Make a Referral

---

 Harmony Allied Health Privacy Policy

Effective Date: 6/6/25
Last Updated: 6/6/25

At Harmony Allied Health, we are committed to protecting the privacy and confidentiality of our clients' personal information. This Privacy Policy outlines how we collect, use, disclose, and store personal information in compliance with the Australian Privacy Principles (APPs) as outlined in the Privacy Act 1988 (Cth), as amended by the Privacy and Other Legislation Amendment Act 2024.

We collect personal and health information necessary for providing occupational therapy services. This information may include:

Personal Information:

• Contact details (name, address, phone number, email)
• Date of birth and emergency contact information
• Medicare number, NDIS participant details, or private health insurance information
• Financial and billing information

Health Information:

• Medical history and current health conditions
• Assessment results and treatment plans
• Progress notes and clinical observations
• Referral information from healthcare providers
• Functional capacity and disability-related information
• Medication details relevant to treatment

Other Information:

• Communication records (emails, phone calls, appointment notes)
• Photographic or video records (only with explicit consent)
• Information from family members or carers (with appropriate consent)

We collect this information directly from you, from referring healthcare professionals, family members (with consent), insurance providers, and through our practice management systems.

We collect personal information to:

• Provide occupational therapy services and related allied health care
• Develop and implement treatment plans and monitor progress
• Communicate with clients and relevant healthcare professionals
• Coordinate care with other members of your healthcare team
• Process referrals and liaise with referring practitioners
• Bill and process payments for services rendered
• Process funding applications (NDIS, etc.)
• Maintain accurate clinical records as required by professional standards
• Comply with legal, regulatory, and professional obligations
• Improve our services through quality assurance activities

We use personal information only for the purposes for which it was collected unless required or permitted by law. Information may be disclosed to:

• Healthcare professionals involved in the client's care (doctors, specialists, other allied health professionals)
• Funding bodies (NDIS, Medicare, Department of Veterans' Affairs, private health insurers)
• Family members or carers with your explicit consent or in emergency situations
• Third-party service providers assisting in the delivery of services (subject to strict confidentiality agreements), including: 
  • Practice management software providers
  • IT support services
  • Billing and accounting services
• Legal representatives when required by law or with your consent
• Professional regulatory bodies (AHPRA) for registration and professional obligations
• Government agencies when required by law

We will not disclose your personal information for marketing purposes or to any other parties without your explicit consent, unless required or authorized by law.

We may use automated systems for:

• Appointment scheduling and reminders through our practice management system
• Billing and invoice generation for services provided
• Insurance claim processing where applicable

 We may use artificial intelligence (AI) systems for administrative purposes, including transcribing therapy sessions and drafting initial therapy notes, which are always reviewed and finalised by qualified practitioners. We do not use AI systems for clinical decision-making or client assessment purposes. All AI-assisted documentation is subject to professional review and approval before becoming part of your clinical record. 

These automated processes are designed to improve efficiency and do not make clinical decisions that would significantly affect your rights or interests. All clinical assessments, treatment decisions, and care planning are conducted by qualified allied health professionals with appropriate human oversight.

We take comprehensive steps to ensure the security of personal information, including:

Physical Security:

• Secure storage of paper records in locked filing cabinets
• Restricted access to areas where personal information is stored
• Secure disposal of confidential waste

Electronic Security:

• Password-protected computer systems and encrypted data storage
• Regular software updates and security patches
• Secure backup procedures for electronic records
• Use of Australian-based servers where possible

Access Controls:

• Personal information access limited to authorised staff on a need-to-know basis
• Regular training of staff on privacy obligations
• Confidentiality agreements with all staff and service providers

Retention Periods:

• Clinical records: Retained for a minimum of 7 years from the last service date (or until age 25 for clients who were minors)
• Financial records: Retained for 7 years in accordance with taxation requirements

Secure Disposal: When personal information is no longer required, it is securely disposed of through:

• Shredding of paper records
• Secure deletion of electronic files with professional data destruction methods

Under the Privacy Act 1988, you have the right to:

Access Your Information:

• Request access to your personal information held by us
• Receive copies of your clinical records (reasonable fees may apply for extensive copying)

Correct Your Information:

• Request corrections to inaccurate, incomplete, or out-of-date information
• Have corrections made within 30 days of your request

Control Your Information:

• Withdraw consent for specific uses or disclosures (where legally permissible)
• Request restrictions on how we use your information
• Choose not to provide certain information (though this may affect our ability to provide services)

Making Requests: Requests for access, correction, or other privacy-related matters should be made in writing to the contact details provided above. We will respond within 30 days and may require verification of your identity.

If you have concerns about how we handle your personal information:

1. Contact us directly - we encourage you to raise concerns with us first
2. Make a formal complaint to us in writing
3. External complaints can be lodged with: 
   • Office of the Australian Information Commissioner (OAIC)
   • Website: www.oaic.gov.au
   • Phone: 1300 363 992
   • Email: enquiries@oaic.gov.au

When providing telehealth services:

• We use secure, encrypted platforms that comply with healthcare privacy standards
• Sessions may be recorded for clinical purposes only with your explicit consent
• You are responsible for ensuring your location provides adequate privacy during sessions
• We may collect technical information to ensure service quality and security

We may use third-party services including practice management software, secure communication platforms, and payment processing services. All third-party providers are required to maintain appropriate privacy and security standards through contractual agreements.

If our website contains links to other websites, this Privacy Policy applies only to our website and services. We are not responsible for the privacy practices of external websites.

By engaging our services, you consent to the collection, use, and disclosure of your personal information as outlined in this Privacy Policy.

Important: You may withdraw your consent at any time by contacting us, though this may affect our ability to provide services to you. Some disclosures may be required by law regardless of consent.

This Privacy Policy may be updated periodically to reflect changes in our practices, services, or legal requirements. We will:

• Post the updated policy on our website 
• Include the effective date of any updates

The current version of this policy is always available by contacting us.

We adhere to all applicable Australian privacy laws and regulations, including:

• Privacy Act 1988 (Cth) and Australian Privacy Principles
• Privacy and Other Legislation Amendment Act 2024
• Health practitioner registration requirements
• NDIS Practice Standards and Code of Conduct

We regularly review our practices to ensure ongoing compliance with these requirements.

Contact Information:

For any inquiries or concerns about this Privacy Policy or the handling of personal information, please contact us via the Contact Us page.