Privacy Policy

Overview

Policy Title    Privacy Policy
Organisation    Wildflower Kids Therapy
Effective Date    23/07/2026
Review Date    23/07/2027
Approved By    Brandon Winter
________________________________________

Version Control
Version    Date    Change
1.0    03/05/2025    Initial version
2.0    16/06/2025    Updated AI policy section
3.0    24/05/2026    Reformatted to WFKT brand standard
4.0    23/07/2026    Limited recording scope to online sessions; added AI consent-at-intake, retention, and overseas processing detail; corrected postcode
________________________________________

1. About This Policy

This Privacy Policy applies to all personal information collected by Wildflower Kids Therapy Pty Ltd, a paediatric occupational therapy practice located in Mudgeeraba, Gold Coast, Queensland.

We are committed to handling your personal information including sensitive health information with care, transparency, and respect, in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This policy reflects our use of AI-assisted tools across our practice platforms, and our commitment to maintaining appropriate safeguards when using these tools.
________________________________________

2. What is "Personal Information"?

Under the Privacy Act 1988 (Cth), "personal information" means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether true or not, and whether recorded in material form or not.

"Sensitive information" is a subset of personal information that includes health information and is afforded a higher level of protection under the APPs.
________________________________________

3. Information We Collect

3.1 Website Visitors
When you use our website, we may collect:
•    Your name, email address, and phone number when submitted via contact or enquiry forms
•    Technical information such as your IP address, browser type, and pages visited
•    Cookie data to help customise your website experience (cookies do not personally identify you)

3.2 Clients and Families
In the course of providing therapy services, we collect personal and health information including:
•    Full name, date of birth, and contact details for clients and their parents or carers
•    Medicare details, private health insurance information, and NDIS participant numbers
•    Medical history, diagnoses, referral letters, and correspondence from other health professionals
•    Assessment results, clinical observations, therapy session notes, and progress reports
•    Audio or video recordings of online consultations, where consent has been provided and recorded in your child's file
•    Post-session notes recorded by our therapists after sessions, which may be drafted with AI assistance
•    Information provided by schools, teachers, or other professionals involved in the child's care
•    Billing, payment, and funding claim information
________________________________________

4. How We Collect Your Information

•    Directly from you or your child's parent or carer during intake, appointments, or communication
•    From referrers such as GPs, paediatricians, or other treating health professionals
•    Through our practice management software and telehealth platforms
•    Via audio or video recording of online consultations, where prior consent has been obtained and recorded in your child's file
•    Via post-session voice or written notes created by your therapist after sessions
•    Via our website contact and booking forms
•    Through email, phone, or in-person interactions

We will always seek your consent before collecting sensitive health information, unless otherwise required or permitted by law.
________________________________________

5. Purpose of Collection and Use

We collect and use your personal information to:
•    Provide, coordinate, and improve paediatric therapy and allied health services
•    Communicate with you regarding appointments, reports, and care planning
•    Process Medicare, private health insurance, and NDIS claims and payments
•    Liaise with other health professionals involved in your child's care
•    Meet our legal, professional, and regulatory obligations (including Ahpra and Occupational Therapy Australia standards)
•    Support documentation and administrative functions
________________________________________

6. Disclosure of Your Information

6.1 Disclosure with Consent
We will only share your personal information with third parties where you have provided consent, or where disclosure is otherwise permitted or required by law.

6.2 Permitted Disclosures without Consent
We may disclose your information without consent only where:
•    It is necessary for the provision of coordinated health care (e.g. to another treating professional)
•    Required or authorised by law, including mandatory reporting under child protection legislation
•    Disclosed to contracted technology service providers operating under strict confidentiality and data protection obligations
•    There is a serious and imminent threat to someone's life, health, or safety

6.3 Technology and AI Platform Providers
We use technology platforms to support clinical documentation and business operations, some of which include AI-assisted features. These platforms have been specifically selected for their strong privacy and security credentials and operate under appropriate data protection agreements. Some platforms may process data overseas, including in the United States. In each case, contractual safeguards are in place to protect your information.

Our technology providers may only use your information for the specific purpose for which it is shared. We do not sell, trade, or rent your personal information to any third party.

6.4 Use of Artificial Intelligence (AI)
We may use secure, third-party tools, including artificial intelligence (AI)-based systems, to assist with clinical documentation and business administration.

Where AI tools are used, we take reasonable steps to ensure that your personal information is handled securely and in accordance with the Australian Privacy Principles, and that data is only used for its intended purpose.

We do not use AI to make automated decisions about your care without appropriate human oversight. A clinician reviews and approves all AI-assisted documentation before it forms part of the clinical record.

Where AI tools are used in connection with health or other sensitive information, we apply additional safeguards to ensure confidentiality and appropriate handling of that information. Access to systems that utilise AI is restricted to authorised personnel only.

We seek your consent for the use of AI-assisted tools at intake. You may give, decline, or change your consent at any time by contacting us, and your decision will not affect the care your child receives.
________________________________________

7. Session Recordings & Transcription
Recording is limited to online consultations and telehealth sessions. We never record in-person sessions, whether in the clinic, at home, at school, or in the community. Where an online session is to be recorded, we will:
•    Seek your verbal consent before any recording takes place, and note that consent in your child's file
•    Explain the purpose of the recording, how it will be stored, and how long it will be retained
•    Give you the right to decline without any impact on the care your child receives
•    Store recordings securely with access restricted to relevant clinical staff only

You may withdraw consent for session recording at any time by advising your therapist or contacting admin@wildflowerkidstherapy.com.au. Withdrawal of consent will apply to future sessions and does not affect recordings already made under prior consent.

Phone calls to and from our office are not recorded. They are transcribed in real time by our phone system to support accurate note taking. This transcription is handled by a provider operating under a formal data protection agreement, and any notes kept are stored securely in your child's record.
________________________________________

8. Data Security
We take reasonable steps to protect your personal information from misuse, interference, loss, unauthorised access, modification, or disclosure. Our measures include:
•    Password-protected, access-controlled systems across all platforms
•    Encryption of data at rest and in transit
•    Restricted staff access on a need-to-know basis
•    Staff training on privacy obligations and data handling
•    Formal data protection agreements with all third-party technology providers handling health information
________________________________________

9. Retention of Your Information
We retain clinical records in line with our legal and professional obligations. For children, this generally means records are kept until the child turns 25, or for at least 7 years after our last service, whichever is longer.

When information is no longer required, we take reasonable steps to securely destroy or de-identify it. Recordings and transcripts used to prepare clinical documentation are retained only as long as needed for that purpose.
________________________________________
10. Access and Correction
Under Australian Privacy Principle 12, you have the right to request access to the personal information we hold about you or your child, and to request corrections where information is inaccurate, out of date, or incomplete.

To make a request, please contact us using the details in Section 12. We will respond within a reasonable timeframe and in accordance with our obligations under the Privacy Act.