About this policy
Catalyst Allied Health (James May Pty Ltd, ABN 41 686 509 008) provides mobile occupational therapy across Townsville and surrounds. Because we provide a health service, we must follow the Privacy Act 1988 (Cth) and the Australian Privacy Principles, even as a small business.
This policy explains how we handle personal information, including health information. It covers our clients and their families and carers, referrers, and anyone who contacts us or asks about working with us.
The information we collect
We collect only what we need to provide your therapy and run the practice.
- Your details: name, preferred name, pronouns, date of birth, address, phone and email.
- Health information: diagnoses, medical and disability history, goals, assessment results, case notes and reports.
- Funding details: NDIS number and plan details, Support at Home or My Aged Care details, DVA file number, Medicare details for GP-referred care, and private health insurance.
- People around you: parents, guardians, carers, emergency contacts, your GP and others in your care team.
- Home visit information: what our clinicians need to know to visit safely, such as pets, access and any risks.
- Billing records: invoices, payments and claims.
- Referrer details: the name, role, organisation and contact details of a person who refers a client to us.
- Job enquiries: the details you send when you ask about working with us.
How we collect it
Most information comes from you, or from the person who supports you, when you:
- send a booking, referral or question through our website
- phone or email us
- see one of our clinicians
We also receive information from others with your consent, such as a referral from your GP, support coordinator, plan manager, hospital, aged care provider or school. When someone refers you, we contact you to check you're happy to go ahead before we start.
If we receive information we didn't ask for and don't need, we destroy or de-identify it as soon as it's lawful and reasonable to do so.
Why we use it
We use your information to provide and manage your care. That means we use it to:
- assess your needs and provide therapy, reports and recommendations
- book appointments and plan home visits safely
- claim from your funding body and send invoices
- work with your GP and care team, with your consent
- meet our legal and professional duties, such as keeping clinical records and taking part in audits
- check and improve the quality of our services, using information that doesn't identify you where we can
We never sell personal information or use it for advertising.
How we store and protect it
Your records are kept in our secure practice system, in a database hosted in Sydney, Australia.
- Every staff member signs in with their own account. Clinicians see only the clients they work with.
- Information is encrypted while it travels between your device and our systems.
- Staff are signed out automatically after 30 minutes without activity.
- Signed clinical notes can't be changed or deleted. Corrections are added as dated addenda.
- The system records who added or changed each client record.
- Our team is bound by confidentiality and follows our privacy procedures.
Our service providers. We use a small number of providers to run our systems. They may handle your information only to provide their service to us:
- Supabase: our client database and staff sign-in, stored in Sydney, Australia
- Vercel: hosts our website
- Google Fonts: supplies the fonts our website uses
- Our email provider: handles the emails you send us
Overseas. We don't send your health records overseas. Vercel and Google are based in the United States and may process technical details of your website visit, such as your IP address, there and in other countries. If you email us, our email provider may store your message outside Australia.
Our website
When you send a form on our website, it goes securely and directly to our client database in Sydney. The website itself doesn't keep a copy.
- We don't use advertising or tracking cookies, or analytics that follow you around the web.
- Our website host keeps standard technical logs, such as IP address and browser type, to run and protect the site.
- To block spam, we keep a scrambled version of your internet address for a short time, never the address itself.
- The staff login area stores a sign-in token on staff devices only. The public pages don't set cookies.
How long we keep records
We keep clinical records for at least 7 years after your last appointment. For a child, we keep them until they turn 25, if that is later.
We may keep records longer when the law requires it, or when a claim, complaint or audit is still open. When we no longer need information, we securely destroy it or remove anything that identifies you.
Website requests that don't lead to a booking are deleted once we've dealt with them, usually within 12 months.
Your choices and rights
Staying anonymous. You can phone us with a general question without giving your name. We need your real details to provide therapy or claim funding.
Seeing your records. You can ask for a copy of the information we hold about you. We'll respond within 30 days. Asking is free. We may charge a reasonable fee to cover the cost of providing copies, and we'll tell you before we do. In rare cases the law lets us refuse or limit access, for example if access could seriously threaten someone's safety. If so, we'll explain why in writing.
Correcting your records. If something we hold is wrong, out of date or incomplete, tell us and we'll correct it within 30 days, free of charge. If we disagree, we'll tell you why, and you can ask us to attach your statement to the record.
To make a request, contact us using the details below. We'll check your identity first, or confirm that you're authorised to act for the person.
If there's a data breach
If your information is lost or accessed without permission, we act straight away to contain it. We then assess within 30 days whether it's likely to cause serious harm. If it is, we tell you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires, and explain what we're doing and what you can do to protect yourself.
Questions and complaints
If you're worried about how we've handled your information, please tell us first using the details below. We'll acknowledge your complaint within 5 business days and give you a full response within 30 days.
If you're not satisfied with our response, you can contact:
- Office of the Australian Information Commissioner for privacy complaints: 1300 363 992
- Office of the Health Ombudsman for complaints about health services in Queensland: 133 OHO (133 646)
- NDIS Quality and Safeguards Commission if you're an NDIS participant: 1800 035 544
- Aged Care Quality and Safety Commission if you receive Support at Home services
Contact us
- Privacy contactOur privacy officer, Catalyst Allied Health
- Phone07 4448 5777
- Emailadmin@catalyst-ah.com.au
We review this policy every year and whenever our practices change. The latest version is always on this page, and we'll give you a free copy on request.