Privacy Policy

The Coastal Cocoon Chiropractic (“we”, “us”, “our”) is operated by Rebecca Sandell (ABN 15 100 338 890), a registered chiropractor practising in New South Wales, Australia. We respect your privacy and are committed to protecting your personal and health information. This policy explains how we collect, use, store and share your information, and your rights, under the Privacy Act 1988 (Cth) including the Australian Privacy Principles (APPs), and the Health Records and Information Privacy Act 2002 (NSW) including the Health Privacy Principles (HPPs).

1. Who to contact

Rebecca Sandell, The Coastal Cocoon Chiropractic

Email: [email protected]

Location: San Remo NSW 2262, Australia

If you have any questions about this policy or how we handle your information, please contact us.

2. What information we collect

We collect the information we need to provide safe, appropriate chiropractic care and to run our practice. This may include:

• Identity and contact details: your name, date of birth, address, phone number, email address and emergency contact.

• Health information: your health history, presenting concerns, symptoms, pregnancy and birth information (where relevant), medications, results of examinations and tests, imaging or reports from other practitioners, your care plan, treatment notes and progress.

• Information about children: for patients under 18, we collect this information from a parent or guardian, including developmental and birth history where relevant.

• Consent records: records of the information we have given you and your consent to care.

• Billing and payment details: invoices, payment history and details of any health fund or third-party payer. Card details are processed by our payment provider and are not stored by us.

• Communications: your enquiries, messages, appointment reminders and feedback.

• Website information: basic technical information about your visit, such as your IP address, browser, device and pages viewed, collected through cookies and similar technologies.

Health information is sensitive information. We only collect it with your consent (or your parent or guardian’s consent), or where the law permits or requires it.

3. How we collect it

We collect information directly from you (or your parent or guardian) through our online intake forms, in consultations, by phone, email or text message, and through our website. Sometimes we collect information from other health practitioners or organisations, such as referrals or reports, but only with your consent or where the law allows.

4. Why we collect and how we use it

We use your information to:

• assess your needs, provide chiropractic care and keep accurate clinical records, as required by the Chiropractic Board of Australia and the law;

• book appointments, send reminders and forms, and communicate with you about your care;

• process payments and manage billing;

• communicate with other health practitioners involved in your care, when you ask us to or agree;

• manage risk, quality and safety, and handle any complaints or claims;

• send you newsletters or updates, only if you have chosen to receive them (you can unsubscribe at any time); and

• meet our legal and professional obligations.

We will only use or disclose your information for these purposes, or a directly related purpose you would reasonably expect, unless you consent or we are required or authorised by law.

5. Who we share information with

We do not sell your personal or health information. We may share it with:

• other health practitioners involved in your care (such as your GP or other specialists), with your consent;

• our service providers who help us run the clinic, such as our practice management software (Zanda Health), our website, booking and communications platform (Ivorey), our payment provider (Stripe), our email provider and our IT and accounting support, under appropriate confidentiality arrangements;

• health funds, insurers or other payers, if you ask us to or where relevant to your claim;

• our professional indemnity insurer and advisers, where needed for insurance, legal or risk management purposes; and

• regulators, courts or other authorities, when required or authorised by law (for example, mandatory reporting obligations or a lawful request from a regulator).

6. Overseas disclosure

Some of our service providers may store or process information on servers outside Australia, including in the United States or other countries. Before disclosing information overseas, we take reasonable steps to ensure the provider handles it in line with the APPs, including by using reputable providers with published security and privacy commitments. Where consent is required for an overseas disclosure, we will seek it.

7. Storing and securing your information

Your records are stored electronically in secure, password-protected systems with access limited to those who need it. We take reasonable steps to protect your information from misuse, interference, loss and unauthorised access, modification or disclosure. No system is completely secure, but we work to keep your information safe.

We keep clinical records for as long as the law and professional standards require. In New South Wales, this is generally at least 7 years from your last visit or, for a child, until they turn 25 (whichever is longer). After that time, records are securely destroyed or de-identified.

8. Data breaches

If a data breach is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.

9. Accessing and correcting your records

You have the right to ask to see the information we hold about you and to ask us to correct anything that is inaccurate, out of date or incomplete. For children, a parent or guardian can make the request on their behalf, subject to the child’s rights and the law. To make a request, email [email protected]. We may need to verify your identity, and we will respond within a reasonable time (generally within 30 days). In limited cases where the law allows, we may refuse or restrict access and, if so, we will explain why.

10. Email, text messages and marketing

We may email or text you appointment reminders, forms and information about your care. We only send marketing or newsletters if you have consented. Every marketing message includes an unsubscribe option, in line with the Spam Act 2003 (Cth). Please note that email and text messages are not always secure, and you can tell us if you prefer another way of communicating.

11. Cookies and analytics

Our website uses cookies and similar technologies to make the site work, understand how it is used and improve it. You can control cookies in your browser settings, but some features may not work properly if you disable them.

12. Making a complaint

If you have a concern about how we have handled your information, please contact us at [email protected]. We will acknowledge your complaint promptly, investigate it and let you know the outcome. If you are not satisfied, you may contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or 1300 363 992, the NSW Information and Privacy Commission at www.ipc.nsw.gov.au or 1800 472 679, or the Health Care Complaints Commission (NSW) at www.hccc.nsw.gov.au or 1800 043 159.

13. Changes to this policy

We may update this policy from time to time. The current version is always available on our website, with the “last updated” date at the top.

© 2026 Rebecca Sandell. All rights reserved.