privacy policy
Best Of You is committed to protecting your privacy and handling your personal information respectfully, securely and in accordance with our legal obligations.
This Privacy Policy explains how Best Of You collects, uses, stores, discloses and protects personal information, including health information, when providing occupational therapy and related services.
We are guided by the Australian Privacy Principles contained in the Privacy Act 1988 and, where applicable, Victorian health privacy requirements.
A copy of the Australian Privacy Principles is available from the Office of the Australian Information Commissioner at www.oaic.gov.au.
What personal information do we collect?
Personal information is information or an opinion that identifies, or could reasonably identify, an individual.
The types of personal information we may collect include:
name, date of birth and contact details
address and service location information
emergency contact and representative details
NDIS participant number, plan details and funding information
referral information
health, disability and functional information
assessment information, therapy notes, reports and recommendations
communication with participants, families, nominees, support coordinators, plan managers and other health professionals
billing and payment information
information required to meet legal, regulatory, insurance or professional obligations.
How do we collect personal information?
We may collect personal information in several ways, including:
directly from you
during occupational therapy sessions, assessments and communications
through website forms, referral forms, email, phone or online booking systems
from authorised representatives, family members, nominees or guardians
from support coordinators, plan managers, health professionals, service providers or other third parties involved in your support
from NDIS-related documents or other records you provide to us.
Where reasonable and practicable, we collect personal information directly from you. Where we receive information from a third party, we will take reasonable steps to ensure you are aware of this.
Why do we collect and use personal information?
We collect, hold, use and disclose personal information for purposes connected with providing occupational therapy and related services, including:
assessing your needs and providing occupational therapy services
preparing notes, reports, recommendations and other clinical documents
communicating with you and people involved in your support, where appropriate
liaising with support coordinators, plan managers, other health professionals and service providers
managing referrals, bookings, waitlists and service agreements
billing, invoicing and payment administration
maintaining accurate clinical and business records
meeting legal, professional, insurance, audit, quality and regulatory obligations
managing risk, safety, complaints and incidents
improving our services and business operations.
We may use your contact details to provide general service updates or information about Best Of You. We will not use your health information for marketing without your consent. You may opt out of non-essential communications at any time by contacting us.
Sensitive information and health information
Sensitive information includes health information and other information protected under privacy law.
We will only collect sensitive information where it is reasonably necessary for our services or business functions, and where we have your consent or another lawful basis to do so.
Sensitive information will only be used or disclosed:
for the primary purpose for which it was collected
for a directly related secondary purpose you would reasonably expect
with your consent
where required or authorised by law
where necessary to lessen or prevent a serious threat to life, health or safety
where otherwise permitted under privacy law.
Disclosure of personal information
We may disclose personal information where reasonably necessary for the provision, administration or management of our services.
This may include disclosure to:
support coordinators, plan managers, nominees, guardians or representatives
other health professionals or service providers involved in your support
employees, contractors and administrative support engaged by Best Of You
software, IT, practice management, accounting and communication service providers
professional advisers, insurers or legal representatives
government, regulatory, law enforcement or statutory bodies where required or authorised by law.
We only disclose personal information where there is a legitimate reason to do so and, where required, with consent.
Cloud-based systems and overseas disclosure
Best Of You uses secure cloud-based systems to support service delivery and business administration. These may include practice management, accounting, email, document storage and communication platforms.
Personal information may be stored or processed by third-party software or cloud service providers. Some providers may store or process information in Australia or overseas.
We take reasonable steps to choose reputable service providers and to protect personal information from misuse, interference, loss, unauthorised access, modification or disclosure.
Use of artificial intelligence and digital tools
Best Of You may use artificial intelligence, automation or digital tools to support administrative tasks, document preparation, communication, quality checking and business processes.
AI tools are not used as a substitute for occupational therapy assessment, clinical reasoning, professional judgement or decision-making. Any AI-assisted material used in client care, reports or correspondence will be reviewed by an appropriate person before use.
We take reasonable steps to not enter identifiable personal information or sensitive health information into publicly available AI tools unless appropriate privacy protections are in place and the use is lawful, necessary and consistent with our privacy obligations.
We do not knowingly permit client personal information or health information to be used to train publicly available AI models unless this has been clearly disclosed and consented to, or is otherwise permitted by law.
Security of personal information
We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification or disclosure.
Security measures may include:
password-protected systems
two-factor authentication where available
restricted access to client information
secure cloud-based practice management and business systems
staff and contractor confidentiality obligations
secure handling of clinical records and documents
reasonable processes for record retention, archiving and disposal.
No electronic system is completely risk-free, but we take reasonable steps to protect the information we hold.
Retention and disposal of records
We retain personal information for as long as required for the purpose for which it was collected and to meet legal, professional, insurance and business obligations.
Health records are generally retained for at least 7 years after the last service contact. Where the record relates to a person who was under 18 at the time of service, records will generally be retained until that person reaches 25 years of age.
When personal information is no longer required, and where we are legally permitted to do so, we will take reasonable steps to securely destroy or permanently de-identify it.
Accessing and correcting your personal information
You may request access to the personal information we hold about you.
You may also ask us to correct information if you believe it is inaccurate, out of date, incomplete, irrelevant or misleading.
Requests should be made in writing. We may need to verify your identity before releasing information. We will not charge a fee for making an access request, but we may charge a reasonable administrative fee for providing copies of information where permitted by law.
In some circumstances, we may be unable to provide access to certain information. If this occurs, we will explain why, where reasonable and appropriate.
Maintaining accurate information
We take reasonable steps to ensure the personal information we hold is accurate, complete and up to date.
Please tell us as soon as practicable if your contact details, representative details, NDIS information, health information or other relevant circumstances change.
Privacy complaints and enquiries
If you have a question or complaint about how Best Of You handles personal information, please contact:
Privacy Officer: Ollie Bradley
Email: ollie@bestofyou.com.au
We will take privacy complaints seriously and aim to respond within a reasonable timeframe.
Policy updates
This Privacy Policy may be updated from time to time. The most current version is available upon request.