About this policy

This Privacy Policy explains how Creative Therapy Adelaide collects, uses, stores, protects and shares personal information through our website, enquiries, intake forms, service delivery, administration and communication with clients, families, participants, referrers, staff, contractors and support networks.

Creative Therapy Adelaide is bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles. These principles set out requirements for how personal information is collected, used, disclosed, stored and managed.

In this policy, “personal information” means information or an opinion about an identified individual, or an individual who is reasonably identifiable. “Health information” includes personal information about a person’s health, disability, therapy needs, services, assessments, reports or supports.

Anonymity and pseudonymity

You may contact Creative Therapy Adelaide anonymously or using a pseudonym where it is lawful and practical to do so.

In many situations, however, we will need accurate identifying information to respond properly, provide therapy services, manage appointments, complete intake, communicate with families or support networks, meet NDIS or funding requirements, process payments, keep records or meet legal and professional obligations.

If you choose not to provide certain information, we may not be able to respond fully to your enquiry or provide services.

What information we collect

We may collect personal information that is reasonably necessary for us to respond to enquiries, provide therapy services, manage bookings, communicate with you and meet our legal, professional and administrative obligations.

This may include:

• name, date of birth and contact details
• parent, guardian, carer, nominee or authorised representative details
• emergency contact details
• NDIS participant details, plan information, funding arrangements or support coordinator details
• Medicare, private health, concession, payment or billing information where relevant
• information provided through enquiry forms, intake forms, referral forms, emails, phone calls or SMS
• health, disability, developmental, communication, therapy, behavioural, sensory or support information
• assessment information, therapy notes, goals, reports and service records
• billing, payment, invoicing and transaction information
• feedback, complaints or other information you choose to provide
• website usage information, such as pages viewed, device information, browser information, IP address and referral source

Health and sensitive information

As an allied health provider, we may collect health information and other sensitive information where it is reasonably necessary for our services and where we have your consent or another lawful basis to do so.

Health information may include details about communication, speech, language, swallowing, regulation, development, disability, diagnosis, therapy goals, functional capacity, support needs, family context, education setting or other information relevant to providing therapy and support.

Sensitive information may also include information about racial or ethnic origin, religious or cultural background, disability, health, mental health, criminal history or other sensitive matters, but only where this is relevant to the service, employment, safeguarding, legal or administrative purpose for which it is collected.

NDIS and protected information

If you are an NDIS participant, we may collect, use, store and disclose information related to your NDIS access, plan, funding, goals, supports, services, invoices and reports.

Some information may be protected under the National Disability Insurance Scheme Act 2013. We will handle NDIS-related information in accordance with our obligations under applicable laws, consent requirements, service agreements and professional responsibilities.

Government identifiers

We may collect government identifiers, such as Medicare numbers or NDIS participant numbers, where reasonably necessary for services, funding, billing, identification or administration.

We do not use government identifiers as our own general client identification system unless permitted or required by law.

How we collect information

We may collect information directly from you when you:

• complete a website enquiry form or intake form
• contact us by phone, email, SMS or in person
• attend appointments or participate in therapy services
• provide documents, reports, plans or other information
• communicate with our clinicians, administration team or management team
• provide feedback or make a complaint
• apply for a role, contractor position, student placement or work opportunity with us

We may also collect information from other people or organisations where appropriate, such as parents, guardians, nominees, support coordinators, plan managers, schools, preschools, medical practitioners, allied health professionals, referrers, referees or other members of a person’s support team.

Unsolicited information

Sometimes we may receive personal information that we did not request, such as information sent to us by mistake or information that is not required for our services.

If we receive unsolicited personal information, we will decide whether we could have collected the information lawfully and appropriately. If we could not have collected it, and it is lawful and reasonable to do so, we will destroy or de-identify the information as soon as practicable.

If we are required or permitted to keep the information, we will handle it in accordance with this Privacy Policy.

Why we collect and use information

We collect and use personal information to provide safe, appropriate and effective services. This may include:

• responding to enquiries
• assessing whether our services may be suitable
• booking and managing appointments
• providing speech therapy, music therapy and related allied health services
• developing therapy goals, plans, reports and service documentation
• communicating with families, participants, carers, referrers and support networks
• managing billing, payments, invoices, claims and funding requirements
• meeting NDIS, professional, clinical, legal, insurance and quality obligations
• responding to feedback, complaints, incidents, risks or safeguarding concerns
• considering employment, contractor or placement applications
• improving our services, systems, website and communication

Use and disclosure

We will generally use personal information for the purpose for which it was collected.

We may use or disclose personal information for another purpose where you have consented, where you would reasonably expect us to use or disclose it for a related purpose, where it is required or authorised by law, where it is necessary to prevent or lessen a serious threat to health, safety or welfare, or where another permitted legal basis applies.

Sensitive information will only be used or disclosed for the purpose for which it was collected, for a directly related purpose you would reasonably expect, with your consent, or where required or permitted by law.

Sharing of personal information

We may share personal information where it is reasonably necessary to provide services, manage administration, meet legal or professional obligations, or where you have consented to the disclosure.

Depending on the circumstances, this may include sharing information with:

• parents, guardians, nominees or authorised representatives
• our clinicians, employees, contractors, students and administration team
• support coordinators, plan managers and funding bodies
• schools, preschools, educators and support teams
• medical practitioners, allied health professionals and referrers
• technology, software, accounting, booking, email, SMS and website service providers
• professional advisers, insurers, auditors or legal representatives
• government, regulatory, safeguarding or law enforcement bodies where required or authorised by law

We take reasonable steps to ensure that external providers who handle personal information on our behalf are required to protect that information and use it only for the purpose of providing services to us.

Information sharing for safety and wellbeing

We respect consent and confidentiality when sharing information. In some circumstances, however, we may share information without consent where it is unsafe, impractical or not possible to obtain consent and where not sharing information may place a person, child, vulnerable person, family member or member of the public at risk of serious harm, abuse, neglect or safety concerns.

Where information is shared for safety, wellbeing, safeguarding or legal reasons, we will take reasonable steps to share only what is necessary and to protect privacy as much as possible.

NDIS, funding and service administration

If services are funded through the NDIS or another funding arrangement, we may collect, use and disclose information reasonably necessary to manage service agreements, appointments, invoices, claims, reports, funding requirements and communication with plan managers, support coordinators or authorised representatives.

We may also keep records required for audit, compliance, safeguarding, quality and professional obligations.

Billing, payment and deferred payment information

We may collect and use billing, payment and financial information to issue invoices, process payments, manage accounts, respond to billing enquiries and recover unpaid amounts where necessary.

If payment is deferred or services are provided before payment is received, we may collect and use information reasonably necessary to manage the account, follow up payment and comply with legal or accounting obligations.

Website analytics, cookies and Microsoft Clarity

We may use website analytics tools, including Google Analytics and Microsoft Clarity, to understand how visitors use our website and to improve the website experience.

These tools may collect information such as pages visited, device and browser information, approximate location, referral source, clicks, scrolling activity, time on page, IP address and interactions with our website.

Microsoft Clarity may use cookies and similar technologies to provide heatmaps and session recordings. We use masking settings where available to help prevent sensitive form information from being captured. Please avoid entering sensitive personal or health information into website forms unless you are comfortable submitting it to us for the purpose of your enquiry or intake.

You can control or disable cookies through your browser settings. Some website features may not work as intended if cookies are disabled.

Third-party websites and platforms

Our website may contain links to third-party websites, platforms, applications or services. These third-party services are not controlled by Creative Therapy Adelaide and are not covered by this Privacy Policy.

We encourage you to review the privacy policy of any third-party website or platform before using it or providing personal information.

SMS, email and mobile information

If you provide your mobile number or email address, we may use it to contact you about enquiries, appointments, service administration, billing, updates, follow-up, feedback or other matters related to your care, support or services.

We do not share mobile numbers, SMS opt-in information or SMS consent information with third parties or affiliates for marketing or promotional purposes.

Information may be shared with contractors, clinicians or service providers where reasonably necessary to provide services, manage appointments, communicate with you, operate our systems or meet legal and professional obligations.

Marketing and communication

We may use contact information to send service-related communication, updates, resources or information about Creative Therapy Adelaide services where permitted by law and appropriate to the relationship we have with you.

You can ask us to stop sending marketing or non-essential communications at any time. We will continue to send essential service, appointment, billing, legal or administrative communication where required.

Use of artificial intelligence

Creative Therapy Adelaide may use approved artificial intelligence tools to support internal administrative, drafting, planning, quality improvement or efficiency-related tasks.

We do not intentionally enter client, participant, staff or other confidential personal information into public AI tools unless there is a lawful basis, appropriate safeguards and the use is approved.

Any AI-assisted output used by our team should be reviewed by a person before use. We remain responsible for the accuracy, appropriateness and confidentiality of our work.

Storage and security

We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification or disclosure.

Personal information may be stored in electronic systems, cloud-based platforms, email systems, practice management systems, accounting systems, secure document storage, backup systems or paper records where required.

Access to personal information is limited to people who need it for their role or purpose. However, no method of electronic storage or transmission is completely secure, and we cannot guarantee absolute security.

Overseas storage or disclosure

We do not generally disclose personal information to overseas recipients except where our technology or service providers store, process or access information using systems located in Australia or overseas.

This may include providers of website hosting, analytics, email, booking, practice management, accounting, cloud storage, SMS or communication services.

Where we use external service providers, we take reasonable steps to choose providers that apply appropriate privacy and security protections.

Data breaches

If we become aware of a suspected or actual data breach involving personal information, we will take reasonable steps to contain, assess and respond to the breach.

Where required under the Notifiable Data Breaches scheme, we will notify affected individuals and the Office of the Australian Information Commissioner.

If a suspected breach requires assessment, we will aim to complete the assessment as soon as practicable and, where required, within the timeframe required by law.

Accessing and correcting your personal information

You may request access to personal information we hold about you, subject to exceptions allowed by law.

You may also ask us to correct personal information if you believe it is inaccurate, out of date, incomplete, irrelevant or misleading.

To protect privacy and security, we may need to verify your identity before responding to an access or correction request. In some circumstances, we may charge a reasonable fee for providing access to information, where permitted by law.

If we do not agree to correct information as requested, we may make a note on the record that a correction was requested, where it is reasonable to do so.

If the information originated from another agency or organisation, such as NDIS-related information, we may not always be able to correct it directly and may need to direct you to the originating party.

Retention of information

We retain personal information for as long as reasonably necessary for the purpose it was collected, to provide services, manage records, meet legal and professional obligations, resolve disputes, support audit requirements and maintain appropriate business records.

In general, client records are retained for at least 7 years after the last record relating to the client, unless a longer period is required by law, professional obligations, funding requirements or the circumstances of the service.

When information is no longer required, we will take reasonable steps to securely destroy or de-identify it, unless we are required or permitted to retain it by law.

Feedback, complaints and privacy concerns

If you have a question, concern or complaint about how your personal information has been handled, please contact us using the details below.

We will take privacy complaints seriously and aim to respond within a reasonable timeframe. Where possible, we aim to provide a response within 30 days. If the matter is complex and we need more time, we will let you know.

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner.

Changes to this Privacy Policy

Creative Therapy Adelaide may update this Privacy Policy from time to time to reflect changes in our services, systems, legal obligations, technology or privacy practices.

The updated version will be published on our website. We encourage you to review this page periodically.