Privacy policy

What we collect

If you send an enquiry or make a booking, we collect the details you provide, such as your name, email address, booking details and message content. If you accept cookies, HubSpot tracking also collects technical and usage information, such as your IP address, browser, pages visited and cookie identifiers. If you decline, that tracking does not run.

Please do not submit patient information, clinical notes or your clients’ personal data through the general contact form or booking page. Consulting work is carried out in your own systems; those records are not stored on this website. Enquiry and booking information is processed and retained through HubSpot.

How we use it

We use your information to respond to enquiries, arrange calls, provide consulting services and maintain our business relationship. Website usage information helps us understand how the site is used.

Personal information is kept only for as long as needed to respond, provide the service and maintain the business relationship, or as required by law. We take reasonable steps to protect it and delete information that is no longer needed.

Third-party services

HubSpot provides this site’s contact form, booking platform and tracking. It processes information submitted through those services and may use cookies or similar technologies. Data may be processed outside Australia or New Zealand under HubSpot’s arrangements. See HubSpot’s privacy policy for more information.

On the physio, dental and chiro landing pages, Google Ads cookies measure which ads lead to an enquiry. They load only after you accept, the same as HubSpot tracking. See Google’s privacy policy for more information.

This site loads fonts from Google Fonts, a third-party font host. Your browser sends requests, including technical information such as your IP address, to Google when loading those fonts. The homepage also uses a Spline-hosted graphic, whose delivery involves requests to third-party services.

A consent banner appears on your first visit. Accept and the HubSpot tracking script loads (and, on the landing pages, Google Ads tracking too), setting cookies that record which pages you view and link a later enquiry back to that visit. Decline and neither tracking script loads, and any HubSpot cookies already in your browser are cleared. Your choice is stored in your browser, so the banner only asks once. To change it, clear this site’s stored data and the banner returns on your next visit.

Declining does not block any part of this site. The contact form and the booking link work either way, and information you submit through them is still processed by HubSpot. You can also manage cookies directly in your browser, and if you prefer not to use the form or booking platform you can email us instead.

Your rights

You can contact us to request access to or correction of personal information you have provided, ask for its deletion where appropriate, or raise a privacy concern. We will respond and work with you to address it, subject to applicable Australian or New Zealand privacy law.

If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner or New Zealand’s Office of the Privacy Commissioner, as applicable.

How Opal handles client data

This is what happens to your patients' information while we work with you.

Who stays responsible for patient data?

Your clinic stays responsible for, and in control of, your patients' data in every engagement. We advise and implement. We do not take that responsibility from you, and we are never the one holding your patients' data.

Do we hold any of it?

No. At no point do we receive, store, copy or keep patient data. Implementation happens inside your own systems, using your own accounts, not ours.

How do we get access?

You create a named login for us, scoped to the minimum the job needs. Your own audit log stays switched on the whole time. We never use a shared login, and never your staff's own credentials.

What do we never do?

We never export, copy, download or screenshot patient details. We never put patient data into email, notes or our own AI tools. Demonstrations and testing run on made-up patients, not real ones.

How do we choose the tools we recommend?

Before we recommend any tool, we ask the vendor in writing where the data is stored and processed, whether it trains on your inputs, how long it keeps data, who its sub-processors are, and what security attestations it holds. A tool that trains on your inputs does not make the list.

What happens if something goes wrong?

If we know or suspect an incident touching your systems or data, we tell you in writing within 24 hours. Whether to notify a regulator or a patient is your call, not ours. We do not make that decision on your behalf.

Which laws apply?

In Australia, your clinic is the entity regulated under the Privacy Act 1988, and stays in control of your patients' data throughout. In New Zealand, the Privacy Act 2020 applies to us directly, and your clinic follows the Health Information Privacy Code 2020, which we work to.

What happens when the engagement ends?

We remove our access on the day the engagement ends. Any business documents you shared with us, never patient data, are returned or deleted, and we confirm it to you in writing.

Contact

For privacy questions or requests, email aaron@opalhealth.com.au.

Opal Health Consulting
ABN 53 407 697 881