Independence,
by design.

Blueprint Therapy Services  |  ABN 28 692 653 679  |  Last updated: June 2026

1. Our commitment to your privacy

Blueprint Therapy Services is committed to protecting the privacy and confidentiality of personal information, including sensitive health information, in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) contained in Schedule 1 of that Act.

As a provider of health-related services, we understand that the information you share with us is personal and sensitive. We take our obligations seriously and handle all information with the care and respect it deserves.

This Privacy Policy explains what personal information we collect, why we collect it, how we use and store it, who we may share it with, and your rights in relation to your information.

By using our website at blueprinttherapy.com.au or engaging our services, you acknowledge that you have read and understood this Privacy Policy.

2. Who this policy applies to

This policy applies to:

• Visitors to our website
• Clients who enquire about or engage our occupational therapy services
• NDIS participants, their families, carers, and guardians
• Aged care recipients
• Private clients
• Referrers including general practitioners, support coordinators, and plan managers

3. What personal information we collect

3.1 Information you provide directly

We collect personal information that you voluntarily provide when you:

• Submit an enquiry or contact form on our website
• Submit an initial consultation request through our online booking system
• Request ongoing availability as an existing client
• Contact us by phone or email
• Engage our services

The types of information we may collect include:

• Identity information: full name, date of birth
• Contact information: phone number, email address, residential address
• Funding information: NDIS plan management type, NDIS participant number, Home Care Package details
• Health information: details of your disability, condition, or health needs relevant to occupational therapy assessment and treatment
• Appointment preferences: preferred days, times, and location of appointments
• Communication preferences: preferred method of contact

3.2 Health information

Health information is classified as sensitive information under the Privacy Act and is afforded a higher level of protection. We collect health information only where it is necessary to provide you with health-related services, and we will always obtain your consent before doing so.

The health information we collect may include, but is not limited to, details about your:

• Physical and cognitive functioning
• Daily living activities and participation
• Home environment and modification needs
• Goals and support requirements
• Current medications, diagnoses, or conditions relevant to health assessments
• NDIS goals and support plan details

3.3 Information collected automatically

When you visit our website, certain information may be collected automatically through Google Analytics (see section 7). This includes:

• IP address (anonymised)
• Browser type and version
• Pages visited and time spent on each page
• Referring website or search terms
• Geographic location (city or region level only)
• Device type (desktop, mobile, tablet)

This information does not identify you personally and is used only for website analytics purposes.

4. How we collect your information

We collect personal information through the following channels:

• Website contact form: when you submit a general enquiry
• Online booking widget (Carepatron): when you request an initial consultation or submit availability preferences
• Phone: when you call us directly
• Email: when you email us at admin@blueprinttherapy.com.au
• In person: during assessment or therapy sessions
• Third parties: with your consent, from referrers such as your GP, support coordinator, or plan manager

5. Why we collect your information

We collect and use your personal information for the following purposes:

• To respond to your enquiry or consultation request
• To schedule and confirm appointments
• To conduct occupational therapy assessments and deliver therapy services
• To develop and implement your personalised support plan
• To prepare reports and documentation required for NDIS, aged care, or private health purposes
• To submit invoices to you, your plan manager, or your funding body
• To communicate with referrers, support coordinators, and other allied health professionals involved in your care, with your consent
• To comply with our legal and regulatory obligations
• To contact you about your appointments, including reminders and follow-ups
• To improve our website and services through analytics data

We will not use your information for any purpose that is inconsistent with the reason it was collected without first obtaining your consent.

6. Carepatron — online booking and practice management

We use Carepatron as our online booking and client management platform. When you submit an initial consultation request or ongoing availability request through our website, your information is transmitted to and stored on Carepatron's secure servers. All client notes and health-related information are stored on Carepatron's secure servers. As part of our client onboarding procedure, we will help you set up a personal client portal, through which we provide access to clinical documentation that needs to be shared electronically. You remain in control of who can access your client portal on your behalf.

What Carepatron collects on our behalf:

• Your name, phone number, and email address
• Your preferred appointment dates, times, and days
• Your funding type
• Any notes you provide about your needs or preferences

How Carepatron protects your information:

• All data transmitted to Carepatron is encrypted using industry-standard SSL/TLS encryption
• Carepatron stores data on secure, access-controlled servers
• Carepatron is designed specifically for healthcare providers and incorporates privacy and security standards appropriate for the handling of health information
• Access to your information within Carepatron is restricted to authorised Blueprint Therapy Services practitioners only

Carepatron's privacy policy: Carepatron maintains its own privacy policy which governs how it handles data as a data processor on our behalf. We encourage you to review Carepatron's privacy policy at carepatron.com for full details of their data handling practices.

7. Google Analytics

Our website uses Google Analytics, a web analytics service provided by Google LLC. Google Analytics helps us understand how visitors use our website so we can improve the experience for our clients.

What Google Analytics collects:

• Anonymised IP addresses (your full IP address is not stored)
• Pages visited and navigation patterns
• Session duration and bounce rates
• Device and browser information
• Geographic location at the city/region level
• Referral source (how you found our website)

How this data is used: We use Google Analytics data solely to understand which pages and content are most useful to visitors, improve website structure and navigation, and measure the effectiveness of our online presence.

Data storage and transfer: Google Analytics data is processed and stored by Google LLC on servers located in the United States. By using our website, you acknowledge that your anonymised usage data may be transferred to and stored in the United States. Google is a signatory to the EU-US Data Privacy Framework and maintains privacy protections for data transferred internationally.

Your choice: Google Analytics is disabled by default on our website. It is only activated if you select "Accept" on the cookie banner shown on your first visit. If you decline, or make no selection, no Google Analytics data is collected. You can also prevent Google Analytics collection at any time by installing the Google Analytics Opt-out Browser Add-on, available at tools.google.com/dlpage/gaoptout, or by managing your browser's cookie settings.

Google's privacy policy: For full details of how Google collects and processes data, please review Google's Privacy Policy at policies.google.com/privacy.

8. Referrals and third-party sharing

Referrers

If you are referred to Blueprint Therapy Services by a GP, support coordinator, plan manager, or other health professional, we may receive personal information about you from that referrer. We will only use information received from referrers to facilitate the provision of our services to you.

Sharing with third parties

We may share your personal information with third parties in the following circumstances:

• Your plan manager or support coordinator: to facilitate invoicing and coordination of your NDIS supports, where you have authorised this
• Other treating health professionals: such as your GP, physiotherapist, or speech therapist, where relevant to your care and with your consent
• NDIS Quality and Safeguards Commission: where required by law or for compliance purposes
• Aged care providers: where you receive support through a Home Care Package and coordination is required
• HealthLink or secure messaging services: where we are required to send clinical correspondence to other health providers
• Legal or regulatory authorities: where we are required to disclose information by law, court order, or regulatory direction

We will not sell, rent, or trade your personal information to any third party for marketing or commercial purposes.

9. Sensitive information and health records

As a health service provider, we are bound by additional obligations under the Privacy Act in relation to health information.

• We collect health information only with your consent or where permitted by law
• We store clinical notes and health records securely within Carepatron, access-restricted to your treating therapist
• We retain clinical records for a minimum of 7 years from the date of your last service (or until a child turns 25, whichever is longer), as required under NSW health records legislation
• We will not disclose your health information to a third party without your written consent, except where required by law

10. Data security

We take reasonable steps to protect your personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure. Our security measures include:

• Encrypted transmission of data via SSL/TLS on our website
• Secure storage of clinical information within Carepatron's access-controlled platform
• Restriction of access to personal information to authorised staff only
• Use of secure, encrypted channels for clinical correspondence (HealthLink where applicable)
• Password protection and two-factor authentication on practice management systems
• Regular review of our privacy and security practices

Despite these measures, no internet transmission or electronic storage is completely secure. We encourage you not to share sensitive clinical information through general contact forms or online chat functions.

11. Cookies

Our website uses cookies — small text files stored on your device — to support website functionality and analytics. The cookies we use include:

• Analytics cookies (Google Analytics): these collect anonymised usage data as described in section 7. These cookies are switched off by default. When you first visit our website you are shown a cookie banner, and Google Analytics is only enabled if you select "Accept". If you select "Decline", or make no choice, no Google Analytics cookies are placed and no analytics data is collected.
• Functional cookies: may be set by embedded third-party tools such as Carepatron's booking widget when you use them. These are necessary for those features to work.

You can change your mind at any time by clearing this website's data in your browser, which will cause the cookie banner to appear again on your next visit. You can also control and manage cookies through your browser settings. Please note that disabling functional cookies may affect the booking widget.

12. Links to third-party websites

Our website contains links to third-party websites including the NDIS Commission website, Carepatron, and other resources. We are not responsible for the privacy practices of these external sites and encourage you to read their individual privacy policies before providing any personal information.

13. Your rights

Under the Australian Privacy Principles, you have the right to:

• Access the personal information we hold about you
• Correct personal information that is inaccurate, out of date, or incomplete
• Make a complaint about how we have handled your personal information
• Withdraw consent for us to collect, use, or disclose your information (noting this may affect our ability to provide services to you)
• Request deletion of your personal information, subject to our legal obligations to retain certain records

To exercise any of these rights, please contact us using the details in section 15.

14. Privacy complaints

If you believe we have handled your personal information in a way that is inconsistent with this Privacy Policy or the Australian Privacy Principles, we encourage you to contact us directly in the first instance so we can address your concern.

We will:

• Acknowledge your complaint within 5 business days
• Investigate your concern and respond within 30 days
• Take appropriate corrective action where required

If you are not satisfied with our response, you may make a complaint to the Office of the Australian Information Commissioner (OAIC):

• Website: oaic.gov.au
• Phone: 1300 363 992
• Post: GPO Box 5218, Sydney NSW 2001

If your complaint relates to health information specifically, you may also contact the NSW Health Care Complaints Commission (HCCC):

• Website: hccc.nsw.gov.au
• Phone: 1800 043 159

15. Contact us about privacy

For any privacy-related enquiries, requests to access or correct your information, or to make a complaint, please contact:

16. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal obligations. The most current version will always be available on our website at blueprinttherapy.com.au/privacy-policy.

We encourage you to review this policy periodically.

This Privacy Policy was last reviewed and updated in June 2026.