Privacy policy.
Last updated 5 October 2026
We look after health information, so we take privacy seriously. This page explains in plain terms what we collect, why, and your rights under the Privacy Act 1988 and the Australian Privacy Principles.
Who we are
Cortis Physiotherapy is a mobile physiotherapy practice run by Yoshiki Chen, Principal Physiotherapist (AHPRA PHY0002667476), ABN 11 665 715 892. We visit clients at home, in retirement villages and in residential aged care across Brisbane's southside. "We", "us" and "our" mean Cortis Physiotherapy.
What we collect
- Contact details: names, phone numbers, email addresses, and the suburb or address for visits.
- Health information: the reason for a visit, your health history, assessment findings, treatment notes and progress.
- Funding details needed to bill your visits: Medicare, DVA, NDIS, Support at Home, health fund, WorkCover or CTP.
- Referral information: letters, care plans and reports from your GP or another health professional.
- Details of the person helping you, if a family member, friend or carer contacts us for you.
We only ask for what we need. Our request form asks for as little as possible, so please don't put detailed medical history in it: we'll ask what we need when we talk.
How we collect it
Mostly from you, or from someone you've asked to help: through our website forms, by phone, by email and during visits. We also receive information from health professionals who refer you and, with your consent, from your GP, hospital or other providers involved in your care.
Why we use it
To call you back, arrange and provide your physiotherapy, keep accurate health records, keep your GP and others involved in your care up to date (with your consent), bill your funding body or health fund, and meet our legal and professional obligations. We never sell your information or use it for advertising.
Who we share it with
Only when it's needed for your care, or when the law requires it:
- your GP, the health professional who referred you, and others in your care team, with your consent
- the people who pay for your visits: Medicare (Services Australia), DVA, the NDIA or your plan manager, your Support at Home provider, your health fund, or the insurer for a WorkCover or CTP claim
- anyone else you ask us to share it with
- where the law requires or allows it, for example to lessen a serious threat to someone's life, health or safety.
Services we use, including outside Australia
We use a few trusted services to run our website and forms. Some of them store or process information outside Australia:
| Service | What it does | Where |
|---|---|---|
| Cloudflare | Hosts this website, runs our forms, checks for spam (Turnstile), counts visits without cookies (Web Analytics) and keeps anonymous daily counts of button and form use (for example, how many requests were started), never anything you type. | United States, and other countries in its global network |
| Resend | Delivers form messages to our inbox. | Japan (Tokyo) for sending; United States for its records |
| Google (Google Workspace) | Our email: stores the messages we send and receive. | United States, and other countries where Google keeps data |
We take reasonable steps to make sure these services protect your information in line with Australian privacy law, and we only send them what each task needs.
How we keep it safe
Our website and forms use encrypted connections. Form details go straight to our inbox: the website doesn't store them, and they are never sent to analytics or advertising services. Health records are kept in secure, password-protected systems.
How long we keep it
We keep health records for as long as the law requires: for adults, at least seven years after the last visit, and for children, at least until they turn 25. After that we securely destroy or de-identify them.
Using a different name, or no name
You can ask general questions without telling us who you are, for example in the free 10-minute phone chat. To provide physiotherapy, we need to know who you are.
Seeing and correcting your information
You can ask to see the information we hold about you, or ask us to correct it. Contact us and we'll respond within 30 days. There's no charge to ask. In rare cases the law lets us refuse access; if so, we'll explain why in writing.
Decisions about your care
All decisions about your care are made by a physiotherapist. The suburb check on our website only tells you whether we usually visit your area; it never decides whether we can help you.
Our website
Our website doesn't use advertising or tracking cookies. To stop spam, our forms use Cloudflare Turnstile, which checks that a real person is using the form, and it only loads once you start filling one in. Our website statistics count visits, and how often buttons and forms are used (for example, how many people started a request or tapped to call), without identifying you. They keep only the day, never the time, your IP address or anything you type into our forms.
If something goes wrong
If a data breach is likely to cause serious harm, we'll tell you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.
Questions and complaints
Contact Yoshiki on 0401 620 668 or hello@cortisphysio.com.au. We'll respond within 30 days. If you're not happy with our response, you can contact the Office of the Australian Information Commissioner (oaic.gov.au, 1300 363 992). For concerns about a health service, you can also contact Queensland's Office of the Health Ombudsman (oho.qld.gov.au, 133 646).
Changes to this policy
We'll update this page when our practices change. The date at the top shows the latest version.