Privacy Policy

Who This Policy Covers

This policy explains how Drift Health handles personal information when you use our website, contact us, apply for a role, request a resource, make a referral, book an appointment or receive allied-health services.

If you provide information about another person, including a child or NDIS participant, you must be authorised to do so and should help them understand this policy where appropriate.

Information We Collect

Depending on how you interact with us, we may collect identity and contact details, postcode and service area, NDIS and plan-management details, referral information, appointment details, application and CV information, website and campaign attribution data, and the questions or messages you choose to submit.

Some forms ask about a participant’s age, goals, mobility, communication, sensory preferences, routines or other health and disability circumstances. This may be sensitive information or health information. Please only provide what is reasonably needed for the requested service or resource.

We may also collect technical information such as browser and device details, approximate location, referring pages, cookie identifiers and interactions with our website.

Why We Collect And Use It

We use personal information to respond to enquiries and referrals, assess whether a service is suitable, arrange and deliver appointments, personalise requested resources, manage applications, keep clinical and business records, improve our website and services, protect our systems, meet legal and professional obligations, and communicate with you.

We only send marketing messages where we have permission or another lawful basis to do so. Marketing consent is optional and separate from the information needed to deliver a resource, respond to an enquiry or provide a service. You can unsubscribe using the link in a message or by contacting us.

Children, Health Information And Consent

We take additional care with children’s information and health information. Where a parent, guardian, nominee, support coordinator or other representative provides information, we may ask them to confirm their authority and consent to the proposed use.

Website questionnaires and generated resources are general information and are not a diagnosis, clinical assessment or substitute for advice from a qualified practitioner. Information needed for clinical care may also be recorded in the systems used by the treating team.

Provider-Assisted AI Tools

Some optional website tools use a third-party generative-AI provider, currently OpenRouter and the model provider it routes to, to draft a personalised, non-diagnostic resource from the answers you submit. The result may be incomplete or inaccurate and should be checked before you rely on it.

These tools only run after the required just-in-time consent is confirmed. Submitted information may be processed overseas by the AI provider and its infrastructure providers. Do not include information that is not needed for the requested resource.

Service Providers And Overseas Processing

We use service providers to operate our website and practice. These may include website and cloud hosting, database and file storage, CRM and communications, booking and calendar systems, analytics and advertising measurement, email delivery, security, professional advisers and provider-assisted AI services.

Our current website stack may disclose or make information accessible to providers such as Vercel, GoHighLevel, booking-widget providers, Google, Meta, Resend and OpenRouter where the relevant feature is enabled. Some providers process or store information outside Australia, and their locations may change. We take reasonable steps to use providers with appropriate privacy and security controls and to limit the information sent to each service.

We design advertising and analytics events so that questionnaire answers, free-text health details and clinical records are not sent as advertising-event parameters. Aggregated events and campaign identifiers may still be used to understand whether a page or form is working.

Disclosure

We may disclose information to our practitioners and authorised team members, the person or organisation involved in a referral or booking where appropriate, service providers acting for us, professional advisers, regulators or authorities, or another party where you consent or the law permits or requires it.

We do not sell personal information.

Storage, Security And Retention

We use administrative, technical and physical safeguards appropriate to the information we hold. No internet or storage system is completely secure, so please contact us promptly if you believe information has been mishandled.

We retain information only for as long as reasonably needed for the purposes described here and to meet legal, clinical, employment, insurance and record-keeping obligations. Different record types have different retention periods. When information is no longer required, we take reasonable steps to delete it or de-identify it.

Access And Correction

You can ask to access or correct personal information we hold about you. We may need to verify your identity and, in limited circumstances, the law may allow or require us to refuse part of a request. If that happens, we will explain why where permitted.

Questions And Complaints

Contact the Drift Health Privacy Officer using our contact form or phone number if you have a privacy question, want to make a request, or believe we have not handled information appropriately. We will acknowledge and investigate complaints and explain our response.

If you are not satisfied with our response, you may be able to contact the Office of the Australian Information Commissioner or another relevant health or NDIS complaints body.

Changes To This Policy

We may update this policy as our services, providers or legal obligations change. The latest version will be published on this page with its effective date.