Privacy Policy

Last updated: 16 October 2026

Keep Me Walking Podiatry (“KMW Podiatry”, “we”, “us”, “our”) is operated by AALWTRADING PTY LTD (ABN 80 660 351 879). Our principal business contact address is Shop 1, 129-141 Findon Rd, Findon SA 5023, and privacy enquiries can be directed to [email protected]. This Privacy Policy applies to podiatry services provided by KMW Podiatry across its clinics and home-visit settings.

We provide podiatry care from clinics across metropolitan Adelaide and Gawler, and through home visits, nursing homes and aged care facilities. Because we provide health services, much of the information we hold about you is health information, which the law treats as sensitive. We take that responsibility seriously.

This policy explains what personal information we collect, why we collect it, how we use and protect it, and how you can access it or make a complaint. We manage personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

Contents

1. Information we collect
2. How we collect it
3. How we use it
4. Photographs, gait video, 3D scans and manufacture
5. Who we share it with
6. Online bookings
7. AI-supported notes, letters and consultation audio
8. Nail surgery: specific procedure consent
9. Our website, cookies and analytics
10. Australian-hosted records and overseas access
11. Storage, security and access monitoring
12. Retention and secure disposal
13. Access and correction
14. Anonymity, choice and consent
15. Appointment communications and marketing
16. Data-breach response
17. Complaints
18. Contact our Privacy Officer
19. Changes to this policy

1. Information we collect

We only collect information that is reasonably necessary to provide our services. Depending on how you deal with us, this may include:

• Identity and contact details: your name, date of birth, gender, address, phone number, email address and preferred contact method.
• Health information: your medical history, current conditions, medications, allergies, symptoms, assessment findings, treatment notes, images, footwear and orthotic details, and referrals or reports from other health practitioners. Depending on the treatment, clinical information may also include photographs of the feet or wounds, gait-assessment videos, 3D foot scans, measurements, orthotic and footwear prescriptions, procedure consent forms, and recorded or transcribed consultation audio where we have obtained appropriate consent.
• Funding and payment details: Medicare details, GP Management Plan or care plan referrals, Department of Veterans’ Affairs (DVA) details, NDIS plan and plan manager details, Support at Home or Home Care Package provider details, WorkCover claim details, private health insurance details, and records of payments. Card payments are processed by our payment providers; we do not store full card numbers on our website.
• Emergency and representative details: next of kin, guardian, carer or authorised representative contact details, and aged care or nursing home facility details where we visit you there.
• Enquiry details: the information you enter in forms on our website, such as your name, phone number, email, date of birth, the clinic or area you prefer, the service you are interested in and any message you send us.
• Website usage information: technical information about how you use our website, described in section 9.

2. How we collect it

Wherever practical, we collect information directly from you, for example when you book an appointment, fill in an intake form, phone us, attend a consultation or submit a form on our website.

We may also collect information from other people when it is unreasonable or impractical to collect it from you, or when you have agreed, including:

• your GP or another health practitioner who refers you to us;
• the medical centre or practice where our clinic operates, when you are referred from within that practice;
• your carer, guardian, family member or authorised representative;
• a nursing home, aged care facility, home care provider or NDIS plan manager;
• funding bodies and insurers, such as Medicare, DVA, the NDIA or a WorkCover insurer.

If you give us information about another person, such as a family member, please make sure they know you are doing so.

3. How we use it

We use your personal information to:

• assess, diagnose and treat you, and keep accurate clinical records;
• book, confirm and remind you about appointments;
• communicate with your GP and other practitioners involved in your care;
• process Medicare, DVA, NDIS, aged care, WorkCover and private health insurance claims and payments;
• respond to your enquiries and feedback;
• manage our clinics, including quality improvement, training, accreditation, audits, insurance and legal obligations;
• maintain and improve our website and services.

We will only use or disclose your health information for another purpose if you consent, if it is directly related to your care and you would reasonably expect it, or if the law requires or permits it, for example to lessen a serious threat to someone’s life, health or safety.

4. Photographs, gait video, 3D scans and manufacture

As part of assessment, treatment and follow-up, we may collect clinical photographs, wound images, gait videos, 3D foot scans and measurements. We use this information for clinical assessment, monitoring, orthotic prescriptions and the design or manufacture of footwear or other prescribed devices. Where necessary, we may provide relevant information to contracted orthotic laboratories or manufacturers subject to appropriate privacy safeguards. Separate appropriate consent is sought before identifiable clinical images or videos are used for advertising, social media or other promotional purposes.

5. Who we share it with

We may disclose your personal information, where relevant, to:

• your GP, specialists and other health practitioners involved in your care;
• Services Australia (Medicare), DVA, the NDIA, your NDIS plan manager, your Support at Home or Home Care Package provider, WorkCover insurers and private health insurers, to process claims and funding;
• nursing homes or aged care facilities where we provide your care;
• contracted orthotic laboratories or manufacturers, where needed to make a prescribed device (see section 4);
• your authorised representative, guardian or carer;
• service providers who help us run our business, such as our practice management and booking system, virtual reception, IT, website, communications, payment and professional advisers, who are required to keep your information confidential;
• regulators, courts, government agencies or others where required or authorised by law.

Virtual reception staff and secure remote access

We may use contracted virtual reception personnel, including personnel located outside Australia, to assist with appointment administration, patient communications and related administrative tasks. Where authorised, these personnel may remotely view relevant information in our secure cloud-based clinical or administration systems. Access is role-based and limited to legitimate work purposes, and personnel are subject to contractual confidentiality, privacy and security obligations. Personnel must not download, copy or store patient information outside our approved systems. Access activities may be monitored and sessions may be recorded for security, quality assurance and compliance. We remain responsible for appropriate safeguards when using external personnel.

Patients, carers and information sharing

We share information with carers, family members, support coordinators, plan managers and aged-care service providers only where reasonably necessary and with an appropriate consent, authority or other lawful basis. Being involved in a person’s care does not automatically give another person unrestricted access to the person’s clinical record.

Children and authorised representatives

Where a patient is a child or requires assistance with decisions or communications, we consider their circumstances, decision-making capacity and any legal authority held by a parent, guardian or representative. We verify authority where appropriate before allowing a representative to access clinical information. Information is disclosed only to the extent appropriately authorised or otherwise permitted by law.

We do not sell, rent or trade your personal information.

6. Online bookings

When you book online, you are taken to our booking system, provided by Cliniko (Red Guava Pty Ltd), at keep-me-walking.au1.cliniko.com. The details you enter there, such as your name, contact details, date of birth and appointment information, are stored in our Cliniko account and become part of your patient record. Our Cliniko account uses Cliniko’s Australian data region. You can read Cliniko’s privacy policy for more information.

We also use analytics on the booking pages to count completed bookings and see which clinic and web page they came from. This tells us whether our website is helping patients book. We do not intentionally send your clinical information to analytics providers.

7. AI-supported notes, letters and consultation audio

We may use AI-assisted clinical documentation software to record or transcribe consultation audio, help organise clinical information, and prepare draft treatment notes, clinical correspondence and letters. Before recording a consultation or using an AI scribe that processes patient information, we explain its use and obtain informed consent. Patients may discuss concerns or decline AI-assisted recording; where appropriate, we will document the consultation using an alternative method.

AI is used to support documentation efficiency and accuracy. It does not independently diagnose, determine treatment, prescribe devices or make decisions affecting patient care, eligibility or funding. A qualified treating practitioner reviews, corrects and approves clinical documentation and remains responsible for all clinical decisions. Consultation audio recordings and transcripts are kept for up to one week and then deleted. Processing locations and access arrangements for them depend on the approved software and are subject to the relevant provider’s privacy and security settings.

8. Nail surgery: specific procedure consent

Before nail surgery or other relevant procedures, we use separate clinical agreement and informed-consent forms. These are intended to explain the proposed procedure and cover its benefits, risks, possible complications, relevant alternatives, anaesthesia where applicable, fees and post-procedure care or follow-up. The treating practitioner discusses the procedure, answers questions, and records the patient’s consent before treatment. These procedure-specific forms operate alongside, and do not replace, this Privacy Policy or any privacy consents required for recording or sharing personal information.

9. Our website, cookies and analytics

Like most websites, ours uses cookies and similar technologies. Cookies are small files stored by your browser. We use them to keep the site working, to protect our forms from spam, and to understand how visitors use the site so we can improve it.

We use website analytics and usability tools to understand website performance and improve the booking experience. Some tools may record or reconstruct visitor interactions, such as page views, clicks, scrolls and mouse movement. We configure these services to avoid collecting clinical content or directly identifying booking-form details wherever practicable. We do not intentionally send patient health information to website analytics providers. Our use of third-party tools, their locations and available privacy controls are reviewed periodically.

These tools are used to understand how the website performs as a whole. We do not use them to identify you or to make decisions about your care. You can block or delete cookies through your browser settings. Most of the site will still work, although some features may not.

Our website links to other websites, including our social media pages and KMW Physio. We are not responsible for the privacy practices of other websites, so please read their policies.

Human decisions, not automated clinical decisions

We may use AI-assisted software to support recordkeeping and document preparation, but we do not use automated systems to independently make clinical, treatment, funding or eligibility decisions that significantly affect patients. Decisions about your podiatry care remain with appropriately qualified healthcare practitioners.

10. Australian-hosted records and overseas access

Our principal patient-record and online-booking systems use Australian-hosted data services. Although our clinical records are intended to remain hosted in Australia, authorised virtual reception personnel located overseas may be able to access and view relevant information remotely for administrative purposes. Remote viewing is different from the physical location of stored records and may constitute an overseas disclosure under Australian privacy law. We apply contractual safeguards, access restrictions and supervision to these arrangements. Some website and other technology providers may also process information outside Australia. Where personal information is likely to be disclosed overseas, we explain this in our collection notices and identify the relevant countries where practicable.

For example, website usage information collected by the tools listed in section 9, such as Google, Hotjar and Microsoft, may be processed in the United States, the European Union and other countries where those providers operate.

11. Storage, security and access monitoring

We store personal information mainly in electronic form, in secure, access-controlled systems. Any paper records are kept securely. We take reasonable steps to protect your information from misuse, interference, loss, and unauthorised access, change or disclosure, including:

• restricting access to staff and contractors who need it for their role;
• password-protected and secured systems;
• confidentiality obligations for our staff and service providers;
• secure destruction or de-identification of information we no longer need.

We use proportionate safeguards, including access permissions, staff confidentiality obligations, account security, contractor controls and monitoring of authorised access where available. Access by reception and administrative personnel is limited to information needed to perform their duties. We review access arrangements when roles or service providers change and seek to prevent unauthorised copying, disclosure or retention of patient information.

No method of sending information over the internet is completely secure. Please avoid including detailed health information in website contact forms or email; it is safer to discuss it at your appointment or by phone.

12. Retention and secure disposal

We keep health records for as long as required by law and professional obligations. In line with Australian health record keeping requirements, we generally keep adult records for at least seven years after your last appointment, and records about a child until at least their 25th birthday.

We keep records for the periods required by applicable laws and professional obligations, and longer where a legal or other lawful reason requires it. Once we are no longer required to retain information, we take reasonable steps to securely destroy or de-identify it. We apply separate retention practices to routine website enquiries, audit logs and any consultation recordings or transcripts, according to their purposes and applicable obligations.

13. Access and correction

You can ask to see the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date, incomplete or misleading. To make a request, contact our Privacy Officer using the details in section 18.

• We will confirm your identity before giving you access.
• If a parent, guardian or representative makes a request for someone else, we verify their authority before giving access to clinical information (see section 5).
• We will respond within a reasonable time, usually within 30 days.
• We do not charge for making a request. If giving access involves significant time or copying costs, we will tell you the cost first.
• In limited situations the law allows us to refuse access, for example if giving access would pose a serious threat to someone’s life or health. If we refuse, we will explain why in writing and tell you how to complain.

14. Anonymity, choice and consent

You can ask general questions without telling us who you are. However, we cannot provide treatment, process funding or claims, or keep proper clinical records without identifying you.

You may ask questions about the information we collect, and may decline optional collection or withdraw consent where the law allows. If you do not provide information reasonably necessary for treatment, clinical records or claims processing, we may be unable to provide some services or obtain funding on your behalf. We will explain relevant consequences and alternatives where appropriate.

15. Appointment communications and marketing

We may contact you by phone, SMS or email about appointments, care coordination and other matters related to your treatment. Because ordinary email and SMS may carry privacy risks, we aim to limit the sensitive information included in these communications and use more secure channels where appropriate. Marketing messages are separate from necessary clinical and administrative communications; we send direct marketing involving health information only with appropriate consent and provide a way to opt out.

You can ask us to stop sending marketing messages at any time.

16. Data-breach response

We maintain procedures for identifying, containing, investigating and assessing suspected data breaches. Where a breach is likely to result in serious harm and notification is required under the Notifiable Data Breaches scheme, we will notify affected individuals and the Office of the Australian Information Commissioner, and provide practical information about steps people can take. We will take reasonable steps to complete any required assessment within the applicable timeframe.

17. Complaints

If you are concerned about how we have handled your personal information, please contact our Privacy Officer first. Tell us what happened and how you would like it resolved. We will acknowledge your complaint promptly and aim to respond in writing within 30 days.

If you are not satisfied with our response, you can contact:

• Office of the Australian Information Commissioner (OAIC): phone 1300 363 992, or lodge a complaint at oaic.gov.au.
• Health and Community Services Complaints Commissioner (South Australia), for complaints about health services in South Australia: hcscc.sa.gov.au.

18. Contact our Privacy Officer

For privacy questions, access or correction requests, or complaints:

19. Changes to this policy

We may update this policy from time to time to reflect changes in the law, our services or the technology we use. The current version is always available on this page, and the date at the top shows when it was last updated.