Appendix: State & Territory Health Laws

Last updated: December 19, 2025
Purpose: To show which state, territory, and country-specific health information laws may apply to how FitPilot handles health data for Australian and New Zealand users. FitPilot is a private-sector provider and primarily complies with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) for Australian users, and with the Privacy Act 2020 (NZ) and the Health Information Privacy Code 2020 (HIPC) for New Zealand users.

How this applies to FitPilot

We are a private-sector fitness software provider (not a public health service and not part of the My Health Record system).
The Commonwealth Privacy Act 1988 (APPs) is the primary law governing our handling of personal and health information in Australia.
For New Zealand users, the Privacy Act 2020 and the HIPC Rules 1–13 govern health information handling and breach notification to the Office of the Privacy Commissioner (OPC).
Where state or territory laws impose additional obligations on private providers, we follow them; where they mainly regulate public-sector health agencies, we still apply the Privacy Act and common-law duties of confidentiality.
Data breach response: we follow the Notifiable Data Breaches (NDB) scheme (Australia) and the notifiable privacy breach scheme (New Zealand). If state/territory notification is required (e.g., NSW, ACT), we will include that in our response plan.

Australia – State & Territory landscape

Jurisdiction	Key health-information law(s)	What this means for FitPilot (private sector)
Commonwealth (Australia)	Privacy Act 1988 (APPs); Notifiable Data Breaches (NDB) scheme; OAIC regulator. My Health Records Act 2012 applies only to the federal My Health Record system (FitPilot is not part of that system).	Primary obligations for collection, use, disclosure, security, retention, and breach notification.
New South Wales	Health Records and Information Privacy Act 2002 (HRIP Act) + PPIP Act; 15 Health Privacy Principles; NSW Privacy Commissioner.	We apply HRIP principles for NSW users and coordinate with OAIC/NSW regulators for eligible breaches.
Victoria	Health Records Act 2001 (Vic); Health Privacy Principles; overseen by OVIC/Health Complaints Commissioner.	Apply Victorian HPPs for Victorian users; complaints may involve OVIC/HCC in addition to OAIC.
Australian Capital Territory	Health Records (Privacy and Access) Act 1997 (ACT); ACT Human Rights Commission.	Apply ACT HPPs for ACT users; ACT notification may be required alongside OAIC.
Queensland	No standalone private-sector health records act. Information Privacy Act 2009 mainly covers public sector.	Private providers like FitPilot are governed primarily by the Commonwealth Privacy Act + confidentiality duties.
South Australia	No dedicated private-sector health records act. SA Health Care Act 2008 and SA Health's Code cover public providers.	Private providers are principally under the Privacy Act 1988 and common-law confidentiality; SA Health obligations may apply when dealing with public providers.
Western Australia	No current private-sector health privacy statute; Health Services Act 2016 (WA) Part 12 covers WA Health (public sector).	FitPilot (private) follows the Privacy Act 1988 and confidentiality duties; monitor for any WA privacy reforms.
Tasmania	Personal Information Protection Act 2004 (PIP Act) covers Tasmanian public sector; no separate private-sector health-records act.	FitPilot relies on Privacy Act 1988 + confidentiality duties for Tasmanian users.
Northern Territory	Information Act 2002 (NT) covers public sector; no specific private-sector health-records act.	Privacy Act 1988 + confidentiality duties apply to FitPilot's handling of NT user data.

New Zealand – Health Information Privacy Code (HIPC)

Privacy Act 2020 (NZ) + Health Information Privacy Code 2020 (Rules 1–13) govern collection, use, disclosure, access, correction, security, and retention of health information.
Mandatory notification of notifiable privacy breaches to the Office of the Privacy Commissioner (OPC) and affected individuals.
Cross-border disclosures must ensure comparable safeguards (see our Privacy Policy for subprocessors and transfer controls).

Your rights and contacts

You can request access to or correction of your information at any time (see /privacy for process and contact details).
Breach/complaint contacts: privacy@fitpilot.me (Privacy), legal@fitpilot.me (Terms/complaints).
Regulators: OAIC (Australia), NSW Privacy Commissioner, OVIC/HCC (VIC), ACT Human Rights Commission, OPC (NZ). We will cooperate with the appropriate regulator(s) depending on your jurisdiction and the facts of the incident.

Appendix: State & Territory Health Laws

How this applies to FitPilot

Australia – State & Territory landscape

New Zealand – Health Information Privacy Code (HIPC)

Your rights and contacts

Related documents