Privacy Policy

About This Policy

HB Rehab is the trading name of WF Health Pty Ltd (ABN 94 650 580 411). We provide occupational therapy and physiotherapy services from 147 Nelson Street, Wallsend NSW 2287, and in clients’ homes, schools, workplaces and communities.

HB Rehab is a registered NDIS provider.

We understand that the information you share with us is personal, and often sensitive. This policy explains how we collect, use, store and share your personal and health information, and how you can access or correct it.

We are bound by the Privacy Act 1988 (Cth), including the Australian Privacy Principles, and the Health Records and Information Privacy Act 2002 (NSW). As a registered NDIS provider, we also follow the privacy requirements of the NDIS Practice Standards.

In this policy, “we”, “us” and “our” means HB Rehab, and “you” includes clients, parents and guardians, carers, referrers, job applicants and visitors to our website.

What Information We Collect

Depending on how you interact with us, we may collect:

your name, date of birth, address, phone number and email
details of parents, guardians, carers or emergency contacts
health information, including medical history, diagnoses, assessment results, therapy notes, reports, and information from other health professionals
photos, videos and audio recordings taken as part of your therapy, with your consent
funding details, such as your NDIS number and plan details, Medicare or private health fund details, DVA details, or insurance and claim numbers
information about your school, workplace or home environment that is relevant to your therapy
billing and payment information
for job applicants, your resume, qualifications, registrations, referee details and checks such as a Working with Children Check and police check

Much of the information we hold is health information, which the law treats as sensitive. We only collect it with your consent, or where the law allows us to.

How We Collect Information

Wherever we can, we collect information directly from you, or from a parent or guardian if the client is a child. We collect it when you contact us, complete a referral or intake form, attend appointments, or speak with your therapist.

With your consent, we may also collect information from other people involved in your care, such as your doctor, other health professionals, your support coordinator or plan manager, the NDIA, insurers, schools or carers.

Children and Young People

When we work with children, we usually collect their information from a parent or guardian, who also provides consent on the child’s behalf. As young people grow older and are able to make their own decisions, we will involve them in decisions about their information where appropriate.

Why We Collect and Use Your Information

We use your information to:

provide safe, effective and coordinated therapy
write assessments, reports and recommendations
communicate with you and with others involved in your care, with your consent
make claims and provide reports to funding bodies
manage appointments, invoicing and payments
meet our legal, professional and NDIS obligations, including incident reporting
improve the quality and safety of our services
assess job applications

We will not use your information for any other purpose unless you have agreed or the law allows it. We do not sell your information, and we do not use it for direct marketing without your consent.

Technology and AI Tools

Like many health practices, we use secure software, including artificial intelligence (AI) tools, to help with tasks such as note-taking, report writing and administration. This gives our team more time to focus on your therapy.

These tools support our staff but do not replace their professional judgement. Everything they produce is checked by a qualified member of our team, and all decisions about your care are made by people, not computer programs. We only use tools that meet our privacy and security standards, and your information is not used to train AI models.

If you have any questions about how we use technology, or would prefer that a session is not recorded, please talk to your therapist.

Photos, Videos and Recordings

With your consent, your therapist may take photos or videos during therapy, or record a session. These help us track progress, review how you move or complete tasks, prepare reports, and support equipment or funding applications.

Photos, videos and recordings form part of your health record and are protected in the same way as the rest of your information:

they are stored securely in our practice systems, not on staff members’ personal devices or accounts
only staff involved in your care can access them
they are only shared with others, such as funding bodies or other professionals, where needed for your care or funding, and with your consent
they are kept and securely destroyed in line with our record-keeping obligations
audio recordings may be deleted once the session notes have been completed and checked

We will never use photos or videos of you or your child on our website, social media or in promotional material without your separate written consent. You can withdraw your consent to photos, videos or recordings at any time by telling your therapist.

Who We Share Information With

We only share your information when it is needed to provide your services, when you have consented, or when the law requires or allows it. This may include:

other health professionals involved in your care
your support coordinator, plan manager or care provider
funding bodies such as the NDIA, iCare, workers compensation and CTP insurers, the Department of Veterans’ Affairs, Medicare, private health funds and aged care providers
schools, day care or preschools, with your consent
the NDIS Quality and Safeguards Commission or other authorities, where we are legally required to report
service providers who help us run the practice, such as our software, practice management, cloud storage and accounting providers, who must keep your information confidential

We may share information without consent in limited situations, such as where there is a serious threat to someone’s life, health or safety, where we have concerns about a child’s safety, or where we are required by law or a court order.

Storing and Protecting Your Information

Your information, including photos, videos and recordings, is stored securely, mostly in electronic systems with password protection, access controls and secure backups. Only staff who need your information to do their jobs can access it, and all staff are bound by confidentiality.

Some of our software providers may store or process data on servers outside Australia. Where this happens, we take reasonable steps to make sure your information is protected to a standard similar to Australian privacy law.

How Long We Keep Your Information

As required by NSW law, we keep health records for at least seven years after your last appointment. For clients who were under 18 when they last saw us, we keep records until they turn 25. After that, records are securely destroyed or de-identified.

Accessing and Correcting Your Information

You can ask to see the information we hold about you, or your child, at any time by contacting us. We will respond within 30 days. In some limited situations, the law allows us to refuse access, and if so we will explain why in writing.

If you think any information we hold is wrong, out of date or incomplete, please tell us and we will correct it.

Using a Pseudonym

You can contact us anonymously or under a different name for general enquiries. However, we will need your real details to provide therapy and to claim funding for you.

Our Website

When you use our website, we may collect general information such as your browser type, the pages you visit and how long you stay. We use cookies and analytics tools to understand how the site is used and to improve it. This information does not usually identify you. You can turn off cookies in your browser settings, although some parts of the site may not work as well.

Information you send through our website forms, including referral forms, is sent securely to our practice systems and handled in line with this policy. Our website may link to other websites, and we are not responsible for their privacy practices.

If There Is a Data Breach

If a data breach is likely to cause serious harm, we will notify you and the Office of the Australian Information Commissioner, as required under the Notifiable Data Breaches scheme.

Questions and Complaints

If you have a question or concern about your privacy, please contact our Privacy Officer:

Privacy Officer, HB Rehab

147 Nelson Street, Wallsend NSW 2287

Phone: 02 4946 4946

Email: info@hbrehab.com.au

We take every concern seriously and will aim to respond within 30 days. If you’re not satisfied with our response, you can contact:

Office of the Australian Information Commissioner: 1300 363 992, www.oaic.gov.au
NSW Information and Privacy Commission (for health information): 1800 472 679, www.ipc.nsw.gov.au

NDIS participants can also contact the NDIS Quality and Safeguards Commission on 1800 035 544.

Changes To This Policy

We may update this policy from time to time. The latest version will always be on our website, and you can ask us for a copy at any time.