1. Our commitment to your privacy
Within Reach Therapy (“we”, “our”, “us”) provides occupational therapy, vocational rehabilitation, functional capacity and driving assessments, assistive technology and home modification assessments, and related allied health and medicolegal services across Southeast Queensland and Northern New South Wales. We deliver services in person and by telehealth.
We follow the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Because we are a health service provider, the information we hold is considered sensitive information, which receives the highest level of protection. When we provide services in New South Wales, we also comply with the Health Records and Information Privacy Act 2002 (NSW). As an NDIS provider, we comply with the NDIS Act, NDIS Code of Conduct, NDIS Practice Standards, and the professional codes for registered occupational therapists.
This policy explains what information we collect, why we collect it, how we use and store it, who we share it with, how our digital and AI tools work, and how you can access or correct your information or make a complaint.
2. What information we collect
The information we collect depends on the service you receive. It may include:
Identity and contact details
Your name, date of birth, gender, contact details, emergency contacts, cultural background, language needs and communication preferences.
Health and disability information
Medical history, diagnoses, medications, allergies, treating team details, disability and functional information, assessment results, clinical notes, photographs and measurements (with consent), driving assessment details, WorkCover information, and reports prepared by us or other providers.
Funding and administrative information
NDIS details, WorkCover claim information, Medicare or private health details, invoicing and payment information, service agreements, consent forms and appointment history.
Telehealth and digital information
Audio, video or images captured during telehealth or inperson sessions (with consent), information submitted through website forms, and technical data such as IP address, browser type and pages viewed.
- Information about others
- Information about carers, family members, employers or other professionals involved in your care.
- Employees, contractors and applicants
Qualifications, registrations, screening checks, references and payroll or contractor details.
3. How we collect information
We collect information directly from you during assessments, sessions, phone calls, emails, SMS, secure online forms and our client portal.
We also collect information from:
- your referrer or funder
- other providers involved in your care
- your guardian, nominee or support person
- the NDIA, NDIS Commission, WorkCover, courts or tribunals
- publicly available sources where relevant
If we receive information we did not request and cannot lawfully keep, we will destroy or deidentify it.
Consent and representatives
We ask for your consent before collecting sensitive information. You can withdraw consent at any time. For children, we work with parents or guardians and involve the young person according to their maturity. For adults with a substitute decisionmaker, we verify their authority and record it.
4. Why we use your information
We use your information to:
- assess your needs and deliver safe, effective services
- prepare reports, plans and recommendations
- communicate with your treating team and support network
- manage bookings, reminders, invoicing and claims
- meet our legal, professional and funding obligations
- support quality assurance, supervision and training (using deidentified data where possible)
- respond to enquiries, feedback and complaints
- manage our workforce and student placements
- send service information or updates (you can opt out at any time)
We may also use or disclose your information without consent if required or authorised by law, or if we reasonably believe it is necessary to prevent or lessen a serious threat to your life, health or safety, or to public health or safety. This includes mandatory reporting, NDIS reportable incidents, licensing safety requirements, and situations where someone is at immediate risk of harm.
5. When services are funded
If your service is funded by the NDIS, WorkCover, an insurer, employer, lawyer or court, we must share certain information with them as part of the service. For example:
- NDIS: service agreements, progress summaries, reports and invoices
- WorkCover: assessment findings, work capacity and rehabilitation plans
- Medicolegal: reports go to the commissioning party
- Driving assessments: findings shared with licensing authorities
These disclosures are required by law or funding rules.
6. Digital systems, Google Business Suite, Xero and AI
Practice management system (Splose)
We use Splose, an Australianhosted practice management system with encryption, access controls and secure backups.
Google Business Suite (Google Workspace)
We use Google Workspace for secure email, document storage, calendars and internal communication. Some Google systems may use servers outside Australia. We take reasonable steps to ensure Google meets APP requirements.
Xero (financial processing)
We use Xero for invoicing, payments, payroll and financial records. Xero stores data securely in encrypted cloud systems and may use servers outside Australia. Only authorised staff can access financial information. No clinical information is stored in Xero.
AIassisted documentation (Splose AI)
AI tools in Splose can transcribe sessions and draft notes or report sections. These tools are:
- opt in only
- fully reviewed by your clinician
- not used for decisionmaking
- protected by contractual safeguards
Transient processing may occur overseas, but only with your consent.
7. Who we share information with
We may share your information with:
- people involved in your care and funding
- your GP, specialists, hospitals, schools and support workers
- our employees, contractors and students
- service providers such as Splose, Google Workspace, Xero, IT support, cloud hosting, accounting, payment processors, legal advisers and auditors
- regulators such as the NDIA, NDIS Commission, WorkCover, Ahpra, courts or child protection authorities
- anyone you authorise us to share with
We never sell your information.
Overseas disclosure
Some providers (including Google Workspace, Xero and Splose AI processing) may use servers outside Australia. We ensure they meet APP requirements or obtain your consent.
8. How we protect your information
We use secure, encrypted systems, rolebased access, multifactor authentication, device security, confidentiality agreements, vendor due diligence and secure destruction methods. We minimise paper records and digitise promptly.
Data breaches
If a data breach is likely to cause serious harm, we will notify you and the OAIC, and where relevant the NDIS Commission.
9. How long we keep information
We keep records for the minimum periods required by law, including:
- adults: 7 years
- children: until age 25
- NDIS records: at least 7 years
- financial records: 7 years
- website enquiries: generally 12 months
When no longer required, records are securely destroyed or deidentified.
10. Your rights
You can:
- access your information
- ask us to correct it
- withdraw consent
- change who we communicate with
- request specific communication methods
- make a complaint
- be notified of any serious data breach
We respond to access requests within 30 days and verify your identity before releasing information.
11. Complaints
If you have a privacy concern, contact our Privacy Officer. We will acknowledge your complaint within two business days and aim to respond within 30 days. You may also contact:
- OAIC — privacy complaints
- NDIS Commission — NDISrelated concerns
- OHO (Qld) or HCCC (NSW) — health service complaints
- Ahpra — concerns about registered occupational therapists
12. Contact us
Director
Email: admin@withinreachtherapy.com.au
Phone: 0494 361 655
Website: withinreachtherapy.com.au
