewed or an enquiry being made. Where we send contact details through the Conversions API, they are encrypted (hashed) before they leave our systems.

Other tools

We also use Google Analytics, Google Ads and the analytics built into our website platform, Squarespace. These collect information such as your device, browser, pages visited and approximate location.

Your choices

  • You can block or delete cookies in your browser settings. Some parts of our website may not work as well if you do.

  • You can manage the ads you see on Facebook and Instagram through your Meta ad preferences.

  • You can opt out of Google Analytics with the Google Analytics opt-out add-on.

Links to other websites

Our website and social media pages may link to other sites, such as Meta, Google or health fund websites. We don't control those sites and aren't responsible for how they handle your information, so please check their privacy policies.

How we use your information

We use your information to:

  • Assess, diagnose and provide chiropractic care

  • Keep accurate clinical records

  • Book appointments and send reminders by SMS or email

  • Communicate with your GP or other practitioners involved in your care, with your consent

  • Process payments, Medicare, DVA and health fund claims

  • Respond to enquiries, including those from our ads

  • Improve our services, website and advertising

  • Meet our legal, insurance and professional obligations

We will not use your health information for any other purpose unless you consent, or the law requires or allows it.

Marketing messages

With your consent, we may send you newsletters, health tips, or information about offers and events. Every marketing email or SMS includes a simple way to unsubscribe, and you can also ask us to stop at any time. Appointment reminders and messages about your care are not marketing and will continue while you are a patient.

Who we share it with

We never sell your personal information. We share it only when needed to care for you or run the practice, including with:

  • Other chiropractors and staff at Up! Chiropractic involved in your care

  • Your GP, specialists, physiotherapists or other practitioners, with your consent

  • People you have authorised to act for you, such as a parent, guardian, carer or someone holding power of attorney

  • Radiology and imaging providers

  • Medicare, DVA and private health funds, to process claims

  • Our service providers, including our practice management software (Practice Hub), website host (Squarespace), email marketing platform (Squarespace Email Campaigns), patient communication and automation platform (GoHighLevel), payment processors (Stripe and HICAPS), IT support and accountants

  • Meta Platforms, Inc. and Google, limited to the advertising and website data described above

  • Our insurers and legal advisers, or regulators such as Ahpra, where required

  • A debt collection agency, only if an account remains unpaid after we have contacted you about it. We share only your contact details and the amount owed, never your health information

  • Anyone else where the law requires or allows it, such as a court order or a serious threat to someone's safety

Our service providers may only use your information to provide their services to us.

If the practice changes hands

If Up! Chiropractic is ever sold or merged, patient records may transfer to the new owner so your care can continue without interruption. The new owner must keep your information confidential and handle it in line with Australian privacy law. Where practical, we will let you know before this happens.

Overseas disclosure

Some of our service providers store or process information outside Australia:

  • Practice Hub, our practice management software, is based in the United Kingdom. Our patient records are hosted in Sydney, Australia, on Amazon Web Services. Practice Hub's support team may occasionally access information from the United Kingdom when helping us with a technical issue.

  • Meta, Google, Squarespace, GoHighLevel and Stripe are based in, or store data in, the United States.

  • HICAPS processes health fund claims in Australia.

We take reasonable steps to make sure overseas providers protect your information in line with the Australian Privacy Principles.

How we keep it safe

We store your records electronically in secure, password-protected systems, with access limited to people who need it to do their job. Our team is trained in privacy and confidentiality. Paper records, if any, are kept secure in the clinic and destroyed securely when no longer needed.

No method of sending information over the internet is completely secure. Email and social media messages carry some risk, so for detailed health matters we recommend calling us or telling us in person.

How long we keep it

In line with professional record-keeping requirements, we keep adult patient records for at least 7 years from your last visit. For patients under 18, we keep records until they turn 25. After that, records are securely destroyed or de-identified.

If something goes wrong

If a data breach is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches scheme.

Your rights

Accessing your records

You can ask for a copy of the personal and health information we hold about you. Contact our Privacy Officer and we will respond within 30 days. We may ask you to confirm your identity first, and may charge a reasonable fee to cover copying costs (never for making the request). If we cannot give you access, we will explain why in writing.

Correcting your information

If something we hold is wrong, out of date or incomplete, let us know and we will correct it. If we disagree that a change is needed, we will tell you why, and you can ask us to note your view on your record.

Staying anonymous

You can make a general enquiry without giving your name. To provide treatment and process claims, though, we need to identify you.

Automated decisions

We do not use computer programs to make decisions about your care, eligibility or treatment without a person involved. Every clinical decision is made by your chiropractor.

Questions and complaints

If you have a concern about how we have handled your information, please talk to us first. Contact our Privacy Officer on 08 9201 2000, at health@upchiropractic.com.au, or in writing at 318 Vincent St, Leederville WA 6007. We will acknowledge your complaint promptly and aim to resolve it within 30 days.

If you are not satisfied with our response, you can contact:

  • Office of the Australian Information Commissioner (OAIC): 1300 363 992, oaic.gov.au

  • Health and Disability Services Complaints Office WA (HaDSCO): 1800 813 583, hadsco.wa.gov.au

Changes to this policy

We review this policy regularly and will update it when our practices or the law change. The latest version is always on our website, and a printed copy is available at reception.