Last updated 5 November 2026

Privacy policy

SAY Health is the occupational therapy practice of Sangeetha (Sang) Varghese in Warrnambool, Victoria. This policy explains how we handle information about children, families and the professionals who refer to us, including through this website.

We handle personal and health information under the Privacy Act 1988 (Cth), including the Australian Privacy Principles, and the Health Records Act 2001 (Vic). A free copy of this policy in another form is available on request.

What we collect

From the booking form

  • Your child's name and date of birth
  • Who your child is and what makes them light up, beyond any diagnosis or label
  • Your name, phone number and email address
  • How you would like us to contact you and the best time to reach you
  • How you plan to pay, such as your NDIS plan type
  • The days and times that suit you for appointments
  • Anything you choose to tell us so your child's first visit feels comfortable, which may include health information

From the referral form

  • The referrer's name, role, phone number, email address and organisation
  • The child's name and date of birth
  • The parent or guardian's name, phone number and, if known, email address
  • Funding type and NDIS number, and any interpreter language
  • The reason for referral, any diagnoses, and other professionals involved
  • Any reports or NDIS plans that are uploaded

If your child becomes a client

We also keep the records needed to provide therapy. These include intake forms, consent forms, service agreements, session notes, reports, appointment details, invoices and payment records.

Details about a child's health, development or disability are health information, which the law treats as sensitive. We only collect it when it is needed to provide our services, and with consent unless the law says otherwise.

How we collect it

We usually collect information directly from parents and guardians, through our forms, by phone or email, or in person.

We also collect information from other people when a child is referred to us, such as a GP, another health professional, a school or an NDIS support coordinator. Referrers must confirm that the parent or guardian knows about the referral and agrees to the details being shared. When Sang contacts the family, she will tell them who sent the referral and what we received.

Why we collect it

  • To reply to enquiries and referrals, and to arrange appointments
  • To provide occupational therapy and keep clinical records
  • To work with other people involved in a child's care, with consent
  • To send invoices and manage NDIS or private payments
  • To meet our legal, registration and insurance duties

We do not use your information for advertising, and we do not sell it.

Staying anonymous

You can ask a general question by phone without giving your name. We need your real details to provide a service or make a booking.

Who we share it with

  • Splose, our practice management system. Our booking and referral forms are Splose forms, so your answers go straight to Splose and are stored there. They do not pass through or stay on this website.
  • The NDIS, plan managers and support coordinators, where needed to arrange or claim for services.
  • Other professionals, such as a child's GP, school or therapists, with your consent.
  • Our insurer, or professional or legal advisers, where needed.
  • Others where the law requires or allows it, such as to lessen a serious threat to someone's safety, for child protection, or under a court order.

How we store and protect it

Client records are stored electronically in Splose. Splose states that Australian customers' data is stored in Australia and encrypted. We limit who can access records and take reasonable steps to protect information from misuse, loss, and unauthorised access or changes.

Email is not a fully secure way to send information. Please use the forms or call us for anything sensitive. Email provider and where it stores messages, to confirm with Sang.

Whether Sang uses splose AI for notes, to confirm. If she does, say so here, and explain any decisions that software makes or helps to make.

This website, cookies and overseas services

This website does not use advertising or analytics tools, and it does not set its own cookies. Some pages use outside services, which may collect technical details such as your IP address and browser type:

  • Google Maps on the home page shows where we are. Google may set cookies when the map loads.
  • Google reCAPTCHA loads with our forms to help block spam. It may collect technical details about your device and how you use the page.
  • Cloudflare hosts this website and handles technical details so that pages can reach your device.

Google and Cloudflare operate worldwide, including in the United States, so these technical details may be handled overseas.

How long we keep it

Health records are kept for at least seven years after the last service. For a child, they are kept until the child turns 25, if that is later. After that, we securely destroy or de-identify them.

How long enquiries and referrals that don't go ahead are kept, to confirm with Sang.

Seeing or correcting your information

You can ask to see the information we hold, or ask us to correct it, by contacting Sang. A parent or guardian can usually do this for their child. We will reply within 30 days. If we can't give you access or make a correction, we will tell you why in writing.

If something goes wrong

If a data breach is likely to cause serious harm, we will tell the people affected and the Office of the Australian Information Commissioner, as the law requires.

Questions and complaints

If you have a question or a privacy concern, please contact Sang first. We will reply within 30 days.

If you are not happy with our reply, you can complain to:

Changes to this policy

We update this policy when the way we handle information changes. The date at the top shows the latest version.