MASSAGE BY NIKKI — PRIVACY POLICY

About this policy
Massage by Nikki is operated by Nikki Jongedyk, a sole-trader health service based in the Cocos (Keeling) Islands. We respect your privacy and handle personal information, including sensitive health information, in accordance with the Privacy Act 1988, the Australian Privacy Principles and other applicable obligations. This policy describes how we collect, use, store and disclose information for remedial massage, lymphoedema-related services and, if our registration is approved, Support at Home services and care management.

Information we collect
We collect information reasonably necessary for safe treatment and service administration. This may include your name, date of birth, contact details, address, emergency contacts, relevant billing or health insurer information, health and medication history, symptoms, functional needs, assessment findings, treatment plans, clinical notes, progress, referrals and correspondence. If we provide Support at Home services, we may also collect relevant aged care assessment information, goals, support needs, nominated supporters, care plans and service coordination records.

How we collect information
We generally collect information directly from you during consultations, through Cliniko booking and intake forms, or by telephone or email. Where you authorise it, or the law otherwise permits, we may receive relevant information from a family member or authorised supporter, a referring clinician, or another health or care service. We will explain when information is needed to deliver safe services; without some information, we may be unable to provide particular care.

Why we use information
We use information to identify you, book appointments, assess your needs, obtain informed consent, provide and review treatment, manage clinical risks, coordinate agreed care, make and follow up referrals, communicate with you, process accounts, meet legal and professional obligations, and respond to concerns or complaints. We may use de-identified information to review service quality. We do not use health information for direct marketing without the consent required by law; you can opt out of marketing communications.

Online bookings and record keeping
Our Squarespace website provides information about our services and directs clients to Cliniko to book appointments. Client booking information, intake forms and clinical records are managed in Cliniko, our primary electronic practice management and clinical record system. We do not use Physitrack. We maintain records of assessments, consent, treatment, relevant communications, referrals and follow-up as appropriate.

Security
Cliniko access is protected by individual login credentials and two-factor authentication. The laptop and iPad used to access records are password-protected. We take reasonable steps to protect information from misuse, loss and unauthorised access, modification or disclosure, and to respond to suspected data breaches. No electronic service is completely risk-free.

Sharing information
With your consent, or another lawful basis, we may share relevant information with IOTHS clinics, your GP, other treating health professionals, or your authorised representative when needed for your care. If Support at Home services commence, we may also share information with relevant aged care assessment, service, funding or regulatory bodies where required or authorised. We share only information reasonably needed for the purpose. We may disclose information to authorities when required or authorised by law, including in certain serious safety situations. We do not sell your health information.

Service providers and overseas handling
Cliniko is operated by Red Guava Pty Ltd. Cliniko states that its servers are located in Australia, but it uses third-party subprocessors that may have access to certain information to deliver its services. Cliniko's published subprocessor list includes providers located in the United States and the United Kingdom. Relevant personal information may therefore be handled by service providers overseas, subject to applicable safeguards. Our website is hosted through Squarespace; website usage information may be processed under Squarespace's own privacy and cookie arrangements. We will review our website's actual analytics and cookie settings and update this notice if needed.

Your consent and choices
We seek informed consent for treatment and appropriate sharing of information. You can ask questions, decline non-essential disclosures or withdraw consent where applicable. Some information may still be used or disclosed where required or authorised by law. We will explain any impact on safe treatment or service coordination.

Access and correction
You may ask to access the personal information we hold about you or request correction of information that is inaccurate, incomplete or out of date, subject to applicable law. We may ask you to verify your identity. If we decline a request, we will explain why and describe available complaint options as required.

Retention and disposal
We retain health and administrative records for the periods required by applicable laws and professional or aged care obligations. When records are no longer required and disposal is lawful, we take reasonable steps to securely destroy or de-identify them. We do not promise deletion of records that must legally be retained.

Privacy complaints
If you have questions or concerns about how your information is handled, please email nikkijongedyk@gmail.com with details of your concern. We will review the issue and respond within a reasonable timeframe. If you are dissatisfied, you may complain to the Office of the Australian Information Commissioner at www.oaic.gov.au. Other aged care complaints pathways may apply if Support at Home services commence.

Contact and updates
Main contact: Nikki Jongedyk nikkijongedyk@gmail.com
We review this policy when our services, systems or legal obligations change.

Policy version: 16 October 2026.