Privacy Policy

Last updated: 14 October 2026

1. About this policy

Prime Movement Lab (Prime Movement Lab Pty Ltd, ABN 39 941 445 472) provides Accredited Exercise Physiology, physical preparation and coaching from ZeroW in Currumbin and through mobile services across the southern Gold Coast. In this policy, “we”, “us” and “Prime” mean Prime Movement Lab.

We respect your privacy. This policy explains what personal information we collect, how we use it, who we share it with, how we protect it, and how you can access or correct it. We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

Much of the information we hold is health information, which the law treats as sensitive. We only collect it with your consent, or where the law allows us to.

2. What we collect

We collect only what we need to provide our services, run the business and meet our legal obligations.

Contact and identity details: name, date of birth, gender, address, phone, email and emergency contact details.

Health information: medical history, current conditions, injuries, medications and relevant test results or scans; pre-exercise screening answers; assessment findings, progress measures and session notes; your exercise programs and goals; and referral letters, reports and correspondence from your GP or other health practitioners.

Funding and payment details: Medicare number, DVA file number and card type, WorkCover Queensland claim number, NDIS participant details and private health fund details where relevant, and billing and payment records. We do not store full card numbers ourselves; our payment provider does.

Website and enquiry details: what you tell us through our enquiry form, and basic website usage data (see section 7).

About referrers: if a health professional refers a client to us, we collect the referrer’s name, practice, contact details and provider number.

3. How we collect it

Where we can, we collect information directly from you: in person, by phone or email, through our intake and consent forms, and through our website.

Sometimes we receive information from other people, such as your GP, specialist or other treating practitioner when they refer you to us; an insurer or case manager for a WorkCover Queensland claim; an NDIS plan manager or support coordinator; or a family member or carer, with your agreement.

If we receive information we did not ask for and do not need, we will destroy or de-identify it where it is lawful and reasonable to do so.

4. Why we collect, use and disclose it

We use your information to assess you and plan, deliver and review your exercise program safely; communicate with you about appointments, programs and progress; work with and report to your referring or treating practitioners; claim and bill through Medicare, DVA, WorkCover Queensland, the NDIS or your health fund; answer enquiries and referrals; manage payments and business records; meet our professional obligations, including Exercise & Sports Science Australia (ESSA) accreditation requirements; and comply with the law.

We will only use or disclose your information for another purpose if you consent, if you would reasonably expect it and it is directly related to your care, or if the law requires or allows it, for example to prevent a serious threat to someone’s life, health or safety.

We do not sell your personal information.

5. Who we share it with

With your consent, or where the law allows, we may share relevant information with your GP, referring practitioner and other members of your care team; Medicare (Services Australia), the Department of Veterans’ Affairs, WorkCover Queensland or your employer’s insurer, the NDIS or your plan manager, and private health funds, for claims and reporting; ZeroW Currumbin, limited to what is needed to arrange gym access; our professional advisers, insurers and auditors; and government or regulators where the law requires it.

We also use trusted service providers to run the practice, and they may only use your information to provide their service to us:

Overseas disclosure. Some of these providers, including GoHighLevel, may store or process information outside Australia, including in the United States. Before we use an overseas provider, we take reasonable steps to make sure it handles your information in a way that is consistent with the Australian Privacy Principles. We keep clinical records in our practice management system, not in our marketing tools.

6. Storage, security and retention

We store client records electronically in secure, password-protected systems. Access is limited to people who need it to provide your care or run the practice. Paper documents are kept secure and scanned into your record where practical.

We take reasonable steps to protect your information from misuse, interference, loss, and unauthorised access, change or disclosure, including multi-factor authentication where available and regular review of who has access.

We keep health records for at least 7 years after your last appointment, or until you turn 25 if you were under 18 when we last saw you, or longer where the law requires. After that, we securely destroy or de-identify them.

7. Your choices and rights

Access and correction. You can ask to see the information we hold about you, or ask us to correct it if it is wrong, out of date or incomplete. We will respond within 30 days and may ask you to confirm your identity. If we cannot give you access, we will explain why in writing. We do not charge for a request, but may charge a reasonable fee for copying large records.

Anonymity. You can make a general enquiry without giving your name. To provide Exercise Physiology services or claim funding, we need to know who you are.

Marketing. If you agree to hear from us, we may send you news, articles and offers. Every message includes an unsubscribe link, and you can opt out at any time. We never use your health information for marketing.

Website, cookies and analytics. Our website may use cookies and similar tools to make it work, understand how visitors use it, and measure our advertising, such as Google Analytics or the Meta Pixel. They collect information such as pages visited, device type and approximate location, not your health information. You can block cookies in your browser settings.

Automated decisions. We do not use computer programs to make decisions about you that could significantly affect your rights or interests. Decisions about your care are made by your Exercise Physiologist.

8. Data breaches

If a data breach is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme, and tell you what you can do to protect yourself.

9. Questions, complaints and contact

If you have a question or concern about how we handle your information, please contact us first. We will acknowledge your complaint within 7 days and aim to resolve it within 30 days.

• Privacy contact: Mathew Ilieff, Prime Movement Lab
• Email: mathew.ilieff@primemovementlab.com.au
• Phone: 0400 735 810

If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner on 1300 363 992, or the Office of the Health Ombudsman (Queensland) on 133 646 about a health service.

We may update this policy from time to time. The current version is always on this website.