Privacy Policy

Flame Tree Speech Pathology is committed to protecting the privacy and confidentiality of all personal and sensitive information we collect from our clients, their families, and our employees. We recognise that the information you share with us is highly personal and requires the highest level of care and security. We adhere strictly to the principles of the Privacy Act 1988 (Cth), including the Australian Privacy Principles (APPs), and all relevant state and federal laws. This policy outlines in detail how we manage and protect the personal information entrusted to us, ensuring our practices are not only legally compliant but also ethically sound.

The purpose of this policy is to:

• Inform clients, families, and staff about our practices for handling personal information, ensuring complete transparency in our operations. We believe that an open and clear privacy policy is essential for building and maintaining trust with our community.
• Ensure all personal information is collected, used, stored, and disclosed in a lawful and transparent manner. This means we will always inform you of why we are collecting information and how we intend to use it.
• Provide a clear and accessible process for individuals to access their own information or their child's information, and to request corrections if they believe it is inaccurate.
• Detail our unwavering commitment to data security and confidentiality, explaining the robust measures we have in place to protect your data from unauthorised access or misuse.

This policy applies to all employees, contractors, and students of Flame Tree Speech Pathology. It covers all personal and sensitive information collected, whether in writing on a physical intake form, verbally during a therapy session, or electronically through our client management systems, emails, or telepractice platforms.

1. Collection of Personal Information

We only collect personal information that is reasonably necessary for us to provide our speech pathology services effectively and safely. The types of information we may collect and the reasons for their collection include:

• Personal details: Such as name, date of birth, address, and contact details. This information is essential for identifying you as a client, for communication regarding appointments, and for administrative purposes.
• Health information: This is considered "sensitive information" and includes medical and developmental history, information from other specialists (e.g., paediatricians, audiologists, occupational therapists), assessment results, and ongoing therapy notes. We collect this to inform our clinical decision-making, tailor our services to your child's specific needs, and track progress over time.
• NDIS plan details: This includes your NDIS number, plan dates, funding periods, and the specific goals and funding available to help us provide services in a compliant manner.
• Billing information: Details such as Medicare, private health fund, or NDIS plan information are collected for processing payments and claims.
• Parent/Guardian details: We collect your contact information and relationship to the client to ensure we are communicating with the correct and authorised individuals regarding your child's care.

We collect this information directly from you or your legal guardian with your explicit consent through intake forms and during our consultations. In some instances, we may collect information from third parties (e.g., other health professionals or schools), but we will only do so after obtaining your written consent.

2. Use and Disclosure of Personal Information

Your personal and sensitive information is used internally to:

• Assess, diagnose, and provide effective speech pathology services. This is the core purpose of our work and the reason we collect the information.
• Communicate with you and manage your appointments to ensure smooth service delivery.
• Administer our billing and accounting processes to ensure accurate record-keeping and financial management.
• Report to the NDIS Quality and Safeguards Commission as required by law, such as in the case of a Reportable Incident.
• Communicate with other health professionals involved in your or your child’s care (e.g., your child's GP, their school, or other therapists). This is only done with your informed and explicit consent to ensure a coordinated and holistic approach to your child's care.

We will not disclose your personal information to any third party without your consent, unless we are required or authorised by law to do so. This includes situations such as a court order or a mandatory reporting obligation, such as where we have a reasonable suspicion of child abuse or neglect.

3. Data Quality

We are dedicated to maintaining the accuracy of our records. We take reasonable steps to ensure that the personal information we collect, use, and disclose is accurate, up-to-date, and complete. To assist us in this, we encourage you to notify us of any changes to your personal details as soon as possible, such as a change of address, phone number, or NDIS plan details. Having current information is vital for your safety, for billing, and for providing effective and appropriate therapy.

4. Data Security

We are committed to protecting your personal information from misuse, interference, loss, and from unauthorised access, modification, or disclosure. Our security measures include a combination of both physical and technological safeguards:

• Physical security: All physical files containing client information are stored in secure and locked filing cabinets within a restricted access area of the clinic.
• Technological security: Our electronic health records and data systems are protected by password-protection, multi-factor authentication, and encryption to prevent unauthorised access. We use a secure, encrypted client management system.
• Staff training: All staff members are regularly trained on privacy and confidentiality protocols, reinforcing their obligation to protect your information.
• Data disposal: We have a secure process for the disposal of outdated or no-longer-required information, ensuring it is destroyed in a manner that prevents any unauthorised access.

5. Accessing and Correcting Your Information

You have the right to request access to the personal information we hold about you or your child. Requests for access should be made in writing to the Clinic Director. We will respond to your request within 30 days. If you believe the information we hold about you is inaccurate, out-of-date, or incomplete, you may request that it be corrected. We will take reasonable steps to correct the information and will notify you of the outcome of your request.

6. Privacy of Minors

For clients under the age of 18, we require consent from their parent or legal guardian for the collection, use, and disclosure of their personal information. We recognise that children have a right to privacy. We respect the privacy of our young clients and, where appropriate for their age and maturity, we will involve them in discussions about their privacy in an age-appropriate manner. This may include explaining what information we are collecting and why, and seeking their assent to share information with others.

7. Complaints

If you have a complaint regarding a breach of this privacy policy or a violation of the Australian Privacy Principles, please contact the Clinic Director in writing. We will acknowledge your complaint within 7 days and will conduct a thorough investigation to resolve the matter. We will keep you informed of the progress and outcome of the investigation. If you are not satisfied with our response, you have the right to contact the Office of the Australian Information Commissioner (OAIC) for further assistance.

8. Use of Artificial Intelligence (AI) and Digital Tools

As part of our commitment to providing high-quality and efficient services, we may utilise secure digital tools, including those powered by Artificial Intelligence (AI). Our use of these technologies is strictly governed by this privacy policy.

• Secure and ethical use: Any AI or digital tools we use are carefully selected to ensure they are secure, compliant with Australian privacy laws, and used only to support our clinical practice. We will never input personal or sensitive information into public, unsecure, or non-compliant AI models.
• Purpose: AI may be used to assist with administrative tasks, such as transcribing clinical notes, summarising key data points, or drafting sections of reports. These tools are designed to enhance our efficiency and help us focus on providing direct, high-quality care.
• Clinical oversight: AI is used purely as a support tool. All clinical decisions, assessments, diagnoses, and final reports are reviewed and approved by a qualified speech pathologist. The ultimate responsibility for your care always rests with our human clinicians, and AI is never a      substitute for their professional judgment.