1. Purpose of this policy
This Privacy Policy explains how Caitlin Stejskal Occupational Therapy (“I”, “me”, “my practice”) collects, holds, uses and discloses personal information, including health information. It also explains how you can access or correct your information and how to make a complaint.
I am committed to protecting your privacy and handling your information in accordance with:
- the Privacy Act 1988 (Cth), including the Australian Privacy Principles (APPs)
- applicable state and territory health records legislation
- the NDIS Practice Standards and the NDIS Code of Conduct
- my professional obligations as an occupational therapist registered with the Occupational Therapy Board of Australia (AHPRA)
When you engage my services, I will explain this policy and ask for your consent to collect, use and disclose your information as described here. You can ask questions about this policy at any time, and you can withdraw or change your consent as described in section 13.
2. Information I collect
I only collect personal and health information that is reasonably necessary to provide occupational therapy and related services. This may include:
- name, date of birth, address and contact details
- NDIS number, plan details, funding and plan management type, and your goals
- medical history, diagnoses, assessments, reports, therapy notes and functional information
- information from other treating professionals and support providers
- emergency contact and next of kin details
- billing, invoicing and payment information
- information provided by a parent, guardian, nominee, authorised representative or support person
- relevant photographs, videos or other clinical records, which I only take or keep with your consent
- session transcripts and draft notes created with an AI scribe, only where you have agreed to this (see section 5)
For children, and for participants who use decision-making supports, information may be collected from parents, guardians, nominees or authorised representatives. I will still involve the participant in decisions about their information as much as they are able and wish to be.
If you give me information about another person (for example, a family member), please make sure they know you are sharing it with me.
3. Anonymity and pseudonyms
You can make a general enquiry without giving your name, or by using a pseudonym. However, because of the nature of therapy and NDIS funding and reporting requirements, I am not able to provide services to you anonymously.
4. How information is collected
Wherever reasonable and practical, I collect information directly from you. Information may also be collected through:
- intake forms, referrals and service agreements
- assessments, therapy sessions and observations
- phone calls, email, SMS, telehealth and other online communication
- NDIS portals and plan documentation
- other health professionals or service providers, with your consent or where otherwise permitted by law
- your authorised representative, guardian or nominee
- my website or online enquiry forms
If I receive information about you that I did not ask for and do not need, I will destroy or de-identify it where it is lawful and reasonable to do so.
5. Use of AI tools
AI transcription (Heidi)
With your consent, I may use Heidi, an AI clinical scribe, to help me write session notes. Heidi listens to the session, creates a written transcript, and produces a draft clinical note. This lets me give you my full attention during sessions rather than typing notes.
Your consent. I will not use Heidi unless you (or your parent, guardian or authorised representative) have agreed to it. I will ask for your consent before I first use it and confirm it verbally at the start of a session. If other people are present in a session, I will make sure they are also comfortable with it being transcribed.
Your right to say no. Using Heidi is optional. You can decline, or ask me to stop or pause transcription at any time, including partway through a session. Saying no will not affect the quality of your services, and I will write my notes manually instead.
How your information is handled.
- Audio is processed in real time to create the transcript. According to Heidi, the audio recording is not stored once the transcript and notes are produced.
- Heidi states that it hosts Australian customer data in Australia and does not use customer data to train its AI.
- I review, edit and approve every note before it becomes part of your record. The AI does not make clinical decisions, and the final clinical note is my professional responsibility.
- Once I have finalised a note, I copy it into your client record in Splose and delete the transcript and draft note from Heidi.
- Your final clinical notes are kept in Splose and retained as described in section 11.
AI assistance with report writing
I may use general AI writing tools to help with the wording, structure or editing of reports and other documents. When I do, I do not enter your name, date of birth, NDIS number, contact details or any other information that could reasonably identify you. Any details that could identify you are removed or changed first, and identifying information is only added afterwards within Splose.
I check all AI-assisted content for accuracy, and every report reflects my own clinical assessment and judgement. The AI does not make decisions about you or your supports. If you would prefer I do not use AI tools for your reports, please let me know and I will respect this.
6. Splose and other service providers
I use Splose, a cloud-based practice management system, to securely manage client records and practice administration. Information stored in Splose may include contact details, clinical notes and assessments, reports, appointment history, billing and invoicing information, and relevant clinical images or attachments. Splose states that Australian users’ data is stored in Australia, encrypted, and regularly backed up.
I also use other trusted providers to support my practice, such as email, accounting, telehealth and electronic document or signature systems. I take reasonable steps to make sure these providers protect personal information appropriately, and they may only use your information to provide their service to me.
7. How your information is used
I use your information to:
- provide occupational therapy services and supports
- conduct assessments and prepare reports
- communicate with you and your support network
- coordinate services with other providers involved in your care
- manage appointments, billing, administration and service delivery
- meet NDIS funding, audit, reporting and compliance requirements
- monitor and improve the quality and safety of my services
- comply with legal and professional obligations
I will not use your information for any other purpose unless you consent or the law allows it. I do not sell your information, and I do not use it for marketing without your consent.
I do not use computer programs to make decisions about you that significantly affect your rights or interests. Any AI tools I use only assist with documentation, and all decisions are made by me.
8. Disclosure of information
Your information may be disclosed to:
- other health or disability service providers involved in your care
- support coordinators, plan managers, Local Area Coordinators or the NDIA
- your parent, guardian, nominee, authorised representative or support person
- Medicare, insurers or other funding bodies where required
- the NDIS Quality and Safeguards Commission, including for incident reporting and audits
- emergency services or medical professionals where there is a serious risk to life, health or safety
- government or regulatory bodies where disclosure is required or authorised by law
This may include situations involving mandatory reporting obligations, reportable incidents under the NDIS, subpoenas or court orders, safeguarding requirements, or suspected abuse, neglect, exploitation or serious risk of harm.
I will ask for your consent before sharing your information, unless disclosure is required or authorised by law or necessary to prevent or lessen a serious threat to someone’s life, health or safety.
9. Overseas storage and disclosure
My main systems, Splose and Heidi, store client data in Australia. Some other providers I use (for example, email or accounting software) may store or process data on servers outside Australia. Where this happens, I take reasonable steps to make sure those providers handle your information in a way that is consistent with the Australian Privacy Principles. I do not otherwise send your information overseas unless you ask me to or consent to it.
10. Electronic communication
I take reasonable steps to protect electronic communications, but email, SMS and other electronic methods are not always completely secure. If you prefer, you can ask me to use a different way of communicating, and I will do so where reasonably practicable.
11. Data retention and destruction
Records are kept in accordance with health records legislation, NDIS requirements and my professional obligations. Generally:
- adult records are kept for at least 7 years from the last date of service
- children’s records are kept until the client turns 25, or for at least 7 years from the last date of service, whichever is later
After the required retention period, records are securely destroyed or permanently de-identified.
12. Security of information
I take reasonable steps to protect your information from misuse, interference, loss, and unauthorised access, modification or disclosure. These include:
- password-protected devices and systems with two-factor authentication where available
- encrypted storage and secure Australian-hosted cloud platforms
- restricting access to client records to people who need it
- secure disposal of paper and electronic records
- secure backup systems
No electronic system can be guaranteed to be completely secure, but I regularly review my practices to keep your information as safe as possible.
13. Your rights: access, correction and consent
You have the right to:
- ask for access to the personal information I hold about you
- ask me to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading
- withdraw or change your consent, including for AI tools or for sharing information with particular people
- ask how your information is collected, stored, used or disclosed
- make a complaint about how your information has been handled
To make a request, please contact me using the details in section 17. I may need to confirm your identity before releasing information. I will respond within 30 days. There is no charge to make a request, though a reasonable fee may apply for providing large volumes of copies, and I will tell you about any fee in advance.
Access may be refused only in limited circumstances allowed by law, for example where giving access would pose a serious threat to someone’s life, health or safety, or would unreasonably affect another person’s privacy. If I refuse access or correction, I will tell you why in writing and how you can complain. If I do not agree to correct your information, you can ask me to attach a statement to your record noting your view.
14. Website and online services
If you visit my website or submit an online enquiry, I may collect your name and contact details, the information you submit, and website usage data such as browser type, IP address and pages visited. Cookies or analytics services may be used to improve how the website works. You can disable cookies in your browser settings, although some website functions may be affected.
15. Data breaches
If a data breach occurs that is likely to result in serious harm, I will act in accordance with the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth). This includes containing the breach, assessing it promptly, and notifying affected individuals and the Office of the Australian Information Commissioner (OAIC) where required.
16. Complaints
If you have concerns about how your information has been handled, please contact me first using the details below. I will acknowledge your complaint within 5 business days and aim to resolve it within 30 days. Making a complaint will not affect your services.
If you are not satisfied with my response, you can contact:
Office of the Australian Information Commissioner (OAIC)
Phone: 1300 363 992 · Website: www.oaic.gov.au
NDIS Quality and Safeguards Commission (for NDIS participants)
Phone: 1800 035 544 · Website: www.ndiscommission.gov.au
You may also contact the health complaints body in your state or territory. You are welcome to have an advocate, support person or interpreter help you with a complaint or any privacy request. The Translating and Interpreting Service (TIS National) can be reached on 131 450.
17. Contact details
Caitlin Stejskal Occupational Therapy
Privacy contact: Caitlin Stejskal
Email: hello@otcaitlin.com.au
Phone: 0424 426 182
18. Changes to this policy
I review this policy regularly and will update it when my practices or the law change. The current version is always available on request, free of charge, and I can provide it in another format (such as large print or Easy Read) if that would help you.