Your information. Handled with care.
This policy explains how PHONKLAI collects, uses, stores and shares personal and health information when you use the website, book an appointment or receive care at the clinic.
Last updated
19 September 2026
Bookings
Handled externally through Fresha
A clear policy should answer three questions quickly.
This policy is intended to explain PHONKLAI’s information handling under the Privacy Act 1988 (Cth), the Australian Privacy Principles and the Health Records Act 2001 (Vic), including the Health Privacy Principles.
What is collected?
Information reasonably needed to provide care, manage appointments and operate the clinic.
Why is it used?
For the purpose it was collected, a directly related purpose you would reasonably expect, or where consent or law permits.
What can you ask for?
You may request access or correction and raise a concern about how your information has been handled.
Where information may be handled.
The website, Fresha and the clinic have different roles. Knowing the difference makes the privacy pathway easier to understand.
Browse information
This website is informational. It has no contact form and does not take bookings. Hosting systems may record routine technical data, and Google Maps loads on the Contact page.
Book externally
Book Online links open Fresha. Fresha handles account, booking and payment information under its own privacy notice. PHONKLAI may access information needed to manage appointments and care.
Receive care
When you contact or visit the clinic, PHONKLAI may collect contact, booking, payment, health and treatment information needed for safe care and clinic administration.
Only information connected to your care or the clinic’s operation.
Identity and contact
Name, phone number, email, date of birth or address where reasonably required.
Booking and payment
Appointment, service, practitioner, transaction and health-fund claim information. Payment-card handling may occur through external payment services.
Health and treatment
Relevant history, symptoms, conditions, medication, pregnancy, allergies, preferences, consent and treatment notes.
Website and communication
Phone or written communications, browser or device details, IP address, server logs and interactions with embedded services.
Schedule and administer appointments
Assess suitability and provide treatment
Process payments and eligible HICAPS claims
Communicate about care or bookings
Maintain records and meet legal duties
Handle enquiries, complaints and website security
Shared only where there is a reason.
Clinic team
Information may be available to therapists and authorised staff who need it to provide care or administer the clinic.
Service providers
Necessary information may be handled by Fresha, payment or HICAPS providers, website hosting, IT support and embedded Google services.
Other care providers
Information may be shared at your request or with your consent, including when you ask for records to be sent to another health service provider.
Law and safety
Information may be used or disclosed where required or authorised by law, or where permitted to address a serious threat to life, health or safety.
PHONKLAI does not sell personal information. Health information is not used for direct marketing without specific consent.
Reasonable safeguards, defined retention and transparent providers.
Security
PHONKLAI takes reasonable physical, technical and organisational steps to protect information from misuse, interference, loss and unauthorised access, modification or disclosure.
Retention
Victorian private health-service records generally cannot be deleted until seven years after the last service, or until age 25 where the person was under 18 at the last service. Other information is kept only as needed or required.
Overseas handling
Some external providers operate globally. Fresha’s current notice identifies operations in Australia, the United States, Canada, the United Kingdom, the United Arab Emirates, the Netherlands and other EEA countries. Provider arrangements may change, so review the linked notices for current details.
No internet transmission or storage system can be guaranteed completely secure. If PHONKLAI becomes aware of an eligible data breach, it will respond in accordance with applicable requirements.
You can ask, correct and question.
Contact the clinic first so PHONKLAI can identify the relevant record and understand what you need. Identity verification may be required before information is released.
Access
Ask to view or receive a copy of personal or health information PHONKLAI holds about you. Legal exceptions and permitted access fees may apply.
Correction
Ask for information to be corrected if it is inaccurate, incomplete, out of date, irrelevant or misleading.
Anonymity where practical
You may ask to deal anonymously or by pseudonym where lawful and practicable. Booking or treatment may require identification when it is necessary for safe care or administration.
Marketing choices
You can withdraw a marketing consent or ask not to receive future promotional messages. Health information is not used for direct marketing without specific consent.
Privacy concerns
Raise the concern with PHONKLAI first. Explain what happened and the outcome you are seeking so the clinic can review and respond.
Their service. Their privacy notice.
External services may use cookies or similar technologies and receive technical information when their content loads or you follow a link.
Fresha
Online bookings, account features and any Fresha payment or consultation tools are governed by Fresha’s current privacy notice.
Google Maps & web services
The Contact page embeds Google Maps, and the website may load Google-hosted resources. Google handles associated information under its privacy policy.
Start with the clinic.
For access, correction, privacy questions or complaints, contact PHONKLAI and describe the issue and outcome you are seeking. If you need this policy in another accessible format, ask the clinic.
PHONKLAI Remedial Massage & Therapy
435 Toorak Road, Toorak VIC 3142
03 9826 5774
Open daily · 10am–8pm
Independent privacy and health-record pathways.
You may be able to contact the Office of the Australian Information Commissioner or Victoria’s Health Complaints Commissioner. Their current eligibility and complaint processes are explained on the linked official websites.
This policy should be reviewed whenever PHONKLAI changes its booking, payment, clinical-record, website or service-provider arrangements.
A clear conversation is the best place to begin.
Contact the Toorak clinic about access, correction or how personal and health information is handled.