Privacy Policy

Overview

​

Policy Title: Privacy Policy

Organisation: Wildflower Kids Therapy

Effective Date: 07/09/2026

Review Date: 07/09/2027

Approved By: Brandon Winter
 

Version Control

​

• 1.0 – 03/05/2025 – Initial version

• 2.0 – 16/06/2025 – Updated AI policy section

• 3.0 – 24/05/2026 – Reformatted to WFKT brand standard

• 4.0 – 23/07/2026 – Limited recording scope to online sessions; added AI consent-at-intake, retention, and overseas processing detail; corrected postcode

• 4.1 – 07/09/2026 – Named our technology providers; corrected recording to audio only; stated what happens to session and phone transcripts; added data breach and children and guardians sections; single privacy contact address
   

1. About This Policy

​

This Privacy Policy applies to all personal information collected by Wildflower Kids Therapy Pty Ltd, a paediatric occupational therapy practice located in Mudgeeraba, Gold Coast, Queensland.

​

We are committed to handling your personal information including sensitive health information with care, transparency, and respect, in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

​

This policy reflects our use of AI-assisted tools across our practice platforms, and our commitment to maintaining appropriate safeguards when using these tools.
 

2. What is "Personal Information"?

​

Under the Privacy Act 1988 (Cth), "personal information" means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether true or not, and whether recorded in material form or not.

​

"Sensitive information" is a subset of personal information that includes health information and is afforded a higher level of protection under the APPs.
 

3. Information We Collect

​

3.1 Website Visitors

​

When you use our website, we may collect:

​

• Your name, email address, and phone number when submitted via contact or enquiry forms

• Technical information such as your IP address, browser type, and pages visited

• Cookie data to help customise your website experience (cookies do not personally identify you)
   

3.2 Clients and Families

​

In the course of providing therapy services, we collect personal and health information including:

​

• Full name, date of birth, and contact details for clients and their parents or carers

• Medicare details, private health insurance information, and NDIS participant numbers

• Medical history, diagnoses, referral letters, and correspondence from other health professionals

• Assessment results, clinical observations, therapy session notes, and progress reports

• Audio recordings of online consultations, where you have consented. Video is never recorded, and neither the audio nor the transcript made from it is kept in your child's record. See sections 7 and 9.

• Post-session notes recorded by our therapists after sessions, which may be drafted with AI assistance

• Information provided by schools, teachers, or other professionals involved in the child's care

• Billing, payment, and funding claim information
   

4. How We Collect Your Information

​

• Directly from you or your child's parent or carer during intake, appointments, or communication

• From referrers such as GPs, paediatricians, or other treating health professionals

• Through our practice management software and telehealth platforms

• Via audio recording of online consultations, where prior consent has been obtained and noted in your child's file. We do not record video.

• Via post-session voice or written notes created by your therapist after sessions

• Via our website contact and booking forms

• Through email, phone, or in-person interactions
   

We will always seek your consent before collecting sensitive health information, unless otherwise required or permitted by law.
 

5. Purpose of Collection and Use

​

We collect and use your personal information to:

​

• Provide, coordinate, and improve paediatric therapy and allied health services

• Communicate with you regarding appointments, reports, and care planning

• Process Medicare, private health insurance, and NDIS claims and payments

• Liaise with other health professionals involved in your child's care

• Meet our legal, professional, and regulatory obligations (including Ahpra and Occupational Therapy Australia standards)

• Support documentation and administrative functions
   

6. Disclosure of Your Information

​

6.1 Disclosure with Consent

​

We will only share your personal information with third parties where you have provided consent, or where disclosure is otherwise permitted or required by law.

6.2 Permitted Disclosures without Consent

​

We may disclose your information without consent only where:

​

• It is necessary for the provision of coordinated health care (e.g. to another treating professional)

• Required or authorised by law, including mandatory reporting under child protection legislation

• Disclosed to contracted technology service providers operating under strict confidentiality and data protection obligations

• There is a serious and imminent threat to someone's life, health, or safety
   

6.3 Technology and AI Platform Providers

​

Our practice management system is splose, provided by Splose Pty Ltd, an Australian company. Your child's clinical record is held there, and splose provides the transcription and documentation features we use. Those AI features are powered by OpenAI and involve information being sent outside Australia, including to the United States. splose publishes its own privacy policy at splose.com/privacy-policy, which sets out how it handles information we place in the system.

​

We also use Claude, provided by Anthropic, for administrative work.

​

Both operate under data protection agreements.

​

Our technology providers may only use your information for the specific purpose for which it is shared. We do not sell, trade, or rent your personal information to any third party.
 

6.4 Use of Artificial Intelligence (AI)

​

We may use secure, third-party tools, including artificial intelligence (AI)-based systems, to assist with clinical documentation and business administration.

​

Where AI tools are used, we take reasonable steps to ensure that your personal information is handled securely and in accordance with the Australian Privacy Principles, and that data is only used for its intended purpose.

​

We do not use AI to make automated decisions about your care without appropriate human oversight. A clinician reviews and approves all AI-assisted documentation before it forms part of the clinical record.

​

Where AI tools are used in connection with health or other sensitive information, we apply additional safeguards to ensure confidentiality and appropriate handling of that information. Access to systems that utilise AI is restricted to authorised personnel only.

​

We seek your consent for the use of AI-assisted tools at intake. You may give, decline, or change your consent at any time by telling your clinician or emailing privacy@wildflowerkidstherapy.com.au, and your decision will not affect the care your child receives.
 

7. Session Recordings & Transcription

​

Recording is limited to online consultations and telehealth sessions. We never record in-person sessions, whether in the clinic, at home, at school, or in the community. Where an online session is to be recorded, we will:

​

• Seek your verbal consent before any recording takes place, and note that consent in your child's file

• Explain the purpose of the recording, how it will be stored, and how long it will be retained

• Give you the right to decline without any impact on the care your child receives

• Store recordings securely with access restricted to relevant clinical staff only
   

Neither the audio nor the transcript is kept. The audio is used at the time of the session to produce a transcript, and both are removed once the clinician finalises their note. Only the clinician's written note is retained in your child's record. Video is never recorded.
 

You may withdraw consent for session recording at any time by advising your therapist or emailing privacy@wildflowerkidstherapy.com.au. Withdrawal of consent will apply to future sessions and does not affect recordings already made under prior consent.
 

Calls to and from our office are not recorded. Our phone system produces a live transcript so we can take accurate notes during the call. Transcripts are held in the phone system, not in your child's record, and are automatically deleted after five days. Where something discussed on a call is clinically relevant, the clinician or administrator writes it into your child's record in the normal way. Our phone provider does not use this information to train AI models.
 

8. Data Security

​

We take reasonable steps to protect your personal information from misuse, interference, loss, unauthorised access, modification, or disclosure. Our measures include:

​

• Password-protected, access-controlled systems across all platforms

• Encryption of data at rest and in transit

• Restricted staff access on a need-to-know basis

• Staff training on privacy obligations and data handling

• Formal data protection agreements with all third-party technology providers handling health information
   

9. Retention of Your Information

​

We retain clinical records in line with our legal and professional obligations. For children, this generally means records are kept until the child turns 25, or for at least 7 years after our last service, whichever is longer.

​

When information is no longer required, we take reasonable steps to securely destroy or de-identify it.

​

Session audio and transcripts are an exception to the retention periods above. Neither is retained. They exist only until the clinician finalises their note for that session. The written note created from them is retained as part of your child's clinical record for the periods set out above.

​

Phone call transcripts are also an exception. They are held in our phone system and automatically deleted after five days.
 

10. Access and Correction

​

Under Australian Privacy Principle 12, you have the right to request access to the personal information we hold about you or your child, and to request corrections where information is inaccurate, out of date, or incomplete.

​

To make a request, please contact us using the details in Section 14. We will respond within a reasonable timeframe and in accordance with our obligations under the Privacy Act.
 

11. Children, Parents and Guardians

​

Almost all of our clients are children, so most of the information we hold is provided by, and accessed by, a parent or guardian rather than the client themselves.

​

Who can give consent and request access. A parent or guardian with parental responsibility for a child can give consent on the child's behalf and can request access to their records under section 10. Where parental responsibility is shared, either parent can usually do this. We may ask you to confirm your parental responsibility before we release information.

​

Separated parents and court orders. If parenting arrangements are in place, or a court order affects who may receive information about your child, please tell us and give us a copy. We will follow it. Unless an order or agreement says otherwise, we treat both parents as equally entitled to information about their child's care.

​

Older children and young people. As a child gets older they become more able to make their own decisions about their information. Where we are satisfied that a young person understands what is being asked of them, we will seek their consent directly, and we may limit what is shared with a parent if the young person asks us to and it is appropriate in the circumstances.

​

Your child's own privacy. Even where a parent is making the decisions, the information is about the child. We take the child's interests into account, and their views where they are able to express them, when we decide what to share and with whom.

​

12. Data Breaches

​

We are covered by the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act 1988 (Cth).

​

If personal information we hold is lost, or accessed or disclosed without authorisation, we assess whether the breach is likely to result in serious harm. We aim to complete that assessment as quickly as we can, and within 30 days at the latest, as the Act requires.

​

Where we decide a breach is likely to result in serious harm, we will notify the people affected and the Office of the Australian Information Commissioner as soon as practicable. Our notification will explain what happened, what information was involved, and the steps we recommend you take.

​

Where a breach occurs at one of our technology providers, we rely on them to notify us so that we can carry out this assessment.
 

13. Complaints

​

If you think we have mishandled your personal information, or you are unhappy with how we have responded to a request for access or correction, please tell us. We would rather hear about it.

​

Attention: Mikaela Winter, Practice Principal

Email: privacy@wildflowerkidstherapy.com.au

Phone: 07 3555 6271

​

We will acknowledge your complaint within 5 business days, and respond to you in writing, normally within 30 days. If we need longer, we will tell you why and when you can expect our response. If you are not satisfied with our response, you can take the matter to the Office of the Australian Information Commissioner at www.oaic.gov.au or on 1300 363 992.

​

Making a complaint will not affect the care your child receives.

​

14. Contact Us

​

Email: privacy@wildflowerkidstherapy.com.au

Phone: 07 3555 6271

Address: 7/31 Railway Street, Mudgeeraba QLD 4213

Website: www.wildflowerkidstherapy.com.au

​

Policy Approval

​

This policy has been approved by Wildflower Kids Therapy and is effective from the date listed below.

​

Approved by: Brandon Winter
Position: Operations Business Manager
Date: 07/09/2026