Wellstrong Privacy Policy
Effective date: March 2026
Business name: Wellstrong Group Pty Ltd
Location: Australia
Wellstrong Group Pty Ltd (“Wellstrong”, “we”, “us”, “our”) is committed to protecting the privacy and confidentiality of personal information, including health information, collected from clients, members, and users of our services. This Privacy Policy explains how we collect, use, store and disclose personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
This Privacy Policy applies to all Wellstrong services, including Exercise Physiology, Personal Training, gym access, group training, online coaching, performance testing, facility use, and related services.
1. Why we collect personal information
We collect personal information so that we can:
- provide safe, effective and appropriate exercise, health and performance services
- manage bookings, programs, memberships, payments and claims
- communicate with you about your services, membership or enquiries
- manage facility access, safety and security
- meet our legal, regulatory and professional obligations; and
- manage and improve our business operations.
By engaging with Wellstrong or using our services or facilities, you consent to the collection and use of your personal information as described in this Privacy Policy.
2. What personal information we collect
The personal information we collect may include:
Identity and contact details
- Name, date of birth, address, phone number and email address
- Emergency contact details
Health and service-related information
- Medical and injury history relevant to exercise and health services
- Screening questionnaires and readiness assessments
- Clinical notes, assessments, exercise programs and progress records
- Performance testing data
- Training history, goals and exercise limitations
Administrative and financial information
- Appointment, attendance and membership records
- Invoices, payments and transaction records
- Medicare numbers and other Commonwealth identifiers (where required for Medicare claiming)
- Private health fund details (where required for claiming)
Facility, media and technical information
- CCTV footage captured at our facility for safety and security purposes
- Photographs or videos where you have provided permission
- Website and technical information such as IP address, browser/device information and cookies (where applicable)
Providing some information is necessary for us to deliver services safely and effectively. If you choose not to provide required information, we may be unable to offer certain services.
3. How we collect personal information
We collect personal information in a number of ways, including:
- directly from you via onboarding forms, consent forms, questionnaires and consultations
- through online booking, membership and payment systems
- through email, SMS, phone or in‑person communication
- through third‑party platforms used to deliver our services
- through CCTV operating at our facility; and
- from other healthcare providers or referrers where authorised.
4. Practice management and clinical records (Cliniko)
Wellstrong uses Cliniko (provided by Red Guava Pty Ltd) as its practice management and clinical record system.
Cliniko is used to manage:
- client identity and contact details;
- appointment scheduling and attendance;
- clinical notes, assessments, exercise programs and treatment records; and
- administrative records.
Personal and health information stored in Cliniko is entered by Wellstrong staff and is controlled by Wellstrong. Cliniko acts as a service provider and processes this information on our behalf in accordance with its Terms of Service and Privacy Policy.
Cliniko uses third‑party infrastructure and service providers, including services located in Australia and overseas (including the United States). As a result, personal information may be stored or processed outside Australia.
Wellstrong remains responsible for responding to requests to access, correct or delete personal information held in Cliniko.
5. Performance testing and training platforms
We use third‑party platforms to support service delivery, including:
- VALD Performance systems (e.g. ForceDecks, VALD Hub) for strength, power, balance and movement testing
- TrainHeroic for training program delivery, online coaching, messaging and progress tracking.
These platforms collect and store performance and training data in accordance with their own privacy policies. De‑identified data may be used by these providers for analytics or product improvement in accordance with their policies.
6. Payments, private health and Medicare claims
Tyro Health
We use Tyro Health to process private health insurance claims, Medicare‑related claims and in‑person EFTPOS payments. Tyro Health may collect and process personal information necessary to complete transactions and claims, including identity details, Medicare numbers, private health fund details and transaction data. Some information may be processed or stored by overseas service providers in accordance with Tyro Health’s Privacy Policy.
Stripe
We use Stripe to process online payments. Stripe may collect transaction data such as payment amount, date, status and payment method details. We do not store full card details where payments are processed via Stripe. Stripe is a global provider and may store or process information outside Australia.
7. CCTV and facility surveillance
We use security cameras (CCTV) at our facility for purposes including:
- the safety and security of members, staff and visitors
- incident investigation
- protection of property and assets
CCTV footage is handled in accordance with applicable laws and our internal practices. Access to footage is restricted and footage is retained only for as long as reasonably necessary, unless required for investigation or legal purposes.
8. Marketing communications, photos and videos
We may send service‑related communications (such as booking confirmations, account updates or important service information). Where you have opted in, or where otherwise permitted by law, we may also send marketing communications such as news, updates or offers.
You can unsubscribe from marketing communications at any time using the unsubscribe link in the communication or by contacting us directly. Opting out of marketing communications will not affect our ability to send essential service or administrative messages.
We may take photographs or videos in our facility and use them for social media, website or promotional content only where permission has been obtained. You may withdraw consent for future use at any time. Withdrawal of consent will apply prospectively and may not always be practicable for content already published.
9. Under‑18 members and clients
We only collect personal information from individuals under 18 years of age where a parent or legal guardian has provided appropriate consent or authorisation, including consent for participation in services where required.
If you believe we have collected personal information from a minor without appropriate consent, please contact us and we will take reasonable steps to address the issue.
10. Disclosure of personal information
We may disclose personal information where reasonably necessary to:
- deliver services and coordinate care
- manage memberships, bookings and facility access
- process payments and claims
- comply with legal obligations (such as court orders or mandatory reporting)
- prevent serious threats to health or safety
- work with professional advisers or service providers
NDIS‑funded services
Where services are provided under the National Disability Insurance Scheme (NDIS), we may collect, use and disclose personal information to support coordinators, plan managers, the National Disability Insurance Agency (NDIA), or the NDIS Quality and Safeguards Commission where reasonably necessary to:
- deliver and manage NDIS‑funded supports
- administer plans, bookings and payments
- meet reporting, incident management or compliance obligations
- respond to audits, reviews or complaints
Information will be handled in accordance with applicable privacy laws, the NDIS Code of Conduct and NDIS Practice Standards. Where required, consent may be provided by a participant’s nominee, guardian or authorised representative.
Department of Veterans’ Affairs (DVA) services
Where services are provided to eligible veterans under Department of Veterans’ Affairs (DVA) arrangements, we may collect, use and disclose personal information to the Department of Veterans’ Affairs where reasonably necessary for:
- treatment authorisation
- claims processing and payment
- audits, reviews or investigations
- compliance with DVA requirements and applicable legislation
We do not sell personal information.
11. Overseas disclosure
Some third‑party service providers we use may store or process personal information outside Australia. Where this occurs, we take reasonable steps to ensure that appropriate safeguards are in place and that information is handled consistently with applicable privacy obligations.
12. Storage, security, retention and deletion
We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. These steps may include restricted access to records, password‑protected systems and use of reputable service providers.
We retain personal information only for as long as reasonably necessary to provide our services and to meet legal, regulatory, insurance and accounting requirements. When information is no longer required, we take reasonable steps to securely delete, destroy or de‑identify it.
In the event of a data breach that is likely to result in serious harm, we will take reasonable steps to contain the breach and notify affected individuals and relevant regulators in accordance with the Privacy Act 1988 (Cth).
13. Access and correction
You may request access to, or correction of, personal information we hold about you. Requests will be handled within a reasonable timeframe and may be subject to limited exceptions permitted by law.
14. Complaints
If you have a privacy concern or complaint, please contact Wellstrong in writing. We will investigate and respond within a reasonable timeframe.
If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.
15. Updates to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology or legal requirements. The current version will be published with an updated effective date.