Privacy Policy
Your health information, handled with care and discretion.
Version 1.1 | Effective July 2026 | Reviewed annually
Who we are
Orion Hand Therapy is a specialist hand therapy clinic based in Oak Park, Melbourne, founded and operated by Rigel Mascarenhas — a registered physiotherapist and AHTA-accredited hand therapist. We provide specialist assessment and treatment of hand, wrist and upper limb conditions.
As a health service provider, we are bound by Australian and Victorian privacy legislation regardless of the size of our practice. This policy explains how we collect, use, store, and protect your personal and health information.
Legislation we follow
Orion Hand Therapy complies with all applicable privacy legislation, including the Privacy Act 1988 (Cth) and its Australian Privacy Principles (APPs), the Health Records Act 2001 (Vic) and its Health Privacy Principles (HPPs), the Privacy and Data Protection Act 2014 (Vic), and the Notifiable Data Breaches (NDB) scheme. As a Medicare provider, we also comply with the Medicare Australia Act 1973 (Cth)
What information we collect
Personal details
- Full name, date of birth, and address
- Phone number and email address
- Emergency contact name and relationship
- Medicare number, DVA file number, or private health fund membership details
- Referral details, including your referring practitioner's name and practice
- Billing and payment information
Health information
- Medical and injury history, current medications, and allergies
- Details of your presenting condition and symptoms
- Clinical assessment findings and outcome measures
- Treatment plans, progress notes, and discharge summaries
- Imaging reports, surgical notes, and specialist correspondence
- Clinical photographs of your hand or upper limb — only taken with your explicit consent
Third-party and funding body information
- NDIS plan and support coordinator details, where applicable
We only collect information that is genuinely necessary for your care. We will always tell you why we are asking for it.
How we collect your information
Wherever possible, we collect information directly from you — through intake forms, during consultations, via our patient portal, by phone, or by email. In some circumstances we may receive information from third parties such as your referring GP, specialist surgeon, employer, or insurer. When this occurs, we will let you know.
You are not obliged to provide your information to us, but withholding it may limit the care we are able to provide.
How we use your information
- For your care
- Assessing, diagnosing, and treating your hand or upper limb condition
- Communicating with your GP, surgeon, or other treating health professionals
- Maintaining accurate clinical records
- Processing billing and health fund or compensation claims
- Coordinating follow-up appointments and care planning
For practice operations
- Quality assurance, clinical audit, and service improvement — de-identified wherever possible
- Professional development and education
- Compliance with legal and regulatory obligations
- Research and statistical reporting — only in de-identified form, unless you provide separate written consent
We use the minimum information necessary for each purpose and will never use your information for advertising or marketing by third parties.
Who we share your information with
With your consent
- Your GP, specialist surgeon, or other treating health professionals
- Your private health insurer, for claims processing
- NDIS support coordinators or plan managers
- Other health services, if you are referred onwards — we will confirm your consent before transferring any records
When required by law
In limited circumstances, we may be required or permitted to disclose your information without your consent — for example, where required by a court order or mandatory reporting obligation, to prevent a serious and imminent threat to someone's life or safety, to Medicare Australia or the DVA for billing verification, or to regulatory bodies investigating a privacy complaint. In all cases, we disclose only the minimum information necessary.
We will never sell, rent, or commercially share your personal or health information.
Telehealth
Orion Hand Therapy offers telehealth consultations using encrypted, secure video platform through Cliniko. Video sessions are never recorded or stored. All clinical information exchanged during a telehealth consultation is documented in your clinical record in the same way as an in-person visit. If a still image is needed during the session — for example, to document a wound — we will ask for your explicit verbal consent before taking it.
We recommend finding a private space before your appointment to protect the confidentiality of your discussion.
How we store and protect your information
Your clinical records are maintained in Cliniko, a cloud-based practice management system hosted on Australian servers. AI-assisted clinical documentation is supported by Heidi Health, an Australian-based platform. Business email is managed through Google Workspace; no clinical records are stored in email. Our website is hosted on Squarespace for analytics purposes only — no health information is stored there.
Paper records are stored securely in locked filing within our clinic premises. Access to all records is restricted to the treating clinician.
How long we keep your records
- Adult records: minimum 7 years from your last appointment
- Records for clients who were minors at the time of service: until they turn 25, or 7 years from the date of last service — whichever is later
After the required retention period, records are securely destroyed. Paper records are cross-shredded and electronic records are permanently deleted.
Your rights
Right to access
You have the right to request a copy of the personal and health information we hold about you. To make a request, please contact us in writing. We will respond within 30 days, may ask you to verify your identity, and a small administrative fee of up to $30.00 may apply for providing copies. We will let you know in advance if this applies
Right to correction
If you believe the information we hold about you is inaccurate, incomplete, or out of date, you may request a correction. We will take reasonable steps to correct any inaccurate information and will advise you in writing if we are unable to make a requested change.
Data breaches
We maintain a Data Breach Response Plan consistent with the Notifiable Data Breaches (NDB) scheme. If an eligible data breach occurs — one likely to result in serious harm — we will assess the breach immediately, notify the Office of the Australian Information Commissioner (OAIC), notify affected individuals as required by law, and take steps to contain the breach and prevent recurrence. If you believe your information may have been involved in a breach, please contact us
Questions and complaints
If you have any questions about this policy, or a concern about how we have handled your information, please contact us in the first instance. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days.
Privacy Officer: Rigel Mascarenhas
Email: admin@orionhandtherapy.com.au
Updates to this policy
This policy is reviewed annually or whenever there is a material change to our information handling practices, technology providers, or applicable legislation. The current version is always available on our website and at our clinic premises upon request.
Orion Hand Therapy | Oak Park, Melbourne VIC | admin@orionhandtherapy.com.au
Version 1.1 | July 2026