Privacy Policy

PRIVACY NOTICE

Last updated: April 29, 2026

This privacy notice for Meridian Rehabilitation Consultants Inc. ("Company," "we," "us," or "our"), describes how and why we may collect, store, use, and/or share ("process") your information when you use our services ("Services").

For users in Australia, this policy is designed to comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

SUMMARY OF KEY POINTS

• Australian Privacy Compliance: We manage personal information in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth).
• Sensitive Information: As a rehabilitation consultancy, we may collect health information. This is collected with your explicit consent and only where reasonably necessary for the provision of our services.
• Security Measures: We enforce strict technical and organizational safeguards, including HTTPS encryption, encrypted password storage, and role-based staff access limits to protect your data.
• Overseas Disclosure: Your data may be stored on servers located in Canada, the United States, and Europe. We take reasonable steps to ensure overseas recipients handle your information in a manner consistent with the APPs. Please see Section 4 for details.
• Your Rights: You have the right to access, correct, and lodge a complaint about our handling of your personal information. See Sections 5 and 7 for details.

1. WHAT INFORMATION DO WE COLLECT?

• Personal information you disclose to us We collect information that identifies you as an individual. This may include your name, phone number, email address, and postal address. If you complete our "Get in Touch" form, we will collect your contact details so that our team can respond to your enquiry.
• Sensitive information Under Australian law, "sensitive information" (including health information) receives a higher level of protection. We may collect health information that is relevant to our rehabilitation services. We will only do so with your explicit consent and where the information is reasonably necessary for us to provide those services.

2. HOW AND WHY WE USE YOUR INFORMATION

We process your personal information in accordance with the Privacy Act 1988 (Cth) and the APPs. The legal bases on which we rely are:

• Consent: We collect sensitive information (such as health data) only with your explicit consent.
• Primary purpose: We use your information for the purpose for which it was collected (for example, providing rehabilitation services or responding to an enquiry), or a directly related secondary purpose you would reasonably expect.
• Direct marketing: We will not use your sensitive information for marketing purposes. If we use your ordinary contact details for any marketing communications, we will provide a clear and easy option to opt out at any time.

3. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

We share your personal information only where necessary. Recipients may include:

• Our administrative and clinical staff, who access your information to contact you and coordinate services.
• Third-party service providers who assist us in operating our business (for example, our practice management platform, cloud storage, and IT support).

We do not sell your personal information. We do not disclose your information to third parties for their own marketing purposes.

4. OVERSEAS DATA TRANSFERS

• Client records (Summit): Client information, clinical notes, and related records are stored within Summit, our practice management platform. Summit stores client data on servers located in Canada, using Google Cloud Storage and MongoDB Atlas as infrastructure providers. Data is encrypted in transit and at rest, and access is restricted to authorized staff only. Both Google Cloud and MongoDB Atlas provide enterprise-grade cloud platform infrastructure and operate under binding Data Processing Agreements (DPAs). These agreements require them to maintain robust technical security, restrict data access, notify us of any security incidents, and adhere to global data protection standards.

• Website forms (Microsoft Forms): We use Microsoft Forms to collect information submitted through our website. Microsoft Forms data may be stored on servers located in the United States. We delete form submission data once it is no longer needed and has been transferred to our secure internal systems. If you have concerns about cross-border data storage, please contact us before submitting your information through our website forms.

5. HOW WE PROTECT AND RETAIN YOUR INFORMATION

We take reasonable steps to protect the personal information we hold from misuse, interference, loss, and unauthorised access, modification, or disclosure. These measures include secure access controls, encrypted data transmission, and limiting access to personal information to staff who need it to perform their role. Our infrastructure providers (Google Cloud and MongoDB) maintain enterprise-grade platform security and infrastructure-level protections.

When we no longer need your personal information for the purpose for which it was collected, and retention is not required by law, we will take reasonable steps to destroy or de-identify it.

6. YOUR PRIVACY RIGHTS

Australian residents have the following rights under the APPs:

• Access: You may request access to the personal information we hold about you. We will respond within a reasonable time and in the manner you request, where it is reasonable and practicable to do so.
• Correction: If you believe any information we hold about you is inaccurate, out of date, incomplete, irrelevant, or misleading, you may ask us to correct it. We will take reasonable steps to correct the information.
• Anonymity: Where it is lawful and practicable, you have the option of not identifying yourself or using a pseudonym when dealing with us (for example, for general enquiries). Where your identity is required to provide our services, we will let you know.

7. HOW TO CONTACT US

For privacy-related enquiries, access requests, correction requests, or complaints, please contact us at:

Email: info@meridianrehab.ca

This notice applies to personal information collected through the Meridian Rehabilitation Australian website and associated services. It does not apply to information collected through our Canadian or Irish operations, which are governed by separate privacy notices.