Privacy policy

This policy explains:

• what information we collect and hold
• how we collect, use, store and disclose information
• how clients and their representatives may access or correct information
• how to make a privacy enquiry or complaint

We handle personal and health information in accordance with the Privacy Act 1988, the Australian Privacy Principles, Speech Pathology Australia's Code of Ethics (2010) and the NSW Health Records and Information Privacy Act 2002, including the Health Privacy Principles.

In this policy, "we", "us" and "our" refer to Bridge Speech Therapy. "Client" includes a child or adult receiving services from Bridge Speech Therapy.

Depending on the services provided, we may collect:

• the client's name, date of birth, address and contact details
• parent, guardian, nominee and emergency contact details
• information about communication, speech, language, literacy, social communication, fluency, feeding or swallowing
• medical, developmental, educational, family and social history
• diagnoses, medications, allergies and information about other health conditions
• assessment results, screening results, clinical observations, progress notes, reports and therapy plans
• photographs, audio or video recordings where separate consent has been obtained
• information provided by parents, guardians, educators, health professionals and other authorised people
• Medicare, private health insurance or NDIS information where relevant
• NDIS participant, plan, funding and plan-manager details
• appointment, invoice, payment and service-agreement information
• correspondence, feedback and complaint information
• information required to meet our legal, professional and insurance obligations

We will only collect information that is reasonably necessary for providing and managing our services.

We may collect information:

• directly from the client or their parent, guardian, nominee or representative
• through online and/or paper forms
• through Splose, our practice-management system
• during telephone calls, consultations, screenings, assessments and therapy sessions
• through email, SMS, telehealth and other approved communication methods
• from schools, preschools, daycare centres, medical practitioners, allied health professionals, support coordinators, plan managers or other people where consent has been provided or collection is otherwise permitted by law
• from referrals, reports and documents supplied to us

Where practical, we collect information directly from the client or their authorised representative.

We may collect, use and hold information to:

• respond to enquiries and referrals
• determine whether our services are appropriate
• arrange and manage appointments
• conduct screenings, assessments and therapy
• develop goals, recommendations and intervention plans
• monitor progress and maintain clinical records
• communicate with clients, parents, guardians and authorised representatives
• prepare reports, letters and supporting documentation
• communicate with authorised educators, health professionals and other service providers
• process invoices, payments, Medicare, private health insurance or NDIS claims
• manage service agreements and funding
• meet professional, legal, regulatory, insurance and record-keeping requirements
• respond to concerns, complaints, incidents or emergencies
• improve the safety and quality of our services

We will not use information for an unrelated purpose unless consent has been obtained or the use is permitted or required by law.

Where a client is a child, we generally collect information from and communicate with the child's parent, legal guardian or another person authorised to act on the child's behalf.

We will involve the child in decisions about their care and information where appropriate to their age, maturity, communication needs and circumstances.

The person providing consent must confirm that they have the authority to make decisions for the child. We may request evidence of that authority where reasonably necessary.

A child's willingness to participate will also be respected. A screening, assessment or therapy activity may be stopped if the child becomes distressed or does not wish to continue.

We may disclose relevant information to:

• the client's parent, guardian, nominee or authorised representative
• employees, contractors or clinicians working with Bridge Speech Therapy
• medical practitioners and other allied health professionals
• preschools, daycare centres, schools, teachers and educators
• support coordinators, plan managers and other NDIS-related providers
• Medicare, private health insurers, the NDIA or other funding bodies
• professional advisers, insurers, auditors or legal representatives
• service providers that assist us with practice management, secure storage, communications, telehealth, payments or information technology
• government, regulatory, law-enforcement or child-protection authorities where disclosure is required or authorised by law

We will obtain consent before sharing health information with another provider, educator or organisation. We will only disclose information that is reasonably necessary for the relevant purpose.

Bridge Speech Therapy uses Splose to assist with functions such as client records, online forms, appointments, communications, invoicing and service management. Splose states that data belonging to Australian users is stored in Australia. Splose operates under its own privacy, security and contractual arrangements.

We may also use reputable providers for email, document storage, telehealth, accounting and payment processing. These providers may process limited personal information when performing services for us. We take reasonable steps to choose appropriate providers and protect information disclosed to them.

Information will be stored electronically. We take reasonable steps to protect information from loss, misuse, interference, unauthorised access, alteration and disclosure. These steps may include:

• password-protected systems
• multi-factor authentication where available
• secure practice-management and storage systems
• encrypted transmission and storage where supported
• device security and software updates
• secure disposal of records
• confidentiality requirements for staff and contractors
• regular review of access and security procedures

We retain health records for the minimum periods required under NSW law. Generally:

• adult health records are retained for at least seven years from the last occasion on which a health service was provided
• records relating to a person who was under 18 when the information was collected are generally retained until that person reaches 25 years of age

Some information may be retained for longer where required by another law, funding arrangement, professional obligation, insurance requirement or legal process. When information is no longer required, we will take reasonable steps to securely destroy or permanently de-identify it, unless we are legally required to retain it.

Clients and their authorised representatives may request access to personal and health information held by Bridge Speech Therapy. We may need to verify the requester's identity and authority before providing access. Access may be provided by allowing the person to view the record, providing a copy or preparing an appropriate summary.

In limited circumstances, access may be refused or restricted where permitted by law. If this occurs, we will explain the reason where legally able to do so. A reasonable fee may be charged for the administrative cost of providing access. We will discuss any fee before processing the request.

Clients and their authorised representatives may ask us to correct information that is inaccurate, incomplete, out of date, irrelevant or misleading. If we do not agree that a correction is required, the person may ask us to attach a statement to the record explaining the requested correction.

We may communicate using telephone, SMS, email, telehealth or the communication functions available through our practice-management system. Although we take reasonable precautions, ordinary email and SMS may have security limitations. Clients should tell us if they do not wish to receive particular information through these methods.

We will only send marketing communications with appropriate consent or where otherwise permitted by law. Recipients may opt out at any time.

Privacy enquiries, access requests, correction requests and complaints may be directed to:

Please include enough information for us to understand and investigate the matter. We may contact you to request further details or verify your identity. We will acknowledge and respond to privacy complaints within a reasonable period.

We may update this privacy policy when our services, systems, legal obligations or information-handling practices change. The current version will be made available through our online forms, provided electronically on request and published on our website.