The Physio House app — patient information and privacy notice
Version: pilot-privacy-2026-11-06 · Prepared 6 November 2026 for the adult pilot
Who looks after your information
The app is operated by JPIGGOTT PTY LTD (ABN 64 671 953 843), trading as The Physio House. Jordon Piggott is your privacy and app-support contact: admin@thephysiohouse.com.au. You can also raise a question with Jordon at your appointment and ask for a copy of this notice.
This notice covers the patient app and the documentation used to prepare its plans. It explains what happens to your information before you decide whether to join.
Live rollout update — 7 November 2026
The initial pilot has expanded to an adult rollout of up to 100 enrolled clients, still managed by Jordon. Existing accounts and records continue in this same service. The privacy practices, optional participation, identity checks and clinician review described below continue to apply.
Taking part is your choice
The app is an optional companion to your physiotherapy. You can receive care, book appointments and receive an exercise program without using it. Ask Jordon for an alternative, including if you prefer not to use AI-assisted documentation.
The initial pilot is for 3–5 adults managing their own accounts, with Jordon arranging access and reviewing and publishing plans. Installing the app does not enrol you, create a clinical record or book an appointment. Jordon will explain the pilot and record your agreement before your information is added to the patient app.
Use your own mobile number, matching the number held by the clinic, and verify it using an SMS code. Tell the clinic if your number changes, is shared or becomes inaccessible. This pilot does not support accounts managed by parents, carers or substitute decision-makers. Do not share sign-in codes.
What we collect and why
We obtain patient and appointment information from Cliniko, draft summaries and exercise programs from your clinician's documentation workflow, and information you choose to enter yourself. This includes:
- Your name, mobile number, clinic patient and appointment identifiers, appointment details and information needed to establish eligibility and account access.
- Session summaries, rehabilitation instructions, exercise dosage and schedules, PDFs, drafts, previous versions and the clinician's review and publication history.
- Messages exchanged with your clinician (including sender and time), notes for your next visit, symptom check-ins, exercise completion records and notification preferences you choose to save.
- An email address if you choose email features, device notification registrations, sign-in and security records, and delivery/error records needed to run and support the service.
We use this information to provide your rehabilitation plan, link it to the correct person and appointment, support your care, provide chosen reminders and availability alerts, manage access, resolve problems and maintain appropriate records. Personal app access requires identification; optional notes and notifications are not required to receive care. Please avoid including unnecessary details about other people.
Who can see it
Authorised clinic physiotherapists can access app patient information for care; access is not permanently limited to the physiotherapist who first treated you. Jordon is the only clinician managing the initial pilot. Your notes are visible to authorised clinicians, not a private diary hidden from the clinic.
The service providers below process information needed to operate their services. Authorised technical support may need limited access to investigate a problem. We may also provide information to you, your authorised representative, or where required or authorised by law. App notification choices are not consent to marketing, and we do not sell app patient information.
Notes are not monitored
Notes and symptom check-ins are reminders for your next appointment, not messages or requests for urgent advice. They are not continuously monitored and you should not expect a reply. Call your physiotherapist or the clinic about important changes. In an emergency, call 000 or go to an emergency department. Email is not an emergency channel either.
Optional messages with your clinician
You can choose to send messages in the app and your clinician can reply. Messages are visible to authorised clinic clinicians and retained with your app records; they are not automatically copied to Cliniko. Messages are not continuously monitored, and a reply is not guaranteed. Call the clinic for important concerns; in an emergency call 000 or go to an emergency department. Sent messages remain in the conversation; send a correction or contact the clinic if something needs correcting.
New-message email and app alerts are optional and off until you enable them. They contain no message text. Open the app to read a message. The existing sending hours and limits apply. Appointment notes and symptom check-ins remain separate and do not send a message.
AI-assisted preparation, with clinician review
Jordon uses the Patient Notes agent in the clinic's OpenAI ChatGPT workspace to help turn appointment dictation into draft clinical notes, patient summaries and exercise programs, including PDFs. Relevant appointment information is processed by that service and the connected tools used to transfer drafts to Cliniko and the app. Only a clinician can publish a plan for you to see. The patient app has no AI chatbot.
Drafts and AI-generated material can contain errors. Ask your physiotherapist about unclear instructions. AI conversations and generated files are separate from the app's records: closing your app account does not automatically delete them. Their storage and deletion depend on the service and workspace settings; we do not promise immediate deletion or Australian-only AI processing.
Services and storage locations
| Service | What it does with information |
| Cliniko | Holds the clinic's clinical records and supplies patient/appointment information; handles bookings when you follow a booking link. |
| Google Cloud | Hosts app records and PDFs in Sydney, with app backups in Melbourne. |
| Firebase Authentication, operated by Google | Verifies sign-in, including your mobile number and related security information. Authentication data is processed in the United States; Google also uses phone numbers provided for authentication for spam and abuse prevention. |
| Resend | Sends app emails and handles recipient addresses, message content and delivery information. Its service providers include providers in the United States. |
| Your device/browser notification provider | Delivers optional device notifications using a device registration and notification content; this may involve Apple, Google or Mozilla, depending on your device/browser. |
| OpenAI ChatGPT and the clinic's connected documentation tools | Process the appointment information used to prepare and transfer drafts. Processing may occur overseas, including in the United States. |
| The clinic's email service, Microsoft Outlook | Handles privacy/support correspondence that you send to the clinic. |
Australian app hosting does not mean that all sign-in, email, AI, support or notification processing stays in Australia. These services and their subprocessors may process information in other countries. We have not established an exhaustive list of countries for every connected service; please contact Jordon if you need more detail before deciding to participate.
We use restricted accounts, verified sign-in, private record storage, clinician attribution and backups to protect app information. No internet service can guarantee absolute security. Keep your device locked and tell the clinic promptly if someone else may have accessed your account.
Optional notifications and bookings
You choose whether to receive rehabilitation-plan updates, earlier-appointment alerts and exercise reminders, and which available delivery channels to use. You can change these settings or ask the clinic to stop them. Sign-in verification is separate from optional notifications.
Alerts can be visible on a lock screen or to anyone with access to your mailbox. They do not contain your detailed exercise instructions; sign in to see your plan. Notification checks operate between 8 am and 8 pm Brisbane time. Delivery is not guaranteed or an urgent-care service.
Earlier-appointment alerts do not reserve a time. Booking takes place in Cliniko. A new booking does not automatically cancel an existing booking; use the clinic's cancellation process or contact the clinic if you need help.
Keeping and deleting information
Cliniko remains the clinic's main clinical-record system. App information is stored separately and is not automatically copied into Cliniko. Temporary patient files on the clinic computer used for transfer to Cliniko are deleted after transfer; this does not delete copies in the app or other services.
Our clinic policy is to retain adult clinical records for at least 10 years from the last appointment with the clinic. Longer retention may be necessary for ongoing care, legal requirements or a documented reason. This is a clinic-selected minimum, not a promise that all records will be deleted at ten years. Records of minors are retained at least until age 25; the app pilot itself is adults only.
Programs can remain available after discharge. After 24 months with neither app use nor a clinic appointment, we will review continued app access and storage manually. There is no automatic deletion during this pilot. Before routine removal of programs from app access, we will preserve required clinical records and give at least 30 days' notice to your recorded contact details so you can download a copy. Access may be restricted sooner for a security concern or at your request.
The app's daily backups use a rolling 30-day retention period, with a further seven-day recovery period after deletion. This backup cycle does not shorten clinical-record retention or erase information still in the main system. Superseded versions, audit/security records, AI material and email copies must be considered separately when handling a deletion request; deletion of a visible item does not necessarily erase all copies. We review what must be retained and securely remove or de-identify information when it is no longer needed and may lawfully be removed.
Stopping, access, corrections and complaints
You may stop using the app at any time without affecting your usual care. Contact Jordon to disable access and future notifications. Removing the home-screen icon alone does not close your account. Copies already downloaded to your device or delivered to your mailbox remain under your control.
To obtain a copy of your information, correct it, ask about deletion or make a privacy complaint, contact admin@thephysiohouse.com.au. We will verify your identity before disclosing or changing records. We aim to acknowledge your request within five business days and respond within 30 calendar days. If more time is needed, we will explain why and provide an update. We do not charge for making a request; if an access request would involve a permissible cost, we will explain it before proceeding. If we cannot grant a request, we will explain the reason and available complaint options.
If you are dissatisfied with our response, you can contact the Office of the Australian Information Commissioner. Requesting deletion does not override requirements to retain clinical records, but we will explain what can be removed and what must remain.
We will provide an updated notice if our information handling materially changes and explain changes relevant to your participation. You can request the current version from Jordon at any time.