Privacy Policy & Content Guidelines

1. Introduction

Fortify Movement & Health ("we", "us", or "our") is committed to protecting your privacy and handling your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This Privacy Policy explains how we collect, use, disclose, and manage your personal information. By using our services or website, you agree to the terms of this policy.

2. Information We Collect

We may collect the following types of personal information:

• Contact information: name, phone number, email address, and postal address
• Health information: medical history, current health conditions, medications, referral details, and exercise history
• NDIS & funding information: NDIS plan details, plan management provider details, and funding allocations
• DVA information: DVA file numbers and treatment entitlements
• Assessment and clinical data: results from fitness testing, body composition scans, strength assessments, and clinical notes
• Payment information: billing details and Medicare or private health fund information
• Communication records: emails, enquiry form submissions, and appointment records

We collect this information directly from you (or your nominee or guardian), from referring health professionals, or from relevant funding bodies.

3. How We Use Your Information

We use your personal information to:

• Deliver and manage your exercise physiology or clinical exercise services
• Develop and monitor personalised exercise programs
• Communicate with you about appointments, progress, and care
• Process payments and manage NDIS or DVA service agreements
• Coordinate care with your GP, specialist, or other treating health professionals
• Meet our legal and professional obligations under ESSA registration standards
• Improve our services and website

We will only use your information for purposes that are directly related to why it was collected, or where you have provided consent.

4. Information Sharing and Disclosure

We may share your personal information with:

• Other treating health professionals involved in your care (with your consent)
• NDIS plan managers or support coordinators, where required for service delivery or invoicing to self-managed and plan-managed NDIS participants
• DVA or Medicare, where applicable
• Third-party software providers who help us manage bookings, clinical records, or communications (under confidentiality agreements)
• Legal or regulatory bodies where required by law

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

5. Data Security

We take reasonable steps to protect your personal information from misuse, interference, loss, unauthorised access, modification, or disclosure. Our security measures include:

• Secure, password-protected clinical record systems
• Restricted staff access to sensitive health information
• Encrypted communications where applicable
• Regular review of our data handling procedures

While we take all reasonable precautions, no system is entirely secure. If you believe your information has been compromised, please contact us immediately.

6. Your Rights

Under the Australian Privacy Principles, you have the right to:

• Access the personal information we hold about you
• Correct any inaccurate or out-of-date information
• Request deletion of your information (subject to our legal and professional obligations to retain clinical records)
• Withdraw consent for certain uses of your information
• Complain about how we have handled your personal information

To exercise any of these rights, please contact us using the details in Section 10 below.

7. Retention of Information

We retain your personal and health information for as long as required by law and professional standards. Under Victorian law, health records for adults are generally retained for a minimum of 7 years from the date of last service, and for children until the age of 25.

When records are no longer required, they are disposed of securely in accordance with applicable legal requirements.

8. Website and Online Services

Our website may collect certain non-identifiable data automatically, including:

• Browser type and version
• Pages visited and time spent on our site
• Referring website or source
• Device type and operating system

This data is collected via cookies or analytics tools (such as Google Analytics) to help us understand how our website is used and to improve user experience. You may adjust your browser settings to disable cookies, though some features of our website may not function correctly as a result.

When you submit an enquiry or booking request via our website, the information you provide will be collected and used in accordance with this policy.

9. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes to our practices or legal obligations. The current version will always be available on our website. We encourage you to review this policy periodically.

10. Contact Us

If you have any questions, concerns, or complaints about this Privacy Policy or how we handle your personal information, please contact us:

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

Last updated: January 2025

Content Publishing Guidelines

The following rules govern how Fortify Movement & Health publishes digital content across its website. All team members, content contributors, and administrators must follow these guidelines to maintain consistent site structure, search engine clarity, and a good experience for visitors.

Rule 1 — Blog & General Education Articles (/blog/<slug>)

Every new article that falls into one of the following categories must be published at /blog/<slug>:

• General education — explainer posts, exercise tips, and introductory health topics written for a general audience
• Wellness — lifestyle, movement habits, mental health intersections, and general wellbeing content
• Nutrition — dietary guidance, nutrition explainers, and food-as-medicine articles not tied to a specific clinical diagnosis
• News & updates — clinic announcements, event recaps, and team introductions

Blog posts are conversational in tone, accessible to a general reader (Grade 8–10 reading level), and optimised for informational search intent. They do not require a Download PDF button.

Rule 2 — Clinical Condition Resources (/resources/<slug>)

Every new resource that is specific to a clinical condition, diagnosis, or funding pathway must be published at /resources/<slug>. Examples include:

• Condition-specific factsheets (e.g. chronic pain, multiple sclerosis, type 2 diabetes, osteoporosis)
• Funding pathway guides (NDIS, Medicare CDM, DVA, WorkSafe, TAC)
• Clinical assessment explainers (e.g. Tanita body composition, functional movement screening)
• Rehabilitation protocol summaries intended for referrers or clients with a specific diagnosis

Every clinical resource page must include a "Download PDF" button — linked to a downloadable version of the factsheet or resource document. This requirement is mandatory; a resource page may not be published without it.

Rule 3 — Prohibited Route Patterns

The following combinations are never permitted:

• Blog posts must not appear under /resources. A general-education or wellness article placed at /resources/<slug> incorrectly signals clinical authority to search engines and confuses visitors expecting a downloadable factsheet.
• Clinical condition factsheets must not appear under /blog. Publishing a clinical resource at /blog/<slug> strips the mandatory Download PDF requirement, dilutes the clinical credibility of the resources section, and misrepresents the depth of the content.

Quick Reference

Checklist Before Publishing

1. Identify the content type using the quick-reference table above.
2. Confirm the slug follows the correct route prefix (/blog/ or /resources/).
3. If publishing under /resources/, verify a Download PDF button is present and links to a valid document before going live.
4. If in doubt about content type, default to /blog/ and escalate to the clinical lead for review before assigning a /resources/ route.

Content guidelines last updated: June 2025