Privacy Policy

Last updated 26 October 2026

Who we are

Strong Hands Massage is run by Rafael Arslanov, a remedial massage therapist and member of Massage & Myotherapy Australia, at 51 Sandgate Rd, Albion QLD 4010 (ABN 29 206 654 779). "We" and "us" in this policy means Strong Hands Massage.

As a health service provider, we follow the Australian Privacy Principles in the Privacy Act 1988 (Cth).

In short

We only collect what we need to treat you safely, take bookings and give you a health fund invoice.
We never sell your information or share it for advertising.
Your health information is only seen by Rafael, and only shared with others if you agree or the law requires it.
You can ask to see or correct your information at any time.

What we collect

Contact and booking details: your name, phone number, email address, appointment times and the treatment you book.
Health information: what you tell us about your health, injuries, medications, pregnancy or other conditions that affect treatment, plus Rafael's treatment notes after each session.
Payment and invoice details: what you paid, the treatment date, length and health fund item number. Card payments are handled by our booking system's payment provider; we don't see or keep your full card number.
Messages: texts, emails and social media messages you send us.
Website information: anonymous visit statistics (see "This website" below).

You don't have to give us your health information, but without it Rafael may not be able to treat you safely.

Why we collect it

To check massage is safe and suitable for you, plan your treatment and keep clinical records, as our professional association requires.
To manage bookings and send confirmations and reminders.
To give you an invoice with our provider numbers so you can claim from your health fund.
To reply to your questions and keep business and tax records.

Emails with news and offers

When you book, you choose whether you would like occasional emails from us with news, offers or availability. It's entirely up to you, and you can change your mind at any time.

If you opt in, the emails are sent from Timely through Mailchimp, an email service, which receives only your name and email address. Your health information is never sent to Mailchimp.

Every email has an unsubscribe link, or you can text us to stop them. Opting out won't affect your bookings, reminders or invoices.

Photos and videos for social media

From time to time, Rafael may film or photograph part of a treatment, for example his hands working on a back or shoulder, to share on our website and social media.

We will always ask you first, on the day. If you'd rather not be filmed, just say so, or let us know when you book. It won't affect your treatment in any way.
Your face is never shown, and we avoid anything that could identify you, such as tattoos, jewellery or your name.
If you change your mind later, tell us and we will remove the photo or video from our pages.

Where it is kept and how it is protected

Bookings, client details, health information and treatment notes are kept online in Timely, our secure booking and client records system.
Email newsletters are sent through Mailchimp, which holds only names and email addresses.
Health fund invoices are created and emailed from our private Google account and kept in a private Google Drive folder and spreadsheet. Invoice file names contain only an invoice number, never your name.
All accounts are protected by strong passwords and two-step verification, and only Rafael can access them. Nothing is shared by link.

Some of these services store data on servers outside Australia, for example in the United States. We choose providers with strong security and privacy commitments, but overseas laws may differ from Australia's.

Who we share it with

We only share your information:

With your health fund, if they audit a claim you made and ask us to confirm the treatment.
With your doctor or another health practitioner, only if you ask us to or agree to it.
With our service providers (booking, email and newsletters, storage and website hosting), only so they can provide their service to us.
When the law requires it, or to prevent a serious threat to someone's life, health or safety.

How long we keep it

Clinical records are kept for 7 years after your last visit (for clients under 18, until they turn 25), in line with health record guidance. Invoices and financial records are kept for at least 5 years for tax purposes. After that they are securely deleted or destroyed.

This website

We use Google Analytics to see how many people visit and which buttons they use, such as "Book online" or "Text Rafael". It uses cookies and does not tell us who you are. You can block it with your browser's privacy settings or Google's opt-out add-on.
We use Hotjar to understand how visitors use the website, for example where people click and scroll, so we can make it easier to use. Hotjar does not record what you type into forms and does not tell us who you are. You can opt out on Hotjar's opt-out page.
The site is hosted by Cloudflare, which processes your IP address to deliver pages and block attacks.
The booking form on the Book page is provided by Timely, and the map is provided by Google Maps. They may set their own cookies under their own privacy policies.
The website has no contact forms and does not collect health information.

See, correct or delete your information

You can ask for a copy of the information we hold about you, ask us to correct it, or ask us to delete what we are not required to keep. Text 0426 104 676 or email [email protected]. We will reply within 30 days, and there is no charge.

Concerns or complaints

If you are worried about how we have handled your information, please tell us first and we will try to fix it quickly. If you are not satisfied, you can contact the Office of the Australian Information Commissioner (1300 363 992).

Changes to this policy

We may update this policy from time to time. The date at the top shows when it last changed.