AI Use Policy

At a glance

Discover Wellness Experiences uses one AI tool, Heidi Health, to help write draft notes and reports after appointments. This policy explains what that means for you.

It is your choice. We ask every time, and you can say no or change your mind at any time. Your care stays the same either way.
A person stays in charge. Your Occupational Therapist reads, corrects and approves everything before it is saved or shared. AI never makes clinical decisions.
Your information is not used to train AI. We only use tools that agree to this.
We do not keep recordings. Heidi turns speech into text as we talk and does not keep the audio.
We never put your identifiable information into public AI tools such as ChatGPT, Gemini or Copilot.

This policy sits alongside our Privacy Policy and Service Agreement. It applies to all clinical and administrative work at Discover Wellness Experiences.

What we use AI for, and what we do not

We use AI so that your Occupational Therapist can focus on you during appointments instead of writing notes at the same time.

What we use it for (with your consent):

Turning what we discuss into a draft clinical note
Helping draft, summarise or tidy reports and letters, which your Occupational Therapist then rewrites and approves

What we do not use it for:

Making or recommending clinical decisions, assessments, diagnoses or risk ratings
Anything where AI is the only basis for a finding or recommendation
Entering identifiable information into free, public or unapproved AI tools
Training AI models with your information

Other tools with AI features. Some platforms we use, such as Zoom, Microsoft Teams or Halaxy, our practice management system, have built-in AI features like meeting summaries or transcripts. We keep these switched off for appointments. If we ever want to use one, we will update this policy and ask for your consent first.

Your choice

Using AI is optional. Agreeing to it is separate from agreeing to Occupational Therapy services, and you do not need to give a reason if you say no.

Before we start. You give written consent in your Service Agreement. At the start of each appointment we also ask again before turning Heidi on, and you can ask us to stop at any point.

If you say no. We take notes another way. Documentation time is capped at 15 minutes per appointment either way (unless otherwise discussed and mutually agreed), so it does not cost you more.

If other people are on the call. Heidi picks up every voice. If a parent, support worker or anyone else joins, we ask them too, and if anyone is uncomfortable we switch it off.

If you change your mind. Tell us in an appointment, by text message or by email. We stop using Heidi from that point. Notes already written stay in your record, because we are legally required to keep clinical records, but we will not use AI in future appointments.

Your choice is recorded in your clinical file.

How your information is protected

Sending an appointment to an AI tool is a disclosure of your health information, so we only use tools after checking them. Before we approved Heidi Health, we confirmed with them in writing that:

Your information is stored and processed exclusively in Australia, including the AI processing itself.
Audio is never stored. It is processed live and discarded as soon as the text is made.
Your information is never used to train, fine-tune or improve any AI model, by Heidi or its providers.
Heidi's Terms of Use and Privacy Policy set out how it must handle your information.

Heidi Health keeps the written text of notes only for as long as we choose. We have set this to 90 days, after which it is permanently deleted. The final note is saved in your clinical record, which we keep for the period the law requires (generally 7 years after your last appointment, or until age 25 for children).

Heidi publishes a list of the third-party services it uses to process information on its website.

We use encrypted, password-protected systems. We re-check Heidi's published compliance information at least once a year. If something important changes, we will update this policy and tell you.

If we ever suspect your information has been exposed, we will act quickly and tell you and the Office of the Australian Information Commissioner where the law requires it.

How we check the AI's work

AI can make mistakes. It can mishear words, miss tone or hesitation, and sound confident when it is wrong. In Occupational Therapy, one wrong word in a report or goal can matter, so:

Your Occupational Therapist reads, edits and approves every AI draft before it becomes part of your record or is sent to anyone. A draft is never the final document.
Your Occupational Therapist is fully responsible for every note and report, in line with AHPRA's guidance on AI in healthcare. That responsibility is never handed to the tool.
AI-assisted notes are labelled in your record. Formal reports (for NDIS, court, insurance or other purposes) say that AI-assisted drafting was used, and confirm that the clinical reasoning and conclusions are your Occupational Therapist's own.
You can ask to see your notes, and ask us to correct anything that is wrong.
At least once a year we review a sample of AI-assisted notes for accuracy, and we record and act on any AI error or privacy incident we find.
We only use an AI tool after your Occupational Therapist understands how it works and what its limits are.

Your rights, questions and complaints

You can ask us at any time what AI we use, see your notes, ask for corrections, or withdraw your consent. Contact us at [email protected] or 0434 697 983.

If you are not happy with our response, you can contact:

Office of the Australian Information Commissioner (privacy): 1300 363 992, oaic.gov.au
Health Complaints Commissioner (Victoria): 1300 582 113, hcc.vic.gov.au
NDIS Quality and Safeguards Commission: 1800 035 544, ndiscommission.gov.au

This policy is reviewed at least once a year, or sooner if the law, professional guidance or the tools we use change. We will tell you about important changes.

Version 5.0 | Effective 01/10/2026 | Next review 01/10/2027 | Discover Wellness Experiences Pty Ltd, ABN 57 653 604 801 Privacy Policy

markdown

Privacy Policy

At Discover Wellness Experiences Pty Ltd, we are committed to protecting your privacy and handling your personal information responsibly. This policy explains how we collect, use, store and share your information.

We follow the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth) and the Health Privacy Principles (HPPs) under the Health Records Act 2001 (Vic). Where both frameworks apply, we follow the stricter obligation.

1. What information we collect

We collect personal information to provide you with Occupational Therapy services and manage our practice. This may include:

Your name, date of birth, address, phone number and email address
Health and disability-related information, including your medical history and therapy records
Appointment history, billing information and communications
NDIS plan details where relevant

2. How we collect your information

We collect your information through:

Intake forms, appointments, phone calls and emails
Referring practitioners, allied health professionals or healthcare providers, with your consent
Funding bodies such as the NDIS

3. How we use your information

We use your information to:

Provide Occupational Therapy services
Manage appointments, billing and practice administration
Communicate with you about your therapy and related services
Meet our legal and regulatory obligations

4. Technology and third-party services

We use secure third-party technology services to support clinical care, appointment management, communication, clinical documentation, assessment, record keeping and practice administration. Some of these services may process or store information outside Australia. We take reasonable steps to select appropriate providers and manage the security and privacy of information handled through these services.

All platforms are accessed using two-factor authentication (2FA).

Practice management and clinical tools

Tool	Purpose	Information handled	Where information is stored or processed
Halaxy (2FA enabled)	Client records, appointment scheduling, invoicing and practice administration	Identifiable client information, health information, contact details, appointment and billing information	Australia for Halaxy-hosted practice data. Halaxy uses overseas sub-processors including AWS (US), Twilio (US), Google (US) and Mailchimp (US) for particular functions.
Halaxy to Outlook calendar integration	Synchronises appointments with Microsoft Outlook	Appointment and calendar information	Halaxy-hosted information is stored in Australia. Calendar information passes through Halaxy's calendar sync provider, Cronofy (US), to Microsoft 365. Microsoft provides confirmed Australian data residency for Exchange Online where the tenant is provisioned in Australia.
Halaxy email	Appointment reminders, practice communications and emails sent from your client file	Client name, contact details, appointment information and the content of messages sent	Halaxy uses Mailchimp (US) for email sending.
Halaxy SMS and phone functions	Appointment reminders by text message	Telephone number, appointment information and communication content	Halaxy uses Twilio (US) for SMS, phone and related communication functions.
HealthLink	Secure communication of clinical information with referring and other healthcare providers	Clinical correspondence, referral information and related messaging	Secure Australian service infrastructure. Some HealthLink systems or service providers may operate outside Australia; safeguards are applied.
Heidi Health (2FA enabled)	AI-assisted clinical documentation during appointments	Consultation audio is processed in real time to generate a transcript and clinical notes. Audio is not retained after processing. Transcripts may be retained according to account settings.	Australian data localisation is confirmed and applied for Australian customers.

Communication platforms

Tool	Purpose	Information handled	Where information is stored or processed
Zoom (2FA enabled)	Video telehealth appointments	Audio and video during appointments, participant information and meeting metadata	International. Zoom operates globally and may transfer, store and process information in multiple countries including the United States. Zoom publishes its sub-processor and infrastructure locations.
Microsoft Outlook (2FA enabled)	Email communication and appointment scheduling	Emails, attachments, contact information and calendar information	Australia confirmed. Microsoft 365 Australian data residency is confirmed for Exchange Online where the tenant is provisioned in Australia.
Phone calls	Clinical appointments and general communication	Conversation content and telephone network metadata	Telephone network and provider infrastructure. Calls are not recorded by the practice.

File storage and document tools

Tool	Purpose	Information handled	Where information is stored or processed
Microsoft OneDrive (2FA enabled)	Secure cloud storage of practice documents and records	Client documents, clinical records and practice files	Australia confirmed. Microsoft 365 Australian data residency is confirmed for OneDrive where the tenant is provisioned in Australia. Access protected by 2FA.
Microsoft Word (2FA enabled)	Document preparation	Document content	Local device when using the desktop application. Where documents are saved to OneDrive, confirmed Australian data residency applies.
Microsoft SharePoint (2FA enabled)	Underlying document storage architecture within Microsoft 365	Practice files and documents stored within the Microsoft 365 environment	Australia confirmed. Microsoft 365 Australian data residency is confirmed for SharePoint where the tenant is provisioned in Australia.
Adobe PDF Viewer	Viewing PDF documents	Document content	Local device when using the desktop application without cloud services.
BentoPDF	Local PDF viewing and editing	Document content	Local browser processing. Files are not uploaded for cloud processing.
QuickBooks Online (2FA enabled)	Practice accounting and invoicing. Invoice and billing information is sent to QuickBooks from Halaxy	Practice financial information, transactions and billing records linked to coded client identifiers rather than names	Cloud-based, with US and international infrastructure, including Intuit-operated and AWS data centres.

Assessment platforms

Where possible, only the minimum information necessary for each assessment is entered into assessment platforms. Where the platform permits, a client code or minimum identifier is used rather than full identifying information.

Tool	Purpose	Information handled	Where information is stored or processed
Pearson Clinical (Q-Global)	Online administration, scoring and reporting of Pearson assessments	Minimum information required to administer the assessment, together with assessment responses and scoring data	Canada, with some systems also hosted in Ireland. Pearson's Australian privacy information identifies potential international transmission, and some scoring processes may involve the United States.
PAR (PARiConnect) (2FA enabled)	Online administration and scoring of PAR assessments	Client or examinee identifiers and assessment responses required by the particular assessment. PAR states that assessment responses and personal data are encrypted and stored separately; PAR does not store assessment scores, only item responses.	International, PAR-hosted cloud platform.
WPS Online Evaluation System	Online administration, scoring and reporting of WPS assessments	Client or examinee identifying information, assessment responses and results as required by the assessment	International, WPS-hosted platform.
COPM Web-App (2FA enabled)	Digital administration and recording of the Canadian Occupational Performance Measure	Client name and COPM responses and scores	International, COPM-hosted secure server. The COPM Web-App states that client information is stored on a secure server with encrypted access and two-factor authentication.

AI features not currently in use

The following platforms include AI features that are not enabled in this practice:

Halaxy AI
Microsoft Copilot
Zoom AI

5. How we keep your information safe

We take reasonable steps to protect your information from misuse, loss, unauthorised access, modification or disclosure. Our measures include:

Two-factor authentication (2FA) on all platforms that handle client information
Secure electronic storage systems with controlled access
Confidentiality obligations for any support staff or contractors
Limiting access to your information to authorised personnel only
Entering only the minimum information necessary when using assessment platforms

6. Sharing your information

We may share your information in the following circumstances:

With other healthcare providers involved in your care, with your consent
Where required by a funding agreement, law or court order
With supervisors or consultants for case discussion, without disclosing your full identity

7. Overseas disclosure

Some of the third-party services we use may process or store information outside Australia, including in Canada, Ireland, the United States and other countries. Where this occurs, we take reasonable steps to ensure those providers handle information in a manner consistent with the Australian Privacy Principles.

Microsoft 365 services used in this practice have confirmed Australian data residency for Exchange Online, OneDrive and SharePoint where the tenant is provisioned in Australia.

Further detail about where each service stores or processes information is set out in the technology tables above.

8. How long we keep your information

Situation	Retention period
Adult clients	Minimum 7 years after your last appointment
Clients who were under 18 at any point during their care	Until you turn 25, or 7 years after your last appointment, whichever is longer

After the relevant period, we will securely destroy or permanently de-identify your information.

9. Your rights

Right	How to exercise it
Access your information	Contact us in writing. We may require proof of identity and an administrative fee may apply.
Correct your information	Contact us in writing with the correction you are requesting.
Make a privacy complaint	Contact us in the first instance. If unresolved, you may contact the OAIC or the Health Complaints Commissioner Victoria.

10. Data breach notification

If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches scheme.

11. Want more detail?

The following links go directly to the privacy information provided by each service.

Halaxy: how your practice and health information is handled (security, privacy)
Heidi Health: how AI-assisted documentation is handled
Zoom: how telehealth information is handled
Microsoft: how email, calendar and files are handled
HealthLink: how clinical messages are handled
Intuit/QuickBooks: how financial information is handled
Pearson Clinical: how assessment information is handled
PAR: how assessment information is handled
WPS: how assessment information is handled
COPM: how COPM Web-App information is handled

We review and update this section when our technology services change.

12. Policy updates

We may update this Privacy Policy from time to time. Any significant changes will be communicated to you by email. We recommend checking this policy periodically.

13. Contact us

If you have any questions about this policy or how we handle your information, please contact us via email

Discover Wellness Experiences Pty Ltd

This policy is reviewed at least once a year, or sooner if the law, professional guidance or the tools we use change. We will tell you about important changes.

Version 2.1 | Effective 10/10/2026 | Next review 10/10/2027 | Discover Wellness Experiences Pty