Privacy Policy

1. Who we are

This Privacy Policy describes how Aura Chiropractic (“we”, “us”, “our”) collects, uses, stores and protects personal information when you interact with our website, our clinic services, or our social media properties operated under the handle @Drarthurchiro.

• Business name: Aura Chiropractic
• Operator: Dr Arthur Kaganovitch (Chiropractor)
• Location: Trak Centre, Shop 32, 443/449 Toorak Rd, Toorak VIC 3142
• Phone: (03) 9661 0447
• Email: info@aurachiropractictoorak.com.au
• Website: aurachiropractictoorak.com.au

We are committed to protecting your privacy in accordance with the Australian Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), the Health Records Act 2001 (Vic), the EU General Data Protection Regulation (GDPR) where applicable, and the California Consumer Privacy Act (CCPA) where applicable.

2. Information we collect

2.1 Information you provide directly

• Name, email address, phone number, postal address
• Date of birth and basic demographic information
• Health information provided during clinical consultations
• Answers and contact details you give in our online Nervous System Quiz, including health information (see Section 6)
• Answers and details you give in our patient outcomes survey, including health information (see Section 7)
• Appointment and booking information
• Payment information (processed via secure third-party payment providers)

2.2 Information collected automatically via our website

• IP address, browser type, device type, operating system
• Pages viewed, time spent, referral source
• Cookies and similar tracking technologies (see Section 11)

2.3 Information collected via the TikTok API

We operate a TikTok developer application that connects to the TikTok account @Drarthurchiro for the purpose of publishing content created by Aura Chiropractic. Through the TikTok API, we may access:

• Basic account information: username, display name, avatar, profile URL
• Content publishing data: video files, captions, hashtags, privacy settings, and publication status for content we post
• Post performance metrics: views, likes, comments, shares, and other engagement metrics for content we have published
• Authentication tokens: OAuth access and refresh tokens required to maintain the API connection

We only access data associated with the @Drarthurchiro account that we own and operate. We do not access, collect, or store personal data of other TikTok users, their followers, or their content, except where that data is publicly visible as engagement on our own posts (for example, public comments on our videos).

3. How we use your information

We use the information we collect to:

• Provide chiropractic services and manage appointments
• Communicate with patients regarding their care
• Publish and schedule marketing content to social media platforms, including TikTok, via our self-hosted content management infrastructure
• Analyse engagement and performance of our social media content
• Comply with legal, regulatory and professional obligations, including those imposed by the Australian Health Practitioner Regulation Agency (AHPRA)
• Improve our website, services and content strategy
• Prevent fraud, abuse and unauthorised access

We do not sell personal information. We do not use TikTok API data for advertising, retargeting, or any purpose other than managing and analysing our own published content.

4. How we share your information

We share personal information only with the following categories of recipients.

4.1 Service providers (data processors)

• Postiz: a self-hosted content management system we use to schedule and publish social media posts. TikTok API tokens and content published through our account are processed via this system, which runs on infrastructure we control.
• Payment processors: to process payments for clinical services.
• Cloud hosting providers: to host our website and internal systems. Our website is hosted by Hostinger.
• Web3Forms: a form delivery service that delivers Nervous System Quiz submissions to our clinic inbox (see Section 6).
• Resend: an email delivery service that sends Nervous System Quiz result emails (see Section 6).
• PracSuite: our practice management system, which sends patient outcomes survey links by SMS and email (see Section 7).
• Supabase: a database service that stores patient outcomes survey answers in its Sydney, Australia region on Amazon Web Services (see Section 7).
• Email and messaging providers: to communicate with patients and subscribers.

All service providers are bound by contractual obligations to handle your data securely and only for the purposes we specify.

4.2 Legal and regulatory requirements

We may disclose information where required by law, court order, or to comply with our obligations to AHPRA, other regulators, or law enforcement agencies.

4.3 Business transfers

In the event of a merger, acquisition, or sale of business assets, personal information may be transferred to the acquiring party, subject to the same privacy obligations.

We do not sell, rent, or trade personal information to third parties for marketing purposes.

5. TikTok API data: specific disclosures

In accordance with TikTok’s Developer Terms of Service, we confirm the following regarding data obtained from the TikTok API.

• We access only the scopes necessary to publish content and retrieve performance metrics for the @Drarthurchiro account.
• We store TikTok API access tokens in encrypted form on infrastructure we control.
• We do not transfer TikTok API data to any third party except where required to provide the publishing service (for example, internal content management databases).
• We do not use TikTok API data to train machine learning or artificial intelligence models.
• Users may revoke our access to their TikTok account at any time via TikTok’s settings, which will immediately terminate our ability to access their data.
• TikTok API data is retained only for as long as needed to operate the publishing and analytics functions described in this policy.

6. Nervous System Quiz

Our website offers an online Nervous System Quiz. This section explains how we handle the information you give us when you complete it.

6.1 What we collect

• Your answers about stress, sleep, energy and recovery, focus, where you hold tension, what you have tried before, your goals, the reason you came to the quiz, and your age range
• Your first name and phone number
• Your email address, if you choose to give it

Your answers about stress, sleep and symptoms are health information, which is sensitive information under the Australian Privacy Principles.

6.2 Your consent

Before you can submit the quiz, you must tick a box to agree to us using your answers as set out in this Privacy Policy. The box links to this policy. Your answers and details are not sent to us unless you tick the box and submit.

6.3 How we use it

• To show you your result on screen
• To email you a copy of your result, if you give your email address
• To contact you about your results and about booking an appointment

We do not sell this information, and we do not use your quiz answers for advertising targeting.

6.4 How it is handled and who receives it

While you complete the quiz, your answers are held in your browser. We do not store them in a database on our website. When you submit, your information is sent to two service providers.

• Web3Forms: a form delivery service that delivers your details, answers and result to our clinic inbox, info@aurachiropractictoorak.com.au. Web3Forms retains submissions in line with its settings, currently for up to three years. Its servers are hosted on Amazon Web Services and may be located outside Australia.
• Resend: an email delivery service based in the United States that sends you the email containing your result. To create that email, our website passes your first name, email address and answers to Resend. The sending infrastructure for our domain is located in Tokyo, Japan, and Resend keeps delivery logs.

Our website is hosted by Hostinger.

6.5 Overseas disclosure

Web3Forms and Resend may store or process your quiz information outside Australia, including in the United States and Japan.

6.6 Access, correction and deletion

You can ask us to access, correct or delete your quiz information using the contact details in Section 10.4.

7. Patient outcomes survey

We ask patients to fill in a short survey during their care. This section explains how we handle it.

7.1 Why we ask

The survey lets your chiropractor follow your neck, back and posture readings over time and plan your care, gives a fuller picture of how you are going overall, and lets us hear your feedback. We also use your star rating to decide whether to invite you to review us on Google (see Section 7.6).

It is optional, and not completing it makes no difference to your care. Once started, each question needs an answer before you can send it, and you can stop at any time. The details on the first screen are saved when you press Continue. Your answers are saved only when you send the final page.

7.2 How you receive it

PracSuite sends you a link by SMS the day after your first appointment and by email before review appointments. Our staff can also send you a personal link, and the same survey opens from a QR code at our front desk.

The PracSuite link includes your first name, surname and client number so the survey can match you to your record. Anyone you forward the message to will see them, and they can also appear in your browser history and in the technical logs of the services that deliver the survey.

7.3 What we collect

• Your name, date of birth and client number
• At the front desk, also your email address, used to help match you to your record, and, optionally, your mobile number
• The concerns you describe in your own words, how bad each one is, how much it affects your daily life, what it is stopping you doing, and where you would like it to be
• Your own 0 to 10 ratings for neck, mid back, lower back and posture, and for some general wellbeing questions: energy levels, ability to handle stress, quality of sleep, immune system, mental state and emotional state
• On follow-up surveys: what has improved, what has been worse or harder, whether you intend to continue care, how often you are attending, anything else you want to tell us, a star rating of your experience, and what would have made it a 5 if you give fewer than 5 stars
• The names of any people you say you would refer to us

The wellbeing questions help us understand how you are going overall. Chiropractic care does not treat immune, mental or emotional health conditions. Your answers are health information, which is sensitive information under the Australian Privacy Principles.

When the details entered do not match our records, we keep a coded form of your device’s internet (IP) address for a short period, usually a day or two, to block repeated guessing. Our providers’ systems also record internet addresses in their technical logs for a limited period.

7.4 Where it is stored and who can see it

Your answers are stored by Supabase in its Sydney, Australia region, which runs on Amazon Web Services data centres. Your chiropractor and our clinic staff can see them. The same survey system serves Advanced Chiropractic in Mulgrave, Dr Arthur Kaganovitch’s other clinic, but staff at each clinic can see only that clinic’s patients’ records.

7.5 Overseas access

Supabase, Inc. is based in the United States. Its staff and some of its providers work from other countries, including the United States and Singapore, and may access the stored data to support or secure the service. Your answers travel to the database through Cloudflare, a United States network provider that Supabase uses. Supabase lists the providers it uses on its subprocessor page. Supabase’s data processing terms, which form part of its terms of service, require it to limit access to staff who need it and to keep the information confidential.

7.6 Referrals and reviews

If you name someone you would refer, we keep the name with your survey answers only. We do not contact them or use their name for marketing.

When you give the top star rating on a follow-up survey, you are invited to leave a review on Google. Whether you do is entirely your choice and has no effect on your care. A review is posted on Google’s website, is public, shows your Google name (so others can see you are our patient), and is covered by Google’s privacy policy.

7.7 Children

For a child patient, we usually expect a parent or guardian to fill in the survey with or for the child. The answers belong to the child’s record.

7.8 Access and correction

You can ask to see or correct your survey answers using the contact details in Section 10.4. A survey cannot be edited after it is sent, but we will record any correction you ask for.

8. Data retention

We retain personal information for as long as necessary to fulfil the purposes described in this policy, or as required by law.

• Patient health records: retained for at least seven years after the last consultation, in accordance with AHPRA and Victorian health records legislation.
• Patient outcomes survey answers: kept as part of your patient health record, for at least seven years after your last visit or, for a patient under 18, until they turn 25 (Health Records Act 2001 (Vic)).
• Marketing and subscriber data: retained until you unsubscribe or request deletion.
• TikTok API data: access tokens are retained while our connection to TikTok is active; performance metrics are retained for up to 24 months for trend analysis and then aggregated or deleted.
• Website analytics data: retained for up to 26 months.

9. Data security

We implement reasonable technical and organisational measures to protect personal information, including:

• Encryption of data in transit (HTTPS/TLS)
• Encryption of sensitive stored data, including API tokens
• Access controls limiting who can view personal information
• Regular review of security practices
• Physical security at our clinic premises

No method of transmission or storage is 100% secure, but we take our obligations seriously and notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in the event of an eligible data breach.

10. Your rights

10.1 Under the Australian Privacy Act

You have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Make a complaint about how we have handled your information

10.2 Under the GDPR (for EU/EEA residents)

Where the GDPR applies, you additionally have the right to:

• Request deletion (“right to be forgotten”)
• Restrict processing
• Object to processing
• Data portability
• Withdraw consent at any time
• Lodge a complaint with a supervisory authority

10.3 Under the CCPA (for California residents)

Where the CCPA applies, you additionally have the right to:

• Know what personal information we collect
• Request deletion
• Opt out of the sale of personal information (we do not sell personal information)
• Non-discrimination for exercising your rights

10.4 How to exercise your rights

Email info@aurachiropractictoorak.com.au or call (03) 9661 0447. We will respond within 30 days.

11. Cookies and tracking technologies

Our website uses cookies and similar technologies to:

• Remember your preferences
• Understand how visitors use our site
• Measure the effectiveness of our content
• Measure visits and enquiries generated by our advertising

We use the OpenAI measurement pixel to measure visits from ChatGPT ads and clicks on our online booking and telephone links. This can involve cookies, advertising click identifiers and technical browser information being shared with OpenAI. A link click does not confirm that an appointment was booked or a phone call connected. Our event code does not include patient names, contact details or health information.

You can disable cookies in your browser settings. Some parts of the website may not function correctly if cookies are disabled.

12. Children’s privacy

Our services are not directed at children under the age of 16. We do not knowingly collect personal information from children under 16 without parental consent. If you believe we have collected information from a child under 16, please contact us and we will delete it promptly.

Chiropractic care for minors at our clinic is provided only with parental or guardian consent, and information relating to minor patients is handled with the same protections as all other patient data.

Patient outcomes surveys for minor patients are usually completed by or with a parent or guardian (see Section 7.7).

13. International data transfers

Aura Chiropractic is based in Australia. Some of our service providers (for example, cloud hosting, database, form and email delivery services, and social media platforms such as TikTok) may process or access data outside Australia, including in the United States, Singapore, Japan and the European Union. Where data is transferred internationally, we take reasonable steps to ensure it is protected to a standard equivalent to Australian law.

14. Third-party links

Our website and social media content may contain links to third-party websites. We are not responsible for the privacy practices of those sites. Please review their privacy policies before providing personal information.

15. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page indicates when changes were made. Material changes will be communicated via our website or by email where appropriate.

16. Contact us

For any questions, concerns, or requests regarding this Privacy Policy or your personal information:

Aura Chiropractic
Attention: Dr Arthur Kaganovitch (Chiropractor)
Trak Centre, Shop 32, 443/449 Toorak Rd, Toorak VIC 3142
Email: info@aurachiropractictoorak.com.au
Phone: (03) 9661 0447

You also have the right to make a complaint to the Office of the Australian Information Commissioner (OAIC):

• Website: oaic.gov.au
• Phone: 1300 363 992

For a complaint about health information, you can also contact the Victorian Health Complaints Commissioner:

• Website: hcc.vic.gov.au
• Phone: 1300 582 113