Bupa Therapy
Information Handling Policy

1. Introduction

1.1 About Bupa Therapy

In this document, ‘we’, ‘us’, ‘our’ and ‘Bupa Therapy’ refers to Bupa Disability Services Pty Ltd (ABN 76 615 942 311).

Bupa Therapy provides integrated allied health therapy services to people with disability and those requiring long-term rehabilitation. Allied health therapy services currently offered by Bupa Therapy include physiotherapy, occupational therapy and speech pathology.  

If you have received products or services from other companies within the Bupa Group (such as health insurance), you should refer to the privacy policies of that company, available on their website.

1.2 Protecting your privacy

Your privacy and maintaining the confidentiality of your personal information is important to Bupa Therapy. This document sets out how we handle your personal information, including the collection, storage, use and disclosure of your personal information, and how you can access and change your information, provide us with feedback or make a complaint.

When you become a Bupa Therapy customer (for example, by receiving allied health therapy services from us) you agree to the handling of your personal information as set out in this document.

In addition to this policy, Bupa Therapy complies with various privacy legislation, including:

  • the Privacy Act 1988 (Cth) (“Privacy Act”) (including the Australian Privacy Principles under that Act)
  • health records legislation, including the Health Records Act 2001 (Vic); and
  • marketing legislation, including the Spam Act 2003 (Cth) and the Do Not Call Register Act 2006 (Cth).

1.3 Definitions

In this policy, the following terms have the following meanings:

Bupa Group

means related bodies corporate of Bupa Therapy.


means your permission. Your consent can be express or implied. Express consent can be written (e.g. when you sign a form or agree to something by completing a transaction online) or verbal (e.g. when you give us your permission over the phone or in face-to-face conversations). Your consent will be implied when we can reasonably form a conclusion that you have given consent by either taking action or deciding not to take action. For example, if you have received direct marketing from us in the past, we have your implied consent to send you further direct marketing, until you tell us otherwise.


means a person who is currently receiving, or has previously received services from us.

Personal information

has the same meaning that it has under the Privacy Act, namely information or an opinion, whether true or not, and whether recorded in a material form or not, about an identified or reasonably identifiable individual.

Sensitive information

is a sub-set of personal information and includes health information and otherwise has the same meaning that it has under the Privacy Act.

2. Collection of your personal information

2.1 What kinds of personal information does Bupa Therapy collect?

The amount and type of personal information we collect from you and hold about you will vary depending on whether you are an existing customer, have made enquiries about our services and also the extent to which we have provided you services.

If you apply to be, are currently or have in the past been our customer, the personal information that we hold about you may include:

  • your NDIS Plan;
  • NDIS Participant Number;
  • NDIS Service Booking Number;
  • your Medicare number;
  • your health and medical history;
  • your name, address, telephone and email contact details;
  • your gender, date of birth and marital status;
  • your billing details; and
  • records of our interactions with you such as system notes and voice recordings of telephone conversations you have had with our employees.

In general, we do not hold information about persons who are not customers. However, if you have previously contacted us to make an enquiry about our services we may hold the information you gave us at that time.

In addition, where someone provides us with information about another person, or is acting on their behalf, we may hold that person’s information.

2.2 Does Bupa Therapy collect sensitive information?

Yes. In particular, we will collect health information that we require in order to provide our services to you.

2.3 How does Bupa Therapy collect personal information?

We may collect personal information from you in a range of ways, including:

  • when you complete an expression of interest or make enquiries about our services;
  • when you enter into a service agreement with us; and
  • when you contact us in person, by phone, via mail, email or online (or when we contact you through any means).

In some instances, we may collect your personal information from other persons or entities such as:

  • referring organisations;
  • your carer;
  • your legal guardian;
  • persons to whom you have granted a power of attorney; or
  • the National Disability Insurance Agency (NDIA).

If you have provided us with information about another person, then you need to tell that other person that you have done so, that they have a right to access their information and that they can refer to this document for information on how Bupa Therapy will handle their personal information.

2.4 If you do not provide us with your personal information

If you do not provide us with the personal information we reasonably request, we may be unable to provide you with the services that you are requesting.

3. Use and disclosure of your personal information

3.1 How does Bupa Therapy use your personal information?

We use your personal information to provide, manage and administer our services to you and to operate an efficient and sustainable business. As part of these processes, we may disclose your personal information on a confidential basis to our related entities within the Bupa Group of companies. In operating our business, we may use your information to:

  • process your request for services;
  • process payments;
  • contact you in relation to your enquiry for services;
  • contact you in relation to any matter relating to you or the services provided to you;
  • answer your enquiries and deliver customer service to you;
  • conduct quality assurance activities;
  • carry out internal functions, including administration, training, accounting, audit and information technology;
  • monitor, price and evaluate services;
  • resolve complaints;
  • conduct customer surveys;
  • conduct market research and analysis;
  • comply with laws and regulations; and
  • fulfill marketing promotions.

3.2 Direct marketing and membership communications

From time to time, we may contact you to provide you with information about other products and services offered by us, our related entities and our business partners that may be of benefit to you and your family.

When we contact you it may be via mail, phone, email or SMS.

We may also share your personal information on a confidential basis with our related entities and bodies corporate so that they can offer you products and services and fulfil offers to you.

When you become our customer, you consent to us using your personal information for direct marketing purposes (for an indefinite period), unless you have contacted us to withdraw your consent.

If you do not wish to receive marketing material from us, you can contact us at  any time to let us know. Our contact details are at the end of this policy.

If you request not to receive marketing material, please note that we will still contact you in relation to our on-going relationship with you. For example, we will still send you any bills, statements and notices that are relevant to the services you receive from us.

3.3 Who does Bupa Therapy disclose your personal information to?

The Bupa Group operates around the world. In the course of conducting our business and providing our services to you, we may disclose your information to our related entities and bodies corporate, and your information may be handled by us in any country where we operate.

In addition, in order to allow us to provide, manage and administer our products and services to you and to operate an efficient and sustainable business, we may be required to disclose your information to third parties. This may include disclosure in the following circumstances:

  • any persons or entities engaged by us or acting on our behalf in relation to our business, such as service providers/suppliers. Suppliers are required to handle your personal information in accordance with the privacy requirements;
  • government and regulatory bodies, including, the National Disability Insurance Agency (NDIA), Medicare, the Australian Taxation Office and the Department of Health, Department of Human Services;
  • any persons acting on your behalf including those persons nominated by you, executors, trustees and legal representatives;
  • lawyers, auditors and other advisors appointed by us or acting on our behalf;
  • where we need to disclose information to enforce our legal rights; and
  • where disclosure is required by law, including compulsory notices from courts of law, tribunals or government agencies.

If we send your information outside of Australia, we will require that the recipient of the information complies with privacy laws and contractual obligations to maintain the security of the data.

3.4 How does Bupa store personal information and for how long?

We will take all reasonable steps to ensure that your personal information is stored securely and is protected. This includes a range of systems and communication security measures, as well as the secure storage of hard copy documents. In addition, access to your personal information will be restricted to those properly authorised to have access. We keep your personal information for as long as we need it to provide you with the products and services you requested from us and to comply with legal requirements.

If we no longer require your personal information for any purpose, including legal purposes, we will take reasonable steps to securely destroy or de-identify your personal information except in limited permitted circumstances.

4. Accessing and Correcting your Personal Information

4.1 Can I access my personal information?

You can ask us for access to the information that we hold about you at any time. Simply contact us (our contact details are listed below) to make your request. We will always endeavour to meet your request for access within a reasonable time and in the manner requested by you, if it is reasonable to do so. However, in some circumstances, we may be unable to give you access to certain information, such as where:

  • we no longer hold or use the information;
  • providing access would have an unreasonable impact on the privacy of others;
  • the request is frivolous or vexatious;
  • the information relates to existing or anticipated legal proceedings and would not normally be disclosed as part of those proceedings;
  • providing access would be unlawful;
  • denying access is required by law;
  • providing access would be likely to prejudice the prevention, detection, investigation and prosecution of possible unlawful activity;
  • the information would reveal our commercially sensitive decision-making process; and
  • where access would pose a threat to the life or health of any individual.

If we are unable to give you access to the information you have requested, we will give you written reasons for this decision when we respond to your request. If you have any concerns about the refusal, please see section 6 for further information. We may charge you a reasonable fee for access to some types of information. This charge will be limited to the cost of recouping our costs for providing you with the information. For example, document retrieval, photocopy, labour and  delivery  to  you.  We  will  not charge you to make a request to access your information.

4.2 Correcting your personal information

To enable us to provide you with the best possible service, it is important that  the information we  hold about you is accurate. We will take reasonable steps to ensure your personal information is accurate, complete and up-to-date at the time of collecting, using or disclosing it. However, you should to notify us when your details change.

If you believe any information we hold about you is inaccurate, incomplete or  out-of-date,  you should contact us. We will respond to your request within a reasonable period and take reasonable steps  to amend your records.

5. Your privacy online

5.1 Online data collection and use

When you access any Bupa Therapy website, we collect certain anonymous technical information about user activities on the website. This may include information such as the type of browser used to access the website and the pages visited.

This information is used by Bupa Therapy to make decisions about maintaining and improving our websites and online services.

For more information, please refer to the website terms and conditions on bupa.com.au/terms-and-conditions.

5.2 Cookies and analytics

We use cookies and industry standard analytics to collect data to help us determine which pages are most popular, peak usage times and other information that helps us make our websites easier and more efficient for you to use. When you visit our websites we may set a cookie on your machine so that when you next visit our websites it links to your personal information that is stored on our system.

A “cookie” is a small text file placed on your computer by a web server when you access  a  website. Cookies are frequently used on websites. Cookies in themselves do not identify the individual user, just the computer used.

You can choose if and how a cookie will be accepted by configuring your preferences and options in your browser. For example, you can set your browser to notify you when you receive a cookie or to  reject cookies. However, if you decide not to display cookies, then you may not be able to gain access to all the content and facilities of this website.

6. Contacting Bupa Therapy

6.1 Your feedback

If you have any questions, feedback or concerns about this policy or how your information is handled by Bupa Therapy, you can contact us at any time by calling us on 1800 097 623.

You can also contact us by post, email (therapy@bupa.com.au) or by visiting the Bupa Therapy Hub. For all of our contact details, please visit https://www.bupa.com.au/therapy/eoi.

Bupa will manage any concerns internally, directly with you. If, after contacting us, you still have concerns or don’t understand a decision we’ve made, you can lodge a formal complaint with us at therapymanager@bupa.com.au and you will receive an initial response from us within 48 hours.

If you are not happy with Bupa Therapy’s response, or if you do not feel your complaint has been resolved, you are able to seek advice from the Office of the Australian Information Commissioner by calling 1300 363 992.