Stepping Stones Occupational Therapy respects your privacy and is committed to protecting the personal and health information entrusted to us.

This Privacy Policy explains how we collect, hold, use and disclose personal information, how you can access or correct your information and how you can raise a privacy concern.

​

In this policy, “Stepping Stones OT”, “we”, “us” and “our” refer to Stepping Stones OT Pty Ltd, trading as Stepping Stones Occupational Therapy.

​

Our privacy obligations

We handle personal and health information in accordance with applicable Australian privacy legislation, including:

• The Privacy Act 1988 (Cth)

• The Australian Privacy Principles

• The Health Records and Information Privacy Act 2002 (NSW)

• The NSW Health Privacy Principles

• Applicable NDIS legislation, rules and practice standards where we provide services to NDIS participants

​

As a health service provider, we recognise that much of the information we collect is sensitive. We take our responsibility to protect this information seriously.

​

The information we collect

The personal information we collect depends on how you interact with us and the services being provided.

​

It may include:

• Your name, date of birth, address and contact details

• The name and contact details of a parent, guardian, carer or authorised representative

• Emergency contact information

• Medicare, private health insurance or NDIS details

• Information about NDIS plans, goals, funding arrangements and plan managers

• Medical, developmental and disability information

• Diagnoses, medications, allergies and relevant health history

• Information about daily activities, behaviour, sensory needs and functional abilities

• Assessment results, therapy notes, reports and treatment plans

• Information provided by family members, carers, teachers, support workers and other health professionals

• School, preschool, childcare or workplace information

• Referrals, correspondence and previous reports

• Appointment and attendance records

• Payment, invoicing and transaction information

• Feedback, enquiries and complaints

• Website usage and technical information

• Photographs, video or audio recordings where separate consent has been provided

• Any other information reasonably required to provide safe and appropriate services

​

We will only collect information that is reasonably necessary for our work or otherwise permitted or required by law.

​

Information about children and young people

As a paediatric occupational therapy practice, we primarily collect information about children and young people.

We will generally obtain consent from a parent, legal guardian or other authorised representative before collecting, using or disclosing a child’s personal or health information.

Where appropriate, we will also involve the child or young person in decisions about their information. We will consider their age, maturity, understanding, communication needs and ability to provide informed consent.

Where parents are separated or family circumstances are complex, we may request information about parental responsibility, guardianship, court orders or other legal arrangements before releasing information or making decisions about consent.

We may limit access to information where required or authorised by law, including where providing access could create a serious risk to a person’s health or safety or unreasonably affect another person’s privacy.

​

How we collect information

Where practical, we collect information directly from you or the person receiving our services.

We may collect information when you:

• Contact us by phone, email or through our website

• Complete an enquiry, intake, consent or assessment form

• Attend an appointment

• Participate in an assessment or therapy session

• Communicate with one of our occupational therapists

• Provide reports, correspondence or supporting documents

• Make a booking or payment

• Submit feedback or make a complaint

• Subscribe to receive updates from us

• Use our website

​

With appropriate consent, or where otherwise permitted by law, we may also collect information from:

• Parents, guardians, carers or authorised representatives

• General practitioners and medical specialists

• Allied health professionals

• Schools, preschools, childcare centres and educators

• Support coordinators, recovery coaches and support workers

• NDIS plan managers

• The National Disability Insurance Agency

• Government agencies, insurers or funding bodies

• Other people involved in providing care or support

​

If you provide us with information about another person, please ensure you are authorised to do so and that the person understands how their information may be handled.

​

Why we collect and use information

We may collect, hold and use personal and health information to:

• Respond to enquiries

• Determine whether our services are appropriate

• Provide occupational therapy assessments and intervention

• Develop and review goals and therapy plans

• Prepare clinical notes, progress reports and recommendations

• Communicate with families and members of a participant’s support team

• Coordinate services with other health professionals and providers

• Support continuity of care

• Make and manage appointments

• Process payments, invoices and funding claims

• Communicate with NDIS plan managers, support coordinators or the NDIA

• Meet professional, clinical, administrative and insurance requirements

• Manage feedback, incidents and complaints

• Maintain and improve the quality and safety of our services

• Train and supervise staff, where information is handled confidentially

• Comply with legal, regulatory and professional obligations

• Protect the health, safety and wellbeing of clients, staff and other people

• Operate, maintain and improve our website and business systems

• Send service information or marketing communications where consent has been provided

​

We will not use sensitive information for direct marketing without appropriate consent.

​

You may unsubscribe from marketing communications at any time by using the unsubscribe option provided or contacting us directly. Essential communications about appointments, services, payments or safety are not considered marketing.

​

Consent

We seek informed consent before providing services and before using or disclosing personal information for purposes beyond those reasonably expected as part of service delivery.

​

Consent may be withdrawn or changed by contacting us. Withdrawing consent will not affect actions already taken with valid consent, but it may affect our ability to continue providing particular services.

​

There may be circumstances where we are permitted or required to collect, use or disclose information without consent.

​

When we may disclose information

We may disclose personal or health information to:

• Parents, guardians, carers or authorised representatives

• Treating health professionals and allied health providers

• Schools, preschools, childcare services or educators

• Support coordinators, plan managers and other NDIS providers

• The NDIA or NDIS Quality and Safeguards Commission

• Funding bodies and insurers

• Professional supervisors, auditors or legal advisers

• Technology, records management, booking, accounting or payment service providers

• Government agencies, courts, tribunals, regulators or law enforcement bodies

• Other parties authorised by you or permitted or required by law

​

Where practical, we will obtain consent before sharing health information with another professional, school or support provider.

​

We may disclose information without consent where this is required or authorised by law. This may include circumstances involving:

• A serious threat to a person’s life, health or safety

• Suspected abuse, neglect or risk of harm

• Mandatory reporting obligations

• Reportable incidents

• A subpoena, court order or other legal requirement

• An investigation by an authorised regulatory body

• Locating a missing person, where legally permitted

​

We do not sell personal or health information.

​

NDIS participant information

Where we provide services to an NDIS participant, we may collect and use information to:

• Understand the participant’s goals and support needs

• Develop and deliver agreed supports

• Prepare assessments, reports and recommendations

• Manage service agreements and bookings

• Claim payment for supports

• Communicate with the participant’s authorised representatives, plan manager, support coordinator or other providers

• Meet NDIS quality, safeguarding, incident and record-keeping requirements

​

We seek consent before disclosing participant information unless disclosure is required or authorised by law.

​

Participants may ask how their information is being used, request access or correction, and withdraw or amend previous consent, subject to applicable legal requirements.

​

Photographs, video and audio recordings

We will not use identifiable photographs, video or audio recordings for marketing, social media, education or promotional purposes without separate consent.

Consent to receive occupational therapy services is not the same as consent to use a person’s image or recording.

You may withdraw consent for future use by contacting us. Withdrawal may not apply to material that has already been lawfully published or distributed, although we will take reasonable steps to remove material from platforms within our control where requested and appropriate.

Clinical photographs or recordings may sometimes be used as part of assessment or therapy. We will explain why they are needed and how they will be stored before seeking consent.

​

Website information and cookies

When you use our website, certain technical information may be collected automatically, including:

• Your IP address

• Browser and device type

• General location information

• The pages you visit

• The date and time of your visit

• Referring websites

• How you interact with the website

​

Our website may use cookies and similar technologies to operate correctly, remember preferences, understand website traffic and improve the visitor experience.

​

You can adjust your browser settings to reject or delete cookies. Some website functions may not work as intended if cookies are disabled.

The website may use services provided by third parties such as Google Analytics, Google Maps, Meta or other platforms. These providers may collect information in accordance with their own privacy policies.

​

Please avoid including detailed or highly sensitive health information in a general website enquiry form unless the form specifically requests it. If necessary, we will arrange a more appropriate way for you to provide clinical information.

​

Links to other websites

Our website may contain links to third-party websites.

We are not responsible for the privacy, security or content of websites operated by other organisations. We encourage you to review the privacy policy of any external website before providing personal information.

​

Storage and security

Personal and health information may be stored in electronic and paper records.

We take reasonable steps to protect the information we hold from misuse, interference, loss, unauthorised access, modification and disclosure. These steps may include:

• Password protection and access controls

• Secure clinical and practice management systems

• Multi-factor authentication where available

• Secure storage for paper records

• Restricted staff access

• Confidentiality requirements

• Staff training

• Secure backups

• Appropriate disposal and destruction procedures

• Reviewing and responding to actual or suspected data breaches

​

No system of electronic storage or transmission can be guaranteed to be completely secure. If we become aware of a data breach, we will assess and respond to it in accordance with our legal obligations, including applicable notification requirements.

​

Overseas storage and disclosure

Some technology providers used to operate our website, email, practice management, file storage, accounting, payments or communications may store or process information outside Australia.

The countries involved will depend on the service providers used and their systems. They may include United States of America and The Unoted Kingdom.

Where personal information may be stored or disclosed overseas, we will take reasonable steps to ensure it is handled appropriately and in accordance with applicable privacy obligations.

​

How long we keep health records

We retain personal and health information for as long as it is needed to provide services and meet our legal, professional, insurance and administrative obligations.

Under NSW health records legislation, private health service providers must generally retain health information:

• For at least seven years from the last occasion on which a health service was provided to an adult

• Where information was collected while a person was under 18, until that person reaches 25 years of age

Some records may be kept for longer where required or permitted by law, a funding arrangement, professional obligation, insurance requirement or anticipated legal proceeding.

When information is no longer required, we take reasonable steps to securely destroy or permanently de-identify it, subject to our record-keeping obligations.

​

Accessing your information

You may request access to personal or health information we hold about you or your child, provided you are legally authorised to do so.

We may ask you to:

• Make the request in writing

• Verify your identity and authority

• Clarify the information you are requesting

​

We will respond within a reasonable period. A reasonable administrative fee may be charged to cover the cost of locating, reviewing, copying or providing access to records. We will advise you of any likely fee before proceeding.

In some circumstances, access may be limited or refused where permitted or required by law. If we cannot provide the requested access, we will generally explain the reason and available complaint options.

​

Correcting your information

We take reasonable steps to ensure the information we hold is accurate, complete, current and relevant.

If you believe information we hold is incorrect or incomplete, please contact us. We may ask you to put your request in writing and provide information supporting the requested correction.

If we do not agree to make a correction, you may ask us to attach a statement to the relevant record noting your position, where required by law.

​

Privacy enquiries and complaints

If you have a question, concern or complaint about how we have handled personal or health information, please contact us:

Stepping Stones Occupational Therapy
Unit 9, 46B Reservoir Road
Mount Pritchard NSW 2170

Phone: 0423 049 327
Email: admin@steppingstonesot.com.au

​

Please provide enough information for us to understand and investigate your concern. We will acknowledge your complaint and aim to respond within a reasonable period.

​

We encourage you to contact us first so that we have an opportunity to address the issue.

If you are not satisfied with our response, you may contact:

• The Office of the Australian Information Commissioner

• The Information and Privacy Commission NSW

• The NDIS Quality and Safeguards Commission, where the concern relates to NDIS supports or services

​

Changes to this Privacy Policy

We may update this Privacy Policy when our services, practices, systems or legal obligations change.

The current version will be published on our website. We encourage you to review it periodically.

Last updated: August 2026