Privacy & AI Use Policy
How Primrose Family Support Services collects, uses, and protects your information, including our use of AI-assisted tools
1. About This Policy
This policy explains how Primrose Family Support Services ('Primrose', 'we', 'us') collects, uses, stores, and protects your personal information, including how we use AI-assisted tools as part of delivering occupational therapy and support services. It applies to all clients, and to parents, guardians, or nominees where relevant.
2. Who We Are
Primrose Family Support Services is a mobile occupational therapy practice based in Port Macquarie, NSW, run by Kate Toholka (Occupational Therapist, AHPRA registration OCC0001720182). We specialise in supporting neurodivergent teenagers and adults, including through the NDIS, and also offer parenting support services.
3. What Information We Collect
Depending on the nature of our work together, we may collect:
● Contact and identifying details (name, date of birth, address, contact information)
● NDIS plan details and funding information
● Health and clinical information relevant to therapy, including assessments, session notes, and reports
● Information shared by you, your family, support workers, or other providers involved in your care
● Audio recordings of sessions, where consent has been given (see Section 8)
4. How We Collect Your Information
We collect information directly from you or your guardian/nominee, through intake forms, conversations, and sessions. With your consent, we may also collect information from other providers involved in your care (for example, your GP, support coordinator, or other allied health professionals), governed by our separate Consent to Share and Obtain Information form.
5. How We Use Your Information
We use your information to provide occupational therapy assessment and intervention, prepare clinical documentation and NDIS reports, communicate with you and, where relevant, other providers involved in your care, and meet our legal and professional obligations, including under the NDIS Practice Standards and NDIS Code of Conduct.
6. Sharing Your Information
We do not share your information with other clinicians, services, or third parties (including NDIS planners or support coordinators) without your consent. Where consent is given, this is managed through our separate Consent to Share and Obtain Information form, which sets out exactly who information may be shared with and for what purpose.
7. Use of AI-Assisted Tools
We use AI-assisted tools to help prepare session notes, formal reports, and clinical documentation more efficiently. This may include voice-to-text transcription and AI-drafted note summaries, generated using our practice management platform (Splose); a general AI assistant (Claude, on a business account with formal data protection agreements in place) used to help draft formal reports, which are then finalised in Microsoft Word; and, in some cases, a voice-recording device (Plaud) used purely to capture audio for later transcription.
A qualified practitioner always reviews, edits, and finalises every note before it forms part of your clinical record. AI is never used to make clinical decisions or judgements about your care, it supports documentation only.
Where AI tools are used in connection with health or other sensitive information, we apply additional safeguards, including restricting access to authorised personnel and using providers with formal data protection agreements in place. Wherever practical, identifying detail is minimised in AI-assisted drafting as an extra precaution.
8. Session Recordings & Transcription
Where audio recording is used to support note-taking (for example, during a home visit or session), we will:
Seek your consent before any recording takes place, either verbally or via our Consent to Audio Recording form, and note that consent in your file
Explain the purpose of the recording, how it will be processed, and how long it will be retained
Give you the right to decline or withdraw consent at any time, without any impact on the support you receive
Keep recordings local to the recording device wherever possible, transferring them directly and only into our secure practice management system for processing. Audio is not routed through additional third-party AI services beyond what is necessary to prepare your notes. Audio recordings are deleted once transcription and Progress Note has been completed.
You may withdraw consent for session recording at any time by telling Kate directly or contacting us using the details in Section 13. Withdrawal applies to future sessions and does not affect recordings already made under prior consent.
9. Data Security
We take reasonable steps to protect your personal information from misuse, interference, loss, unauthorised access, modification, or disclosure. Our measures include:
● Password-protected, access-controlled systems
● Encryption of data at rest and in transit
● Restricted access to client information on a need-to-know basis
● Formal data protection agreements with third-party technology providers handling health information
● Avoiding use of any AI tool or platform that lacks appropriate data protection safeguards for client information
10. Retention of Your Information
We retain clinical records in line with our legal and professional obligations under the NDIS Practice Standards and applicable privacy law. Session recordings used to prepare clinical documentation are retained only as long as needed for that purpose and are then securely deleted. When information is no longer required, we take reasonable steps to securely destroy or de-identify it.
11. Access and Correction
Under Australian Privacy Principle 12, you have the right to request access to the personal information we hold about you, and to request corrections where information is inaccurate, out of date, or incomplete. To make a request, please contact us using the details in Section 13. We will respond within a reasonable timeframe and in accordance with our obligations under the Privacy Act.
12. Complaints
If you have a concern about how we have handled your personal information, please contact us in the first instance using the details below. We will acknowledge your complaint promptly and aim to resolve it within 30 days. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au, or the NDIS Quality and Safeguards Commission.
13. Contact Us
Practitioner
Kate Toholka, Occupational Therapist (AHPRA OCC0001720182)
Email: admin@primrosefss.com.au