1. About this policy

iThrive Health, also referred to as iThrive Group, iThrive, we, us or our, respects your privacy and is committed to handling personal information responsibly.

This Privacy Policy explains how we collect, hold, use and disclose personal information when you visit our website, contact us, make a booking or receive services from us.

As a private health service provider, we handle personal information in accordance with applicable Australian privacy laws, including the Privacy Act 1988 (Cth), the Australian Privacy Principles and the Notifiable Data Breaches scheme.

2. The information we collect

The information we collect depends on how you interact with us and the services you receive. It may include:

• Your name, date of birth, address and contact details
• Details of a parent, guardian, carer, nominee or authorised representative
• Emergency contact information
• Appointment, referral and attendance information
• Health, medical, developmental and disability information
• Relevant family, social, educational and support information
• Clinical assessments, treatment plans, progress notes and correspondence
• Details relating to Medicare, private health insurance, the NDIS or another funding body
• Payment, billing and transaction information
• Information contained in enquiries, feedback, complaints or other communications
• Documents, photographs, recordings or files you choose to provide, where relevant to your care

Health information is sensitive information under Australian privacy law. We only collect sensitive information where it is reasonably necessary for our functions or services and where we have consent or another lawful basis to do so.

3. Children and authorised representatives

Many iThrive services are provided to children and young people. We may collect personal information from a child or young person directly where appropriate, or from their parent, guardian, carer, school, referrer, healthcare professional or authorised representative.

We take the individual's age, maturity, circumstances and capacity into account when seeking consent and communicating about privacy. Where appropriate, we involve the child or young person in decisions about their information.

If you provide information about another person, you should have their authority to do so and ensure the information is accurate.

4. How we collect information

We generally collect personal information directly from you or your authorised representative when you:

• Contact us by telephone, email, website form or in person
• Make, change or attend an appointment
• Complete an intake, consent, assessment or feedback form
• Receive an assessment, treatment or other service
• Provide a referral, report, care plan or supporting document
• Communicate with our practitioners or administration team
• Make a payment or submit a funding or rebate claim

With consent or where otherwise permitted by law, we may also collect information from third parties such as referring practitioners, other healthcare providers, schools, support coordinators, carers, government agencies, funding bodies and insurers.

5. Website, cookies and analytics

When you visit our website, technical and usage information may be collected automatically. This may include your Internet Protocol address, browser and device type, general location, referral source, pages viewed, interactions, and the date and time of your visit.

Our website and service providers may use cookies or similar technologies for website functionality, security, preferences, traffic measurement and performance improvement. You can restrict or block cookies through your browser settings, although some website features may not function correctly.

Please only include information that is reasonably necessary when using our website forms. Website enquiries are not intended for emergencies or urgent clinical assistance.

6. Why we use personal information

We may collect, hold and use personal information to:

• Respond to enquiries and communicate with you
• Assess suitability for services and manage referrals
• Schedule and manage appointments
• Provide occupational therapy, speech pathology, chiropractic and related services
• Develop, deliver, review and document assessments and treatment plans
• Coordinate care with authorised family members, carers, schools, referrers and other professionals
• Process payments, rebates, claims and funding arrangements
• Maintain clinical, administrative and business records
• Manage quality, safety, complaints and service improvement
• Train, supervise and support our workforce, using de-identified information where appropriate
• Operate, protect and improve our website, systems and services
• Meet professional, legal, regulatory, insurance and contractual obligations
• Prevent or respond to suspected fraud, misconduct, security incidents or threats to health and safety

We will not sell or rent your personal information.

7. When we disclose information

We may disclose personal information where reasonably necessary for the purposes described in this policy, with consent or as otherwise permitted or required by law. Recipients may include:

• iThrive practitioners, employees and authorised contractors
• Parents, guardians, carers, nominees or representatives authorised to receive information
• Referring practitioners and other healthcare or allied-health providers involved in your care
• Schools, childcare providers, support coordinators or other support services where authorised
• Medicare, the National Disability Insurance Agency, plan managers, private health insurers and other funding or claims bodies
• Appointment booking, clinical records, payment, communication, website, information technology and security providers
• Professional advisers such as lawyers, accountants, auditors and insurers
• Government authorities, regulators, courts or emergency services where required or permitted by law
• A successor organisation in connection with a proposed or completed business transfer, subject to appropriate confidentiality and privacy safeguards

We limit disclosures to information that is reasonably necessary for the relevant purpose.

8. Direct marketing

We may use your contact details to send service updates, health information or other communications that may be relevant to you, where permitted by law. We will provide a simple way to opt out of marketing communications.

We do not use health information for direct marketing without consent where consent is required.

9. Overseas processing

Some technology and service providers may store or process information outside Australia. The countries involved may vary depending on the systems, infrastructure and subcontractors used by those providers.

Where required, we take reasonable steps to ensure overseas recipients handle personal information consistently with applicable Australian privacy requirements.

10. Data security

We take reasonable administrative, technical and physical measures to protect personal information from misuse, interference, loss, unauthorised access, modification and disclosure.

These measures may include access controls, staff confidentiality obligations, secure systems, backups, monitoring and procedures for responding to suspected privacy or security incidents.

No website, internet transmission or electronic storage system can be guaranteed to be completely secure. Please contact us if you believe information you have provided may have been compromised.

Where a data breach is likely to result in serious harm, we will take action in accordance with the Notifiable Data Breaches scheme, including notifying affected individuals and the Office of the Australian Information Commissioner where required.

11. Retaining personal information

We retain personal information for as long as reasonably required to provide services, maintain clinical and business records, and meet professional, legal, regulatory, insurance and contractual obligations.

Retention periods may vary depending on the type of information, the age of the client and the applicable requirements. When information is no longer required, we take reasonable steps to securely destroy or de-identify it.

12. Accessing or correcting your information

You may request access to personal information we hold about you and ask us to correct information that is inaccurate, incomplete, out of date, irrelevant or misleading.

To make a request, contact us using the details below. We may need to verify your identity or authority before providing access or making a correction.

In some circumstances, we may be permitted or required to refuse access. If this occurs, we will explain the reason and available complaint options where legally permitted.

13. Privacy questions and complaints

If you have a question or complaint about how we handle personal information, please contact us using the details below. Please provide enough information for us to understand and investigate your concern.

We will acknowledge and investigate privacy complaints and respond within a reasonable timeframe. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner at oaic.gov.au.

14. Third-party websites

Our website may contain links to websites operated by other organisations. We are not responsible for the privacy, security or content of third-party websites. We recommend reviewing the privacy policy of any external service before providing personal information.

15. Changes to this policy

We may update this Privacy Policy to reflect changes to our services, website, systems, business practices or legal obligations. The current version will be published on our website with its latest revision date.

16. Contact iThrive

iThrive Health

Telephone:(08) 9381 2614

Email:info@ithrivegroup.com.au

Website:ithrivegroup.com.au

West Leederville clinic

2/178 Railway Parade

West Leederville WA 6007

Hillarys clinic

Suite C1, 32 Endeavour Road

Hillarys WA 6025