privacy policy
Best Of You is committed to protecting your privacy and handling your personal information respectfully, securely and in accordance with our legal obligations.
This Privacy Policy explains how Best Of You collects, uses, stores, discloses and protects personal information, including health information, when providing occupational therapy and related services.
We are guided by the Australian Privacy Principles contained in the Privacy Act 1988 and, where applicable, Victorian health privacy requirements.
A copy of the Australian Privacy Principles is available from the Office of the Australian Information Commissioner at www.oaic.gov.au.
What personal information do we collect?
Personal information is information or an opinion that identifies, or could reasonably identify, an individual.
The types of personal information we may collect include:
name, date of birth and contact details
address and service location information
emergency contact and representative details
NDIS participant number, plan details and funding information
referral information
health, disability and functional information
assessment information, therapy notes, reports and recommendations
communication with participants, families, nominees, support coordinators, plan managers and other health professionals
billing and payment information
information required to meet legal, regulatory, insurance or professional obligations.
How do we collect personal information?
We may collect personal information in several ways, including:
directly from you
during occupational therapy sessions, assessments and communications
through website forms, referral forms, email, phone or online booking systems
from authorised representatives, family members, nominees or guardians
from support coordinators, plan managers, health professionals, service providers or other third parties involved in your support
from NDIS-related documents or other records you provide to us.
Where reasonable and practicable, we collect personal information directly from you. Where we receive information from a third party, we will take reasonable steps to ensure you are aware of this.
Why do we collect and use personal information?
We collect, hold, use and disclose personal information for purposes connected with providing occupational therapy and related services, including:
assessing your needs and providing occupational therapy services
preparing notes, reports, recommendations and other clinical documents
communicating with you and people involved in your support, where appropriate
liaising with support coordinators, plan managers, other health professionals and service providers
managing referrals, bookings, waitlists and service agreements
billing, invoicing and payment administration
maintaining accurate clinical and business records
meeting legal, professional, insurance, audit, quality and regulatory obligations
managing risk, safety, complaints and incidents
improving our services and business operations.
We may use your contact details to provide general service updates or information about Best Of You. We will not use your health information for marketing without your consent. You may opt out of non-essential communications at any time by contacting us.
Sensitive information and health information
Sensitive information includes health information and other information protected under privacy law.
We will only collect sensitive information where it is reasonably necessary for our services or business functions, and where we have your consent or another lawful basis to do so.
Sensitive information will only be used or disclosed:
for the primary purpose for which it was collected
for a directly related secondary purpose you would reasonably expect
with your consent
where required or authorised by law
where necessary to lessen or prevent a serious threat to life, health or safety
where otherwise permitted under privacy law.
Disclosure of personal information
We may disclose personal information where reasonably necessary for the provision, administration or management of our services.
This may include disclosure to:
support coordinators, plan managers, nominees, guardians or representatives
other health professionals or service providers involved in your support
employees, contractors and administrative support engaged by Best Of You
software, IT, practice management, accounting and communication service providers
professional advisers, insurers or legal representatives
government, regulatory, law enforcement or statutory bodies where required or authorised by law.
We only disclose personal information where there is a legitimate reason to do so and, where required, with consent.
Cloud-based systems and overseas disclosure
Best Of You uses secure cloud-based systems to support service delivery and business administration. These may include practice management, accounting, email, document storage and communication platforms.
Personal information may be stored or processed by third-party software or cloud service providers. Some providers may store or process information in Australia or overseas.
We take reasonable steps to choose reputable service providers and to protect personal information from misuse, interference, loss, unauthorised access, modification or disclosure.
Use of artificial intelligence and digital tools
Best Of You may use artificial intelligence, automation and other digital tools for administrative tasks, document preparation, communication, quality checking, analysis and business processes.
AI tools are not used as a substitute for occupational therapy assessment, clinical reasoning, professional judgement or decision making. Any AI assisted material used in participant care, reports or correspondence will be reviewed by an appropriate person before use.
Best Of You may use deidentified reports, notes or other information with AI tools for purposes such as document preparation, quality checking, analysis and improvement of business processes. Where information is deidentified for this purpose, we take reasonable steps to remove or obscure identifying information and minimise information that could reasonably enable a participant to be identified or reidentified.
We take reasonable steps not to intentionally provide identifiable personal information or sensitive health information to publicly available AI tools unless appropriate privacy and security protections are in place and the use is lawful, necessary and consistent with our privacy obligations.
Some AI enabled software used by Best Of You may operate in an environment where it has the technical capability to access files containing participant information. Technical capability does not constitute permission or authorisation to access that information. Best Of You does not instruct AI tools to access, use or process participant information unless that use has been specifically approved as appropriate, necessary, lawful and subject to suitable privacy and security protections.
We use operating procedures, access controls and other technical safeguards to the extent reasonably and practically available within our existing information technology environment, together with appropriate organisational controls, to minimise the risk of unnecessary or unauthorised access, use or disclosure.
We do not knowingly permit identifiable participant personal information or health information to be used to train general-purpose AI models unless this has been appropriately disclosed and consented to, or is otherwise permitted by law.
Security of personal information
We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification or disclosure.
Security measures may include:
password-protected systems
two-factor authentication where available
restricted access to client information
secure cloud-based practice management and business systems
staff and contractor confidentiality obligations
secure handling of clinical records and documents
reasonable processes for record retention, archiving and disposal.
No electronic system is completely risk-free, but we take reasonable steps to protect the information we hold.
Retention and disposal of records
We retain personal information for as long as required for the purpose for which it was collected and to meet legal, professional, insurance and business obligations.
Health records are generally retained for at least 7 years after the last service contact. Where the record relates to a person who was under 18 at the time of service, records will generally be retained until that person reaches 25 years of age.
When personal information is no longer required, and where we are legally permitted to do so, we will take reasonable steps to securely destroy or permanently de-identify it.
Accessing and correcting your personal information
You may request access to the personal information we hold about you.
You may also ask us to correct information if you believe it is inaccurate, out of date, incomplete, irrelevant or misleading.
Requests should be made in writing. We may need to verify your identity before releasing information. We will not charge a fee for making an access request, but we may charge a reasonable administrative fee for providing copies of information where permitted by law.
In some circumstances, we may be unable to provide access to certain information. If this occurs, we will explain why, where reasonable and appropriate.
Maintaining accurate information
We take reasonable steps to ensure the personal information we hold is accurate, complete and up to date.
Please tell us as soon as practicable if your contact details, representative details, NDIS information, health information or other relevant circumstances change.
Privacy complaints and enquiries
If you have a question or complaint about how Best Of You handles personal information, please contact:
Privacy Officer: Ollie Bradley
Email: ollie@bestofyou.com.au
We will take privacy complaints seriously and aim to respond within a reasonable timeframe.
Policy updates
This Privacy Policy may be updated from time to time. The most current version is available upon request.