PRIVACY POLICY
1. Our commitment to your privacy
Speech Bubble Speech Pathology is committed to protecting the privacy, confidentiality and security of the personal and health information we collect and hold about all patients, children, their parents, guardians, and families.
We understand that clients entrust us with sensitive information about their families’ development, communication, health, learning and wellbeing. We take this responsibility seriously and handle information respectfully, lawfully and securely.
This Privacy Policy explains how we collect, use, store, disclose and protect personal and health information, including information stored electronically in Halaxy and information kept in physical, hard-copy patient files.
We manage personal and health information in accordance with applicable Australian and Victorian privacy laws, including the Privacy Act 1988 (Cth), the Australian Privacy Principles, the Health Records Act 2001 (Vic) and the Victorian Health Privacy Principles, as applicable.
2. What information do we collect?
We collect only information that is reasonably necessary to provide safe, appropriate and effective speech pathology services, manage our practice and meet our legal and professional obligations.
The information we may collect includes:
Personal and contact information: the patient’s name, date of birth, address, contact details and relevant parent, guardian or emergency contact details.
Health and developmental information: medical history, developmental milestones, speech and language development, communication skills, feeding and swallowing information where relevant, hearing information, diagnoses, assessment results, reports and therapy progress.
Family and background information: relevant family history, languages spoken at home, cultural considerations, educational history and other information necessary to understand the child’s communication needs.
Clinical information: referral letters, assessment findings, clinical observations, therapy plans, progress notes, correspondence and discharge summaries.
Third-party information: relevant information provided by parents, guardians, doctors, teachers, schools, psychologists, occupational therapists and other health professionals.
Administrative and financial information: appointment details, attendance records, invoices, payment information, Medicare or funding information where applicable, and correspondence relating to our services.
Consent and legal information: consent forms, relevant parenting or guardianship arrangements, court orders and restrictions on access to information, where necessary.
We may collect information directly from the patient, child, parent or guardian, or from another person involved in the child’s care, where appropriate and lawful.
3. How do we collect information?
We may collect information through:
Initial intake, registration and consent forms.
Consultations, assessments and therapy sessions.
Telephone calls, emails, text messages and other communications.
Referrals, reports and correspondence from other health professionals or educational providers.
Information provided by parents, guardians or other authorised representatives.
Halaxy, our practice management and clinical record system.
Written clinical notes, assessment forms and other paper-based documents.
Payment, invoicing and funding administration processes.
Where information is collected from someone other than the patient, child or their parent or guardian, we take reasonable steps to ensure that the collection is lawful and appropriate.
We aim to provide clients and families with information about why we collect personal and health information, how it will be used, and how they can access or correct it.
4. Why do we collect and use information?
We collect and use personal and health information for purposes including:
Assessing a patient’s speech, language, communication, literacy, social communication, feeding or swallowing needs, where relevant to our services.
Planning, delivering, monitoring and reviewing speech pathology intervention.
Maintaining accurate clinical records and documenting professional decisions.
Communicating with patients, parents, guardians and authorised representatives about appointments, assessment results, therapy progress and recommendations.
Coordinating care with other treating health professionals and, where authorised, schools and educational staff.
Managing appointments, billing, payments, rebates and funding arrangements.
Meeting our legal, regulatory, insurance and professional obligations.
Responding to questions, concerns, complaints or requests relating to our services.
Managing practice operations, quality improvement and record keeping.
If information is not provided, we may be unable to assess a patient adequately, provide certain services or manage appointments and payments effectively. We will explain any significant consequences where relevant.
We do not use a patient’s health information for unrelated purposes or direct marketing without the necessary authority or consent.
5. Children, parents and guardians
Because we provide paediatric services, we take particular care when collecting, using and disclosing information about children.
Consent to services and information handling
We seek appropriate consent from a parent, legal guardian or other person legally authorised to consent to the child’s care, taking into account the child’s age, maturity, capacity and circumstances.
Where appropriate, we also explain our services and privacy practices to the child in an age-appropriate manner and seek their involvement, understanding and assent.
We may need to verify parental responsibility, guardianship or decision-making authority before providing services or disclosing information.
Access by parents and guardians
A parent or guardian does not necessarily have an unrestricted right to access all information held about a child. Access requests are assessed in accordance with applicable law, the child’s maturity and capacity, the child’s privacy and best interests, any relevant court orders, and any other legal restrictions.
Where appropriate, we consider the child’s views and confidentiality interests before providing access to their records.
Where parents or guardians are separated, or there are parenting orders or disputes about decision-making, we may request relevant documentation and obtain legal advice where necessary before disclosing information.
We will not disclose information to a person where doing so would be unlawful or where a lawful restriction applies.
6. Disclosure of information to other people and organisations
We treat all personal and health information as confidential. We disclose information only where authorised or required by law, with appropriate consent, or in other circumstances permitted by applicable privacy legislation.
Depending on the circumstances, information may be disclosed to:
A patient, a child’s parent, guardian or authorised representative.
Other health professionals involved in the patient’s care, such as a general practitioner, paediatrician, psychologist, occupational therapist or audiologist.
A school, kindergarten, childcare service or other educational provider, where appropriate and authorised.
Medicare, private health insurers, funding bodies or relevant government agencies, where necessary and applicable.
Professional advisers, insurers, auditors or regulatory bodies where required or authorised.
Service providers who assist us to operate our practice, such as Halaxy and relevant information technology, communication, payment or administrative providers.
Emergency services, child protection authorities, law enforcement agencies or other appropriate bodies where disclosure is required or permitted by law, including in certain circumstances involving a serious threat to health or safety.
Where we communicate with a school or another treating professional, we generally seek appropriate consent before sharing identifiable clinical information, unless an exception under applicable law applies.
We aim to disclose only the information reasonably necessary for the relevant purpose.
We do not routinely share a patients or child’s clinical records with schools, other family members or unrelated third parties without appropriate authority.
7. Electronic records and Halaxy
We use Halaxy as our practice management and electronic clinical record system. Halaxy is an encrypted, cloud-based health and practice management platform bound by data protection laws such as the Australian Privacy Principles and the Privacy Act 1988 (Cth) in Australia, alongside global standards like ISO/IEC 27001 Speech pathologist and administration staff have access to your general records and personal information as required in Halaxy.
Halaxy may be used to manage patient demographics, appointments, clinical notes, assessment information, reports, consent records, communications, billing and other information relevant to providing our services.
Information entered into Halaxy is handled in accordance with our privacy obligations and Halaxy’s applicable privacy and security arrangements.
We take reasonable steps to protect electronic information by implementing appropriate safeguards, which may include:
Individual user accounts and access permissions.
Strong passwords and multi-factor authentication where available.
Restricting access to authorised personnel who need the information for their work.
Securing computers and devices used to access patient records.
Keeping software and devices appropriately updated.
Taking reasonable precautions when sending reports, emails and other electronic communications.
Reviewing access and security arrangements when staff or contractors cease working with the practice.
Halaxy’s published privacy information states that Australian practice data is generally stored in Australia, although certain integrations or third-party services may involve overseas recipients. We consider the services and integrations actually used by our practice when assessing overseas disclosure and privacy risks.
Data Security and Storage
· Encryption: Information, payment details, and clinical notes use 256-bit bank-grade encryption.
· Data Centers: Data is hosted in regional cloud infrastructure (such as Amazon Web Services in Australia for Australian users, or the EU for European Union users to comply with GDPR).
· Access Control: Files are restricted to authorized practitioners and staff members based on account permissions and multi-factor authentication. Access to files is overseen by the Director as appropriate.
Artificial Intelligence (AI Scribe)
· Audio Handling: Halaxy AI Scribe streams audio live for real-time transcription and does not store audio recordings.
· Data Training: Patient data and practice notes are not used to train Halaxy's AI models.
· Access: Transcriptions and generated summaries are stored with the same clinical privacy controls as standard patient records.
For further information about Halaxy’s handling of personal information, please refer to the Halaxy Privacy Policy at https://www.halaxy.com/privacy/.
8. Hard-copy patient files and written clinical notes
In addition to electronic records, we maintain hard-copy records where appropriate. These may include handwritten clinical notes, assessment forms, signed consent forms, referral letters, reports, correspondence and other documents relevant to a child’s care.
We protect physical records by taking reasonable steps to ensure that they are:
Stored in secure cabinets or other secure storage areas.
Accessible only to authorised personnel.
Kept in areas that are not accessible to unauthorised visitors or other patients.
Transported securely where they must be moved.
Protected from loss, theft, damage, unauthorised copying or disclosure.
Disposed of securely when retention is no longer required or authorised.
We take care when using written notes during appointments and when discussing patient information in shared or public areas.
Where information is transferred between paper files and Halaxy, we take reasonable steps to maintain the accuracy, confidentiality and integrity of the records.
9. Storage, security and retention of information
We take reasonable steps to protect personal and health information from misuse, interference, loss, unauthorised access, modification and disclosure.
Our safeguards may include physical security measures, access controls, password protection, secure storage, staff confidentiality obligations and appropriate disposal procedures.
No electronic system or physical storage method can be guaranteed to be completely secure. However, we take reasonable measures to reduce privacy and security risks.
We retain patient information for as long as required to provide services, meet applicable legal and professional obligations, manage complaints or claims, and protect the legitimate interests of the child and practice.
We follow applicable record-retention requirements and relevant professional guidance, including any requirements that apply specifically to records relating to children.
When records are no longer required to be retained, we take reasonable steps to securely destroy them or permanently de-identify the information, where appropriate and lawful.
In Australia, speech pathologists are required to retain client files and health records for minimum periods that depend on the age of the client at the time of their last treatment. These rules align with state-based health records legislation and insurance guidelines:
· Adult clients (18 years and older): Records must be kept for at least 7 years from the date of the last entry or interaction with the client.
· Child clients (under 18 years): Records must be kept until the client turns 25. (This ensures the file is preserved for at least 7 years after they reach adulthood).
Key Exceptions and Considerations
· Medicolegal Matters: If a client file is subject to an active complaint, legal claim, or expected subpoena, the records must be kept indefinitely and cannot be destroyed, even if the standard 7-year or age-25 threshold has passed.
· Patient Death: The death of a patient does not alter these legal requirements; the files must still be retained for the mandatory duration.
· Secure Disposal: Once the retention period lapses, files are permanently destroyed or permanently de-identified using secure commercial shredding or secure electronic deletion.
10. Email, text messages and other communications
We may communicate with parents, guardians and authorised representatives by telephone, email, SMS or other agreed communication methods for purposes such as appointment reminders, scheduling, invoices, reports and therapy service-related correspondence.
We take reasonable precautions to protect information when communicating electronically. However, electronic communications may carry risks, including misdirected messages, access by other users of a shared device or email account, and interception.
We ask patients and families to notify us if their contact details change or if there are particular communication or confidentiality requirements we should observe.
Where appropriate, we may verify a person’s identity and authority before discussing sensitive information or sending reports and clinical documents.
Patients and families should tell us if they do not wish to receive particular types of communication through a specific channel, so that reasonable alternatives can be considered.
11. Accessing and correcting information
You may request access to personal or health information we hold about you or your child, subject to applicable law.
You may also request correction of information that you believe is inaccurate, incomplete, out of date or misleading.
To make a request, please contact us using the details provided at the beginning of this policy.
We may ask you to verify your identity and, where you are requesting access to a patient’s records, demonstrate your legal authority to act on the patient’s behalf.
We will respond to requests within the timeframes required by applicable law. In some circumstances, access may be restricted or refused where permitted by law, including where access could pose a serious threat to an individual’s life or health, unreasonably affect another person’s privacy, or be inconsistent with a legal restriction.
If we are unable to provide access or make a requested correction, we will explain the reasons where required and advise you of any available review or complaint options.
Where appropriate, if we disagree with a requested correction, we may record the request and your concerns alongside the existing information.
12. Privacy breaches
We take reasonable steps to prevent, identify and respond to suspected or actual privacy breaches.
A privacy breach may include unauthorised access to patient records, a lost paper file, an email sent to the wrong recipient, or the unauthorised disclosure of a patient’s health information.
If a breach occurs, we will take appropriate steps to contain it, assess the potential harm, reduce further risks and investigate the circumstances.
Where required by applicable law, we will notify affected individuals and relevant authorities. This includes complying with any applicable notifiable data breach requirements.
13. Complaints about privacy
If you have concerns about how we have collected, used, stored or disclosed personal or health information, we encourage you to contact us first.
Please submit your complaint using the contact details provided at the beginning of this policy. We will acknowledge and investigate the complaint, seek further information if necessary, and respond within a reasonable timeframe.
We will handle privacy complaints respectfully and confidentially, and we will take reasonable steps to address any substantiated concerns.
If you are not satisfied with our response, you may contact the relevant privacy oversight body, depending on the nature of your complaint and the legislation that applies.
For Victorian health privacy matters, you may contact the Health Complaints Commissioner (Victoria):
Website: https://hcc.vic.gov.au/
For matters within its jurisdiction, you may also contact the Office of the Australian Information Commissioner (OAIC):
Website: https://www.oaic.gov.au/
14. Changes to this Privacy Policy
We may review and update this Privacy Policy from time to time to reflect changes in our services, record-keeping practices, technology, applicable legislation or professional obligations.
The current version will be made available to families on request and, where applicable, through our website or practice information materials.
We encourage families to review this policy periodically.
15. Contact us
If you have questions about this Privacy Policy, wish to access or correct information, or would like to raise a privacy concern, please contact:
Speech Bubble Speech Pathology
Privacy contact: Catherine Moloney (Director)
Email: Catherine@speechbubble.com.au or Appointments@speeechbubble.com.au
Phone: 0491 686 780
Address: 230-231 Nepean Hwy, Edithvale, VIC 3196
Effective Date: 1st January 2020
Last Reviewed: 1st October 2026
We are committed to handling your family’s information with care, respect and confidentiality.