KNOWLEDGE BASE
POLICY
Privacy, Confidentiality and Information Management Policy
Document No:
POL-003
Version:
1.0
Approved by:
Management
Effective Date:
30/06/2026
Review Date:
30/06/2027
Purpose
Bodyfocus Wellness Centre is committed to protecting the privacy, confidentiality, integrity, and security of information collected, used, stored, and managed in the course of providing services and conducting business operations.
This policy outlines the organisation's approach to information management and establishes expectations for all personnel regarding the handling of confidential and sensitive information.
Scope
This policy applies to all employees, contractors, students, volunteers, and other personnel engaged by Bodyfocus Wellness Centre.
The policy applies to all information held by the organisation, including patient information, employee information, business records, and other confidential information.
Policy Statement
Bodyfocus Wellness Centre is committed to:
Respecting the privacy and confidentiality of patients, employees, and other stakeholders.
Protecting information from unauthorised access, use, disclosure, alteration, or loss.
Maintaining accurate and secure records.
Ensuring information is accessed only by authorised persons for legitimate business purposes.
Complying with applicable privacy, health records, and information management requirements.
Promoting responsible use of organisational information systems and technology.
Confidential Information
Confidential information may include, but is not limited to:
Patient records and health information
Personal information
Employee records
Financial information
Business records
Incident reports
Complaint records
Organisational documents
Information obtained through professional duties
Personnel must not disclose confidential information except where authorised, required for legitimate work purposes, required by law, or where appropriate consent has been obtained.
Collection and Use of Information
Information will be collected, used, and disclosed only for legitimate business, clinical, operational, or legal purposes.
Personnel must only access information necessary to perform their duties.
Access to information must be restricted according to role, responsibilities, and operational requirements.
Information Systems
Bodyfocus Wellness Centre utilises electronic systems to manage clinical, workforce, governance, and training information.
Information must be stored within approved organisational systems and managed in accordance with organisational policies and procedures.
Personnel must not establish unofficial records or store organisational information in unauthorised locations.
Patient Records
Patient records are maintained within approved clinical information systems.
Personnel may access patient information only where necessary for the provision of services or the performance of authorised duties.
Patient information must be recorded accurately, professionally, and in a timely manner.
Employee Records
Employee records are maintained within approved workforce management systems and are accessible only to authorised personnel.
Employee information will be managed confidentially and in accordance with applicable legal and organisational requirements.
Information Security
Personnel are responsible for taking reasonable steps to protect information from unauthorised access, loss, misuse, or disclosure.
This includes:
Maintaining secure passwords
Protecting login credentials
Logging out of systems when not in use
Securing devices used for work purposes
Following organisational cybersecurity requirements
Reporting suspected security incidents
Passwords and system access credentials must not be shared with others.
Portable Devices and Personal Storage
Patient information and other confidential organisational information must not be stored on personal devices, personal cloud storage services, portable storage devices, or unauthorised systems unless specifically authorised by management.
Personnel must take reasonable precautions to protect information when accessing organisational systems remotely.
Remote Access
Approved organisational systems may be accessed remotely where authorised and appropriate to an employee's role.
Personnel accessing information remotely must ensure:
Information is protected from unauthorised viewing or access.
Devices are appropriately secured.
Confidentiality is maintained at all times.
Artificial Intelligence and Approved Technologies
Personnel must only use organisation-approved technologies, software platforms, and artificial intelligence tools when collecting, processing, storing, transmitting, analysing, or documenting organisational information.
Unauthorised use of artificial intelligence tools or external services involving confidential or patient information is prohibited.
Additional requirements relating to approved technologies may be addressed in separate organisational procedures.
Information Sharing and Disclosure
Information may only be disclosed:
With appropriate consent;
For legitimate clinical or business purposes;
Where required or authorised by law;
To manage risks to health, safety, or wellbeing;
In accordance with organisational policies and procedures.
Only the minimum necessary information should be disclosed to achieve the intended purpose.
Records Retention and Disposal
Records will be retained and disposed of in accordance with applicable legal, professional, and organisational requirements.
When records are no longer required, they will be securely destroyed or disposed of using approved methods.
Breaches of Privacy or Confidentiality
Any actual or suspected privacy breach, confidentiality breach, information security incident, or unauthorised disclosure must be reported to management as soon as practicable.
Such incidents may be managed in accordance with the Incident Management Policy and other relevant organisational procedures.
Training and Awareness
Personnel will receive information, training, or guidance regarding privacy, confidentiality, and information management requirements appropriate to their role.
Compliance with this policy forms part of each employee's professional responsibilities.
Responsibilities
Management
Management is responsible for:
Maintaining appropriate information management systems;
Implementing reasonable security measures;
Providing training and guidance;
Managing privacy and confidentiality incidents;
Monitoring compliance with organisational requirements.
Employees and Other Personnel
Personnel are responsible for:
Protecting confidential information;
Accessing information only where authorised;
Following organisational policies and procedures;
Reporting privacy, confidentiality, or security concerns;
Maintaining professional and ethical standards.