Privacy Policy

How Bloom Play Studio collects, uses, stores and protects personal and health information.

Last updated: 3 November 2026

About this policy

Bloom Play Studio Pty Ltd ("Bloom", "we", "us") is a paediatric allied health practice with studios in Essendon and Moonee Ponds, Victoria. We also see children in early learning centres, schools, homes and by telehealth.

This policy explains how we collect, use, store and share personal and health information. We handle information in line with:

  • the Privacy Act 1988 (Cth) and the Australian Privacy Principles
  • the Health Records Act 2001 (Vic) and its Health Privacy Principles
  • the NDIS Code of Conduct and NDIS Practice Standards, when we deliver NDIS-funded supports
  • the professional codes of our clinicians' registering and membership bodies

It applies to the children and young people we support, their parents and carers, referrers and other professionals, website visitors and job applicants.

What information we collect

We collect only the information we need to provide safe, effective care. Much of it is health information, which the law treats as sensitive.

  • Children and young people: name, date of birth, address; NDIS, Medicare or health fund details; developmental, medical, educational and family history; diagnoses; assessment results; session notes, goals, progress and reports; photos or videos of therapy activities (only with consent).
  • Parents, carers and guardians: names, contact details, relationship to the child, any court orders that affect consent or contact, billing details, plan manager or support coordinator details.
  • Referrers and other professionals: name, role, organisation and contact details.
  • Job applicants: résumé, qualifications, professional registration, Working with Children Check, NDIS Worker Screening, referee feedback.
  • Website visitors: details you enter in our contact or enquiry forms, and general site usage data.

You can make a general enquiry without giving your name. We cannot provide therapy anonymously, because safe care and record-keeping laws require us to identify the people we support.

How we collect it

We collect most information directly from you, through intake forms, phone calls, emails, our website and therapy sessions. With your consent, we may also collect information from:

  • referrers, such as GPs, paediatricians and other health professionals
  • the NDIA, plan managers and support coordinators
  • early learning centres, kindergartens and schools
  • previous or current therapists and assessment providers

If we receive information about you that we did not ask for, we will keep it only if we could have lawfully collected it. Otherwise we will destroy or de-identify it.

Why we collect it and how we use it

We use your information to provide and manage your child's care. This includes to:

  • assess, plan and deliver therapy, and write reports and letters
  • contact you about appointments, progress and fees
  • coordinate care with others involved in your child's support, with your consent
  • issue invoices and process NDIS, Medicare and health fund claims
  • meet our legal duties, including record keeping, child safety, mandatory reporting and NDIS incident reporting
  • support clinical supervision, quality improvement and staff training, using de-identified information wherever possible
  • manage insurance, complaints and legal matters
  • assess job applications

We will only send you newsletters or service updates if you agree, and you can unsubscribe at any time.

Artificial intelligence. Our clinicians may use AI tools to support their work, but only with the consent of the client or their parent or guardian. You can decline or withdraw consent at any time, and this will not affect your child's care. AI tools do not make decisions about your child's care, funding or eligibility. Those decisions are made by our clinicians and staff.

Children, young people and consent

For younger children, a parent or legal guardian gives consent on the child's behalf. If parents are separated, we may ask to see any court orders that affect who can consent or receive information.

Older children and adolescents may be able to make their own decisions about their care and privacy. Where a clinician assesses that a young person understands what is involved, we will respect their wishes about what is shared with parents, unless there is a safety concern. Clinicians explain the limits of confidentiality at the start of therapy.

We never post photos, videos or artwork that identify a child on our website or social media without separate written consent.

Child safety always comes first. We may share information without consent where the law requires or allows it, such as mandatory reporting to Child Protection or to prevent a serious threat to someone's life, health or safety.

Who we share information with

We share information only with your consent, or where the law requires or allows it. With consent, we may share with:

  • the NDIA, plan managers and support coordinators, to claim and report on NDIS supports
  • Medicare and private health funds, to process claims
  • your child's GP, paediatrician, other treating professionals, early learning centre or school
  • other Bloom clinicians involved in your child's care

We also use trusted service providers to run the practice, such as our practice management software, AI tools (only with your consent), IT support, payroll and HR, accounting, insurers and professional advisers. They may only use your information to provide services to us and must keep it confidential.

Without consent, we share information only where required or permitted by law. Examples include a court order or subpoena, mandatory reporting, reportable incidents to the NDIS Quality and Safeguards Commission, or a serious threat to someone's life, health or safety.

We never sell personal information.

How we store and protect information

Client records are kept electronically in a secure, cloud-based practice management system. We protect information by:

  • limiting access to staff who need it for their role
  • using strong passwords, multi-factor authentication and up-to-date devices
  • requiring all staff and contractors to keep information confidential
  • locking away any paper records and shredding them securely once scanned
  • training staff in privacy and information security

How long we keep records. Under Victorian law, we keep health records for at least 7 years after the last service. For anyone who was under 18 at the time, we keep records until they turn 25. After that, we destroy or de-identify them securely.

Data breaches. If a data breach is likely to cause serious harm, we will notify the people affected and the Office of the Australian Information Commissioner, as required by the Notifiable Data Breaches scheme.

Accessing and correcting your information

You can ask to see or get a copy of the information we hold about you or your child. Please contact us in writing and we will confirm your identity first. We aim to respond within 30 days.

There is no charge to make a request. We may charge a reasonable fee for copying or preparing records, within the limits set by law, and will tell you the cost first.

In some cases we may limit or refuse access, for example if it would put someone's safety at risk, unreasonably affect another person's privacy, or where a young person has asked us to keep information confidential. If so, we will explain why in writing.

If you think information we hold is wrong, out of date or incomplete, let us know and we will correct it. If we disagree, you can ask us to add a note to the record setting out your view.

Website, telehealth and electronic communications

Website. Our website may use cookies and analytics tools to understand how visitors use it. These do not identify you personally, and you can turn cookies off in your browser settings.

Email and SMS. We use email and SMS for appointment reminders and general communication. These are not completely secure. Tell us if you would prefer we contact you another way.

Telehealth. We use secure video platforms for telehealth sessions. We do not record sessions without your consent.

Where information is stored. We store all personal and health information in Australia. We do not store it overseas.

Complaints

If you are concerned about how we have handled your information, please email our Privacy Officer first at complaints@bloomplaystudio.com.au. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days.

If you are not satisfied with our response, you can contact:

Contact us

For privacy questions, access requests or complaints, contact our Privacy Officer:

Privacy Officer, Bloom Play Studio
Suite 2, 77 Raleigh Street, Essendon VIC 3040
Email: complaints@bloomplaystudio.com.au

Changes to this policy

We review this policy at least once a year and whenever our practices or the law change. The current version is always available on our website and at reception, and we will give you a free copy on request.