Privacy Policy

Purpose

At Include Me Speech Pathology Illawarra, we respect your privacy and understand the importance of protecting personal and health information.

We collect information that is reasonably necessary to provide safe, effective and individualised speech pathology services and to meet our professional, legal and administrative responsibilities.

We take reasonable steps to keep your information secure and confidential. We only use or share information for the purposes for which it was collected, for related purposes you would reasonably expect, with your consent, or where we are otherwise permitted or required to do so by law.

You may ask to access or correct information we hold about you or your child and may raise concerns with us about how your information has been handled.

1. Our Privacy Obligations

Include Me Speech Pathology Illawarra Pty Ltd ("Include Me", "we", "our" or "us") is committed to protecting the privacy, confidentiality and dignity of our clients and their families.

We manage personal and health information in accordance with applicable laws and professional obligations, including:

• the Privacy Act 1988 (Cth) and Australian Privacy Principles (APPs);
• the Health Records and Information Privacy Act 2002 (NSW) and Health Privacy Principles (HPPs);
• applicable NDIS legislation, Rules, Practice Standards and Quality Indicators;
• the NDIS Code of Conduct; and
• the Speech Pathology Australia Code of Ethics.

2. Information We May Collect

The information we collect will depend on the services you receive and may include:

• your or your child's name, date of birth and contact details;
• parent, guardian, nominee or emergency contact details;
• Medicare or NDIS information where relevant;
• medical, developmental and health history;
• diagnoses and disability-related information;
• speech, language, communication, feeding or swallowing information;
• assessment results and clinical observations;
• therapy goals, progress notes and treatment records;
• reports from other health professionals, schools or services;
• information about education and participation;
• cultural, linguistic or communication preferences where relevant to providing services;
• correspondence between Include Me and you or other authorised people involved in your care;
• billing and payment information; and
• other information reasonably necessary to provide safe and appropriate speech pathology services.

Health information and some other information we collect is considered sensitive information and receives additional protection under Australian privacy law.

3. Why We Collect Information

We may collect, hold, use and disclose information where reasonably necessary to:

• assess communication and related needs;
• plan and provide speech pathology assessment and intervention;
• monitor and document progress;
• communicate with you about services;
• prepare clinical reports and recommendations;
• communicate and collaborate with other professionals where authorised;
• provide Telehealth services;
• manage appointments, billing and administration;
• meet NDIS, Medicare, insurer or other funding requirements where applicable;
• maintain appropriate clinical and business records;
• manage feedback, complaints, incidents and risks;
• meet our legal, regulatory, insurance and professional obligations; and
• maintain and improve the quality and safety of our services.

Where practical, we will explain why particular information is being requested and how it will be used.

4. How We Collect Information

We generally collect information directly from you, your child or their authorised representative.

Information may be collected through:

• enquiry and intake forms;
• conversations during appointments;
• assessment and therapy sessions;
• telephone and video calls;
• email and other electronic communication;
• Telehealth;
• clinical observations;
• questionnaires and assessment tools; and
• our website or online contact forms.

With appropriate consent, we may also obtain relevant information from people or organisations such as GPs, paediatricians, other allied health professionals, schools, early childhood services, hospitals or previous service providers.

In limited circumstances, information may be collected without consent where collection is permitted or required by law.

5. Consent, Use and Disclosure

We seek informed consent for the collection, use and disclosure of information as appropriate to the services we provide.

With your consent, relevant information may be shared with people or organisations involved in your or your child's care or support, including:

• medical practitioners;
• allied health professionals;
• schools and educational services;
• the NDIS or NDIA;
• plan managers or support coordinators;
• Medicare;
• insurers; and
• other authorised service providers.

We aim to share only information that is reasonably necessary for the relevant purpose.

There are circumstances in which we may be permitted or required by law to disclose information without consent. These may include circumstances involving mandatory reporting obligations, serious threats to health or safety, court orders or other legal requirements.

You may withdraw or change consent for future collection, use or disclosure by contacting us. Withdrawal of consent will not affect information already lawfully collected, used or disclosed and may, in some circumstances, affect our ability to provide particular services.

6. Photographs, Audio and Video Recordings

We will explain the purpose of any photograph, audio recording or video recording that we wish to make as part of assessment, therapy, supervision, consultation, training or another clinical activity and seek appropriate consent.

Recordings will not be used for unrelated purposes without appropriate consent or another lawful basis.

Consent to optional recording can be declined or withdrawn without affecting access to ordinary speech pathology services, except where a particular recording is necessary for an assessment or service and this has been explained to you.

7. Electronic Systems, Telehealth and Third-Party Providers

We may use electronic systems to manage clinical records, appointments, billing, communication, Telehealth and other aspects of service delivery.

Cross-Border Data Disclosures

Storage and Hosting of Records

We take the security of your personal and health information seriously. We utilise premium, secure cloud-based practice management and accounting software platforms to administer our clinic services, manage client files and process financial invoicing.

Local Storage (Clinical Data)

Your primary health records, clinical notes, speech therapy assessment data and appointment histories are stored on secure cloud servers physically located within Australia (via our practice management software, Cliniko). Continuous data backups and data redundancy architectures are maintained strictly within Australian borders.

Overseas Data Transfers (Administrative & Financial Data)

To ensure seamless business operations and billing efficiency, certain administrative and financial transaction data is processed using cloud platforms whose infrastructure is hosted internationally.

• What information is transferred: When we generate invoices, process payments, or track accounts, limited personal information—such as your name, contact details, appointment dates, and payment history—is synced with our cloud accounting platform (Xero).
• Where it is stored: This financial and basic administrative data is securely transferred to and stored on enterprise data centres located in the United States.
• No Health Data Shared: We do not upload clinical speech pathology notes, raw assessment scores, or diagnostic health reports to these international accounting platforms.

International Security Safeguards

Before engaging any cloud software provider that stores data outside of Australia, we verify that they maintain world-class security frameworks. All data transferred overseas is protected by bank-grade encryption both in transit (while moving across the internet) and at rest (while stored on servers).

Our international partners maintain independent third-party security certifications (such as SOC 2 Type II compliance) and are contractually bound by Data Processing Addendums that meet or exceed the data protection standards required by the Australian Privacy Act 1988 (Cth).

8. Storage and Security

We take reasonable steps to protect personal and health information from misuse, interference, loss, unauthorised access, modification and disclosure.

Depending on the type of information, safeguards may include:

• password-protected electronic systems;
• access controls;
• secure electronic storage;
• appropriate device security;
• secure methods of transferring information;
• locked storage for paper records where used; and
• limiting access to people who require the information to perform their role.

No method of electronic storage or communication can be guaranteed to be completely secure. If we become aware of a data breach, we will take appropriate steps to contain and assess the breach and will make notifications where required by applicable privacy law.

9. Accessing Your Information

You may request access to personal or health information that we hold about you or your child, subject to applicable legal requirements and exceptions.

Requests may be made by contacting Include Me Speech Pathology Illawarra using the details below.

We will respond within the timeframe required by applicable law or, where no specific timeframe applies, within a reasonable period.

In some circumstances, the law may permit or require us to refuse access to some or all information. If this occurs, we will explain the reason where we are permitted to do so and provide information about available complaint or review options.

10. Correcting Information

We take reasonable steps to ensure the information we hold is accurate, current, complete, relevant and not misleading.

You may ask us to correct information that you believe is inaccurate, out of date, incomplete, irrelevant or misleading.

If we decline to make a requested correction, we will explain the reason where required and inform you of available complaint mechanisms. Where applicable, you may also request that a statement noting your requested correction be associated with the record.

11. Privacy and Children and Young People

Much of our work involves children and young people.

We recognise that children's capacity to understand and participate in decisions about their information develops with age, maturity, communication abilities and individual circumstances.

Where appropriate, we seek consent from a parent, guardian or other legally authorised representative and involve the child or young person in decisions about their information in a way that supports their understanding, communication needs, preferences, autonomy and dignity.

As children develop greater capacity to make their own healthcare and privacy decisions, we will take this into account when determining whose consent or authorisation is required.

12. Record Retention and Disposal

We retain clinical records in accordance with applicable legal, professional and contractual requirements.

For health information held by a private health service provider in NSW, records relating to an adult are generally retained for at least seven years from the last occasion on which a health service was provided.

Where health information was collected while the person was under 18 years of age, records are generally retained until the person reaches 25 years of age.

Records may be retained for longer where another legal, contractual, insurance or professional requirement applies.

When records are no longer required to be retained, they are securely destroyed or de-identified in accordance with applicable requirements. Required records of the disposal or transfer of health information are maintained.

13. Use of Emerging Technology and Artificial Intelligence (AI)

We may utilise secure third-party Artificial Intelligence (AI) platforms to assist our clinicians in creating customised therapy resources, structuring educational materials and analysing clinical assessment patterns to support reporting.

To protect client confidentiality and strictly adhere to Australian Privacy Principle 11 (Information Security), no personal information or sensitive health data is ever disclosed or uploaded to external AI models. All data undergoes a rigorous de-identification process prior to utilisation.

Strict De-identification Protocols

Before any clinical observation, speech sample pattern, or assessment data is processed through AI assistance, all direct and indirect identifying references are completely removed. This includes the removal of names, dates of birth, geographic locations, school or workplace references and government identifiers (such as Medicare or NDIS numbers).

We contractually and technologically ensure that the AI platforms we utilize do not retain, store, or use our processing inputs to train public or proprietary machine learning models.

Maintenance of Professional Accountability

AI systems are strictly used as administrative and analytical support tools. Clinical reasoning, diagnosis, therapy planning, and final report validations are exclusively performed by our qualified Speech Pathologists in alignment with the Speech Pathology Australia Code of Ethics.

14. Privacy Complaints and Concerns

We welcome questions or concerns about how personal or health information has been handled.

You can make a privacy complaint verbally or in writing by contacting:

The Director – Michelle Halloran
Include Me Speech Pathology Illawarra Pty Ltd
Phone: 0415 353 797
Email: contact@includemespeechpathology.com.au

We will treat privacy complaints respectfully and confidentially, acknowledge the complaint, investigate the concerns fairly and provide a response and information about any actions taken or proposed.

Making a complaint will not adversely affect your access to our services.

Further information about our complaints process is available in our Complaints Policy and Procedure, which we can provide on request.

If you are not satisfied with our response, or wish to seek external assistance, you may be able to contact:

• the Office of the Australian Information Commissioner (OAIC);
• the Information and Privacy Commission NSW (IPC);
• the NDIS Quality and Safeguards Commission, where the matter relates to NDIS services; or
• Speech Pathology Australia, where the matter concerns the professional or ethical conduct of a member.

15. Data Breaches

We take suspected privacy and data breaches seriously.

Where a breach or suspected breach occurs, we will take reasonable steps to contain it, investigate what occurred, assess the potential consequences and take appropriate remedial action.

Where a breach meets the requirements of the Notifiable Data Breaches scheme or another applicable notification requirement, we will notify affected individuals and relevant authorities as required by law.

16. Changes to This Privacy Policy

We review this Privacy Policy periodically and may update it to reflect changes in our services, information-handling practices, technology or legal and professional requirements.

The current version will be available on our website.

17. Contact Us

Questions, requests for access or correction, privacy concerns and complaints can be directed to:

Michelle Halloran
Director
Include Me Speech Pathology Illawarra Pty Ltd
Phone: 0415 353 797
Email: contact@includemespeechpathology.com.au

A copy of this Privacy Policy can also be provided in another accessible format on request.