Privacy Policy

PRIVACY POLICY 

How Bright Star Therapy collects, uses, stores, protects and shares personal and health information. 

Version: 1.2 

Effective date: 10 August 2026 

Review date: August 2027 

Document owner: Bright Star Therapy

1. Purpose and scope

Bright Star Therapy is committed to protecting the privacy, dignity and confidentiality of clients, prospective clients, families, representatives, referrers and other people whose personal information it holds. As a private health service provider, Bright Star Therapy handles health information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), and other applicable legal and professional requirements.

This policy explains the kinds of personal information we collect and hold, how we collect and protect it, why we use or disclose it, and how you can request access or correction or make a privacy complaint.

2. What information we collect and hold 

The information collected depends on the enquiry, referral, funding arrangement and services requested or provided. It may include:

· identity and contact information, including name, preferred name, date of birth, address, phone number and email address;

· parent, guardian, nominee, emergency-contact, support-person and authorised-representative details;

· health, disability, developmental, communication, educational, social and relevant family information;

· assessment results, clinical observations, therapy goals, progress notes, reports, correspondence and care-planning information;

· information about communication supports, AAC, access needs, safety considerations and reasonable adjustments;

· Medicare, NDIS, plan-management, private-health or other funding information where relevant;

· billing, invoice and payment information;

· referral information and information received from health professionals, schools, support providers and other third parties where authorised or otherwise permitted by law;

· appointment, service-use and communication records;

· complaint, incident, risk-management and quality-improvement information; and

· photographs, audio or video recordings only where clinically relevant and appropriately consented to.

3. How we collect information

We usually collect information directly from the client or from a parent, guardian, nominee or other authorised person. Collection may occur through website enquiries, secure Splose forms, service agreements, phone calls, email, appointments, assessments, home or community visits, telehealth, uploaded documents and other service interactions.

We may also receive information from a referrer, GP, specialist, allied health professional, school or education service, support coordinator, plan manager, support provider, insurer, funding body or another person where the client has authorised this, where it is reasonably expected as part of the service, or where collection is otherwise permitted by law.

If we receive unsolicited personal information that we could not lawfully have collected, we will take reasonable steps to destroy or de-identify it where lawful and reasonable to do so.

4. Anonymity and pseudonyms

You may make a general enquiry anonymously or using a pseudonym where this is lawful and practicable. However, Bright Star Therapy will usually need accurate identifying, contact, clinical and funding information to provide safe speech pathology services, maintain clinical records, issue invoices, and meet Medicare, NDIS or other legal and administrative requirements.

5. Why we collect, use and disclose information

We collect, hold, use and disclose personal and health information where reasonably necessary to provide and manage speech pathology services, including to:

· respond to enquiries and referrals and determine service suitability and availability;

· assess, plan, provide, review and document speech pathology services;

· communicate with clients and authorised family members, representatives and support people;

· coordinate care with health, education and disability providers where authorised or otherwise permitted;

· prepare reports, referrals, clinical correspondence and funding documentation;

· arrange appointments, reminders, telehealth, invoicing, payments, Medicare and NDIS administration;

· manage complaints, incidents, risks, emergencies, safeguarding and service quality;

· meet legal, professional, insurance, funding, audit and regulatory obligations; and

· operate, secure and improve the practice, including through appropriately de-identified information where suitable.

If you choose not to provide information that is reasonably necessary, we may be unable to assess a referral, provide a service safely, communicate effectively, process a claim or invoice, or meet applicable funding and legal requirements.

6. When information may be disclosed

We will generally only disclose personal or health information for the purpose for which it was collected, for a directly related purpose a person would reasonably expect, with consent, or where disclosure is otherwise permitted or required by law. We aim to disclose only the information reasonably necessary for the purpose.

Depending on the circumstances, recipients may include:

· parents, guardians, nominees, substitute decision-makers or other authorised representatives;

· GPs, specialists, allied health professionals and other treating providers;

· schools, kindergartens, childcare services or workplaces where authorised and relevant;

· support coordinators, plan managers, supported-living providers and other NDIS-related parties where authorised or required for agreed service or payment administration;

· Medicare, private health insurers or other funding bodies where necessary for claims, verification or payment;

· technology and business service providers that support secure practice operations, such as practice-management, email, document, telehealth, accounting or payment services;

· professional advisers, insurers, auditors and regulators where reasonably necessary; and

· emergency services, child-protection or safeguarding authorities, courts, law-enforcement bodies or other authorities where disclosure is required or authorised by law.

Bright Star Therapy does not sell client information and does not disclose health information for unrelated marketing.

7. Consent, information sharing and supported decision-making

Where consent is the basis for collecting, using or sharing information, we seek consent appropriate to the circumstances. Consent may be limited, changed or withdrawn. We will respect a request to restrict information sharing unless disclosure is permitted or required by law, or the restriction means we cannot safely or reasonably provide the requested service.

Bright Star Therapy supports clients to participate in decisions about their information and services. Where a parent, guardian, nominee, support person or other representative is involved, we will consider the client’s rights, preferences, decision-making ability, communication needs and the representative’s actual authority.

8. Storage and security

Bright Star Therapy takes reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. Information is primarily held electronically. Security measures may include secure practice-management and business systems, role-based access, strong passwords and multi-factor authentication, device security, encryption, secure backups, privacy-aware communication practices and limiting access to information needed for service delivery or administration.

Bright Star Therapy uses Splose as its practice-management system for functions such as client records, forms, appointments, clinical notes, documents and invoicing. Splose states that data for Australian users is stored in Australia and encrypted in transit and at rest. Bright Star Therapy also uses Microsoft 365 services, including business email, document storage and Microsoft Teams, to support practice operations and telehealth. Microsoft 365 provides encryption for customer data at rest and in transit. Where a Microsoft 365 tenant is provisioned in Australia, Microsoft states that certain core customer data, including Exchange Online mailbox content, SharePoint Online content, OneDrive files and Microsoft Teams chat messages, is stored at rest only within Australia under its applicable Product Terms.

Paper documents, where used, are kept to a minimum and are stored or disposed of securely.

9. Email, SMS, telehealth and electronic communication

Email, SMS and telehealth are convenient but may carry privacy and security risks. We use reasonable safeguards and may use secure Splose forms, controlled-access documents or other secure methods where appropriate. Clients may discuss preferred communication methods and request a reasonable alternative. Please avoid sending highly sensitive information through ordinary email or SMS where a secure form or other safer method is available.

10. Technology providers and overseas handling

Bright Star Therapy uses reputable third-party technology and service providers to support practice operations. Although Splose states that data for Australian users is stored in Australia, Splose also states that it uses third parties located both locally and overseas and may disclose personal information to overseas service providers, including overseas cloud computing hosts. Other technology suppliers may also use overseas sub-processors, technical infrastructure or support functions. Bright Star Therapy does not routinely send client clinical records to overseas recipients as part of clinical care.

Where Bright Star Therapy is likely to disclose personal information to an overseas recipient, we will take reasonable steps to meet the requirements of the Privacy Act, including APP 8. The countries involved may vary according to the relevant supplier and service and may not always be practicable to specify in advance. We will update this policy if our usual overseas-disclosure practices materially change.

11. Direct marketing and service communications

Appointment reminders, service updates, billing messages and other communications connected with an existing or requested service are not treated as unrelated marketing. Bright Star Therapy will not use sensitive health information for unrelated direct marketing. Any optional promotional communication will be handled in accordance with applicable privacy and spam requirements and will include a reasonable way to opt out where required.

12. Access to and correction of your information

You may request access to personal information Bright Star Therapy holds about you, or ask us to correct information you believe is inaccurate, out of date, incomplete, irrelevant or misleading. Requests can be made by email to admin@brightstartherapy.com.au. We may need to verify identity or authority before giving access or making changes.

We aim to respond to access and correction requests within a reasonable period, generally within 30 calendar days. There is no charge to make an access or correction request, and no charge to correct information. If a permitted charge is required for providing access, it will be reasonable and explained in advance. Access or correction may be refused or limited where the law permits; if so, we will generally provide written reasons and available complaint options.

13. Retention and secure disposal

Clinical and business records are retained for the periods required by applicable law, professional and insurance requirements, funding arrangements and legitimate clinical or business needs. Records may therefore be retained after services end. When personal information is no longer required and there is no lawful reason to retain it, Bright Star Therapy will take reasonable steps to securely destroy or de-identify it.

14. Data breaches

Bright Star Therapy maintains processes to identify, contain, assess and respond to suspected privacy or data-security incidents. If a data breach is likely to result in serious harm and meets the requirements of an eligible data breach under the Notifiable Data Breaches scheme, Bright Star Therapy will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by law.

15. Privacy enquiries and complaints

Privacy enquiries, access or correction requests, and privacy complaints should be directed to the Bright Star Therapy Privacy Contact at admin@brightstartherapy.com.au. Please provide enough information for us to understand the issue, identify the relevant records where applicable, and understand the outcome you are seeking.

We will acknowledge and consider privacy complaints fairly and aim to provide a response within 30 calendar days. If we need more time, we will let you know where reasonably practicable.

If you are not satisfied with our response, or if we have not responded within a reasonable period (generally 30 days), you may lodge a privacy complaint with the Office of the Australian Information Commissioner (OAIC). Information is available at www.oaic.gov.au and the OAIC enquiries line is 1300 363 992.

16. Availability and changes to this policy

This Privacy Policy will be made available free of charge, including through the Bright Star Therapy website once published, and can also be provided on request in a reasonably accessible form.

We may update this policy when legal requirements, services, technology providers or information-handling practices change. The current version will show its effective date and version number.

Contact Details  

Bright Star Therapy 

Email: admin@brightstartherapy.com.au

Office of   the Australian Information Commissioner

Email: enquiries@oaic.gov.au

Phone: 1300   363 992 

Website:   www.oaic.gov.au