Privacy Policy

Introduction

Therapia (“we”, “us”, “our”) provides Positive Behaviour Support, Early Intervention, Therapy supports and allied health therapy services to individuals and families across Australia. We are committed to protecting the privacy and confidentiality of the personal and health information we hold, in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), the My Health Records Act 2012 (Cth) where applicable, the NDIS (Provider Registration and Practice Standards) Rules 2018, and relevant state and territory health records legislation.

This Privacy Policy explains what personal information we collect, why we collect it, how we use, store, and disclose it, and the choices and rights available to you. It applies to information collected through our clinical services, our website, our online forms, and any other interaction you have with Therapia.

1.Information We Collect

The type of information we collect depends on the nature of your relationship with us — for example, as a client, a family member or guardian, a referring provider, or simply a visitor to our website. This may include:

We only collect sensitive information, such as health information, where it is reasonably necessary for us to provide our services, and generally with your consent or as otherwise permitted by law.

2. How We Collect Information

We collect personal information through a range of channels, including:

• Direct conversations, consultations and assessments with our clinicians and support staff
• Intake, registration and consent forms completed by you or on your behalf
• Referrals and records shared by other health professionals, schools, or support coordinators (with appropriate consent)
• Forms submitted through our website, such as enquiry, referral, appointment and feedback forms
• NDIS plan documents and correspondence with the National Disability Insurance Agency, where applicable
• Telephone, email and other written correspondence
• Cookies and similar technologies used on our website (see Section 8)

3. Our Website and Online Forms

3.1 Online forms

Our website may include forms for purposes such as:

• General enquiries and contact requests
• New client registration and intake
• Referral submissions
• Appointment and consultation requests
• NDIS-related enquiries
• Requests to transfer or access records
• Feedback and complaints

By submitting a form on our website, you consent to Therapia collecting and using the information provided for the purpose stated on that form, and as otherwise described in this Policy.

3.2 Spam and security protection

Our online forms may use bot-detection tools, such as CAPTCHA services, to prevent spam and misuse. These tools may collect limited technical information, such as your IP address and browser type. This information is handled in accordance with the relevant provider’s own privacy policy.

3.3 Automated messages

After submitting a form, you may receive an automated confirmation email or SMS acknowledging receipt. These messages confirm that your submission was received and do not contain clinical or health information.

4. How We Use Your Information

We use personal information primarily to provide our services to you. This includes:

• Delivering Positive Behaviour Support, Early Intervention and therapy services
• Assessing needs, planning supports, and preparing reports and plans
• Coordinating care with other treating practitioners, support coordinators, schools or service providers, with your consent
• Communicating with you about appointments, services and account matters
• Invoicing and processing payments, including claims to the NDIS, Medicare or private health funds
• Meeting our legal, regulatory, clinical governance and quality assurance obligations
• Improving our services through de-identified analysis, audits and training
• Direct marketing about services that may be relevant to you, where you have not opted out (see Section 7)

5. Disclosure of Your Information

We do not sell or rent your personal information. We may disclose your information, only as reasonably necessary, to:

• Other treating health practitioners and allied health providers involved in your care
• Support coordinators, plan managers, schools, and other services nominated by you or your guardian
• The National Disability Insurance Agency (NDIA), Medicare, and private health insurers for funding and billing purposes
• Regulatory and oversight bodies, such as AHPRA or the NDIS Quality and Safeguards Commission, where required by law
• Our professional advisers, insurers and IT service providers, under confidentiality obligations
• Law enforcement or government agencies where required or authorised by law
• A third party in the event of a business sale, merger or restructure, subject to equivalent privacy protections

We will never disclose your health information to family members, employers or other third parties without your consent, unless required or authorised by law (for example, in an emergency, or to prevent a serious threat to health or safety).

6. Children and Young People

Many of our clients are children and young people accessing Early Intervention or therapy supports. Where a client is a minor, we collect and use information as authorised by a parent, guardian or legal representative, and we take extra care to ensure information is only shared with people who have appropriate parental responsibility or legal authority. Young people may exercise privacy rights on their own behalf once they have sufficient maturity and understanding to do so, consistent with Australian privacy guidance.

7. Marketing Communications

From time to time, we may send you information about services, resources, or events that may be relevant to you. You can opt out of marketing communications at any time by using the unsubscribe link in an email, or by contacting us directly using the details at the end of this Policy. Opting out of marketing does not affect service-related or clinical communications.

8. Cookies and Website Analytics

Our website may use cookies and similar technologies to improve functionality and understand how visitors use our site. This may include:

• Essential cookies required for the website to function correctly
• Analytics cookies that help us understand website traffic and usage patterns
• Preference cookies that remember choices you have made on our site

You can manage or disable cookies through your browser settings; however, some parts of our website may not function correctly if you do so.

9. Data Security

We take the security of your information seriously and apply administrative, technical and physical safeguards appropriate to the sensitivity of the information we hold, including:

• Secure storage of physical records in access-controlled locations
• Encryption of data in transit and at rest for digital systems
• Role-based access controls limiting information access to authorised staff on a need-to-know basis
• Regular staff training on privacy, confidentiality and information handling
• Secure and permanent destruction or de-identification of records once they are no longer required
• Ongoing review of our systems and processes to address emerging security risks

10. Where Your Information Is Stored

We engage third-party service providers to support our operations, such as client management, file storage, email delivery, website hosting and payment processing. Some of these providers may store or process information on servers located in Australia, while others may store or process information overseas, depending on the provider. Where information is handled outside Australia, we take reasonable steps to ensure the provider applies privacy and security standards consistent with the Australian Privacy Principles. The table below outlines the categories of third-party services we may use.

*Exact storage locations are not always disclosed by every provider and may change over time. Contact us for current details of the specific providers we use and where your information is held.

11. Data Retention

We retain personal and health information only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. As a general guide:

• Health and clinical records are retained in accordance with applicable state and territory health records legislation, which generally requires retention for a minimum of 7 years from the date of last contact (or, for records relating to a client who was a minor, until they turn 25), unless a longer period applies
• Financial and billing records are retained in accordance with taxation and NDIS record-keeping requirements
• Documents uploaded through website forms, such as referral letters, are retained only as long as needed to action the request and are then securely deleted
• Once information is no longer required, it is securely destroyed or de-identified

12. Overseas Disclosure

Some of the third-party providers we use to operate our services and website may store or process personal information on servers located outside Australia. Where this occurs, we take reasonable steps to ensure any overseas recipient handles information consistently with the Australian Privacy Principles. Please contact us if you would like further information about the specific countries in which your information may be held.

13. Data Breach Notification

In the unlikely event of a data breach that is likely to result in serious harm, we will act in accordance with our data breach response plan and the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth). This includes notifying affected individuals and the Office of the Australian Information Commissioner (OAIC), where required.

14. Your Rights and How to Access Your Information

Under Australian privacy law, you generally have the right to:

• Access the personal information we hold about you
• Request correction of information that is inaccurate, out of date, or incomplete
• Request a copy of your medical or clinical records
• Ask how your information has been collected, used or disclosed
• Withdraw consent for particular uses of your information, where applicable
• Lodge a complaint if you believe your privacy has been breached

We will respond to reasonable requests within a reasonable timeframe, generally within 30 days. In some circumstances, we may need to verify your identity, or there may be limited legal grounds on which we can decline a request; where this occurs, we will explain our reasons.

15. How to Make a Complaint

If you have concerns about how we have handled your personal information, we encourage you to contact us first so that we can investigate and resolve the issue. Please provide as much detail as possible so we can address your concern effectively.

If you are not satisfied with our response, you may also contact:

• The Office of the Australian Information Commissioner (OAIC) — www.oaic.gov.au
• The NDIS Quality and Safeguards Commission, for complaints relating to NDIS-funded supports — www.ndiscommission.gov.au
• The relevant state or territory health complaints body, for clinical or health-service related concerns

16. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal obligations. The updated policy will be published on our website with a revised effective date. We encourage you to review this Policy periodically.

17. Contact Us

If you have any questions about this Privacy Policy, would like to access or correct your information, or wish to make a complaint, please contact us using the details below.

THERAPIA Pty Ltd

Address: 30 Gardener Drive, Point Cook, VIC, 3030

Phone: 03 8348 1742

Email: admin@therapiasupport.com.au

Website: www.therapiasupport.com.au

ABN: 84 686 374 363

Effective date: 16/08/2026, Last reviewed: 16/08/2026