Privacy Policy

We protect your personal and health information and handle it only as described here and as Australian law requires.

1. About this policy

New Leaf Allied Health Services Pty Ltd (ABN 23 696 922 746) (“New Leaf”, “we”, “us”, “our”) is a mobile occupational therapy practice based on the Gold Coast, Queensland. Our services are delivered by occupational therapists registered with the Australian Health Practitioner Regulation Agency (Ahpra). We provide services to private clients and to NDIS participants who self-manage or are plan-managed.

This policy applies to anyone whose information we handle, including clients, parents, guardians, carers, nominees, referrers, support coordinators, plan managers, other health professionals, job applicants, contractors and visitors to our website.

Laws and standards we comply with

• Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs). As a health service provider, we are covered by the Privacy Act regardless of our annual turnover.
• Notifiable Data Breaches scheme under Part IIIC of the Privacy Act.
• National Disability Insurance Scheme Act 2013 (Cth) and the NDIS Code of Conduct, which applies to all NDIS providers, including unregistered providers. We also align our practices with the privacy and dignity requirements of the NDIS Practice Standards.
• Health Practitioner Regulation National Law, as applied in Queensland, and the Occupational Therapy Board of Australia’s Code of conduct, including its requirements on confidentiality, privacy and health records.
• Spam Act 2003 (Cth) for any electronic messages we send.

Where this policy and the law differ, the law prevails.

2. What information we collect

We collect only the information we reasonably need to provide safe, effective occupational therapy and to run our practice.

Personal information may include:

• name, date of birth, gender, and preferred name and pronouns
• address, phone number and email address
• details of parents, guardians, carers, nominees and emergency contacts
• school, early learning or workplace details where relevant to therapy
• NDIS number, plan details, plan management type, plan manager and support coordinator details
• Medicare, private health insurance or other funding details
• billing and payment records

Health and sensitive information may include:

• referral information, medical history, diagnoses and current supports
• developmental, sensory, functional, communication and daily living information
• assessment results, reports, goals, clinical notes and therapy plans
• information about cultural background, language and access needs, where it helps us provide respectful and safe care
• photos or videos taken during sessions, only with your express consent and only for clinical purposes

We only collect sensitive information with your consent, unless the law permits otherwise (for example, in an emergency or where required by law).

Other information may include enquiries made through our website, emails and messages you send us, and feedback or complaints.

3. How we collect information

We collect information directly from you wherever we can, in a way that is fair, lawful and not intrusive.

We collect information:

• when you contact us, complete an intake or referral form, or book a service
• during assessments, therapy sessions, phone calls, video calls and emails
• through our website contact or enquiry forms

With your consent, we may also collect information from others involved in your care, such as your GP, paediatrician, other allied health professionals, school or early learning staff, support coordinators, plan managers, or the National Disability Insurance Agency (NDIA).

If we receive information we did not ask for, we will check whether we could have lawfully collected it. If not, we will destroy or de-identify it where lawful and reasonable to do so.

Consent and decision-making

• We seek informed consent before starting services and before sharing information with others.
• For children, and for adults who need support to make decisions, we seek consent from a parent, guardian or authorised representative, while involving the person themselves as much as possible.
• We support each person’s right to make decisions about their own information, in line with their age, capacity and preferences.
• You can withdraw or change your consent at any time by contacting us. This will not affect anything we have already done in reliance on that consent.

Anonymity and pseudonyms

You can make general enquiries without identifying yourself or by using a pseudonym. To provide clinical services, process NDIS or other claims, and meet our legal and professional obligations, we will need your real name and identifying details.

4. How we use and share information

We use and share your information only for the purpose we collected it, a directly related purpose you would reasonably expect, or as the law requires or allows.

How we use it

• to provide assessment, therapy, reports and recommendations
• to plan, coordinate and review your supports
• to communicate with you about appointments and services
• to issue invoices and process payments and claims
• to meet our legal, professional, insurance and regulatory obligations
• to improve the quality and safety of our services, using de-identified information where possible

Who we may share it with

With your consent, we may share relevant information with:

• your GP, specialists and other health or allied health professionals involved in your care
• schools, early learning services or workplaces, where this supports your goals
• support coordinators, plan managers and the NDIA, including reports needed for plan reviews
• Medicare, private health insurers or other funding bodies

We will only share what is needed for the purpose.

When we may share it without consent

We may disclose information without consent only where permitted or required by law, including where:

• there is a serious threat to the life, health or safety of any person, or to public safety
• we have concerns about the safety or wellbeing of a child or an adult at risk
• we are required by a court order, subpoena or other legal process
• we are required to provide information to a regulator, such as Ahpra, the Occupational Therapy Board of Australia or the NDIS Quality and Safeguards Commission
• it is needed for our professional indemnity insurer or legal advisers

NDIS participants

• We operate as an unregistered NDIS provider and support self-managed and plan-managed participants.
• We share invoices and service details with your plan manager (if you have one) so they can pay for your supports.
• We share reports and progress information with the NDIA or your support coordinator only with your consent.
• We follow the NDIS Code of Conduct, including respecting your right to privacy, dignity and choice and control.
• Choosing not to share information will not affect your right to receive our services, although it may limit what we can do (for example, providing a report for a plan review).

Direct marketing

We do not sell, rent or trade your personal information. We will only send you newsletters or service updates if you agree, and every message will include an easy way to unsubscribe. We never use health information for marketing.

5. Our website and digital tools

Our website collects only the information you choose to give us and basic, non-identifying usage data.

Website forms and emails

Information you submit through our contact or enquiry forms is sent to us securely and used only to respond to your enquiry. Please do not include detailed health information in a website form or general email. We will arrange a secure way to share it.

Cookies and analytics

Our website may use cookies and analytics tools (such as Google Analytics) to understand how visitors use the site. This data is aggregated and does not identify you. You can disable cookies in your browser settings, although some features may not work as intended.

Third-party links and social media

Our website and social media pages may link to other sites. We are not responsible for their privacy practices. We will never post client information, photos or testimonials on social media or our website without your express written consent.

Telehealth

Where sessions are held by video, we use secure platforms and ask that you join from a private space. We do not record telehealth sessions without your express consent.

Artificial intelligence tools

We will only use AI-assisted tools (such as AI note-taking or transcription) with your informed consent, and you can decline without affecting your care. Your occupational therapist reviews and remains responsible for all clinical records. We only use tools that meet Australian privacy requirements and do not use your information to train AI models.

Automated decisions

We do not make decisions about you using automated processes. All clinical and service decisions are made by our qualified staff.

6. Storage, security and retention

We store records securely, keep them for the periods the law and our professional standards require, and then destroy them securely.

How we keep information secure

• Client records are kept in secure, password-protected practice management software (Splose) with multi-factor authentication.
• Only staff and contractors who need information to do their work can access it, and all are bound by confidentiality obligations.
• As a mobile practice, we keep devices locked and encrypted, and keep any paper documents in a locked container while travelling. Paper records are scanned into the client file and securely destroyed.
• We regularly review our security practices, software and staff training.

How long we keep records

Record type	Minimum retention period
Adult client records	7 years from the date of last contact
Records of children and young people	Until the person turns 25, or 7 years from last contact, whichever is later
NDIS service and billing records	At least 7 years, or longer if required by the NDIS or other law

We may keep records longer if they are needed for a legal matter. When records are no longer needed, we destroy or permanently de-identify them securely.

Overseas disclosure

We aim to store information in Australia. Our only software provider that may store data outside Australia is Splose, our practice management software, which stores data wherever its own hosting is located. Where this happens, we take reasonable steps to ensure the provider handles your information in line with the Australian Privacy Principles.

7. Your rights, complaints and contact

You can access and correct your information, and raise a concern with us or an external body at any time.

Accessing and correcting your information

• You can ask for a copy of the information we hold about you by contacting us. We will respond within 30 days.
• There is no charge to make a request. We may charge a reasonable fee for copying large records, and will tell you before any cost applies.
• We may refuse access only where the law allows, for example if access would pose a serious threat to someone’s life, health or safety. If we refuse, we will explain why in writing and how you can complain.
• If you believe your information is inaccurate, out of date or incomplete, you can ask us to correct it. If we disagree, you can ask us to attach a statement of your view to the record.

Data breaches

If a data breach is likely to result in serious harm to anyone, we will contain it, assess it and notify the people affected and the Office of the Australian Information Commissioner (OAIC), as required by the Notifiable Data Breaches scheme.

Making a complaint

Please contact us first so we can try to resolve your concern. We will acknowledge your complaint within 5 business days, aim to resolve it within 30 days, and keep you informed. Raising a concern will never affect your access to our services. You can involve an advocate or support person at any stage.

If you are not satisfied, you can contact:

Body	For	Contact
Office of the Australian Information Commissioner	Privacy complaints	1300 363 992
NDIS Quality and Safeguards Commission	Concerns about NDIS supports	1800 035 544
Office of the Health Ombudsman (Qld)	Concerns about a health practitioner or service in Queensland	133 646
Ahpra	Information about practitioner registration	1300 419 495

Contact us

Privacy Officer, New Leaf Allied Health Services Pty Ltd

• Email: hello@newleafallied.com.au
• Phone: 0493 740 019
• Post: PO Box 1097, Nerang QLD 4211
• Website: newleafallied.com.au

If you need an interpreter, contact the Translating and Interpreting Service (TIS National) on 131 450. If you are Deaf or have a hearing or speech impairment, contact us through the National Relay Service.

Changes to this policy

We review this policy at least once a year and when the law changes. The current version is always available on our website, and a printed copy is available on request.