Privacy Policy

Purpose

At Include Me Speech Pathology Ballarat, we respect your privacy and understand the importance of protecting personal and health information.

We collect information that is reasonably necessary to provide safe, effective and individualised speech pathology services and to meet our professional, legal, regulatory and administrative responsibilities.

We take reasonable steps to keep your information secure and confidential. We only collect, use or disclose information for the purposes for which it was collected, for related purposes you would reasonably expect, with your consent, or where we are otherwise permitted or required to do so by law.

You may ask to access or correct information we hold about you or your child and may raise concerns with us about how your information has been handled.

1. Our Privacy Obligations

Include Me Speech Pathology Ballarat Pty Ltd ("Include Me", "we", "our" or "us") is committed to protecting the privacy, confidentiality and dignity of our clients and their families.

We manage personal and health information in accordance with applicable laws and professional obligations, including:

• the Privacy Act 1988 (Cth) and Australian Privacy Principles (APPs);
• the Health Records Act 2001 (Vic) and Health Privacy Principles (HPPs);
• applicable National Disability Insurance Scheme (NDIS) legislation, Rules, Practice Standards and Quality Indicators;
• the NDIS Code of Conduct; and
• the Speech Pathology Australia Code of Ethics.

Where more than one privacy requirement applies, we will manage information in accordance with our applicable legal and professional obligations.

2. Information We May Collect

The information we collect will depend on the services you receive and may include:

• your or your child's name, date of birth and contact details;
• parent, guardian, nominee, advocate or emergency contact details;
• Medicare or NDIS information where relevant;
• medical, developmental and health history;
• diagnoses and disability-related information;
• speech, language, communication, literacy, feeding or swallowing information;
• assessment results and clinical observations;
• therapy goals, progress notes and treatment records;
• reports from medical practitioners, allied health professionals, schools or other services;
• information about education, daily activities and participation;
• cultural, linguistic, communication or accessibility preferences where relevant to providing services;
• correspondence between Include Me and you or other authorised people involved in your care or support;
• billing and payment information; and
• other information reasonably necessary to provide safe and appropriate speech pathology services.

Health information and some other information we collect are considered sensitive information and receive additional protection under Australian privacy law.

We aim to collect only information that is reasonably necessary for the purposes of providing our services and meeting our legal, professional and administrative obligations.

3. Why We Collect Information

We may collect, hold, use and disclose information where reasonably necessary to:

• assess communication and related needs;
• plan and provide speech pathology assessment and intervention;
• monitor and document progress;
• communicate with you about services;
• prepare clinical reports and recommendations;
• communicate and collaborate with other professionals where authorised or otherwise permitted by law;
• provide telehealth services;
• manage appointments, billing and administration;
• meet NDIS, Medicare, insurer or other funding requirements where applicable;
• maintain appropriate clinical and business records;
• manage feedback, complaints, incidents and risks;
• supervise staff, students or other workers where appropriate and authorised;
• meet our legal, regulatory, insurance and professional obligations; and
• maintain and improve the quality and safety of our services.

Where required, we will explain why particular information is being collected, how it will be used and disclosed, and how you may access or correct it.

4. How We Collect Information

We generally collect information directly from you, your child or an authorised representative.

Information may be collected through:

• enquiry and intake forms;
• conversations during appointments;
• assessment and therapy sessions;
• telephone and video calls;
• email and other electronic communications;
• telehealth;
• clinical observations;
• questionnaires and assessment tools;
• correspondence and reports;
• our website or online contact forms; and
• other methods reasonably necessary to provide our services.

With appropriate consent or another lawful basis, we may also obtain relevant information from people or organisations such as:

• GPs and medical specialists;
• paediatricians;
• allied health professionals;
• schools and early childhood services;
• hospitals;
• disability support providers;
• support coordinators or plan managers;
• previous service providers; and
• other people involved in your or your child's care or support.

In limited circumstances, information may be collected without consent where collection is permitted or required by law.

5. Consent, Use and Disclosure

We seek informed consent for the collection, use and disclosure of information as appropriate to the services we provide.

With your consent, relevant information may be shared with people or organisations involved in your or your child's care, education or support, including:

• medical practitioners;
• allied health professionals;
• schools and educational services;
• early childhood services;
• the National Disability Insurance Agency (NDIA) or NDIS-related bodies where appropriate;
• plan managers or support coordinators;
• Medicare;
• insurers; and
• other authorised service providers.

We aim to share only information that is reasonably necessary for the relevant purpose.

There are circumstances in which we may be permitted or required by law to collect, use or disclose information without consent. These may include circumstances involving:

• mandatory reporting or child safety obligations;
• serious threats to a person's life, health or safety;
• serious threats to public health or safety;
• court orders, subpoenas or other legal processes;
• investigation or enforcement activities authorised by law; or
• other circumstances permitted or required by applicable privacy or health records legislation.

You may withdraw or change consent for future collection, use or disclosure by contacting us.

Withdrawal of consent does not affect information already lawfully collected, used or disclosed. Depending on the circumstances, withdrawing consent may affect our ability to provide particular services safely or effectively. If this occurs, we will discuss this with you.

6. Photographs, Audio and Video Recordings

Photographs, audio recordings and video recordings may sometimes be clinically useful for assessment, therapy, consultation, supervision or monitoring progress.

Where we wish to make a recording, we will explain its purpose and seek appropriate consent.

Recordings will not be used for unrelated purposes without appropriate consent or another lawful basis.

Consent to an optional recording may be declined or withdrawn without affecting access to ordinary speech pathology services.

Where a particular recording is necessary to conduct an assessment or provide a particular service, we will explain this before seeking consent.

Recordings that form part of a clinical record will be managed with appropriate privacy and security protections.

7. Electronic Systems, Telehealth and Third-Party Service Providers

We may use electronic systems and third-party service providers to manage aspects of our clinical and business operations, including:

• clinical records;
• appointment scheduling;
• billing and accounting;
• electronic communication;
• telehealth;
• secure document storage and transfer;
• payment processing; and
• other administrative functions.

Our primary practice management system is currently Cliniko. We also use Xero for accounting and financial administration.

We take reasonable steps when selecting and using service providers to consider their privacy, security and data-handling practices.

Australian and Overseas Data Processing

Some electronic service providers may store or process information using infrastructure located outside Victoria or outside Australia.

Where personal or health information is disclosed or transferred outside Victoria or Australia, we take reasonable steps to manage that information consistently with our obligations under applicable privacy legislation, including the transborder data requirements of the Health Records Act 2001 (Vic) and, where applicable, the cross-border disclosure requirements of the Australian Privacy Principles.

The countries in which information may be processed can change as technology providers change their infrastructure and subcontractors. Information about the current data-handling and hosting arrangements of particular providers may be obtained from us on request or from the relevant provider's published privacy and security information.

We seek to minimise the amount of personal and health information disclosed to administrative and financial systems and do not intentionally enter detailed clinical notes, raw assessment data or diagnostic reports into accounting platforms unless reasonably necessary and lawfully permitted.

8. Storage and Security

We take reasonable steps to protect personal and health information from misuse, interference, loss, unauthorised access, modification and disclosure.

Depending on the nature of the information and the systems involved, safeguards may include:

• password-protected electronic systems;
• appropriate access controls;
• secure electronic storage;
• multi-factor authentication where available and appropriate;
• appropriate computer and device security;
• secure methods of transferring information;
• locked storage for paper records where used;
• maintaining appropriate backups;
• limiting access to people who require information to perform their role; and
• reviewing the security and privacy arrangements of service providers where appropriate.

No method of electronic storage or communication can be guaranteed to be completely secure. If we become aware of a suspected privacy or data breach, we will take appropriate steps to contain and assess the breach and make notifications where required by law.

9. Accessing Your Information

You may request access to personal or health information that we hold about you, subject to applicable legal requirements and exceptions.

Where you are requesting information concerning another person, including a child or young person, we may need to consider your legal authority to access that information and the privacy rights and decision-making capacity of the person concerned.

Requests may be made by contacting Include Me Speech Pathology Ballarat using the contact details at the end of this policy.

We will respond to access requests without unreasonable delay.

Where the Health Records Act 2001 (Vic) applies, an access request will be handled within the timeframe required by that Act, including the applicable maximum 45-day response period.

Reasonable fees may apply to some requests where permitted by law. If a fee applies, we will explain this before proceeding where appropriate.

In some circumstances, the law may permit or require us to refuse access to some or all of the requested information. If this occurs, we will explain the reason where we are permitted to do so and provide information about available complaint or review mechanisms.

10. Correcting Your Information

We take reasonable steps to ensure that personal and health information we hold is accurate, current, complete, relevant and not misleading.

You may ask us to correct information that you believe is inaccurate, out of date, incomplete, irrelevant or misleading.

Where the Health Records Act 2001 (Vic) applies, we will respond to a correction request within the applicable legal timeframe, including the applicable 30-day period.

If we decline to make a requested correction, we will explain the reason where required by law and provide information about available complaint mechanisms.

Where applicable, you may request that a statement setting out the correction you sought be associated with the relevant record.

11. Privacy and Children and Young People

Much of our work involves children and young people.

We recognise that a child's or young person's capacity to understand and participate in decisions about their health information develops with their age, maturity, communication abilities and individual circumstances.

Where appropriate, we seek consent from a parent, guardian or other legally authorised representative and involve the child or young person in decisions about their information in a way that supports their:

• understanding;
• communication needs;
• preferences;
• privacy;
• autonomy; and
• dignity.

As children and young people develop greater capacity to understand and make their own healthcare and privacy decisions, we will take this into account when determining whose consent or authorisation is required.

We will also consider applicable legal arrangements affecting parental responsibility, guardianship or decision-making authority where these are relevant to the provision of services or handling of information.

12. Record Retention and Disposal

We retain clinical records in accordance with applicable Victorian legislation and other legal, professional, insurance and contractual requirements.

Under the Victorian health records framework, health information held by a private-sector health service provider is generally retained for at least:

• seven years from the last occasion on which a health service was provided to an adult; or
• where the information was collected while the person was under 18 years of age, until that person reaches 25 years of age.

Records may be retained for longer where another legal, contractual, insurance, risk-management or professional requirement applies.

When information is no longer required to be retained, we take reasonable steps to securely destroy or permanently de-identify it in accordance with applicable requirements.

Where required, records relating to the destruction or transfer of health information will also be maintained.

13. Transfer of Records and Closure or Transfer of the Practice

You may request that relevant health information be made available to another health service provider, subject to applicable legal requirements.

If Include Me Speech Pathology Ballarat ceases providing health services, transfers or sells the practice, or otherwise changes arrangements for custody of health records, we will manage affected health information in accordance with the Health Records Act 2001 (Vic) and other applicable requirements.

Where required, reasonable steps will be taken to notify affected clients about what will happen to their records and how they may obtain access to them or arrange for appropriate transfer.

14. Use of Emerging Technology and Artificial Intelligence

Include Me may use appropriate technology, including artificial intelligence (AI)-assisted tools, to support administrative, educational or clinical work.

Examples may include assisting with:

• developing therapy resources;
• organising or structuring educational materials;
• drafting or structuring documents;
• analysing de-identified patterns or information; and
• other administrative support functions.

AI systems are support tools and do not replace professional clinical judgement.

Include Me does not intentionally enter identifiable client health information into general-purpose generative AI systems.

Where information derived from clinical work is used with an AI-assisted tool, we take reasonable steps to remove identifying information unless the particular system has been specifically assessed and approved for the lawful and secure handling of that information.

De-identification may include removing information such as:

• names;
• dates of birth;
• addresses and specific geographic information;
• school or workplace names;
• contact details;
• Medicare or NDIS numbers;
• photographs or other direct identifiers; and
• combinations of information that could reasonably identify an individual.

We consider the privacy and security arrangements of AI services before using them for practice-related purposes and seek to use systems and settings appropriate to the sensitivity of the information involved.

Clinical reasoning, diagnosis, therapy recommendations and final clinical documentation remain the responsibility of the treating speech pathologist. AI-generated material is reviewed as appropriate before being relied upon for professional purposes.

15. Privacy Complaints and Concerns

We welcome questions, feedback or concerns about how personal or health information has been collected, used, stored, disclosed or otherwise handled.

You may make a privacy complaint verbally or in writing by contacting:

The Director – Ann Betts
Include Me Speech Pathology Ballarat Pty Ltd
Phone: 0419 942 589
Email: contact@includemespeechpathology.com.au

We will treat privacy complaints respectfully, fairly and confidentially.

We will:

• acknowledge the complaint;
• consider and investigate the concerns fairly;
• provide information about the outcome and any actions taken or proposed; and
• keep you informed if additional time is reasonably required to investigate a complex matter.

We aim to provide a substantive response to privacy complaints within 30 days wherever reasonably possible.

Making a complaint will not adversely affect your access to our services, and you will not be treated unfavourably because you have raised a concern.

You may have a family member, advocate, support person or other representative assist you in making a complaint.

Further information about our complaints process is available in our Complaints Policy and Procedure, which we can provide on request.

External Complaint Options

If you are not satisfied with our response, or wish to seek external advice or assistance, the appropriate organisation will depend on the nature of your concern.

Health Complaints Commissioner – Victoria (HCC)

The Health Complaints Commissioner handles complaints about health services and the handling of health information in Victoria, including concerns relating to privacy, confidentiality and access to health records.

Phone: 1300 582 113
Website: hcc.vic.gov.au

Office of the Australian Information Commissioner (OAIC)

The OAIC handles privacy complaints under the Privacy Act 1988 (Cth) and Australian Privacy Principles where those laws apply.

Generally, you should first raise your concern with us. If you are not satisfied with our response, or we have not responded within 30 days, you may be able to lodge a complaint with the OAIC.

Website: oaic.gov.au

NDIS Quality and Safeguards Commission

If your concern relates to NDIS-funded supports or services, including concerns about the conduct of an NDIS provider or worker or the handling of a complaint, you may contact the NDIS Quality and Safeguards Commission.

Phone: 1800 035 544
Website: ndiscommission.gov.au

Speech Pathology Australia

If your concern relates to the professional or ethical conduct of a Speech Pathology Australia member, you may contact Speech Pathology Australia for information about its ethics concerns and complaints processes.

Website: speechpathologyaustralia.org.au

16. Data Breaches

We take suspected privacy and data breaches seriously.

Where a breach or suspected breach occurs, we will take reasonable steps to:

• contain the incident;
• investigate what occurred;
• identify the information and people potentially affected;
• assess the potential consequences;
• reduce the risk of further harm;
• take appropriate remedial action; and
• review whether changes to our systems, processes or practices are required.

Where a breach meets the requirements of the Commonwealth Notifiable Data Breaches scheme or another applicable notification requirement, we will notify affected individuals and relevant authorities as required by law.

We may also report or seek guidance about a privacy incident from an appropriate regulator where required or appropriate.

17. Changes to This Privacy Policy

We review this Privacy Policy periodically and may update it to reflect changes in:

• our services;
• information-handling practices;
• technology;
• third-party service providers; or
• legal, regulatory and professional requirements.

The current version of this Privacy Policy will be available on our website.

The date on which the policy was last updated will be displayed at the beginning of the document.

18. Contact Us

Questions about this Privacy Policy, requests for access or correction, privacy concerns and complaints can be directed to:

Ann Betts
Director
Include Me Speech Pathology Ballarat Pty Ltd
Phone: 0419 942 589
Email: contact@includemespeechpathology.com.au

A copy of this Privacy Policy can be provided in another accessible format on request.