Privacy Policy

Your privacy matters to us. This policy explains what information we collect, why we need it, how we look after it and what you can do if you have a question or concern.

1. Who this policy applies to

This policy applies to current and former clients, parents and guardians, people who contact us about services, and other people whose information we handle. As we provide services to children, we take particular care with children’s personal and health information.

Hawkesbury Speech Pathology Practice aims to handle information in line with the privacy and health-records laws and professional requirements that apply to the practice.

2. What information we collect

The information we collect depends on the service and your child’s needs. It may include:

  • names, dates of birth and contact details for clients and their parents or guardians;

  • health, developmental, communication, speech, language, literacy, fluency, feeding, swallowing and orofacial information;

  • assessment results, clinical observations, therapy plans, progress notes, reports and recommendations;

  • relevant information from doctors, dentists, schools, preschools and other professionals, where provided or authorised;

  • appointment, referral, billing, payment, Medicare, NDIS or other funding information where relevant; and

  • information shared through forms, conversations, emails, phone calls, text messages, telehealth or other contact with Hawkesbury Speech Pathology Practice.

Where recording or transcription is used with appropriate consent, information may also include audio, transcripts or summaries. Digital tools may help prepare draft notes or other documents.

3. How we collect information

We usually collect information from you, your child, or a parent or guardian. With appropriate authority or permission, we may also receive relevant information from a referrer, school, preschool or another health professional. We aim to explain why we need information and will take reasonable steps to collect only what is relevant.

4. Why we use information

We use information to:

  • respond to enquiries and decide whether we can offer a service;

  • assess your child’s needs and provide speech pathology services;

  • prepare clinical notes, reports, therapy plans and home-practice resources;

  • communicate with families and, where authorised and appropriate, other people involved in your child’s care;

  • manage appointments, waiting lists, payments, funding claims and practice administration; and

  • meet legal, professional, safety, quality and recordkeeping responsibilities.

5. Digital tools and AI

Hawkesbury Speech Pathology Practice uses digital systems to manage the practice and may use selected tools with artificial intelligence (AI) features to assist with documentation. AI tools can make mistakes, so the speech pathologist checks AI-assisted clinical information before relying on it or adding it to the clinical record.

Heidi Health

Hawkesbury Speech Pathology Practice uses Heidi Health’s free account to help prepare clinical notes and summaries. Depending on the feature used, this may involve audio or dictated content, transcripts, notes, summaries and questions about session content. Heidi may also be used to organise or analyse session information, such as extracting examples or counting communication behaviours. These outputs are checked by the speech pathologist.

Under the free-plan terms Hawkesbury Speech Pathology Practice has reviewed, Heidi may remove details that identify people and use the resulting de-identified information to develop, test and improve its services. Heidi states that it will not attempt to identify people from this information. De-identification reduces privacy risks but cannot be treated as a guarantee that re-identification is impossible.

Heidi processes information to provide its service. This is separate from any use of de-identified information for service improvement. Recordings, transcripts, notes and other content may have different storage, retention and deletion arrangements.

Hawkesbury Speech Pathology Practice takes reasonable steps to check the terms and privacy arrangements that apply to the features it uses. Heidi and its service providers may process information outside Australia. We cannot promise that all information is stored only in Australia unless this has been confirmed for the relevant service and feature. We provide more detail about Heidi and choices around its use in a separate parent consent form.

ChatGPT

Hawkesbury Speech Pathology Practice uses ChatGPT Go for general questions and general information only. We do not enter identifiable client information into ChatGPT as part of our practice workflow.

Microsoft 365 and Copilot

Hawkesbury Speech Pathology Practice has a Microsoft 365 Business account that includes Copilot. It is used occasionally for general business tasks, such as drafting emails. We do not enter identifiable client health information into Copilot.

We review our use of digital tools from time to time and will update this policy if our practices materially change.

Hawkesbury Speech Pathology Practice maintains an internal procedure governing the appropriate use of AI tools in practice. This procedure identifies permitted and prohibited uses, privacy safeguards, clinical review requirements, consent arrangements and processes for responding to privacy incidents. The procedure is reviewed periodically and when relevant systems, features or provider terms change.

6. When we share information

We may share relevant information with a parent or guardian, referring practitioner, doctor, dentist, ENT specialist, orthodontist, other health professional, school or preschool, insurer, Medicare, a funding body, or a service provider that helps us run the practice. We share information only where there is an appropriate reason, such as your permission, a relevant care purpose, a legal requirement or another basis allowed by law. We aim to share only what is reasonably needed.

We do not sell personal information. Some technology providers may process information on our behalf to provide services such as practice management, storage, communication or documentation.

7. How we store and protect information

Hawkesbury Speech Pathology Practice uses the cloud-based practice management system, Splose, for electronic client files. Paper records are stored in a locked filing cabinet. We take reasonable steps to protect information from loss, misuse and unauthorised access or disclosure, including using password-protected accounts, multi-factor authentication and limiting access where appropriate.

Technology providers may have their own storage, backup and deletion arrangements. Information may be stored or processed outside Australia, depending on the provider, product and feature. We do not promise that information can be immediately deleted from every provider system or backup unless this has been confirmed.

8. How long we keep records

We keep clinical and administrative records for as long as required by applicable law, professional obligations and other legitimate recordkeeping needs.

The required period can depend on the client’s age and the type of record. Recordings, transcripts, drafts and final clinical notes may have different retention arrangements. We take reasonable steps to securely destroy or de-identify information when it is no longer required and we are permitted to do so.

9. Accessing or correcting information

You may ask to access personal information Hawkesbury Speech Pathology Practice holds about you or your child, or ask us to correct information that is inaccurate, incomplete or out of date. A parent or guardian’s access may depend on their authority, the child’s circumstances and applicable legal or professional requirements. Contact us using the details below. We will respond within a reasonable time and explain if any limits apply.

10. Questions, concerns or privacy complaints

If you have a question or concern about how we handle information, please contact us. We will acknowledge and look into your concern and aim to provide a written response within 15 days. If we need more time, we will let you know.

If you are not satisfied with our response, you may be able to contact the Office of the Australian Information Commissioner (OAIC) or another relevant regulator, depending on which privacy laws apply. More information is available at https://www.oaic.gov.au/.

11. Reviewing this policy

We review this policy periodically and when our systems, services or information-handling practices materially change.