1. Purpose

Bloom Health Clinic ("Bloom Health Clinic", "Bloom", "we", "us" or "our") is committed to protecting the privacy, confidentiality and security of personal information.

Bloom Health Clinic provides psychological and allied health services and handles personal information, including sensitive health information, in connection with those services.

This Privacy Policy explains how Bloom Health Clinic collects, holds, uses and discloses personal information and how individuals may access or seek correction of their personal information or make a privacy complaint.

Bloom Health Clinic handles personal information in accordance with the Privacy Act 1988 (Cth), including the Australian Privacy Principles (APPs), and other privacy, health-record and professional obligations applicable to our services.

This Privacy Policy should be read together with Bloom Health Clinic's Client Information and Consent Form and other applicable clinic policies.

This Privacy Policy explains our usual information-handling practices. It does not, by itself, constitute consent to every collection, use or disclosure described in this Policy.

Where consent is required for a particular collection, use or disclosure, Bloom Health Clinic will seek appropriate consent.

2. What is Personal Information?

Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable.

Sensitive information is a category of personal information that receives additional protection under Australian privacy law.

Health information is sensitive information.

Because Bloom Health Clinic provides health services, much of the information we collect about clients is sensitive health information.

3. What Information We Collect

The personal information Bloom Health Clinic collects depends on the individual, the services being provided and the circumstances.

We may collect the following types of information.

Identity and Contact Information

This may include:

• name;

• date of birth;

• address;

• telephone number;

• email address;

• gender and pronouns where relevant;

• emergency contact information;

• parent, guardian or carer information;

• relationship information relevant to the provision of services; and

• other information reasonably necessary to identify or communicate with a client.

Health and Clinical Information

This may include:

• presenting concerns;

• medical and health history;

• mental health information;

• developmental history;

• psychological history;

• medications;

• diagnoses;

• assessment information and results;

• treatment history;

• clinical observations;

• clinical formulations;

• treatment plans;

• progress notes;

• correspondence;

• referrals;

• reports;

• questionnaires and assessment responses;

• information provided during consultations;

• information concerning risk or safety;

• information concerning family, relationships, education, employment or social circumstances where clinically relevant;

• disability, neurodevelopmental or accessibility information;

• cultural or language information where relevant to care; and

• other information reasonably necessary to provide psychological or allied health services.

Administrative and Financial Information

This may include:

• appointment information;

• billing and payment information;

• Medicare, private health insurance or other funding information where applicable;

• relevant government-related identifiers where permitted by law;

• referral information;

• correspondence with Bloom Health Clinic; and

• information required to administer services.

Information Concerning Children and Young People

Where the client is under 18, we may also collect information concerning:

• parents, guardians and carers;

• consent arrangements;

• parental responsibility and decision-making arrangements;

• parenting arrangements;

• relevant court, parenting, guardianship, family violence or protection orders;

• information relevant to a young person's capacity to provide informed consent;

• relevant school or educational information; and

• information necessary to establish appropriate confidentiality, communication and information-sharing arrangements.

AI-Assisted Information

Where an approved AI-assisted tool is used, information processed may include:

• audio processed for transcription;

• transcripts;

• dictated information;

• clinical information supplied to an approved AI-assisted tool;

• draft clinical notes;

• summaries;

• draft reports or other documents; and

• other outputs generated to assist a practitioner with an approved clinical or administrative task.

The information processed will depend on the particular approved tool and purpose.

Bloom Health Clinic seeks to limit the collection of personal information to information reasonably necessary for its functions and activities and applicable clinical purposes.

4. How We Collect Personal Information

Where reasonably practicable, Bloom Health Clinic collects personal information directly from the individual to whom the information relates or, where appropriate, from an authorised parent, guardian, carer or other decision-maker.

Information may be collected when a person:

• contacts Bloom Health Clinic;

• completes an enquiry or intake form;

• makes an appointment;

• participates in an assessment, consultation or treatment session;

• completes a questionnaire or assessment;

• communicates with a practitioner or Bloom Health Clinic team member;

• provides documents or records;

• uses our website or online services; or

• otherwise provides information in connection with our services.

We may also collect personal information from other people or organisations where permitted, including:

• parents, guardians or carers;

• referring practitioners;

• general practitioners;

• paediatricians;

• psychiatrists;

• psychologists and other allied health practitioners;

• schools or educational providers;

• hospitals and health services;

• insurers or funding bodies;

• government agencies;

• legal representatives;

• other health professionals; and

• other persons or organisations involved in the client's care.

Where required, appropriate consent or other authority will be established before collecting information from another person or organisation.

5. Unsolicited Personal Information

Bloom Health Clinic may occasionally receive personal information that we did not request.

Where we receive unsolicited personal information, we will consider whether we could have lawfully collected that information under applicable privacy requirements.

Where we could not have collected the information and are not otherwise legally required or authorised to retain it, we will take reasonable steps to destroy or de-identify it where lawful and practicable.

6. Why We Collect, Hold, Use and Disclose Personal Information

Bloom Health Clinic may collect, hold, use or disclose personal information for purposes connected with providing and administering health services, including:

• assessing a client's needs;

• providing psychological and allied health assessment and treatment;

• clinical formulation and treatment planning;

• communicating with clients, parents, carers and authorised persons;

• coordinating care with other health professionals;

• providing referrals and recommendations;

• maintaining clinical records;

• scheduling and administering appointments;

• billing and processing payments;

• processing Medicare, insurance or other funding claims where applicable;

• managing enquiries;

• quality assurance and clinical governance;

• professional supervision, peer consultation and internal clinical review;

• managing complaints;

• managing clinical and safety risks;

• complying with professional obligations;

• complying with legal and regulatory requirements;

• responding to lawful requests for information;

• maintaining information security;

• investigating privacy or security incidents; and

• operating and administering Bloom Health Clinic.

Bloom Health Clinic will not use or disclose personal information for an unrelated purpose unless appropriate consent has been provided or the use or disclosure is otherwise permitted or required by law.

7. Sensitive and Health Information

Bloom Health Clinic recognises that health information is sensitive information and requires a high level of protection.

We collect sensitive information where the collection is reasonably necessary for our functions or activities and where appropriate consent or another applicable legal basis permits the collection.

Health information will be used and disclosed for purposes connected with the provision and administration of services or as otherwise permitted or required by law.

Bloom Health Clinic seeks to collect only the information reasonably necessary for the relevant purpose.

8. Children and Young People

Bloom Health Clinic provides services to children and young people.

We may collect personal and sensitive information directly from a child or young person, from a parent, guardian or authorised decision-maker, and from other relevant persons or organisations where permitted.

The appropriate consent and confidentiality arrangements depend on the individual circumstances.

A practitioner will consider a child's or young person's:

• age;

• maturity;

• developmental capacity;

• understanding of the proposed service; and

• ability to understand and make the relevant decision.

A young person's ability to provide informed consent is not determined solely by age.

Where a young person has sufficient maturity and understanding to provide informed consent to some or all aspects of their own care, their consent and confidentiality will be managed accordingly.

Where the child or young person does not have sufficient capacity to provide informed consent, consent will ordinarily be obtained from an appropriate parent, guardian or other authorised decision-maker.

A parent's involvement in a child's care does not automatically mean that the parent is entitled to all information disclosed by the child or young person during therapy or to the complete clinical record.

Information sharing will be considered having regard to factors including:

• the child's or young person's age, maturity and capacity;

• applicable consent;

• confidentiality;

• the authority of the person requesting the information;

• parental responsibility and decision-making arrangements;

• relevant court or other legal orders;

• the nature and purpose of the information;

• safety considerations;

• the potential effect of disclosure on the therapeutic relationship;

• applicable privacy requirements; and

• the practitioner's professional and legal obligations.

Where appropriate, practitioners may provide parents or carers with general information about treatment progress, recommendations or strategies for supporting the child without unnecessarily disclosing confidential therapeutic discussions.

Further information is available in Bloom Health Clinic's Consent and Confidentiality for Parents of a Young Person Under 18 Years Policy and Separated Parents and Parenting Arrangements Policy.

9. Separated Parents and Parenting Arrangements

Where a child's parents are separated, Bloom Health Clinic does not assume that consent, parental responsibility, decision-making or information-sharing arrangements are the same for every family.

Bloom Health Clinic may request information concerning:

• parental responsibility;

• decision-making arrangements;

• parenting orders;

• parenting plans;

• guardianship arrangements;

• family violence or protection orders; and

• other circumstances relevant to consent, confidentiality, communication or safety.

Being a parent, arranging treatment, paying for treatment or being recorded as the nominated administrative contact does not, by itself, determine entitlement to receive all confidential clinical information or the child's complete clinical record.

Requests for information will be considered according to the individual circumstances and applicable privacy, legal and professional obligations.

Further information is available in Bloom Health Clinic's Separated Parents and Parenting Arrangements Policy.

10. Professional Supervision, Peer Consultation and Clinical Governance

Bloom Health Clinic practitioners may participate in professional supervision, peer consultation, case discussion, quality assurance and internal clinical review as part of maintaining safe and appropriate professional practice.

Where client information is used for these purposes, only information reasonably necessary for the relevant purpose will be shared.

Identifying information will be limited or removed where reasonably practicable.

Persons participating in professional supervision, consultation or clinical review are expected to maintain appropriate confidentiality and comply with applicable professional and privacy obligations.

Access to client information within Bloom Health Clinic is restricted according to role and legitimate clinical, administrative, privacy, governance or legal requirements.

11. Artificial Intelligence and AI-Assisted Tools

Bloom Health Clinic practitioners may use approved artificial intelligence (AI) assisted tools for specified clinical or administrative purposes.

Approved uses may include:

• transcription;

• preparation of draft clinical notes;

• summarisation;

• preparation or refinement of draft reports or other documents; and

• other approved documentation or administrative functions.

Bloom Health Clinic assesses AI-assisted tools before approving their use with client information.

Depending on the tool and proposed use, we consider matters including:

• the types of information processed;

• the purpose for which information is processed;

• where information is stored or processed;

• retention and deletion arrangements;

• security protections;

• access by the provider and subprocessors;

• overseas processing;

• whether information may be used to train or develop AI models;

• contractual protections;

• accuracy limitations; and

• appropriate human oversight.

Bloom Health Clinic does not approve identifiable client information being entered into publicly available, personal or otherwise unapproved AI tools.

Bloom Health Clinic does not approve identifiable client information being used to train general-purpose AI models.

Where informed consent is required for an AI-assisted use of client information, appropriate consent will be obtained.

Where an approved AI-assisted tool records or transcribes a consultation or session, appropriate informed consent will be obtained before recording or transcription commences.

Clients may decline an optional AI-assisted use involving their personal or health information. Where an AI-assisted documentation method is declined, an appropriate alternative method will be used.

AI-generated transcripts, summaries and other material may contain errors or omissions. Practitioners remain responsible for appropriate human review of AI-generated information before relying on it for clinical purposes or incorporating it into the clinical record.

Approved AI tools may be accessed through Bloom Health Clinic accounts or through individually held professional practitioner accounts that have been approved for use with Bloom Health Clinic clients.

Practitioner-held accounts remain subject to Bloom Health Clinic's privacy, consent, security, record-management and AI governance requirements.

Further information, including information about approved AI-assisted tools, is available in Bloom Health Clinic's Artificial Intelligence (AI) Policy.

12. Service Providers and Other Third Parties

Bloom Health Clinic uses third-party service providers to assist with the operation and delivery of our services.

Depending on our systems and the services being provided, these may include providers of:

• practice-management systems;

• appointment scheduling;

• telehealth;

• secure communications;

• electronic forms;

• payment processing;

• accounting;

• website hosting;

• cloud storage;

• information technology and security;

• AI-assisted clinical documentation;

• assessment or clinical software; and

• other professional or administrative services.

Providers used by Bloom Health Clinic may include Zanda, approved Zanda/BizzyAI functionality, Heidi Health, NovoNote, Everbility, Stripe and Squarespace, together with other approved providers used from time to time.

Third-party providers may process personal information where reasonably necessary to provide their services to Bloom Health Clinic.

Bloom Health Clinic takes reasonable steps appropriate to the circumstances when selecting and using providers that handle personal information.

Depending on the provider and service, this may include considering:

• privacy and security arrangements;

• data location;

• access controls;

• subprocessors;

• retention and deletion;

• breach notification arrangements;

• contractual protections; and

• whether client information may be used for AI model training or unrelated secondary purposes.

Use of a third-party provider does not remove Bloom Health Clinic's obligation to manage personal information in accordance with applicable privacy requirements.

13. Overseas Disclosure and Processing

Bloom Health Clinic uses technology and service providers that may store, access or process personal information in Australia and, in some circumstances, overseas.

Depending on the provider, service, functionality and configuration used, personal information may be processed overseas or disclosed to overseas recipients.

Our current technology arrangements may include the following.

Zanda and BizzyAI

Information associated with Australian Zanda accounts is ordinarily hosted and backed up in Australia based on Zanda's current published information.

In limited circumstances, authorised access may occur from the United Kingdom or United States, including in connection with support arrangements.

Some optional integrations and AI-assisted functionality may also involve overseas processing.

Certain approved BizzyAI or Zanda AI functions may involve processing using infrastructure located in the United States, depending on the functionality used.

Heidi Health

Information associated with Australian Heidi Health users is ordinarily hosted within the applicable Australian data region based on Heidi Health's current published information.

Some functions, service providers or subprocessors may involve international processing or access depending on the functionality used.

Bloom Health Clinic therefore does not represent that every aspect of Heidi Health processing necessarily occurs only within Australia.

NovoNote

Current provider information indicates that clinical session notes and transcripts for Australian users are stored using Australian infrastructure.

Audio used for transcription may be processed transiently in connection with providing the transcription service.

Some non-patient account, operational or service information may be processed in other jurisdictions depending on NovoNote's service arrangements.

Everbility

Bloom Health Clinic may use Everbility for approved clinical documentation functions.

Everbility's infrastructure, model providers and subprocessors may change over time. Bloom Health Clinic reviews available provider privacy, security and data-processing information as part of approving and reviewing the service.

Where country-specific processing information cannot reasonably be confirmed from current provider documentation, Bloom Health Clinic does not represent that processing is limited to Australia.

Stripe

Bloom Health Clinic may use Stripe for payment processing.

Payment, transaction and related information may be processed by Stripe, its related entities, service providers and financial partners in Australia and overseas, including the United States and other jurisdictions involved in providing payment and financial services.

Bloom Health Clinic does not ordinarily require Stripe to receive detailed clinical session information in order to process a payment.

Squarespace and Website Services

Bloom Health Clinic may use Squarespace and associated website services.

Website, enquiry, usage and technical information may be processed outside Australia, including in the United States, depending on the services and functionality used.

Clients should avoid including unnecessary sensitive clinical information in general website enquiry forms.

Other Providers

Other approved technology, communication, security, assessment, accounting or professional service providers may use infrastructure, personnel or subprocessors outside Australia.

Countries and processing arrangements may change as providers change their infrastructure, subprocessors or services.

Bloom Health Clinic periodically reviews material providers that handle sensitive or health information.

Before approving or continuing to use a service that handles health or other sensitive information, Bloom Health Clinic considers, where relevant:

• the nature and sensitivity of the information;

• the purpose of processing;

• where information is stored and processed;

• likely overseas recipients;

• provider and subprocessor access;

• contractual and privacy protections;

• security controls;

• retention and deletion arrangements;

• breach notification arrangements;

• whether information may be used for AI training or product development; and

• applicable Australian privacy obligations.

Where Bloom Health Clinic discloses personal information to an overseas recipient and APP 8 applies, Bloom Health Clinic will take such steps as are reasonable in the circumstances to comply with its obligations under the Australian Privacy Principles, unless an applicable exception applies.

Where practicable, Bloom Health Clinic will provide additional information about relevant overseas recipients or countries through this Policy, an applicable collection notice or on request.

14. When We May Disclose Personal Information

Bloom Health Clinic may disclose personal information where appropriate and permitted, including in the following circumstances.

Treatment and Continuity of Care

With appropriate consent or other lawful authority, information may be disclosed to:

• general practitioners;

• paediatricians;

• psychiatrists;

• psychologists;

• allied health practitioners;

• hospitals;

• schools or educational providers where appropriate;

• support services; and

• other persons or organisations involved in the client's care.

Where Required or Authorised by Law

Information may be disclosed where required or authorised by law, including in response to:

• applicable mandatory reporting obligations;

• lawful subpoenas;

• court orders;

• warrants;

• statutory requirements; or

• other lawful processes.

Where records or information are sought by subpoena, court order or another formal legal process, Bloom Health Clinic will respond in accordance with applicable legal and professional obligations and may obtain legal advice where appropriate.

Safety

Information may be used or disclosed where permitted by law in circumstances involving serious threats to the life, health or safety of an individual or to public health or safety.

With Consent

Information may be disclosed to another person or organisation where appropriate consent has been provided.

Service Providers

Information may be disclosed or made accessible to approved service providers where reasonably necessary for them to provide services to Bloom Health Clinic and where the disclosure or access is permitted under applicable privacy requirements.

Bloom Health Clinic seeks to limit disclosures to information reasonably necessary for the relevant purpose.

15. Anonymity and Pseudonymity

Where practicable, individuals may have the option of interacting with Bloom Health Clinic anonymously or using a pseudonym.

However, because Bloom Health Clinic provides healthcare services, it will often be impracticable to provide clinical services without obtaining information that identifies the client.

Identification may also be required because of clinical, safety, billing, funding, professional, record-keeping or legal requirements.

Bloom Health Clinic will advise where identification is necessary.

16. How We Hold and Protect Personal Information

Bloom Health Clinic may hold personal information electronically and, where applicable, in physical form.

We take reasonable steps to protect personal information from:

• misuse;

• interference;

• loss;

• unauthorised access;

• unauthorised modification; and

• unauthorised disclosure.

Security measures may include:

• role-based access controls;

• password protection;

• multi-factor authentication where available and appropriate;

• encryption and secure communications;

• secure practice-management systems;

• device and account security;

• restricted access to clinical information;

• practitioner and team-member privacy obligations;

• secure destruction procedures;

• incident-response procedures; and

• review of relevant third-party service providers.

No electronic system can be guaranteed to be completely secure.

Bloom Health Clinic reviews its privacy and information-security practices periodically and when material changes to systems or risks occur.

17. Clinical Records and Retention

Bloom Health Clinic maintains clinical and administrative records as required for the provision of healthcare and in accordance with applicable legal and professional record-keeping requirements.

Records may include:

• intake information;

• consent documentation;

• clinical notes;

• assessment information;

• correspondence;

• reports;

• referrals;

• treatment plans;

• relevant communications; and

• other information forming part of the clinical or administrative record.

Records will be retained for at least the period required by applicable legal and professional obligations.

Where information is no longer required to be retained, Bloom Health Clinic will take reasonable steps to destroy or de-identify it where required and lawful.

Temporary information generated or processed by approved AI-assisted tools, including transcripts where applicable, will be managed according to Bloom Health Clinic's approved arrangements for the relevant tool and applicable privacy and record-keeping requirements.

Temporary AI-generated or transcription material is not necessarily retained for the same period as the final clinical record.

The practitioner remains responsible for ensuring that information required to form part of the clinical record is appropriately recorded in Bloom Health Clinic's approved clinical record system.

18. Access to Personal Information

Individuals may request access to personal information Bloom Health Clinic holds about them.

Requests should ordinarily be made in writing so that Bloom Health Clinic can identify the information requested and verify the identity and authority of the person making the request.

Bloom Health Clinic will respond to access requests within the period required by applicable privacy law.

Where reasonable and practicable, access will generally be provided in the manner requested.

In some circumstances, Bloom Health Clinic may be permitted or required to refuse access to some or all of the requested information.

Where access is refused, Bloom Health Clinic will provide applicable reasons for refusal and available complaint mechanisms where required by law.

Bloom Health Clinic may charge reasonable costs associated with providing access where permitted by law. Any charge will not be excessive and no charge will be made merely for making an access request.

A request to access existing personal information is different from a request for a practitioner to prepare a new:

• report;

• summary;

• interpretation;

• opinion;

• letter; or

• other professional document.

Requests for new professional work may attract the practitioner's usual professional fees and may be declined where the requested work falls outside the practitioner's role, competence or Bloom Health Clinic's scope of service.

19. Access Requests Concerning Children and Young People

Requests by a parent, guardian or other person for access to a child or young person's information will be considered individually.

Bloom Health Clinic may consider:

• the child's or young person's age, maturity and capacity;

• their confidentiality;

• applicable consent;

• the identity and authority of the person making the request;

• parental responsibility and decision-making arrangements;

• relevant court or other orders;

• whether the information includes personal information about another person;

• safety considerations;

• the potential effect of disclosure;

• applicable privacy requirements; and

• applicable professional obligations.

A parent does not automatically receive the child's complete clinical record simply because they arranged, attended or paid for treatment.

Bloom Health Clinic may request documentation reasonably necessary to establish the requesting person's identity or authority before providing access.

Complex or disputed requests may require additional review before information is released.

20. Correction of Personal Information

Bloom Health Clinic takes reasonable steps to ensure that personal information it uses and discloses is accurate, up-to-date, complete and relevant, having regard to the purpose for which it is used or disclosed.

Individuals may request correction of personal information they believe is inaccurate, out-of-date, incomplete, irrelevant or misleading.

Bloom Health Clinic will consider correction requests in accordance with applicable privacy requirements.

Where appropriate, a correction may involve:

• correcting factual information;

• adding an explanatory statement;

• appropriately annotating the clinical record; or

• taking another reasonable step to address the concern.

Clinical records will not ordinarily be altered merely because an individual disagrees with a practitioner's appropriately documented professional observation or opinion.

Where Bloom Health Clinic declines to make a requested correction, we will provide applicable reasons and complaint information where required by law.

21. Accuracy of Information

Bloom Health Clinic takes reasonable steps to ensure that personal information collected, used or disclosed is accurate, up-to-date and complete and, in relation to use or disclosure, relevant for the relevant purpose.

Clients, parents, carers and other authorised persons are encouraged to inform Bloom Health Clinic if information we hold materially changes or appears to be inaccurate.

AI-assisted tools may generate inaccurate, incomplete or inappropriate content.

Practitioners remain responsible for reviewing AI-generated clinical documentation and taking reasonable steps to ensure information incorporated into the clinical record is appropriate and sufficiently accurate for its intended clinical use.

22. Data Breaches

A data breach may occur where personal information is lost or is subject to unauthorised access or disclosure.

If Bloom Health Clinic becomes aware of a suspected data breach, we will take appropriate steps to:

• contain the incident;

• assess what information may have been affected;

• assess potential risks to affected individuals;

• take appropriate remedial action;

• determine whether the incident is an eligible data breach under the Notifiable Data Breaches (NDB) scheme;

• notify affected individuals and the Office of the Australian Information Commissioner where required; and

• review the incident and take reasonable steps to reduce the likelihood of recurrence.

An eligible data breach may arise where there has been unauthorised access to or disclosure of personal information, or loss of personal information in relevant circumstances, and a reasonable person would conclude that the breach is likely to result in serious harm to one or more affected individuals, subject to applicable remedial-action and other provisions.

Bloom Health Clinic maintains procedures for responding to suspected privacy and information-security incidents.

Practitioners and team members must promptly report suspected privacy or security incidents through Bloom Health Clinic's applicable incident-management process.

23. Website, Cookies and Electronic Communications

When individuals use Bloom Health Clinic's website or electronic services, certain technical information may be collected automatically depending on the technology used.

This may include:

• IP address;

• browser or device information;

• website usage information; and

• cookies or similar technologies.

Bloom Health Clinic may use this information for purposes including:

• website functionality;

• security;

• analytics;

• service administration; and

• website improvement.

Where third-party website, analytics, booking or communication services are used, those providers may also process information in accordance with their applicable service and privacy arrangements.

Individuals should avoid sending unnecessary sensitive clinical information through ordinary email, general website contact forms or other unsecured communication channels.

Where Bloom Health Clinic requires sensitive information, an appropriate method for providing that information may be specified.

24. Direct Marketing

Bloom Health Clinic will not use sensitive health information for direct marketing except where permitted by law and appropriate consent has been obtained where required.

Where Bloom Health Clinic sends other permitted marketing communications, individuals may request not to receive those communications.

Clinical and administrative communications concerning appointments, treatment, billing, safety or the provision of services are not marketing communications merely because they are sent electronically.

25. Government-Related Identifiers

Bloom Health Clinic may collect or use government-related identifiers, such as Medicare information, where reasonably necessary for the provision, administration or funding of services and where permitted by law.

Bloom Health Clinic will not adopt a government-related identifier as its own identifier or use or disclose such identifiers except as permitted by applicable privacy requirements.

26. Privacy Complaints

If you have a concern about how Bloom Health Clinic has handled your personal information, you may contact Bloom Health Clinic.

We encourage privacy concerns to be raised with us so that we have an opportunity to investigate and respond.

A privacy complaint should provide sufficient information for us to understand:

• the nature of the concern;

• the personal information involved where relevant; and

• the outcome being sought.

Bloom Health Clinic will acknowledge and investigate privacy complaints and respond within a reasonable period.

Making a privacy complaint will not negatively affect a person's access to healthcare at Bloom Health Clinic.

If you are not satisfied with Bloom Health Clinic's response, you may have the right to raise your concern with an external regulator, including the Office of the Australian Information Commissioner (OAIC).

Depending on the nature of the complaint and the service provided, concerns regarding health services may also be raised with the Office of the Health Ombudsman Queensland or an applicable professional regulator.

Nothing in this Policy requires a person to make a complaint to Bloom Health Clinic before exercising any right they may have to approach an external complaint or regulatory body directly.

27. Contacting Bloom Health Clinic

Questions about privacy, requests for access or correction, privacy concerns and privacy complaints may be directed to:

Bloom Health Clinic

Email: admin@bloomhealthclinic.au

Website: www.bloomhealthclinic.au

Privacy-related correspondence may be marked for the attention of the Practice Manager.

Bloom Health Clinic may require reasonable verification of identity or authority before responding to a request involving personal or sensitive information.

28. Changes to This Privacy Policy

Bloom Health Clinic may update this Privacy Policy from time to time to reflect changes in:

• legislation or regulatory guidance;

• professional requirements;

• our services;

• technology;

• information-handling practices;

• approved service providers;

• overseas processing arrangements; or

• AI-assisted tools.

The current version will be published on Bloom Health Clinic's website and will display the date it was last updated.

Where a material change affects how personal or sensitive information is collected, used or disclosed, Bloom Health Clinic will take reasonable steps to provide additional notification where appropriate.

Where a new or materially different information-handling practice requires consent, Bloom Health Clinic will obtain appropriate consent rather than relying solely on publication of an updated Privacy Policy.

Publication of an updated Privacy Policy does not, by itself, expand an individual's existing consent to new or materially different uses or disclosures of their personal or health information.

29. Related Bloom Health Clinic Documents

This Privacy Policy should be read together with applicable Bloom Health Clinic documents, including:

• Client Information and Consent Form;

• Consent and Confidentiality for Parents of a Young Person Under 18 Years Policy;

• Separated Parents and Parenting Arrangements Policy;

• Artificial Intelligence (AI) Policy;

• applicable Telehealth provisions and procedures;

• Fees and Cancellation Policy; and

• other applicable clinical, records-management, privacy, security and governance procedures.

Where there is uncertainty about how a privacy, consent or confidentiality requirement applies to an individual client's circumstances, Bloom Health Clinic practitioners should seek appropriate internal guidance before acting.

30. Review

Bloom Health Clinic will review this Privacy Policy periodically and when there are material changes to:

• applicable privacy legislation;

• regulatory guidance;

• professional requirements;

• clinical services;

• information systems;

• approved AI tools;

• material service providers;

• overseas information-handling arrangements; or

• identified privacy or information-security risks.

Policy owner: Bloom Health Clinic
Last updated: August 2026