Privacy Policy
Last updated: 19 October 2026
Hand Therapy Collective is committed to protecting the privacy, confidentiality and security of personal and health information.
This Privacy Policy explains how Hand Therapy Collective collects, uses, stores, discloses and protects personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs) and other applicable Australian laws.
For the purposes of this policy, "we", "us" and "our" refer to Hand Therapy Collective.
1. Personal Information We Collect
We collect personal information that is reasonably necessary to provide hand therapy, occupational therapy and related healthcare services.
Depending on the circumstances, this may include:
Name, date of birth, address, telephone number and email address
Emergency contact or authorised representative details
Medicare, DVA, private health insurance or other funding information
Workers' compensation, insurer, employer and claim information
Defence or other third-party funding information
Referrals, medical history and relevant health conditions
Details of injuries, symptoms, diagnoses, surgery and treatment
Imaging information, reports, medications and other relevant clinical information
Clinical assessments, measurements, treatment plans and progress notes
Clinical photographs, where appropriate and with consent
Correspondence with healthcare professionals, insurers and others involved in your care
Appointment, booking and billing information
Information provided through PracSuite booking and intake forms, email, telephone, SMS or in person.
Health information is considered sensitive information under Australian privacy law and is subject to additional protections.
2. How We Collect Information
Where practicable, we collect information directly from you.
Information may be collected when you:
Book an appointment through our online booking system, PracSuite
Complete a digital patient intake form or other clinical documentation
Attend an appointment or receive treatment
Communicate with us by telephone, email, SMS or in person
Provide referrals, imaging reports or other medical documentation
Make a payment or provide funding and insurance details.
We may also receive information from healthcare professionals and organisations involved in your care or funding, including GPs, specialists, hospitals, allied health professionals, insurers, WorkCover Queensland, DVA, Defence healthcare services and authorised representatives.
Referrals and supporting clinical documentation may be provided directly to the clinic through appropriate communication channels.
3. Why We Collect, Use and Disclose Information
We collect, use and disclose personal and health information primarily to provide healthcare services and operate the practice.
This may include:
Assessing your condition and providing treatment
Developing and reviewing rehabilitation plans
Fabricating or supplying splints, orthoses and other therapeutic products
Monitoring treatment progress
Managing appointments, referrals and patient communications
Communicating with healthcare professionals involved in your care
Obtaining or reviewing relevant imaging and medical documentation
Processing payments, rebates and third-party funding claims
Maintaining accurate clinical records
Meeting professional, contractual, regulatory and legal obligations
Managing complaints, incidents and quality-assurance activities
Administering and operating the practice.
We will not ordinarily use or disclose your health information for unrelated purposes without your consent unless permitted or required by law.
4. Clinical Documentation & Use of Artificial Intelligence
Hand Therapy Collective may use PracSuite AI-assisted documentation tools to assist with preparing clinical notes, letters and other clinical documentation.
This may involve practitioner-entered information, voice transcription or audio recording of part or all of a consultation for the purpose of producing written clinical documentation.
Where audio recording is used, your consent will be obtained before recording commences.
According to PracSuite's published information, audio transcription occurs within its Australian cloud environment, audio recordings are destroyed following transcription, and information passed to its AI processing tools is not used to train AI models.
Hand Therapy Collective is configured so that audio recordings are not retained as part of your clinical record.
AI-assisted documentation is reviewed and finalised by the treating practitioner before being incorporated into the clinical record.
You may ask questions about AI-assisted documentation or request an alternative documentation method. Choosing an alternative method will not prevent you from receiving care.
Further information is available through the PracSuite Help Centre.
5. Consent
Where consent is required for the collection, use or disclosure of personal or health information, it may be obtained electronically, in writing or verbally, as appropriate.
You may withdraw consent for an optional use of your information by contacting us.
Withdrawal of consent does not affect information already lawfully collected, used or disclosed before the withdrawal.
In some circumstances, personal or health information may be collected, used or disclosed without consent where permitted or required by law.
6. Disclosure of Information
Depending on your circumstances, relevant information may be disclosed to:
Your GP, surgeon, specialist or other treating healthcare professional
Hospitals and health services
Diagnostic imaging providers
Insurers, workers' compensation organisations and authorised claims managers
DVA or Defence healthcare administrators
Private health insurers and claiming services
Aged-care providers
Parents, guardians, carers or authorised representatives
Professional advisers, including accountants, insurers or legal advisers, where reasonably necessary
Technology and administrative service providers assisting with practice operations
Government agencies, regulators or other parties where disclosure is authorised or required by law.
We take reasonable steps to limit disclosures to information necessary for the relevant purpose.
We do not sell patient information.
7. Service Providers & Electronic Systems
Hand Therapy Collective uses third-party technology and service providers to assist with healthcare delivery and practice administration.
These may include:
PracSuite: Practice management, clinical records, online appointment bookings, digital intake forms, clinical documentation and patient communications
Squarespace: Website hosting and functionality
Google Workspace: Business email and administrative services
Boost Mobile and telecommunications providers: Telephone and SMS communications
Tyro and Tyro Health: Payment processing and supported electronic claiming services, where used
Xero: Accounting, bookkeeping and financial administration, where used
Other professional, technology and administrative providers reasonably necessary to operate the practice.
The information made available to each provider depends on the services being provided.
Clinical information is primarily maintained within PracSuite. Website, telecommunications, payment and accounting providers do not routinely receive access to complete clinical records merely because their services are used.
We seek to limit third-party access to personal information to what is reasonably necessary.
8. Overseas Processing & Disclosure
Some technology providers used for website hosting, email, communications, payment processing, accounting or other administrative purposes may use infrastructure located outside Australia or allow authorised overseas personnel to process information.
Where personal information is disclosed overseas, we take reasonable steps required under Australian privacy law to ensure it is handled appropriately.
PracSuite states that its data and AI-related processing infrastructure relevant to PracSuite AI is hosted in Australia.
Further information about relevant service providers and overseas processing arrangements may be provided on request.
9. Website & Online Bookings
Our website is hosted through Squarespace and provides information about our services, appointments and contact details.
Online appointments are booked directly through PracSuite, our practice management and booking platform.
When booking online, you may be asked to provide your name, contact details and information necessary to arrange your appointment. New patients may also receive digital intake forms to complete before attending.
Information submitted through PracSuite is used for appointment management, healthcare delivery and related administrative purposes in accordance with this Privacy Policy.
Patients and healthcare professionals may also contact us directly by telephone or email with general enquiries or referrals.
When visiting our website, certain technical information may be collected automatically, including:
IP address
Browser and device information
Date and time of access
Pages visited
General website usage information.
Squarespace may use cookies and similar technologies to operate, secure and understand use of the website.
Please avoid including unnecessary sensitive health information in ordinary email enquiries.
10. Email, Telephone & SMS Communication
We may communicate with you by telephone, SMS or email regarding appointments, treatment, accounts and administrative matters.
Electronic communication carries inherent privacy and security risks.
Where information is particularly sensitive, we may use a more appropriate communication method or request that information be provided through a secure clinical system.
11. Security of Personal Information
We take reasonable steps to protect personal information against misuse, interference, loss and unauthorised access, modification or disclosure.
Security measures may include:
Password-protected clinical and administrative systems
Multi-factor authentication where available
Access controls and restricted clinical record access
Secure cloud services and encryption where supported
Device security measures
Secure information disposal practices
Confidentiality obligations
Ongoing review of privacy and security practices.
While no electronic system can be guaranteed to be completely secure, we take reasonable precautions proportionate to the sensitivity of the information we hold.
12. Data Breaches
Hand Therapy Collective maintains processes for responding to suspected or actual privacy and information-security incidents.
Where a data breach meets the requirements of the Notifiable Data Breaches scheme, we will take the steps required by law, including notifying affected individuals and the Office of the Australian Information Commissioner (OAIC), where applicable.
13. Accuracy of Information
We take reasonable steps to ensure personal information we collect, use and disclose is accurate, current, complete and relevant to its intended purpose.
Clinical documentation prepared with AI assistance is reviewed by the treating practitioner before finalisation.
Please inform us if your contact details, health information or other relevant information changes, or if you believe information held about you is incorrect.
14. Accessing or Correcting Your Information
You may request access to personal information held about you or ask us to correct information that is inaccurate, incomplete or out of date.
We may need to verify your identity before providing access or making changes.
In certain circumstances, access may be limited or refused where permitted by law. Where required, we will explain the reason.
A reasonable administrative fee may apply when providing access to records, where permitted by law. You will not be charged simply for making a request.
15. Retention & Disposal
Clinical and business records are retained for periods required by applicable legal, professional, contractual and clinical obligations.
When personal information is no longer required and there is no lawful reason to retain it, we take reasonable steps to securely destroy or de-identify it.
Audio recordings created solely for PracSuite AI transcription are not retained as part of the patient record and are destroyed as part of the transcription process in accordance with PracSuite's system arrangements.
16. Children & Persons Requiring Assistance
Where healthcare is provided to a child or a person requiring assistance managing their healthcare information, personal information may be collected from or disclosed to a parent, guardian, carer or authorised representative where appropriate and lawful.
We consider the individual's circumstances, including their capacity, privacy interests and applicable legal requirements.
17. Marketing
We will not use sensitive health information for direct marketing except where permitted by law and appropriate consent has been obtained.
You may request not to receive marketing communications at any time.
Appointment reminders, clinical communications and other service-related communications are not considered marketing.
We will seek separate, explicit consent before using identifiable clinical photographs, testimonials or patient information for promotional purposes.
18. Privacy Complaints
If you believe your personal information has not been handled appropriately, please contact us so we can investigate your concerns.
We take privacy complaints seriously and aim to respond within a reasonable timeframe.
If you're not satisfied with our response, you may be able to lodge a complaint with the Office of the Australian Information Commissioner (OAIC).
Further information is available at www.oaic.gov.au.
19. Contact Us
For privacy enquiries, requests to access or correct information, or privacy complaints, please contact:
Hand Therapy Collective
Shop 4, 59 Bowen Road, Rosslea QLD 4812
Phone: 0437 142 415
Email: admin@handtherapycollective.com.au
Website: www.handtherapycollective.com.au
20. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our services, technology, legal obligations or privacy practices.
The current version will be published on our website and will display the date it was last updated.