Privacy Policy

Last updated: October 2026

I am committed to respecting your privacy and protecting the personal and health information that I collect in providing occupational therapy services.

This policy explains what information I may collect, how I use and store it, when it may be shared, and your rights in relation to your information.

What information may I collect?

The information I collect will depend on the services I provide to you. It may include:

·       your name, date of birth and contact details;

·       information about your health, disability, diagnoses, medications and treatment;

·       information about your daily functioning, activities, relationships, living situation, supports and goals;

·       information provided by family members, carers or other people involved in your care;

·       reports and correspondence from health professionals, support providers and other organisations;

·       NDIS, Medicare, DVA or other funding information;

·       assessment results, clinical observations and occupational therapy notes;

·       appointment and communication information;

·       billing and payment information; and

·       reports, recommendations, letters and other documents prepared as part of your occupational therapy services.

Health information is sensitive personal information and is treated with a high level of confidentiality.

How do I collect information?

Where possible, I collect information directly from you.

With your consent, I may also obtain relevant information from other people or organisations involved in your care or supports, such as your:

·       family, partner, carers or other nominated supports;

·       GP, psychiatrist or other medical specialists;

·       psychologist, counsellor or allied health professionals;

·       Support Coordinator, Psychosocial Recovery Coach or support providers;

·       NDIA, plan manager or other NDIS services;

·       WA Health or private health services; or

·       Medicare, DVA or another funding body.

There may also be limited circumstances where information may be collected without your consent where this is permitted or required by law.

Why do I collect and use your information?

I collect and use personal and health information where it is reasonably necessary to provide occupational therapy services.

This may include using information to:

·       understand your needs, strengths, goals and circumstances;

·       assess your functional capacity;

·       plan and provide occupational therapy assessment and intervention;

·       make recommendations about supports, equipment, services or strategies;

·       communicate and coordinate with other people involved in your care or supports;

·       prepare reports, letters, assessments or funding applications;

·       meet NDIS, Medicare, DVA or other funding requirements;

·       manage appointments, billing and practice administration;

·       maintain appropriate clinical records; and

·       meet professional, legal and regulatory responsibilities.

When may I share your information?

I will generally only share relevant personal or health information:

·       with your consent;

·       for the purpose for which the information was collected, or for a related purpose you would reasonably expect;

·       where sharing is reasonably necessary to provide the services you have asked me to provide; or

·       where sharing is otherwise permitted or required by law.

Where appropriate, I will ask you which people or organisations you are comfortable with me communicating with.

You may place limits on your consent, including asking me not to communicate with a particular person or organisation.

 When might information be shared without your consent?

There are limited circumstances where I may be permitted or required to disclose information without your consent.

These may include situations involving:

·       a serious threat to someone's life, health or safety;

·       child protection obligations;

·       a court order or other legal requirement; or

·       another circumstance where disclosure is authorised or required by law.

Where appropriate and lawful, I will try to discuss this with you.

How are clinical records stored?

My primary clinical practice management system is splose.

I use splose for functions including:

·       client records;

·       clinical notes;

·       assessments and forms;

·       appointments;

·       correspondence;

·       invoicing; and

·       other practice administration.

I also use Microsoft OneDrive for secure business document and file storage.

Access to my practice systems and devices is restricted and protected using passwords, device security and other available security measures.

Relevant information received through email, telephone, SMS, messaging platforms, telehealth or team meetings may be recorded or summarised in the clinical record where appropriate.

Electronic systems and third-party service providers

I use a number of technology services in operating my practice.

Depending on how services are provided and how you choose to communicate with me, information may be processed or stored using:

·       splose – practice management and clinical records;

·       Microsoft OneDrive – business and document storage;

·       email – communication with clients, professionals, support providers and funding bodies;

·       Apple devices and iCloud – devices, file synchronisation, contacts, messages and device services;

·       telephone and SMS – communication;

·       WhatsApp – where a participant and their support team have chosen to use a group chat;

·       Tyro – payment processing;

·       Zoom – telehealth and meetings; and

·       Microsoft Teams – telehealth, meetings and team communication.

I take reasonable steps to use these systems in a way that protects privacy and to limit the information entered or shared to what is reasonably necessary.

Email, SMS and electronic communication

I may communicate with you and, where authorised, with other people involved in your care or supports by:

·       email;

·       telephone;

·       SMS;

·       telehealth; or

·       another agreed electronic communication method.

Electronic communication can carry privacy and security risks that cannot be completely eliminated.

I take reasonable steps to minimise these risks, including limiting identifying or sensitive information where practical and using more secure methods where the nature of the information warrants it.

WhatsApp and group messaging

Where you and members of your support team choose to establish a group chat using WhatsApp or another messaging platform, information shared in that group will be visible to all members of the group.

I will use group messaging for relevant communication and will avoid sharing more sensitive clinical information than is reasonably necessary.

Group members may be able to retain, copy, forward or take screenshots of information shared in a group. I therefore recommend that group chats are used thoughtfully and only with people you are comfortable receiving the information shared there.

Important clinical information received or discussed in a group chat may be recorded or summarised in your clinical record where appropriate.

You may ask me to stop communicating through a group chat at any time.

Telehealth and online meetings

Telehealth appointments or meetings may be conducted using Zoom or Microsoft Teams.

I take reasonable steps to use appropriate privacy and access settings.

Appointments or meetings are not routinely recorded. If recording were ever considered necessary, this would be discussed with you and specific consent would be obtained beforehand.

AI-assisted clinical documentation

With your consent, I may use AI-assisted functionality within splose to assist with clinical documentation.

For example, AI may assist with drafting, summarising or organising notes from an appointment.

AI-assisted documentation does not replace my professional judgement. I remain responsible for reviewing the information and for the accuracy and appropriateness of the final clinical record.

Consent to the use of AI-assisted documentation is optional.

You may decline or withdraw consent to AI-assisted documentation without affecting your ability to receive occupational therapy services.

Cloud storage and overseas processing

Some of the technology services I use operate through cloud-based systems.

Although I take reasonable steps to select reputable providers with appropriate privacy and security protections, some providers or their subcontractors may process or store limited information outside Australia.

Where this occurs, I take reasonable steps to ensure that the services I use have appropriate arrangements for protecting personal information.

Further information about particular technology providers or their privacy arrangements is available on request.

How do I protect your information?

I take reasonable steps to protect personal and health information from misuse, loss, interference, unauthorised access, modification or disclosure.

Measures include:

·       password-protected devices and services;

·       restricting access to clinical information;

·       secure electronic clinical and cloud storage;

·       locking devices when they are not in use;

·       protecting screens and documents from being viewed by others;

·       securely storing paper information;

·       avoiding public Wi-Fi when accessing clinical information; and

·       using appropriate privacy and security settings within the technology services I use.

Paper records

Most clinical information is stored electronically.

Where paper documents are required, I take reasonable steps to keep them secure and protected from unauthorised access.

Paper documents containing identifying information are kept securely when stored at my home office or when travelling.

Accessing your information

You may ask to access personal or health information that I hold about you.

Please contact me if you would like to request access to your records.

There may be limited circumstances where access may lawfully be refused or restricted. If this applies, I will explain the reason where I am legally able to do so.

Correcting your information

I aim to keep the personal information I hold accurate, complete and up to date.

If you believe information I hold about you is incorrect, incomplete or out of date, please let me know.

You may ask for information to be corrected.

How long is information retained?

I retain clinical and business records for the period required by applicable professional, legal, funding and record-keeping obligations.

When information is no longer required to be retained, I take reasonable steps to securely destroy or de-identify it.

Data breaches

If personal information is lost or accessed or disclosed without authorisation, I will take reasonable steps to:

·       contain the incident;

·       assess what has occurred;

·       reduce the risk of further harm; and

·       notify affected people and relevant authorities where required by law.

Privacy concerns and complaints

If you have a question or concern about how your personal information has been collected, stored, used or shared, please contact me.

I will take privacy concerns seriously and will try to resolve them promptly.

If you are not satisfied with my response, you may contact the:

Office of the Australian Information Commissioner (OAIC)
Phone: 1300 363 992
Website: www.oaic.gov.au

Changes to this Privacy Policy

I may update this Privacy Policy from time to time to reflect changes in my practice, technology, legal requirements or privacy practices.

The current version will be made available to clients on request and through any location where I make this policy available electronically.

Contact

Penny Thomas
Occupational Therapist
AHPRA: OCC0001750713
ABN: 24 593 522 190

Phone: 0430 050 534
Email: pennythomas.ot@icloud.com

pennythomasot.com.au