At Discover Wellness Experiences Pty Ltd, we are committed to protecting your privacy and handling your personal information responsibly. This policy explains how we collect, use, store and share your information.
We follow the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth) and the Health Privacy Principles (HPPs) under the Health Records Act 2001 (Vic). Where both frameworks apply, we follow the stricter obligation.
We collect personal information to provide you with Occupational Therapy services and manage our practice. This may include:
We collect your information through:
We use your information to:
We use secure third-party technology services to support clinical care, appointment management, communication, clinical documentation, assessment, record keeping and practice administration. Some of these services may process or store information outside Australia. We take reasonable steps to select appropriate providers and manage the security and privacy of information handled through these services.
All platforms are accessed using two-factor authentication (2FA).
| Tool | Purpose | Information handled | Where information is stored or processed |
|---|---|---|---|
| Halaxy (2FA enabled) | Client records, appointment scheduling, invoicing and practice administration | Identifiable client information, health information, contact details, appointment and billing information | Australia for Halaxy-hosted practice data. Halaxy uses overseas sub-processors including AWS (US), Twilio (US), Google (US) and Mailchimp (US) for particular functions. |
| Halaxy client portal (2FA enabled, offered by agreement) | Secure client access to appointments, forms, documents and contact details | Identifiable client information, appointment details, forms and shared documents | Australia for Halaxy-hosted practice data. Halaxy uses overseas sub-processors for particular functions, as described above. |
| Halaxy to Outlook calendar integration | Synchronises appointments with Microsoft Outlook | Appointment and calendar information | Halaxy-hosted information is stored in Australia. Calendar information passes through Halaxy's calendar sync provider, Cronofy (US), to Microsoft 365. Microsoft provides confirmed Australian data residency for Exchange Online where the tenant is provisioned in Australia. |
| Halaxy email | Appointment reminders, practice communications and emails sent from your client file | Client name, contact details, appointment information and the content of messages sent | Halaxy uses Mailchimp (US) for email sending. |
| Halaxy SMS and phone functions | Appointment reminders by text message | Telephone number, appointment information and communication content | Halaxy uses Twilio (US) for SMS, phone and related communication functions. |
| HealthLink | Secure communication of clinical information with referring and other healthcare providers | Clinical correspondence, referral information and related messaging | Secure Australian service infrastructure. Some HealthLink systems or service providers may operate outside Australia; safeguards are applied. |
| Heidi Health (2FA enabled) | AI-assisted clinical documentation during appointments | Consultation audio is processed in real time to generate a transcript and clinical notes. Audio is not retained after processing. Transcripts may be retained according to account settings. | Australian data localisation is confirmed and applied for Australian customers. |
| Tool | Purpose | Information handled | Where information is stored or processed |
|---|---|---|---|
| Zoom (2FA enabled) | Video telehealth appointments | Audio and video during appointments, participant information and meeting metadata | International. Zoom operates globally and may transfer, store and process information in multiple countries including the United States. Zoom publishes its sub-processor and infrastructure locations. |
| Microsoft Outlook (2FA enabled) | Email communication and appointment scheduling | Emails, attachments, contact information and calendar information | Australia confirmed. Microsoft 365 Australian data residency is confirmed for Exchange Online where the tenant is provisioned in Australia. |
| Phone calls | Clinical appointments and general communication | Conversation content and telephone network metadata | Telephone network and provider infrastructure. Calls are not recorded by the practice. |
| Tool | Purpose | Information handled | Where information is stored or processed |
|---|---|---|---|
| Microsoft OneDrive (2FA enabled) | Secure cloud storage of practice documents and records | Client documents, clinical records and practice files | Australia confirmed. Microsoft 365 Australian data residency is confirmed for OneDrive where the tenant is provisioned in Australia. Access protected by 2FA. |
| Microsoft Word (2FA enabled) | Document preparation | Document content | Local device when using the desktop application. Where documents are saved to OneDrive, confirmed Australian data residency applies. |
| Microsoft SharePoint (2FA enabled) | Underlying document storage architecture within Microsoft 365 | Practice files and documents stored within the Microsoft 365 environment | Australia confirmed. Microsoft 365 Australian data residency is confirmed for SharePoint where the tenant is provisioned in Australia. |
| Adobe PDF Viewer | Viewing PDF documents | Document content | Local device when using the desktop application without cloud services. |
| BentoPDF | Local PDF viewing and editing | Document content | Local browser processing. Files are not uploaded for cloud processing. |
| QuickBooks Online (2FA enabled) | Practice accounting and invoicing. Invoice and billing information is sent to QuickBooks from Halaxy | Practice financial information, transactions and billing records linked to coded client identifiers rather than names | Cloud-based, with US and international infrastructure, including Intuit-operated and AWS data centres. |
Where possible, only the minimum information necessary for each assessment is entered into assessment platforms. Where the platform permits, a client code or minimum identifier is used rather than full identifying information.
| Tool | Purpose | Information handled | Where information is stored or processed |
|---|---|---|---|
| Pearson Clinical (Q-Global) | Online administration, scoring and reporting of Pearson assessments | Minimum information required to administer the assessment, together with assessment responses and scoring data | Canada, with some systems also hosted in Ireland. Pearson's Australian privacy information identifies potential international transmission, and some scoring processes may involve the United States. |
| PAR (PARiConnect) (2FA enabled) | Online administration and scoring of PAR assessments | Client or examinee identifiers and assessment responses required by the particular assessment. PAR states that assessment responses and personal data are encrypted and stored separately; PAR does not store assessment scores, only item responses. | International, PAR-hosted cloud platform. |
| WPS Online Evaluation System | Online administration, scoring and reporting of WPS assessments | Client or examinee identifying information, assessment responses and results as required by the assessment | International, WPS-hosted platform. |
| COPM Web-App (2FA enabled) | Digital administration and recording of the Canadian Occupational Performance Measure | Client name and COPM responses and scores | International, COPM-hosted secure server. The COPM Web-App states that client information is stored on a secure server with encrypted access and two-factor authentication. |
The following platforms include AI features that are not enabled in this practice:
We take reasonable steps to protect your information from misuse, loss, unauthorised access, modification or disclosure. Our measures include:
We may share your information in the following circumstances:
Some of the third-party services we use may process or store information outside Australia, including in Canada, Ireland, the United States and other countries. Where this occurs, we take reasonable steps to ensure those providers handle information in a manner consistent with the Australian Privacy Principles.
Microsoft 365 services used in this practice have confirmed Australian data residency for Exchange Online, OneDrive and SharePoint where the tenant is provisioned in Australia.
Further detail about where each service stores or processes information is set out in the technology tables above.
| Situation | Retention period |
|---|---|
| Adult clients | Minimum 7 years after your last appointment |
| Clients who were under 18 at any point during their care | Until you turn 25, or 7 years after your last appointment, whichever is longer |
After the relevant period, we will securely destroy or permanently de-identify your information.
| Right | How to exercise it |
|---|---|
| Access your information | Contact us in writing. We may require proof of identity and an administrative fee may apply. |
| Correct your information | Contact us in writing with the correction you are requesting. |
| Make a privacy complaint | Contact us in the first instance. If unresolved, you may contact the OAIC or the Health Complaints Commissioner Victoria. |
If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches scheme.
The following links go directly to the privacy information provided by each service.
We review and update this section when our technology services change.
We may update this Privacy Policy from time to time. Any significant changes will be communicated to you by email. We recommend checking this policy periodically.
If you have any questions about this policy or how we handle your information, please contact us via email
Discover Wellness Experiences Pty Ltd
This policy is reviewed at least once a year, or sooner if the law, professional guidance or the tools we use change. We will tell you about important changes.
Version 2.3 | Effective 26/10/2026 | Next review 26/10/2027 | Discover Wellness Experiences Pty Ltd, ABN 57 653 604 801