Privacy policy

1. Purpose

This Privacy Policy explains how Social Sense Allied Health (SSAH) collects, holds, uses, discloses, secures, accesses, corrects and disposes of personal information, including health and other sensitive information. It covers information collected in person, by telephone, through telehealth, online and through SSAH's service providers.

2. Scope and accountability

This policy applies to SSAH, its Director, employees, contractors, students and authorised service providers. The Director, SSAH is responsible for privacy governance and performs the Privacy Officer function unless another person is formally appointed.

3. Governing principles

Lawful and fair collection. Information is collected by lawful and fair means and, where practicable, directly from the individual.

Purpose and minimisation. SSAH collects only information reasonably necessary for a stated function or activity.

Consent and choice. Sensitive information is collected with consent unless an authorised exception applies, and consequences of non-disclosure are explained.

Accuracy. Reasonable steps are taken to keep information accurate, complete, current and relevant.

Security and retention. Information is protected from misuse, interference, loss and unauthorised access, modification or disclosure, and is securely destroyed or de-identified when no longer required.

Access and accountability. People can request access or correction and can raise concerns without disadvantage.

4. Definitions

Personal information: information or an opinion about an identified individual, or an individual who is reasonably identifiable.

Health information: personal information about a person's health, disability, health services or related wishes, and other information treated as health information by applicable law.

Sensitive information: personal information given additional protection by law, including health, racial or ethnic origin, sexual orientation, gender identity, religious beliefs and certain other attributes.

AI-assisted clinical documentation: use of an approved artificial intelligence system to process a consultation and create a draft record for clinician review.

5. Legal, ethical and professional framework

SSAH applies this policy consistently with the following requirements, where relevant:

  • Privacy Act 1988 (Cth), the Australian Privacy Principles and the Notifiable Data Breaches scheme.

  • Health Records Act 2001 (Vic) and the Victorian Health Privacy Principles.

  • Health Records and Information Privacy Act 2002 (NSW), where applicable.

  • Health Complaints Act 2016 (Vic) and the General Code of Conduct for general health service providers.

  • AASW Code of Ethics 2020 and current AASW Practice Standards.

  • NDIS Code of Conduct and applicable NDIS Practice Standards, where SSAH provides NDIS supports or services.

6. What information SSAH collects

Depending on the service and relationship, SSAH may collect:

  • identity and contact details, including name, date of birth, address, telephone number and email address;

  • health, disability, psychosocial, family, cultural, support, risk and service history relevant to care;

  • referral information, assessments, plans, progress notes, correspondence, reports and discharge information;

  • Medicare, DVA, health fund, NDIS, WorkCover, EAP, Victims Services, Home Care Package or other funding and billing details;

  • information about guardians, nominees, support people, referrers, providers and other people involved in care;

  • consent, complaint, incident, quality, audit, insurance and legal records; and

  • website enquiry, newsletter, technical, analytics and cookie information described in section 15.

If a person does not provide information reasonably needed for the service, SSAH may be unable to provide or safely continue the requested service. SSAH will explain the likely consequence where practicable.

7. How information is collected

SSAH generally collects information directly from the individual during enquiry, intake, appointments, forms, telephone calls, telehealth and correspondence. With consent or other lawful authority, SSAH may collect information from a referrer, family member, guardian, nominee, support person, health professional, funder, insurer or government body.

8. AI-assisted clinical documentation and Heidi

SSAH may use Heidi Scribe, supplied by Heidi Health Trading Pty Limited, to process spoken conversation and prepare a transcript and draft clinical documentation. Heidi does not make clinical decisions. The responsible clinician reviews, corrects and approves every final record before it is filed or relied upon.

SSAH uses Heidi only after providing relevant information and obtaining separate, express and informed consent. Written consent is ordinarily obtained before first use and verbal consent is reconfirmed before every session. Every participant must consent. Refusal or withdrawal does not affect service access, fees or quality; manual notes are used instead.

Information processed may include voices, identifying details, health and other sensitive information, and information about third parties discussed in the session. AI output may contain transcription errors, omissions, incorrect additions, speaker-attribution errors or biased language. The clinician must correct the output before use.

Heidi currently represents that session audio is processed transiently and not permanently retained, and that patient data is not used to train its AI models. Transcripts and drafts may remain in the account until deleted. Once the verified final record has been transferred to SSAH's authorised record system, temporary transcripts and drafts are deleted as soon as practicable, ordinarily within 24 hours, unless a clinical, legal, complaint, incident or insurance reason requires retention.

SSAH conducts due diligence on Heidi's terms, security, sub-processors, data location, retention and material changes. Further requirements are set out in the AI-Assisted Clinical Documentation Policy.

9. Purposes of use

SSAH may use personal information to:

  • assess enquiries and referrals, provide therapy and allied health services, coordinate care and communicate about treatment;

  • prepare, maintain and quality-check clinical records, reports, referrals and discharge summaries;

  • conduct clinical supervision, staff education, quality assurance, accreditation, audit, risk, incident, complaint and claims management;

  • manage appointments, reminders, accounts, invoices and payments;

  • liaise with Medicare, DVA, health funds, the NDIA or NDIS plan managers, WorkCover and other authorised funders to verify services and payment;

  • meet safeguarding, mandatory reporting, court, tribunal, subpoena, insurance and other legal obligations; and

  • send marketing or research communications only where express consent or another lawful basis applies, with an opportunity to opt out.

10. Disclosure

SSAH may disclose information, to the minimum extent reasonably necessary and as permitted by law, to:

  • health and allied health professionals involved in the person's care;

  • a referrer, including through a discharge summary or other clinically relevant communication, unless the person asks SSAH not to disclose and SSAH can lawfully and safely comply;

  • a parent, guardian, authorised representative, close relative, support person or legal representative where consent, authority or law permits;

  • funders, insurers, billing providers, auditors and professional advisers;

  • technology, practice-management, communications, storage and clinical-documentation providers subject to appropriate confidentiality and security arrangements; and

  • government, regulatory, law-enforcement, safeguarding, court or tribunal bodies where required or authorised by law.

11. Overseas handling or disclosure

SSAH seeks to use Australian data locations for health information where reasonably available. Some service providers, related entities, support personnel or sub-processors may handle information outside Australia. Before an overseas disclosure, SSAH will take reasonable steps required by applicable privacy law and will describe likely countries or locations where practicable. SSAH will not state that information never leaves Australia unless that has been verified for the relevant service and configuration.

12. Access and correction

A person may request access to personal and health information held about them and may ask for inaccurate, out-of-date, incomplete, irrelevant or misleading information to be corrected. Requests should be made to the Privacy Officer. SSAH may verify identity, may charge only reasonable permitted costs and will respond within applicable legal timeframes. If correction is refused, SSAH will give reasons where required and may attach a statement of the requested correction to the record.

13. Data quality, security and retention

SSAH uses proportionate administrative, technical and physical safeguards, including access controls, approved accounts and devices, encryption where available, network protections, secure storage, confidentiality obligations and monitoring. Unauthorised access or disclosure by an employee or contractor is a serious breach and may result in disciplinary or legal action.

Information is retained for the period required by applicable health-record, funding, professional, insurance and legal obligations. When no longer required, it is securely destroyed or permanently de-identified. SSAH reviews safeguards as technology and risk change.

14. Privacy incidents and eligible data breaches

Suspected loss, unauthorised access, modification or disclosure must be reported immediately to the Director, SSAH. SSAH will contain, assess, document and remediate the incident, and will notify affected people, the Office of the Australian Information Commissioner and any other authority where legally required.

15. Website, analytics and cookies

SSAH does not seek to identify website visitors unless they provide personal information, for example through an enquiry, newsletter subscription, complaint or email. The website host or service providers may record technical information such as internet protocol address, top-level domain, visit date and time, pages accessed and browser type for security, administration and statistics.

The website may use session or other cookies to recognise a browser and support functionality or analytics. Browser settings may reject or notify a user about cookies, but some functionality may be reduced. SSAH does not control the content or privacy practices of third-party websites linked from its site.

16. Privacy enquiries and complaints

Questions, access or correction requests and privacy complaints may be sent to the Privacy Officer, Social Sense Allied Health, PO Box 212, Brunswick VIC 3056; hello@socialsense.com.au; or 0435 005 669. SSAH will acknowledge a complaint within five business days, assess it promptly, keep the person updated and provide an outcome.

A person who is dissatisfied may contact the Office of the Australian Information Commissioner, the Victorian Health Complaints Commissioner, the NSW Health Care Complaints Commission or another body with jurisdiction. Service complaints are handled under the SSAH Complaints Policy.

17. Availability and review

This policy is available on request and on www.socialsense.com.au. It is reviewed at least annually and after a material legal, service, technology, vendor or privacy change.

References

Privacy Act 1988 (Cth). https://www.legislation.gov.au/C2004A03712/latest

Office of the Australian Information Commissioner. Australian Privacy Principles. https://www.oaic.gov.au/privacy/australian-privacy-principles

Office of the Australian Information Commissioner. Notifiable Data Breaches scheme. https://www.oaic.gov.au/privacy/notifiable-data-breaches

Health Records Act 2001 (Vic). https://www.legislation.vic.gov.au/in-force/acts/health-records-act-2001

Health Records and Information Privacy Act 2002 (NSW). https://legislation.nsw.gov.au/view/html/inforce/current/act-2002-071

Heidi Health. Safety and privacy information. https://www.heidihealth.com/en-au/safety

Australian Association of Social Workers. Code of Ethics 2020. https://www.aasw.asn.au/about-aasw/ethics-standards/code-of-ethics/

Policy contact

For questions or concerns about privacy, access, correction or this policy, contact the Director, SSAH on 0435 005 669 or hello@socialsense.com.au. Correspondence may also be sent to PO Box 212, Brunswick VIC 3056.