Privacy | Geelong Occupational Therapy

Who this covers

This policy explains how Geelong Occupational Therapy handles personal information and health information. It covers information collected through this website and in the course of providing occupational therapy services.

We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and in Victoria by the Health Records Act 2001 (Vic) and its Health Privacy Principles. We also follow Occupational Therapy Australia's Code of Ethics.

The small business exemption does not apply to us

Most Australian businesses turning over less than $3 million a year sit outside the Privacy Act. Health service providers do not, regardless of size or turnover. We are a small practice and we are still fully bound, which is how it should be given what we hold.

What we collect

We collect only what we need to provide a service and to be paid for it.

Identity and contact details: name, date of birth, address, phone, email, and the details of anyone enquiring on your behalf.
Health information: your reasons for seeking occupational therapy, relevant diagnoses and medical history, functional assessments, therapy notes, goals, progress, equipment prescribed and reports written about you. Health information is sensitive information under the Privacy Act and stricter rules apply to it.
Funding and billing details: your NDIS, TAC, DVA or My Aged Care information, private health fund details, plan management contacts, invoices and payment records.
Correspondence: emails, letters, text messages and file notes of phone calls.

How we collect it

Directly from you, in conversation, in appointments and through the forms on this website.
From a person who enquires or refers on your behalf, such as a family member, support coordinator, plan manager, GP or case manager.
From other health professionals involved in your care, with your consent.

Where it is reasonable and practical, we collect information from you rather than from someone else. If we receive information about you that we did not ask for and do not need, we destroy or de-identify it.

If information is incomplete or inaccurate, or you would rather not give it to us, we may not be able to provide the service you are asking for. We will tell you if that is the case.

Consent

We collect health information with your consent. Consent means you were told what we were collecting and why, you agreed freely, you had the capacity to agree, and the agreement is current and specific. You can withdraw it at any time, though that may affect our ability to keep providing a service, and we will tell you plainly if it does.

Why we collect it, and how we use it

To assess your needs, plan and deliver therapy, and to contact you about your care.
To write the reports your funding requires, and to correspond with the people involved in your care.
To send appointment reminders and follow-ups by text message or email, to the number or address you have given us.
To invoice and be paid, and to confirm with your funder or health fund the services we have provided.
For quality assurance, accreditation, audits, risk and claims management, client satisfaction surveys, and staff education and training.
To meet our legal, professional and insurance obligations.

We will not use your information for marketing or research unless you have given us your express consent. We do not sell it, and we do not trade mailing lists.

Who we disclose it to

Only where you have consented, or where the law requires or permits it. In practice that usually means:

Your funder or its representative, such as the NDIA, a plan manager, a support coordinator, the TAC, the Department of Veterans' Affairs, your private health fund or an aged care assessor.
Other treating professionals, such as your GP, specialist, physiotherapist, psychologist or speech pathologist, including those working or consulting with us on your care.
The person who referred you, usually your doctor. We generally send them a discharge summary when your therapy ends, and at other times where your care needs it. Tell us if you would rather we did not, or if your referrer's details have changed.
Family members, close friends, a guardian or another person responsible for you, about your condition, unless you tell us you do not want us to.
Equipment suppliers and, for home modifications, builders and access consultants, limited to what they need to quote and complete the work.
Our insurers and professional advisers, where relevant to a claim or an obligation.
Anyone you have specifically authorised, including a plan nominee.

We may also disclose information without your consent where we are legally required to, or where there is a serious and imminent threat to someone's life, health or safety. These situations are rare, and we would tell you wherever it is safe and lawful to do so.

We do not send your records overseas. The one exception is the enquiry form on this website, described below, which is delivered by service providers whose servers may be outside Australia. If anything else ever changes, this policy will be updated before it happens.

Information collected through this website

This website has one form of its own, the enquiry form. It asks for a name and contact details, and includes a free-text box in which people sometimes describe a health condition. Anything you write there is treated as health information. The NDIS and aged care referral forms are provided by Splose, our practice management system, and are handled by Splose rather than by this website.

Enquiries are emailed to the practice inbox and are not stored in a database on this website. On the way they pass through our web host (Netlify) and an email delivery service (Resend), whose servers may be outside Australia. The delivery service keeps a copy in its delivery logs for a limited period.
The site is served over an encrypted connection (HTTPS).
We set no cookies and run no analytics, advertising or tracking scripts.
The service-area map loads map tiles from OpenStreetMap, which necessarily receives the request. It is not given any information about you beyond what any website request involves, and it is not used to identify you.

Please do not send detailed medical information through a web form or by email. Bring it to an appointment or send it the way we agree with you.

How we store it, and how long we keep it

Records are held in our practice management system with access limited to the people who need it. Paper records, where they exist, are stored securely. Staff are trained on confidentiality and are bound by professional obligations as well as this policy. We use access controls, firewalls, encryption and physical security to protect it from misuse, loss and unauthorised access, and we take reasonable steps to keep it accurate, complete and up to date.

Under the Health Records Act 2001 (Vic) we must keep health records for at least:

seven years from the date of last service, for an adult; and
until the 25th birthday, for anyone who was under 18 at the date of last service.

After that, records are securely destroyed or de-identified. Enquiries that do not become clients are removed once the enquiry has been answered and closed out.

Getting access, and correcting it

You can ask for a copy of the information we hold about you, and you can ask us to correct anything that is wrong, out of date or misleading. Ask our Privacy Officer in writing and we will respond within 30 days. If we do not agree to make a correction you have asked for, you can give us a statement of the change you wanted and we will keep it with your record.

There are limited circumstances in which we can refuse access, such as where it would pose a serious threat to someone's life or health, or unreasonably affect another person's privacy. If we refuse, we will tell you why in writing and explain how to complain. We may charge a reasonable fee for the cost of retrieving and copying a large record, and we will tell you what it is before we do the work.

If something goes wrong

If there is a data breach that is likely to result in serious harm, we are required to notify the affected people and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme. We would tell you what happened, what was involved and what to do about it.

Complaints

Talk to us first. Questions, comments and complaints about privacy go to our Privacy Officer: call 0409 405 017 or email info@geelongot.com.au and we will acknowledge it promptly and try to resolve it.

If you are not satisfied with how we have handled it, you can escalate:

Health Complaints Commissioner (Victoria), for complaints about health information: hcc.vic.gov.au (opens in a new tab)
Office of the Australian Information Commissioner, for complaints under the Privacy Act: oaic.gov.au (opens in a new tab)

Changes to this policy

We will update this page when our practices change, and the date below will change with it. If a change materially affects how we handle your information, we will tell you directly rather than rely on you noticing.

Version 1, November 2026.