Privacy Policy

Brave Bodies Privacy Policy

Brave Bodies Paediatric Allied Health Pty Ltd  |  ABN 91 692 938 640
Updated on: 10/08/2026

1. Our commitment to your family’s privacy

Brave Bodies provides physiotherapy and occupational therapy services to children and young people aged 0–18 across South West Western Australia. Looking after your child’s personal and health information carefully is part of looking after your child.

This policy explains what information we collect, why we collect it, who we share it with, and what rights you have. We are bound by the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth), and by our professional obligations as AHPRA-registered practitioners.

2. Who this policy covers

This policy applies to information we hold about the children we treat, their parents and guardians, and anyone who contacts us through our website, by phone, or by email.

Because our clients are children, personal and health information is generally provided by, and access rights are generally exercised by, a parent or legal guardian. Where a young person has sufficient maturity and understanding to make their own decisions about their health information, we will respect their wishes in line with our professional obligations.

3. What we collect

• Your child’s name, date of birth, address, and contact details.

• Parent and guardian names, contact details, and relationship to the child.

• Health information: presenting concerns, developmental and medical history, diagnoses, assessment findings, treatment notes, therapy plans, and progress reports.

• Referral information from GPs, paediatricians, hospitals, schools, and other health professionals.

• Funding and billing information: NDIS participant number and plan details, Medicare details, private health fund details, and payment records.

• Information collected when you use our website, including basic analytics data.

We collect only what we need to provide safe, effective therapy and to meet our legal and funding obligations.

4. How we collect it

Most information comes directly from you — through enquiry and intake forms, during appointments, and in conversations with your therapist. We also receive information from referrers such as your GP or paediatrician, from other health professionals involved in your child’s care (with your consent), and from funding bodies where relevant.

If we receive information about your child from someone else and you have not been told, we will take reasonable steps to let you know.

5. Why we use it

• To assess, plan, and deliver therapy for your child.

• To communicate with you about appointments, progress, and recommendations.

• To write reports and correspondence you or your funders have asked for.

• To bill for services and process payments.

• To meet our legal, professional, and funding obligations.

• To improve our services and, where required, to manage complaints or insurance matters.

We do not sell your information, and we do not use it for marketing without your express consent.

6. Who we share it with

We share your child’s information only where it is necessary and permitted. This may include:

• Other health professionals involved in your child’s care — with your consent.

• Your referring GP or paediatrician, where a report or update is part of the referral.

• Your child’s school or early learning centre — only with your specific consent.

• NDIS plan managers, support coordinators, and the NDIA, where your child is NDIS-funded and this is necessary for billing, plan reviews, or reporting.

• Medicare and private health funds, for claiming and rebate purposes.

• Our practice management, accounting, and payment providers, who are bound to protect your information.

• Where required or authorised by law — including mandatory reporting obligations.

7. Mandatory reporting and child protection

As health practitioners working with children, we have legal obligations to report suspected child abuse or neglect. If we form a reasonable belief that a child is at risk, we are required to report this to the relevant authority, and we may not be able to seek your consent first. This obligation overrides confidentiality, and we take it seriously as part of keeping children safe.

8. Use of artificial intelligence tools

We use software that includes artificial intelligence features to help with clinical documentation — for example, assisting our therapists to produce accurate session notes. This helps our clinicians spend more time with your child and less time writing.

Where these tools are used, personal identifiers are anonymised during processing, the AI provider does not retain or train on your information, and all AI-generated content is reviewed and approved by the treating clinician before it becomes part of your child’s record.

9. Automated decision-making

We do not use computer programs to make, or substantially assist in making, decisions about your child’s care, eligibility, or funding. Clinical decisions are made by qualified practitioners. Where software assists with documentation, as described in section 8, the clinician remains responsible for the content and the decision.

10. Storing your information

Your child’s records are held in our practice management system, which stores Australian users’ data in Australia, encrypted in transit and at rest. Access is restricted to staff who need it to do their job.

11. How long we keep it

Because our clients are children, we keep clinical records until the child turns 25, or for seven years from the last entry in the record — whichever is later. This reflects health record retention requirements for children and our professional obligations.

Billing and financial records are kept for the periods required under tax and corporations law. When records are no longer required, they are securely destroyed or de-identified.

12. Keeping your information secure

We protect your information through access controls and individual staff logins, encryption in transit and at rest, secure disposal of physical documents, staff training and confidentiality obligations, and cyber insurance cover.

No system can be guaranteed completely secure, but we take reasonable steps appropriate to the sensitivity of children’s health information.

13. Data breaches

If a data breach occurs that is likely to result in serious harm, we will notify you and the Office of the Australian Information Commissioner as required under the Notifiable Data Breaches scheme. We will tell you what happened, what information was involved, and what you can do about it.

14. Accessing and correcting your information

You have the right to ask for a copy of the information we hold about your child, and to ask us to correct anything inaccurate or out of date. Requests should be made in writing to the contact below. We will respond within 30 days.

There is no charge to request access. Where a request requires substantial time to compile, we may charge a reasonable fee for retrieval and copying, and we will tell you before any cost is incurred.

In limited circumstances we may need to refuse access — for example where providing it would pose a serious threat to someone’s life, health, or safety, or unreasonably affect another person’s privacy. If we refuse, we will explain why in writing and tell you how to have that decision reviewed.

15. Website, cookies, and analytics

Our website collects standard technical information such as your IP address, browser type, and pages visited, to help us understand how the site is used and improve it. You can disable cookies in your browser settings, though some parts of the site may not work as well.

16. Making a complaint

If you have a concern about how we have handled your child’s information, please contact us first. We take privacy complaints seriously and will investigate and respond within 30 days.

If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

17. Changes to this policy

We review this policy periodically and will publish any updated version on our website with a revised effective date.

18. Contact us

Questions about privacy, or requests to access or correct information, can be directed to:

Email: [email protected]

Phone: 0430 042 989