Home About
Services
OT Services Public Speaking & Training Professional Supervision Embracing YOU! Course
Resources Shop Podcast
WORK WITH ME

Privacy Policy

 

1 About this policy

SGR Occupational Therapy respects the privacy of clients, families, course participants, website visitors and other people who interact with the practice. This policy explains what personal information we collectand hold, why we use it, when it may be shared, how it is protected, and how a person can request access, correction or make a privacy complaint.

SGR Occupational Therapy is a sole-trader occupational therapy practice.
It provides NDIS-funded and non-NDIS-funded services, telehealth, professional education, supervision, online resources and related business services.

2 Privacy laws and principles

As a private allied-health provider that holds health information, SGR Occupational Therapy is covered by the Privacy Act 1988 and the Australian Privacy Principles, regardless of business turnover. The practice also handles health information consistently with the Health Records Act 2001 (Vic) and the Victorian Health Privacy Principles, together with applicable professional and record-keeping obligations.

Personal information is information or an opinion about an identified person, or a person who is reasonably identifiable, whether or not the information is true and whether or not it is recorded in material form. Sensitive information includes health information and other categories given additional protection under privacy law.

3 Information we may collect and hold

The information collected depends on the person’s relationship with SGR Occupational Therapy. It may include:

  • identity and contact information, including name, date of birth, pronouns, address, telephone number and email address;

  • contact and authority details for parents, guardians, nominees, advocates, carers and other support people;

  • health, disability, developmental, sensory, functional, psychosocial, family and support information relevant to the service;

  • information about daily activities, environments, education, employment, relationships, communication, identity, goals and support needs;

  • referrals, assessments, clinical notes, reports, plans, correspondence, outcome measures and information supplied by other professionals or services;

  • NDIS information, including participant number, plan dates, goals, funding arrangements, support coordination details and service bookings where relevant;

  • billing, invoicing, transaction and funding information. Payment-card details are processed by Stripe or another payment provider, and SGR Occupational Therapy generally receives payment status and transaction information rather than complete card details;

  • appointment, telehealth and electronic communication information;

  • complaints, feedback, incidents, safety concerns and related follow-up;

  • course, webinar, mailing-list and resource-registration information; and

  • website and technical information such as device, browser, IP address, pages visited and cookie or analytics data.

We do not intentionally collect information that is not reasonably required for our services or lawful business activities.

4 How we collect information

We usually collect information directly from the person or their authorised representative. Collection may occur through conversations, sessions, assessments, online or paper forms, referrals, telephone calls, email, text messages, telehealth, the website, course platforms, payment systems and other correspondence.

Where it is unreasonable or impracticable to collect information directly, or where consent or another lawful basis permits, we may receive information from a parent, guardian, nominee, advocate, family member, support coordinator, school, employer, medical or allied-health practitioner, disability provider, funding body or another relevant person or organisation.

When information is collected, we take reasonable steps to explain what is needed, how it may be used or shared, the main consequences of not providing it, and how to access this policy. More specific collection notices or consent forms may be used for particular services ortechnologies.

5 Choice and consequences of not providing information

A person may choose not to provide requested information. In some situations, this may mean that SGR Occupational Therapy cannot safely or effectively provide a service, complete an assessment or report, process a payment, meet a funding requirement or respond to a request. We will explain the likely consequence where it is not obvious.

6 Why we collect hold use and disclose information

We use personal information for purposes connected with providing and managing services, including to:

  • respond to enquiries, assess service suitability and arrange appointments;

  • provide occupational therapy, telehealth, supervision, education, courses and resources;

  • complete assessments, clinical records, reports, recommendations and service planning;

  • communicate with clients and authorised people involved in their care or support;

  • manage consent, safety, accessibility, complaints, incidents and continuity of care;

  • prepare invoices, process payments, make funding claims and meet financial or insurance requirements;

  • maintain professional registration, supervision, quality assurance and legal compliance;

  • operate, secure and improve the website, technology systems and business processes; and

  • send requested resources or marketing communications where consent or another lawful basis permits.

We will not use or disclose personal information for an unrelated purpose unless the person consents or the use or disclosure is otherwise authorised or required by law.

7 Information about children, families, and support people

When a child is the client, we may collect information about the child and relevant family or household circumstances. Information supplied by a parent, carer or other person may become part of the child’s record where it is relevant to the service. We aim to involve children in privacy and consent decisions in ways suited to their age, communication and decision-making capacity.

Information about family members, carers and support people is handled respectfully and only to the extent reasonably needed. Authority to access or direct the sharing of another person’s information is considered case by case, including where guardians, nominees or separated parents are involved.

8 Who information may be shared with

With consent, or where another lawful basis applies, personal information may be shared with:

  • parents, guardians, nominees, advocates, carers or other authorised support people;

  • medical, allied-health, mental-health and disability professionals;

  • schools, childcare services, employers or community organisations;

  • support coordinators, plan managers, the NDIA, NDIS Quality and Safeguards Commission or other funding bodies;

  • professional supervisors, advisers, insurers, accountants, legal representatives, auditors or debt-recovery services where reasonably necessary;

  • technology, hosting, booking, payment, communication, transcription and document-service providers acting for the practice; and

  • emergency, safeguarding, law-enforcement, regulatory or statutory bodies where authorised or required.

We seek to share only the information reasonably necessary for the purpose. De-identified information is used for supervision, education or service improvement where practicable. We do not sell personal information.

9 Safety and legally authorised disclosures

There are circumstances in which information may be used or disclosed without consent. These may include where disclosure is required or authorised by Australian law, is necessary to lessen or prevent a serious threat to life, health or safety, is needed for an appropriate safeguarding response, or is required for regulatory, legal or law-enforcement purposes.

The precise obligation depends on the circumstances and the law that applies. Where it is lawful and safe, we will explain a disclosure to the person affected and limit the information shared.

10 Digital platforms and service providers

SGR Occupational Therapy uses third-party systems to deliver and administer services. Current systems may include:

The systems used may change as the practice changes. Before using a system that will handle personal or health information, we consider its purpose, privacy terms, security arrangements, access controls, data location and suitability for the information involved. Current information about a provider may also be requested from SGR Occupational Therapy.

11 Telehealth recordings and AI assisted documentation

Telehealth and electronic communication involve privacy and security risks that cannot be completely eliminated. We use appropriate platforms and take reasonable steps to protect sessions and communications. A session is not intentionally recorded without the knowledge of the people involved and an appropriate consent process.

SGR Occupational Therapy uses Everbility, an AI-assisted documentation tool designed for allied-health professionals, to help prepare clinical notes, reports, summaries and related administrative material. Where Everbility will handle identifiable client information, its use will be explained to the client. Consent will be obtained where required or appropriate, and alternatives will be discussed where available.

Everbility states that client notes and report templates are encrypted in transit and at rest, personal information is not used for purposes other than the primary purpose for which the service is used, and customer data is not used to train its AI models. Further information about Everbility’s handling of information is available at https://www.everbility.com/privacy.

All AI-assisted content is reviewed by the Occupational Therapist before it is relied upon or placed in a clinical record. AI does not make final clinical decisions, determine a person’s diagnosis, decide NDIS eligibility or funding, or replace professional judgement. Information will not be knowingly entered into a general-purpose AI service unless its use has been approved for that information and complies with the practice’s privacy requirements.

 

12 Overseas storage and disclosure

Some technology providers may store, process or support information outside Australia. Overseas locations may include the United States and other countries identified by the relevant provider. Provider arrangements and data locations can change, so current details are available from the provider’s privacy information or from SGR Occupational Therapy on request.

Before using an overseas service for personal or health information, we take reasonable steps appropriate to the circumstances to assess the service and protect the information. Privacy protections and legal remedies in another country may differ from those in Australia.

13 Information security

We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. Measures may include access controls, passwords and multifactor
authentication, encryption where supported, secure cloud systems, software updates, backups, careful sharing practices, secure disposal and review of third-party services.

No method of electronic transmission or storage can be guaranteed to be completely secure. If a person sends sensitive information by ordinary email or text message, they should be aware that these methods may carry additional risk. Alternative arrangements can be discussed.

14 Privacy and data breaches

A privacy or data breach may involve the loss of personal information or unauthorised access, use, modification or disclosure. If a suspected breach occurs, SGR Occupational Therapy will act to contain it, assess what happened and who may be affected, reduce potential harm, document the response and improve relevant systems.

Where the Notifiable Data Breaches scheme or another law requires notification, affected individuals and the Office of the Australian Information Commissioner or another relevant body will be notified. Not every privacy incident meets the legal threshold for notification, but each incident will be assessed.

15 Record retention and secure disposal

Personal information is kept only for as long as it is reasonably needed for the purpose for which it was collected, or as required by law, professional obligations, funding arrangements, insurance or legitimate business needs.

As a practice standard, adult clinical records are generally retained for at least seven years after the last service entry. Records created when a client is under 18 are generally retained until the client reaches 25 years of age, or for any longer period that applies. Different periods may apply to financial records, complaints, incidents, course records or legal matters.

When information is no longer required, reasonable steps will be taken to securely destroy it or permanently de-identify it, unless destruction is prohibited or a lawful reason requires continued retention.

16 Access to and correction of information

A person may request access to personal information held about them and ask for inaccurate, out-of-date, incomplete, irrelevant or misleading information to be corrected. Requests may be made by telephone or email using the contact details below. We may ask for information needed to verify identity or authority before providing access.

We will respond within a reasonable period and aim to acknowledge requests promptly. Access may be provided in a suitable form, such as a copy of records or an explanation of the information. A reasonable charge may apply to the work involved in providing access, but not to making the request.

Access or correction may be refused or limited where permitted by law. If this occurs, we will ordinarily provide written reasons and information about how to complain. If requested information is not corrected, a statement noting the person’s view may be associated with the record where required.

17 Anonymity and pseudonyms

A person may interact anonymously or use a pseudonym where this is lawful and practicable, such as for a general enquiry or some website activities. Identification is usually necessary for clinical services, reports, funding claims, billing, safety and continuity of care.

18 Website cookies and analytics

The SGR Occupational Therapy website may use cookies and similar technologies to operate the site, remember preferences and understand how the site is used. Information may include IP address, browser and device type, date and time of access, pages viewed, files downloaded and referring website.

Cookie settings can be managed through the person’s browser and, where available, the website’s cookie controls. Disabling cookies may affect some website functions. The website may link to external sites; SGR Occupational Therapy is not responsible for their privacy practices.

19 Mailing lists resources and marketing

When a person requests a resource, registers for a course or webinar, or joins a mailing list, we may collect their name, email address and related registration information. We use this information to provide the requested material and send communications the person has agreed to receive.

Marketing contact details are not sold. A person may unsubscribe at any time by using the unsubscribe link in an email or contacting SGR Occupational Therapy. Service messages that are necessary for an existing booking, purchase or client relationship may still be sent.

20 Research opportunities

SGR Occupational Therapy may share information about opportunities to participate in external research. Participation is voluntary and choosing not to participate will not affect access to services. Identifiable client information will not be given to a researcher for recruitment or research use without consent or another lawful basis.

21 Privacy enquiries and complaints

Privacy questions, access or correction requests and complaints can be made using the contact details below. A complaint should explain the concern and any outcome the person is seeking, but no particular form is
required. We will acknowledge the complaint, assess it fairly, communicate about progress and provide an outcome within a reasonable period.

In most cases, the Office of the Australian Information Commissioner expects a person to first give the organisation a reasonable opportunity to respond, usually 30 days. If the person is not satisfied, they may
contact the Office of the Australian Information Commissioner. A complaint about Victorian health information may also fall within the jurisdiction of the Victorian Health Complaints Commissioner.

Office of the Australian Information Commissioner:
https://www.oaic.gov.au/privacy/privacy-complaints

Victorian Health Complaints Commissioner:
https://hcc.vic.gov.au/make-complaint

22 Contact details

Principal Occupational Therapist
SGR Occupational Therapy
Phone 0432 467 750
Email hello@sgroccupationaltherapy.com
Website https://sgroccupationaltherapy.com

23 Changes to this policy

This policy is reviewed at least annually and when services, technology, information-handling practices or legal requirements change. The current version will be published on the SGR Occupational Therapy website. If a
significant change affects how existing information is handled, reasonable steps will be taken to communicate the change where appropriate.

Â