Privacy and your records

This practice handles health information, so it is bound by law

It is bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and in Victoria by the Health Records Act 2001 (Vic). What follows is how those obligations are met in practice.

Two kinds of information are involved, and they are treated differently: what you send through the enquiry form, and the clinical records you send if the work goes ahead.

The form first, because it is the one most people use.

The enquiry form is used to reply to you, and it goes no further

It collects your name, your email address, a phone number if you give one, what has happened so far, whether a deadline is running, what was refused, and how you found me.

It is used to reply to you and to work out whether the work is a fit. Your answer to how you found me is also counted, without your name, so I know which parts of this site are useful. It is not added to a mailing list, and it is not passed to anyone else.

Please do not attach or paste medical records into the form. Send only as much as you need to explain the enquiry. If you send clinical detail anyway, it is treated as health information from the moment it arrives.

Enquiries that do not proceed are deleted within twelve months.

If the work does go ahead, a different set of rules applies.

Clinical records are used for your review and for no secondary purpose

Records reach me by encrypted email or registered post, whichever you prefer. They are used for the review you have engaged me to do and for nothing else. They are not used for research, teaching, marketing or any secondary purpose.

Health records are held for the period health records law requires: at least seven years from the last entry for an adult, and for a child until they turn twenty-five. After that they are destroyed securely. This is a legal minimum, not a preference, and it means records cannot simply be deleted on request.

Files are held on encrypted storage under my control. Where a third-party service is involved in delivering the work, it is one that stores data in Australia, unless I tell you otherwise before you engage me.

Which leaves the question everyone actually wants answered.

Nobody else sees it unless you direct it

A finished report goes where you tell me to send it: to you, to your solicitor, to your advocate, or to the Agency or Tribunal on your instructions.

There are three exceptions, and they are the ordinary ones: where disclosure is required by law, where a court or tribunal compels it, or where there is a serious and imminent threat to someone's life, health or safety.

I do not report to the NDIA and I am not engaged by it. I am engaged by you, and the fee is paid by you or from your plan, whichever applies.

The site itself collects almost nothing.

This website sets no tracking cookies and runs no analytics

There are no advertising or tracking cookies, and no third-party analytics or advertising scripts. The hosting provider keeps standard server logs, including IP addresses, for security and diagnostics.

Articles and case notes are plain pages. Nothing you read here is recorded against you.

And if you want to see what I hold, or correct it.

You can ask for a copy, ask for a correction, or complain

Email simon@painevidence.com.au. I will respond within thirty days. There may be a reasonable charge for retrieving and copying a large file, and I will tell you the amount before doing the work.

If you are unhappy with how your information has been handled, tell me first and I will deal with it. If that does not resolve it, you can complain to the Office of the Australian Information Commissioner, or in Victoria to the Health Complaints Commissioner.

Last updated 30 September 2026. Previous version 19 September 2026.