Privacy Policy

Our Commitment to Protecting Your Privacy
Hobart Allied Health Pty Ltd, trading as Hobart Speech Pathology (we, us, our) is an allied health practice providing speech pathology and related services to adults in Tasmania.

We place the highest priority on responsible privacy practices. This privacy policy (this policy) explains how we will collect, use, disclose, store, and protect your personal information. This Policy also describes the way in which you may access or correct the personal information we hold about you, and how to contact us if you have any complaints in relation to your privacy

We handle your personal information in compliance with the Privacy Act 1988 (Cth) (Privacy Act) and its Australian Privacy Principles (APPs) , and the following state and territory legislation:

• the Health Records Act 2001 (Vic) and its ‘Health Privacy Principles’ in Victoria;
• the Health Records and Information Privacy Act 2002 (NSW) and its ‘Health Privacy Principles’ in New South Wales; and
• the Health Records (Privacy and Access) Act 1997 (ACT) and its ‘Privacy Principles’ in the Australian Capital Territory.

The above state and territory Health Privacy Principles and Privacy Principles are referred to in this policy as the ‘HPPs’.

This policy is regularly reviewed and updated. The latest version is always available on our website: hobartspeechpathology.au.

A reference in this policy to a ‘patient’ includes NDIS participants, clients and other consumers of our services.

What is Personal Information?

This policy applies to our handling of personal information. Personal information is any information or opinion about an identified or reasonably identifiable individual.

Sensitive information is a type of personal information.  Sensitive information includes identifying health information about you (such as details of your health and medical history, and health services you seek or receive).   Sensitive information also includes information about racial or ethnic origin, political opinions or associations, religious or philosophical beliefs, and sexual orientation or practices.  Sensitive information is subject to additional protections under the Privacy Act. As a health service provider, most of the information we collect is sensitive health information. We apply the highest standards of care and security to all personal information we hold.

What Personal Information Do We Collect and Why?

We collect only the minimum information reasonably necessary to provide safe, effective, and person-centred allied health services and to manage your care, or where this is otherwise necessary for our functions or activities.

We may also collect your personal information to provide you with information regarding our services, to arrange billing with you for our services, to obtain any necessary consents from you, and to enable us to respond to any queries or complaints you may have. 

We may collect the following categories of information:

Identity and Contact Information

• Full name, date of birth, gender, address, phone numbers, and email address
• Occupation, employment status, or vocational goals (where relevant to your communication or participation goals)
• Medicare other government identifiers (where required for claiming)
• Information collected via our website and emails, including IP address

Health and Clinical Information

• Medical, surgical, psychiatric, and relevant developmental history
• Current medications and medication lists, including allergies and intolerances
• GP health summaries and hospital discharge summaries, specialist reports
• Health service unit record numbers (UR/URN) from referrers
• Reports, plans, and recommendations from other allied health professionals and services involved in your care (e.g., Occupational Therapy, Dietetics, Behaviour Support Practitioners, Physiotherapy, Psychology)
• Referral information and relevant history from the Tasmanian Health Service (THS), where applicable
• Assessment data and results from formal/standardised assessments and informal clinical observations that we collect
• Treatment and progress records, including individualised therapy plans, session notes, home programs, outcome measures, and goal attainment (including NDIS plan goals)
• Details of assistive technology or AAC devices and their use

Support Network and Representative Information

• Emergency contacts and next-of-kin (where relevant for your care)
• Details of guardians, advocates, and substitute decision-makers, and relevant Tasmanian Civil and Administrative Tribunal (TASCAT) orders or pending applications
• Office of the Public Guardian (OPG) details and orders (where applicable)
• Relevant social, family, and participation history, including living situation, support networks (family, carers, advocates), and valued activities or goals (to ensure therapy is functional and meaningful)

Funding, Referrer, and Administrative Information

• Details of all health providers and services involved in the delivery of your care (including referrers, GPs, specialists, and other treating professionals)
• NDIS participant number, NDIS plans, DSOA numbers, and ISP packages (where applicable)
• Tasmanian Health Service referrer information
• Funding and billing details, where applicable, including NDIS plan goals and budget information (for service coordination and claiming), Plan Manager information, Private health insurance details

If you are a person other than a patient, such as a service provider, contractor or other third party we engage with, we will collect your personal information to the extent necessary for our functions or activities, and to work, transact or engage with you. 

You are not required to disclose your personal information to us.  However, if you do not provide the information requested, you may not be able to receive our services or engage with us effectively.

How Do We Collect Personal Information?

We will collect your personal information in a lawful and fair way and in a manner that is not unreasonably intrusive.

We will only collect your personal information where you have consented, or otherwise in accordance with the law.

If you are a patient, we will generally collect your personal information directly from you. We collect personal information directly from you through intake forms, queries submitted through our website contact form, consultations, assessments (in-person and telehealth), phone, and email.

We also obtain relevant information from third parties involved in your care, including:

• GPs, medical specialists, hospitals and other health facilities (via health summaries, discharge summaries, and Release of Information requests)
• Other allied health professionals (e.g., Occupational Therapy, Dietetics, Behaviour Support Practitioners)
• Tasmanian Health Service (where applicable)
• Prior reports and clinical documentation from previous or current providers
  Your NDIS Support Coordinator or Local Area Coordinator (Where applicable)
• Family members or other persons you have authorised to provide your information to us
• Medicare and your health insurer (where applicable)

We will only collect your personal information from third parties with your consent, or where it is not practical to obtain this information from you and this is otherwise permitted by the privacy laws.

If you are a person other than a patient, such as service providers, contractors and third parties we engage with, we will generally collect your personal information directly from you, and we may collect your personal information from third parties. For example, if you are a service provider we may collect information from your referees.

When we collect your personal information, we will as soon as is practicable take reasonable steps to notify you of the details of the collection (including notifying you through this policy), such as the purposes for which the information was collected, the organisations (if any) to which the information will be disclosed, and also notify you that this policy contains details on how you may access or correct your information, or raise any complaints. 

Cookies
Our website uses minimal functional cookies (if any) only to enable basic features like form submissions or appointment booking. We do not use analytics, tracking, or advertising cookies.

How Do We Use and Disclose Your Personal Information?
How we use and disclose your personal information will depend on why you are dealing or engaging with us and in what capacity.

We will generally only use your personal information for the primary purposes for which you have provided it to us.

If you are a patient, we use your information for the following primary purposes:

• To assess your communication and/or swallowing needs and deliver safe, effective, evidence-based speech pathology services
• To develop, implement, and review individualised therapy plans and goals (including NDIS plan goals)
• To coordinate your care with other health professionals and services involved in your support 
• To identify and manage clinical risks and support your safety
• To deliver training and education to carers, support workers, and family members to support the safe and effective implementation of therapy strategies and recommendations
• To communicate with you and your authorised representatives or support network about your care, appointments, progress, and reports
• To maintain clinical records and manage your appointments with us
• To process billing, invoices, and claims

We may also use your personal information where we are otherwise required or authorised by law to do so, which may include the following:

• where we use your information for purposes which are directly related to the primary purpose for which we collected it, in circumstances where you would reasonably expect us to use your information for these purposes, which may include:
  • To prepare reports, summaries, and recommendations for referrers, the Tasmanian Health Service, NDIS Support Coordinators,  funding bodies, and other authorised parties
  • To process billing, invoicing, and claims through the NDIS, Medicare, private health insurers, or other funders
  • To maintain accurate and up-to-date clinical records as required by law and professional standards
  • To meet our legal, regulatory, and professional obligations, including audits, quality reviews, complaints handling, and mandatory reporting requirements
• to support quality assurance, clinical governance, and continuous improvement of our services (where we take all reasonable steps to de-identify the information)

• where it is unreasonable or impracticable to obtain your consent and the use is necessary to lessen or prevent a serious threat to the life, health or safety of any individual, or to public health or safety

• where we are compelled under law, e.g., under a subpoena or court order.

If you are a person other than a patient, such as service providers, contractors and third parties we engage with, we may use your personal information to manage our relationship with you.

We will generally only disclose your personal information to other persons for the primary purposes for which you have provided it to us, which if you are a patient will usually be for the purposes of you receiving services from us.

If you are a patient, disclosures of your personal information are strictly limited and may include disclosure:

• to treating practitioners or staff (bound by confidentiality)
• to other health professionals involved in your care
• to your authorised representative (where applicable)
• to funding bodies for claims
• of reports, summaries, and recommendations to referrers, the Tasmanian Health Service, NDIS Support Coordinators,  funding bodies, and other authorised parties (where applicable)

These disclosures will only be to the extent this is necessary for your ongoing care and support.  Please tell us if you do not wish for your personal information to be disclosed to a particular health professional or organisation.

We use a secure third party Australian-based practice management system, to enable the delivery of our services. Through this practice management system, we may collect and handle your personal information for purposes including booking and managing appointments, maintaining clinical records, billing and payments, and communicating with you about your care. We may share your information with the third party practice management system provider to the limited extent necessary for these functions to be provided. We take all reasonable steps to ensure the third party practice management system provider complies with the Privacy Act and APPs.

If you are a person other than a patient, such as service providers, contractors and third parties we engage with, we may disclose your personal information to manage our relationship with you.

We will otherwise only disclose your personal information to other persons:

• for other purposes for which you have provided consent. This includes where you consent to use of and disclosure of your information to our third party AI-assisted note taking tool (see the ‘Automated decision making and use of artificial intelligence (AI)’ section of this policy)
• for purposes which are directly related to the primary purposes for which the information was collected, in circumstances where you would reasonably expect us to disclose your information for these purposes
• where we are otherwise required or authorised by law to do so, for example:
• where disclosure is compelled under law, such as where we need to comply with a subpoena or Court order
• where it is unreasonable or impracticable to obtain your consent and we reasonably believe disclosure is necessary to lessen or prevent a serious threat to the life, health or safety of any individual, or to public health or safety.

Speech pathology students working under direct supervision are bound by the same confidentiality and privacy obligations as our qualified staff.

We do not engage in direct marketing, or use your information for promotional purposes. We do not share information for research, teaching, audits, or secondary uses without your explicit consent.

Photos, Audio, or Video Recordings
If we take any photos, video recordings, audio recordings, or similar, these are stored securely within our Australian-based practice management system and used only for your direct care, with your consent.

Automated decision making and use of artificial intelligence (AI)
With your consent, our health practitioner staff may use a third-party AI-assisted note-taking tool, to help prepare clinical notes of your consultations and related documents post consultation.

The AI tool records and processes the practitioner’s spoken content of your consultation, and transcribes these recordings into written notes post consultation, allowing your practitioner to focus more on your care during consultations.

After transcription, the AI tool also helps format the information into formal clinical documents. These documents are always reviewed and finalised by your health practitioner to ensure accuracy and completeness before they are included in your clinical records.

Once your clinical notes and related documents are finalised, the audio recordings are permanently deleted.

The AI tool is hosted within Australia, and it does not store your data or use it for any external purposes, including training or development.

You may decline or withdraw consent to the use of this AI tool at any time, without affecting your access to care.

We do not make decisions which could reasonably be expected to significantly affect the rights or interests of patients or other individuals solely by means of automated decision making or the use of AI, and all AI use is subject to human oversight and clinical judgement.

We will inform you through this policy if in future we use any computer programs or AI systems that use personal information to make automated decisions that could reasonably be expected to significantly affect the rights or interests of an individual. This will include information about the kinds of personal information used in, and types of decisions made by, such computer programs or AI systems that use personal information to make such decisions.

Overseas and Interstate Disclosure
All personal information and data we collect is stored and processed within Australia.

It may be necessary to disclose your personal information to persons or organisations interstate or overseas to provide you with ongoing care (for example, where a referral is made by our staff to a health professional located interstate or overseas).

We will only disclose your personal information interstate or overseas if we would be lawfully permitted to disclose it to a recipient in Australia, and:

• we have taken reasonable steps to ensure that the interstate or overseas recipient of your personal information does not breach the APPs or HPPs; or
• the interstate or overseas recipient is subject to a law, binding scheme or binding contract that provides substantially similar protection to the APPs and HPPs which you can access and enforce; or
• the disclosure interstate or overseas is otherwise required or authorised by law.

Security and Data Breaches
We implement robust physical, technical, and administrative safeguards to protect your information from misuse, interference, loss, or unauthorised access. As a mobile practice, we maintain secure digital systems and strict staff protocols.

We are required to comply with mandatory ‘notifiable data breach’ scheme (the NDB scheme) under the Privacy Act. The NDB scheme applies when an ‘eligible data breach’ of personal information occurs.

An ‘eligible data breach’ occurs when:

• there is unauthorised access to or unauthorised disclosure of personal information, or a loss of personal information, that an organisation holds; and
• this is likely to result in serious harm to one or more individuals; and
• the organisation has not been able to prevent the likely risk of serious harm with remedial action.

Where we have reasonable grounds to believe that we have experienced an eligible data breach (and remedial action cannot be used), we will promptly notify affected individuals and the Office of the Australian Information Commissioner (OAIC) about the breach in accordance with the Privacy Act.

Storage and Retention of Records
We store your personal and health information (including all clinical records, assessment data, treatment notes, reports, and related sensitive health information) securely in our electronic practice management and clinical records system. This system is hosted in Australia.

We keep your personal information for the time periods required by law. When your personal information is no longer required (and in the case of your health information, the information has been retained for the required periods under the HPPs or otherwise under law) we will take steps to securely destroy the information or to ensure that the information is permanently de-identified.  The minimum required retention period for health information under the HPPs is usually 7 years from the date of last service for adults, or for health information collected from a child it must be retained until they are 25 years of age.

Access and Correction
You have the right to request access to and correct of your personal information (for example, because you believe the information is inaccurate, out-of-date, incomplete, irrelevant or misleading). Requests should be made in writing to the Manager, Hobart Allied Health Pty Ltd, using the contact details set out below.

In certain circumstances, we may refuse to allow you access to your personal information where this is authorised by the law, such as where providing access would have an unreasonable impact on the privacy of other individuals, providing access would pose a serious threat to the life or health of any person or to public health or safety, or giving access would be unlawful.

We will verify your identity and respond promptly (usually within 30 days).

If we refuse your request for access or correction, we will provide you with reasons for the refusal in writing, and details about how you may complain about the decision.

If access is provided, this will occur securely (e.g., in person, via registered post, or other secure electronic means). Access is provided free of charge except where extensive copying or postage costs apply (we will advise any reasonable fees in advance, and subject to applicable laws regarding access fees). We do not send sensitive information via unencrypted email.

Anonymity
Where practicable, you may interact with us anonymously or by pseudonym (e.g., initial enquiries), except where identification is required for safe care or by law.

Complaints
If you have concerns about your privacy, please contact the Manager – we will investigate thoroughly and respond promptly. If unsatisfied, , or if you do not wish to raise a question or complaint with us directly, you may wish to raise the matter with the OAIC (www.oaic.gov.au or 1300 363 992).

Changes to this Policy
We may update this policy and will post changes on our website with the new effective date.

Contact Us
For privacy questions, access requests, or complaints:

Privacy Contact: The Manager
Hobart Allied Health Pty Ltd
Email via website contact form below: