Privacy policy
Privacy Policy
Last updated: 3 August 2026
Atleta Health & Performance Clinic (Atleta, we, us, our), ABN 58 228 881 744, respects your privacy. This policy explains what personal information we collect, why we collect it, who we share it with, and how you can access, correct or complain about it.
It covers both our website at atleta.com.au and the services we provide at our clinic at Suite 26, 166A The Entrance Road, Erina NSW 2250.
The laws that apply to us
We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
Many small businesses are exempt from the Privacy Act, but health service providers are not. Because we provide a health service and hold health information, the Privacy Act applies to us regardless of our size or turnover. Accredited Exercise Physiologists are allied health professionals and fall squarely within the definition of a health service provider (Office of the Australian Information Commissioner).
Because we operate in New South Wales, we are also bound by the Health Records and Information Privacy Act 2002 (NSW) (HRIP Act) and the Health Privacy Principles it contains, which apply specifically to health information.
What personal information we collect
If you buy a program or subscribe on our website
- your name and email address
- your billing address and phone number
- your order history and the products you have accessed or downloaded
- your marketing preferences, and whether you have opened or clicked our emails
We do not collect or store your full credit card or debit card number. Payment card details are entered directly into our payment provider's secure systems and are never visible to us. We only see the last four digits, the card type and whether the payment succeeded.
If you download a free resource
Your name and email address, and the resource you requested.
If you attend the clinic or use our services
This is where we collect health information, which is a form of sensitive information and attracts the highest level of protection under Australian privacy law. Depending on your circumstances, this may include:
- your date of birth, contact details, emergency contact and next of kin
- your medical history, injuries, surgeries, symptoms, medications and allergies
- your GP or referring practitioner's details, and any referral or care plan
- results of physical assessments, movement screening, exercise testing and progress measures
- your Medicare number, DVA number, private health fund membership, NDIS number, or workers compensation or insurance claim details
- notes of consultations and the programs prescribed to you
Automatically, when you use the website
- your IP address, browser type, device type and operating system
- the pages you visited, how you arrived, and how long you stayed
- information stored in cookies and similar technologies
How we collect it
Wherever it is reasonable and practicable, we collect personal information directly from you — through the website, over the phone, by email, or on the intake forms you complete before your first appointment.
Sometimes we collect information about you from someone else, such as your GP or referring specialist, another treating practitioner, your insurer or employer in a workers compensation matter, or a parent, carer or guardian. We only do this where you have consented, or where the law otherwise permits it. If we receive information about you from someone else and you did not know, we will take reasonable steps to let you know.
Consent for health and sensitive information
We only collect health information where it is reasonably necessary for us to provide you with a health service, and where you have consented. In practice, that consent is given when you complete an intake form or attend an appointment. You can withdraw your consent at any time by contacting us, though this may mean we can no longer safely provide you with a service.
Why we use your information
- to assess, plan, deliver and review your exercise physiology care
- to fulfil your order and give you access to the program you purchased
- to answer your enquiries and provide customer support
- to book, confirm and remind you about appointments
- to bill you, and to claim on your behalf from Medicare, the DVA, your private health fund, the NDIS or an insurer
- to send you marketing emails, where you have asked to receive them
- to improve our website, our programs and our services
- to meet our legal, professional, insurance and record-keeping obligations
We will not use your health information for direct marketing without your express consent.
Direct marketing and how to opt out
We only send marketing emails to people who have asked to receive them, or who have bought from us and would reasonably expect to hear from us. Every marketing email we send includes an unsubscribe link and our contact details, as required by the Spam Act 2003 (Cth). Unsubscribing is immediate and free, and it will never affect the clinical care you receive.
Transactional messages — an order confirmation, a download link, an appointment reminder — are not marketing, and you will continue to receive those where they are necessary.
Who we disclose your information to
We never sell your personal information, and we never sell or trade your health information under any circumstances.
We may disclose your information to:
- Shopify, which hosts our online store and processes orders on our behalf
- our payment providers, to process payments and refunds
- Google, which provides our email and business productivity software
- our practice management and appointment software provider, which stores clinical records
- Medicare, the Department of Veterans' Affairs, the NDIA, your private health fund, your employer's insurer or a workers compensation scheme, where you have asked us to claim or report on your behalf
- your GP, referring practitioner or other treating health professionals, where you have consented or where it is directly related to your care and you would reasonably expect it
- our professional indemnity insurer, lawyers or accountants, where genuinely necessary
- anyone else you have authorised in writing
We may also disclose your information where we are required or authorised to do so by law — for example under a subpoena, a court order, a mandatory reporting obligation, or where there is a serious and imminent threat to someone's life, health or safety.
Information sent overseas
Some of the providers we use store data outside Australia:
- Shopify — Canada and the United States
- Google Workspace — the United States and other countries in which Google operates data centres
Before disclosing personal information to an overseas recipient, we take reasonable steps to ensure they handle it consistently with the Australian Privacy Principles, as APP 8 requires.
Your clinical health records are held in our practice management system. Where you would like to know exactly where those records are stored, ask us and we will tell you.
Cookies and website analytics
Our website uses cookies. Some are strictly necessary — they keep you logged in, remember what is in your cart, and protect the site against fraud and spam. Others help us understand how the site is used so we can improve it.
As at the date of this policy, the analytics on our website are limited to Shopify's own built-in store analytics, together with Google reCAPTCHA, which protects our forms from automated abuse. We do not currently run a Meta (Facebook) pixel, Google Analytics or any third-party advertising tracker on this website. If that changes, we will update this policy before turning anything on.
You can block or delete cookies through your browser settings. Some parts of the site, including checkout, may not work properly if you do.
How we keep your information secure
We take reasonable steps to protect your information from misuse, interference, loss, and unauthorised access, modification or disclosure. These include encrypted connections across the whole website, access controls and individual logins for clinical systems, multi-factor authentication on our email and administrative accounts, secure storage of any paper records, and limiting access to those who genuinely need it to do their job.
No system is completely secure. If something goes wrong, we will act quickly — see "Data breaches" below.
How long we keep it
Health records. Section 25 of the HRIP Act sets minimum retention periods that we must follow. Where the information was collected while you were an adult, we must keep it for seven years from the last occasion on which we provided you with a health service. Where the information was collected while you were under 18, we must keep it until you turn 25 (Health Records and Information Privacy Act 2002 (NSW), s 25).
This means we cannot delete your clinical records on request before those periods have passed, even if you ask us to. It is a legal obligation, not a policy choice.
Order and financial records. Kept for seven years to meet our obligations under Australian tax law.
Marketing records. If you unsubscribe, we remove you from our sending lists but retain a minimal record of your unsubscribe so that we do not accidentally email you again.
When information is no longer needed and no legal obligation requires us to keep it, we destroy or de-identify it securely. As the HRIP Act requires, we keep a record of whose health information was destroyed, the period it covered, and the date.
Accessing and correcting your information
You have the right to ask for a copy of the personal and health information we hold about you, and to ask us to correct it if it is wrong, out of date, incomplete or misleading.
To make a request, email info@atleta.com.au or write to us at the address below. We may ask you to verify your identity. We will respond within 30 days.
We will give you access unless a legal exception applies — for example, where giving access would pose a serious threat to someone's life, health or safety, or would unreasonably affect another person's privacy. If we refuse, we will tell you why in writing and explain how to complain.
Access to your own records is free. Where you ask for copies, we may charge a reasonable fee for the time and materials involved. We will always tell you the cost before we proceed, and we never charge simply for making the request.
Data breaches
We are covered by the Notifiable Data Breaches scheme. If a data breach occurs that is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner as soon as practicable, and tell you what has happened and what you should do about it.
Complaints
If you think we have mishandled your personal or health information, please tell us first — most issues are resolved quickly and directly.
Privacy Officer
Atleta Health & Performance Clinic
Suite 26, 166A The Entrance Road, Erina NSW 2250
Email: info@atleta.com.au
Phone: (02) 9011 5300
We will acknowledge your complaint promptly and respond within 30 days.
If you are not satisfied with our response, you can escalate it:
- Office of the Australian Information Commissioner — 1300 363 992, oaic.gov.au
- Information and Privacy Commission NSW, for complaints about health information under the HRIP Act — 1800 472 679, ipc.nsw.gov.au
Links to other websites
Our website may link to other sites. We are not responsible for their privacy practices, and we encourage you to read their policies before giving them your information.
Children and young people
Our online programs are intended for adults. Where we provide clinical services to someone under 18, we collect their information with the consent of a parent or guardian, unless the young person is assessed as capable of giving their own consent.
Changes to this policy
We may update this policy from time to time. The current version will always be published on this page with the date it was last updated. Where a change is significant, we will take reasonable steps to let you know.
Contact us
Atleta Health & Performance Clinic
ABN 58 228 881 744
Suite 26, 166A The Entrance Road, Erina NSW 2250
Email: info@atleta.com.au
Phone: (02) 9011 5300