Privacy Policy

Last updated 25 August 2026

I'm Lauren Schoenauer, and I run Tewantin Remedial Massage as a sole practitioner in Tewantin, Queensland. This policy explains what information I collect about you, why I collect it, where it's kept and what rights you have over it.

Because I provide a health service, I'm bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles. This applies to me regardless of the size of my practice — the small business exemption does not apply to health service providers.

What I collect

Depending on how you interact with me, I may collect:

• Contact details — your name, phone number and email address.
• Health information — your symptoms, medical history, medications, injuries, pregnancy status where relevant, and my notes on your assessment and treatment. This is classed as sensitive information and is given a higher level of protection under the Privacy Act.
• Appointment and payment records — dates of treatment, services provided, amounts paid and receipt details.
• How you found me — if you tell me, so I know which parts of my practice are working.

How I collect it

Directly from you, in almost every case: through the online booking page, by phone or text, by email, on the intake form you complete before your first treatment, and in conversation during your appointments. This website itself has no forms — nothing is collected from you simply by reading it.

I'll only collect health information from someone other than you — such as your GP or physiotherapist — if you've given me permission, or where the law allows it.

Why I collect it

• To arrange your appointment and respond to your questions.
• To assess you safely, plan your treatment and track your progress between visits.
• To issue receipts you can claim with your health fund.
• To send appointment reminders.

Where it's stored

Client records, appointments and invoices are kept in my practice management system, Halaxy, which also runs my online booking page. If you book online, the details you enter — your name, contact details and the appointment you choose — are collected by Halaxy on my behalf and stored in my client record there. Messages you send me by text or email are held in my phone and email accounts. All of these are password-protected and access is limited to me.

Some of these services store data on servers outside Australia. I choose providers who commit to protecting your information to a standard comparable with Australian privacy law.

Who I share it with

I don't sell your information, and I don't share it for marketing. I may disclose it:

• To another practitioner — such as your GP, physiotherapist or the person who referred you — only with your consent.
• To your health fund, in the form of an itemised receipt, if you're claiming a rebate.
• Where the law requires it, or where there's a serious and imminent threat to someone's life, health or safety.

How long I keep it

I keep clinical records for a minimum of seven years from your last appointment, in line with standard practice for health service providers. Where a client was under 18 at the time of treatment, records are kept until they turn 25. Enquiries that don't become appointments are deleted once they're no longer needed.

Your rights

You can ask me to:

• See the information I hold about you, and be given a copy.
• Correct anything that's wrong, out of date or incomplete.
• Delete information I no longer need to keep.

Just ask — by phone, text or email. I'll usually respond within 30 days. There's no charge for making a request, though I may charge a reasonable fee for the cost of copying a large file. In rare cases I may need to refuse access, and if so I'll explain why in writing.

Keeping it secure

Records are held in password-protected systems, paper notes are stored securely, and I take reasonable steps to protect your information from loss, misuse and unauthorised access. If a data breach occurred that was likely to cause you serious harm, I would notify you and the Office of the Australian Information Commissioner, as the law requires.

Website analytics and cookies

This website uses Google Analytics 4 (GA4) to help me understand how people find and use the site. GA4 may set cookies and collect information such as pages viewed, approximate location, device and browser details, referral source, and interactions such as clicks on the booking link, my phone number or my email address. These are counts of anonymous activity on the website — no name, phone number or health information is ever sent to Google. Anything you enter on the booking page itself is handled by Halaxy, not by Google Analytics.

Google may process analytics data on servers outside Australia, including in the United States. You can limit or block cookies in your browser settings, or use the Google Analytics opt-out browser add-on.

I may update this policy from time to time. The current version will always be on this page, with the date it was last changed shown at the top.