WEBSITE PRIVACY POLICY

This Privacy Policy applies to all personal information collected by Talk It Out Services (we, us or our) via the website located at talkitoutservices.com.au (Website).

1. What information do we collect?

The kind of Personal Information that we collect from you will depend on how you use the website. The Personal Information which we collect and hold about you may include:

We may collect personal information from website users including their name, contact details (email address, phone number, postal address), date of birth, health information relevant to psychology and speech pathology services, Medicare or health fund details, emergency contact information, appointment booking details, and any information voluntarily provided through contact forms, intake forms or online enquiries. Where users interact with our website, we may also collect technical information such as IP address, browser type and device information through cookies and analytics tools.

2. Types of information

The Privacy Act 1988 (Cth) (Privacy Act) defines types of information, including Personal Information and Sensitive Information.

Personal Information means information or an opinion about an identified individual or an individual who is reasonably identifiable:

(a) whether the information or opinion is true or not; and

(b) whether the information or opinion is recorded in a material form or not.

If the information does not disclose your identity or enable your identity to be ascertained, it will in most cases not be classified as “Personal Information” and will not be subject to this privacy policy.

Sensitive Information is defined in the Privacy Act as including information or opinion about such things as an individual's racial or ethnic origin, political opinions, membership of a political association, religious or philosophical beliefs, membership of a trade union or other professional body, criminal record or health information.

Sensitive Information will be used by us only:

(a) for the primary purpose for which it was obtained;

(b) for a secondary purpose that is directly related to the primary purpose; and

(c) with your consent or where required or authorised by law.

3. How we collect your Personal Information

(a) We may collect Personal Information from you whenever you input such information into the Website, related app or provide it to Us in any other way.

(b) We may also collect Personal Information through cookies and similar technologies when you use Our Website. These technologies may collect information about your device, browser and use of Our Website. We will only use cookies and similar technologies in accordance with applicable privacy laws and this Privacy Policy.

(c) Where required by law, We will obtain your consent before using non-essential cookies or similar tracking technologies. Where available, you may manage your cookie preferences through your browser settings or any cookie preference tools made available on Our Website.

(d) We generally don’t collect Sensitive Information, but when we do, we will comply with the preceding paragraph.

(e) Where reasonable and practicable we collect your Personal Information from you only. However, sometimes we may be given information from a third party, in cases like this we will take steps to make you aware of the information that was provided by a third party.

(f) Where we collect your Personal Information from a third party (including payment processors, analytics providers, and cloud storage services), we will notify you of the identity of that third party, the type of information collected, and the purpose of collection prior to or as soon as practicable after collection. All third-party subcontractors engaged by Us are contractually required to comply with the Privacy Act 1988 (Cth), the Australian

Privacy Principles, and any applicable health information legislation, and you may contact Us at any time to request that we restrict the sharing of your Personal Information with specified third parties.

4. Purpose of collection

(a) We collect Personal Information to provide you with the best service experience possible on the Website and keep in touch with you about developments in our business.

(b) We may disclose Personal Information to service providers who assist us in operating our business and providing our services. We take reasonable steps to ensure those providers handle Personal Information securely and in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles, including appropriate contractual and data security safeguards where applicable. Where information is disclosed overseas, we will comply with the overseas disclosure requirements of this Privacy Policy and applicable privacy laws.

(c) By using our Website, you consent to the receipt of direct marketing material. We will only use your Personal Information for this purpose if we have collected such information direct

from you, and if it is material of a type which you would reasonably expect to receive from use. We do not use sensitive Personal Information in direct marketing activity. Our direct marketing material will include a simple means by which you can request not to receive further communications of this nature, such as an unsubscribe button link.

5. Security, Access and correction

(a) We may disclose Personal Information and Sensitive Information to third-party service providers who assist Us in operating Our business and providing Our services, including providers of practice management and clinical software, information technology, cloud storage, communications, payment processing, accounting, website hosting, maintenance and support services. We take reasonable technical and organisational measures to protect Personal Information and Sensitive Information from misuse, interference, loss, and unauthorised access, modification or disclosure, in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. These measures may include secure and encrypted systems and communications where appropriate, password protection and multifactor authentication, role-based and restricted access to information, access being limited to authorised personnel who require it to perform their duties, secure cloud-based systems, device and network security controls, staff privacy and confidentiality obligations and procedures for responding to suspected privacy or data security incidents. Where We engage third-party service providers that handle Personal Information or Sensitive Information on Our behalf, We take reasonable steps to assess and manage privacy and information security risks associated with those providers.

(b) The Australian Privacy Principles:

(i) permit you to obtain access to the Personal Information we hold about you in certain circumstances (Australian Privacy Principle 12); and

(ii) allow you to correct inaccurate Personal Information subject to certain exceptions (Australian Privacy Principle 13).

(c) Where you would like to obtain such access, please contact us in writing on the contact details set out at the bottom of this privacy policy.

(d) In accordance with our obligations under applicable health records legislation and the Australian Privacy Principles, we retain psychology and speech pathology records for a minimum of [7] years following the last date of treatment, or [7] years after a minor client turns 18, whichever is later. Upon expiry of the applicable retention period, we will destroy records using secure methods (including secure digital deletion, cross-cut shredding, or incineration of physical documents) and maintain a documented destruction log to verify compliance.

6. Complaint procedure

If you have a complaint concerning the manner in which we maintain the privacy of your Personal Information, please contact us as on the contact details set out at the bottom of this policy. All complaints will be considered and we may seek further information from you to clarify your concerns. If we agree that your complaint is well founded, we will, in consultation with you, take appropriate steps to rectify the problem. If you remain dissatisfied with the outcome, you may refer the matter to the Office of the Australian Information Commissioner.

7. Overseas transfer

Your Personal Information will not be disclosed to recipients outside Australia unless you expressly request us to do so. If you request us to transfer your Personal Information to an overseas recipient, the overseas recipient will not be required to comply with the Australian Privacy Principles and we will not be liable for any mishandling of your information in such circumstances.

8. How to contact us about privacy

If you have any queries, or if you seek access to your Personal Information, or if you have a complaint about our privacy practices, you can contact us through: admin@talkitoutservices.com.au.

9. Overseas transfer

We may use third-party service providers, including technology, cloud hosting, practice management, communications and other service providers, in connection with the operation of

Our business and provision of Our services. As a result, Personal Information or Sensitive

Information may in some circumstances be disclosed to recipients located outside Australia. Where We disclose Personal Information or Sensitive Information to an overseas recipient, We will comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles, including Australian Privacy Principle 8, and will take such steps as are reasonable in the circumstances to ensure that the overseas recipient handles the information in accordance with the Australian Privacy Principles, unless an exception under the Privacy Act applies. Where We rely on your consent in relation to an overseas disclosure, We will obtain consent in accordance with the requirements of the Privacy Act 1988 (Cth), including providing you with information about the relevant consequences of providing that consent where required by law. Where Personal Information is likely to be disclosed to overseas recipients, We will identify the countries in which those recipients are likely to be located where it is practicable for Us to do so.

10. Complaint procedure

If you have a complaint concerning the way We have handled your Personal Information or believe that We have not complied with Our obligations under the Privacy Act 1988 (Cth) or the Australian Privacy Principles, please contact Us using the contact details set out in this Privacy Policy. We will acknowledge receipt of your complaint in writing within 5 business days. We will consider and investigate your complaint and may contact you to request further information or clarify your concerns. We will aim to provide you with a written response outlining the outcome of Our investigation and any steps We propose to take within 30 calendar days of receiving your complaint. If We are unable to resolve your complaint within this timeframe, We will notify you of the delay and, where practicable, provide an expected timeframe for resolution. If you are dissatisfied with Our response, you may request that the matter be reviewed by a senior member of Talk It Out Services Pty Ltd. If you remain dissatisfied following Our internal complaint process, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC).