Privacy Policy

Your privacy matters, especially because this work involves sensitive health information. This policy explains, in plain language, what I collect and why. It's written to meet the Privacy Act 1988 (Cth), the Australian Privacy Principles, and state health records laws that apply to health service providers.

Who we are

DNA Kinesiology is a complementary health practice run by Phil Duval, Registered Kinesiologist (ABN 61 925 696 087). In this policy, "I", "we" and "us" mean DNA Kinesiology.

Contact for privacy questions: phil@dnakinesiology.com or +61 408 612 490.

What we collect

Contact details

Your name, email address, phone number and, for in-person or home visits, your address.

Health information

Because I provide a health service, I collect health information so I can work safely with you. This can include:

• your medical history, current conditions, medications and anything relevant to contraindications
• what you'd like support with, and notes from your sessions
• for bodywork, your pre-brief consultation notes, boundaries, preferences and signed consent documentation

You choose how much to share. Some information, such as medical history, is required before bodywork for your safety.

Booking and payment records

Appointment history, invoices and payment records. Card payments are handled by the payment provider; I don't store your card number.

Website information

What you type into the contact or newsletter forms, and basic, anonymous usage statistics about the website.

How we collect it

Mostly directly from you: through the website forms, online booking, discovery calls, pre-brief consultations, intake forms and sessions. I only collect information about you from someone else (for example, a referring practitioner) with your consent.

Why we use it

• To reply to your enquiries and manage bookings
• To assess whether this work is suitable and safe for you, and to provide sessions
• To keep accurate, confidential clinical records
• To issue invoices and meet tax and record-keeping obligations
• To send the occasional newsletter, only if you've subscribed. You can unsubscribe at any time

I don't sell, rent or trade your information, and I don't use your health information for marketing.

Testimonials are only published with the client's permission, using a first name or initial they've agreed to.

Who we share it with

Your information is shared only where needed to run the practice, with services that keep it confidential:

• the online booking and practice-management system (Halaxy), which holds appointments and clinical notes
• the email provider (Proton Mail) and website host (Cloudflare)
• payment providers, to process payments
• an accountant, for invoices and tax records only

Otherwise, I only disclose your information with your consent, or where the law requires or allows it. This includes:

• mandatory reporting obligations, where abuse or harm to a child is disclosed
• where I believe it's necessary to lessen or prevent a serious threat to someone's life, health or safety
• where required by a court order or other law

Overseas storage

Some services store data outside Australia. Proton Mail stores email in Switzerland and the European Union, and Cloudflare operates a global network. These providers apply strong privacy and security protections. By using the website and contacting me by email, you consent to this. Appointments and clinical notes are kept in Halaxy, a practice-management system built for health practitioners; its own privacy policy explains how and where it stores data.

Storage and security

Records are kept electronically in secure, password-protected, encrypted systems, and any paper records are stored securely. Only I have access to your clinical records.

Health records are kept for at least 7 years after your last session (or, for someone who was under 18, until they turn 25), as required for health service providers. After that they're securely destroyed.

Access and correction

You can ask to see the information I hold about you, or ask me to correct it, at any time. Email me and I'll respond within 30 days. In rare cases the law allows access to be refused; if so, I'll explain why in writing.

Online sessions

Online sessions are held over a secure video platform. Sessions are never recorded without your explicit agreement. Please join from a private space where you're comfortable.

This website

• The contact form sends your message to me by email. It's only used to reply to you.
• Newsletter emails are only sent if you subscribe, and every email has an unsubscribe link.
• The site uses privacy-friendly analytics that don't use advertising cookies or identify you personally.
• Links to other sites (such as Instagram or the booking system) are covered by those sites' own privacy policies.

Questions and complaints

If you have a question or concern about your privacy, please contact me first at phil@dnakinesiology.com. I'll respond within 30 days.

If you're not satisfied, you can contact the Office of the Australian Information Commissioner (oaic.gov.au, 1300 363 992), or the health complaints body in your state.

I may update this policy from time to time. The current version is always on this page.