Privacy Policy

Personal health information encompasses information about a client's or participant's health, medical history, and healthcare records that identifies — or could reasonably identify — the individual. This includes your name, contact details, medical diagnoses, therapy notes, imaging results, and any correspondence related to your care. Under the Privacy Act 1988 (Cth), health information is classified as sensitive information and is subject to additional protections.

We take great care in how your records are stored and retained to ensure long-term security and accessibility.

• Hard copy documents are scanned and stored securely in electronic format
• For children, files are retained for seven years after the final date of attendance following the child turning 18
• Electronic records are stored indefinitely via our practice management software (Splose and PracSuite), which is hosted on secure, encrypted servers
• Records may be made inactive at the discretion of the practice manager or treating clinician
• No records are destroyed without the explicit permission of the treating clinician

Our clinicians take deliberate steps to ensure that all consultations are conducted in private settings — whether in-clinic or during home visits. All clinicians and staff take steps to ensure that you can discuss issues relating to your therapy in a confidential and comfortable environment.

Consultation rooms are designed to protect your privacy, and home-visit clinicians follow strict protocols to maintain discretion when visiting your residence.

Access to your personal health information is limited to those who need it to provide or support your care.

• Administrative staff and your treating clinician(s) have access to your records as required
• Your consent is always obtained before any information is used for research or quality improvement activities
• All internal staff are bound by confidentiality agreements — breaches result in dismissal
• External researchers must provide written confidentiality agreements before any access is granted

Any restricted or sensitive information requires separate, specific consent before it can be shared.

Mandatory reporting: We are legally required to disclose information without your consent in certain circumstances, including mandatory reporting of suspected child abuse or neglect under child protection laws, notification of communicable diseases under public health legislation, and compliance with court orders or legal proceedings. These obligations override your usual privacy protections.

We collect your personal health information with your consent. Consent may be express (written or verbal) or implied through your actions in seeking therapy from us. We will always explain what information we are collecting and why before or at the time of collection.

You have the right to withdraw or modify your consent at any time by contacting us in writing or verbally. Please be aware that withdrawing consent may affect our ability to continue providing therapy, as certain information is necessary for safe and effective care.

Where you have previously consented to a specific use or disclosure, we may continue to rely on that consent for information already collected unless you tell us otherwise. Withdrawal of consent applies from the date we receive your request and is not retrospective.

If your treating clinician changes — whether within our practice or to an external provider — your records can be transferred upon your request. Providing complete, up-to-date information to a new clinician is essential for high-quality, continuous care.

Please note that administrative charges may apply for the preparation and transfer of records.

Under Australian Privacy Principle 12, you have the right to access the personal health information we hold about you. Your treating clinician can provide a summary of your health information upon request.

• Written access requests are assessed and responded to within 30 days of receipt
• Photo identification may be required to verify your identity before records are released
• In rare circumstances, access may be limited where providing the information could pose a serious risk to your physical or mental wellbeing, or would unreasonably impact another person's privacy
• Copying and administrative fees may apply for formal record requests

Correction of records: Under Australian Privacy Principle 13, if you believe any information we hold about you is inaccurate, out of date, incomplete, irrelevant, or misleading, you may request a correction. We will respond to correction requests within 30 days. If we decline a correction request, we will provide a written explanation and you have the right to request that a statement of the correction sought be associated with your record.

We employ comprehensive measures to prevent unauthorised access to your personal health information during storage, use, and transmission.

• Visitors to our clinic are never granted access to health records
• Non-clinical staff access is kept to the minimum necessary for their role
• Communications via email and telephone are managed with the same level of security as physical records
• Computer screens are positioned to prevent unauthorised viewing
• Data is protected against loss, damage, and unauthorised alteration
• Records remain on-site except where required for direct clinical care
• All records are securely filed or disposed of promptly after contact
• Hard-copy files are shredded when due for destruction

Our practice management software (Splose and PracSuite) may store data on cloud servers. Where any personal information is stored or processed outside of Australia, we take reasonable steps to ensure the overseas recipient handles your information in accordance with the Australian Privacy Principles.

We do not routinely disclose your personal health information to overseas recipients. If a situation arises where overseas disclosure is necessary (for example, if you are receiving care from an international provider), we will seek your explicit consent before any disclosure takes place.

In the event of an eligible data breach — where unauthorised access to, or loss of, personal information is likely to result in serious harm — we are required under the Notifiable Data Breaches (NDB) scheme to notify both you and the Office of the Australian Information Commissioner (OAIC).

• We will assess any suspected breach promptly and complete our assessment within 30 days
• If serious harm is likely, we will notify the OAIC and affected individuals as soon as practicable
• Notifications will include what information was involved, what we are doing to respond, and what steps you can take to protect yourself

All staff are inducted on the importance of confidentiality from their first day. Every team member signs a confidentiality statement acknowledging that breaching privacy is a dismissible offence.

We encourage ongoing in-house privacy seminars, and every new staff induction includes a dedicated segment on personal health information management, data security, and your rights.

We strive to deliver educational content and resources to improve your overall experience as a client or participant. From time to time, we may send periodic emails with health tips, service updates, or clinic news.

You can unsubscribe from any marketing emails at any time using the link provided in each email. Your choice to unsubscribe will never affect the quality of your care.

We may update this privacy policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the "last updated" date at the top of this policy.

We encourage you to review this policy periodically. The most current version will always be available on our website. Continued use of our services after any changes constitutes your acceptance of the updated policy.