Privacy Policy Gap Analysis for Motion Health Kids

Executive summary

This review assesses the provided draft Privacy Policy against the Privacy Act 1988 (Cth) and Australian Privacy Principles (APPs) (using the current consolidated text available on the Federal Register of Legislation dated 10 June 2025), plus key regulator guidance from the Office of the Australian Information Commissioner^[1] and state health-records guidance where relevant.^[2]

Overall, the draft is a solid “starter” privacy policy (it explains what you collect, why, and how people can contact you) but it is not yet complete against APP 1.4’s mandatory privacy-policy content and common “health clinic” expectations. The highest-risk gaps are:

Missing or weak items that should be treated as High priority:
– Overseas disclosures / cloud hosting locations: APP 1.4 requires stating whether you are likely to disclose overseas and (if practicable) which countries; the draft does not address this, and it also omits the APP 8 cross‑border safeguards framing.^[3]
– Data breach response + Notifiable Data Breaches (NDB) compliance: the draft has no breach response procedure, detection/triage pathway, or statement that eligible breaches will be assessed and notified under Part IIIC.^[4]
– Security controls described only at a high level: “reasonable steps” is stated, but there’s no concise, patient-facing description of key controls (MFA, role-based access, logging, encryption, backups, secure disposal). APP 11 requires reasonable steps and (since 2024 reforms) explicitly contemplates technical and organisational measures.^[5]
– Direct marketing / communications preferences: the draft doesn’t address APP 7 direct marketing rules or Spam Act unsubscribe expectations for promotional messages (and doesn’t clearly separate “care communications” from “marketing”).^[6]

Items that are partly covered but need strengthening:
– Children’s consent/capacity + parent/guardian access: the draft doesn’t explain how you handle consent where a child may have capacity, or how parent/guardian access requests are assessed (important for paediatric practice).^[7]
– Retention and destruction: the draft mentions “until 25” for paediatric records, which aligns with explicit minimum retention rules in some states (e.g., NSW; and also reflected in Victorian guidance for health service providers), but it omits adult retention, destruction/de‑identification triggers, and record-of-destruction practices.^[8]
– NDIS-specific handling: the draft references NDIS generally but does not set out the practical “who we share with” and “why” that many NDIS participants expect; NDIS Practice Standards also emphasize that participants understand and agree to what info is collected and why (including recordings).^[9]

Scope and methodology

This report evaluates the text of the draft privacy policy you provided (as written) against:
 Privacy Act 1988 (Cth), Schedule 1 — APP 1–13, focusing on APP 1.4 mandatory privacy-policy contents, APP 3/5 collection and notices, APP 6–8 use/disclosure and cross-border, APP 11 security and destruction, and APP 12–13 access/correction.^[10]
 Key OAIC guidance for health service providers, privacy-by-design, PIAs, security, direct marketing, and tracking technologies.^[11]
 State health records regimes where they commonly apply to private allied health providers (examples used where sources clearly set minimum retention expectations).^[12]
 NDIS expectations via the NDIS Quality and Safeguards Commission^[13] practice standards (relevant if you are an NDIS provider, including unregistered providers aligning to expectations).^[14]

This is a compliance-oriented analysis (not legal advice). Because the clinic’s state/territory is unspecified, this report flags where state-based obligations may vary and recommends language that truthfully covers multi-jurisdiction operations while still meeting APP requirements.^[15]

Findings by attribute

For each attribute below: (a) coverage status in the draft, (b) gaps/weaknesses (with exact wording examples from the draft), and (c) recommended text additions/edits (suggested clauses you can paste).

Types of personal and sensitive information listed

(a) Coverage: Partially covered. The draft lists basic identity/contact details, health information, payment info, and website data. This aligns with APP 1.4(a) at a high level (privacy policy must describe kinds of personal information collected/held).^[16]

(b) Gaps / weaknesses (with draft examples):
– The draft says you collect “Health Information (Sensitive Information): Medical history, assessments, therapy notes…” but it does not explicitly list common paediatric allied-health data types such as: school/kindergarten reports, behavioural observations, developmental screening results, audio/video recordings (telehealth or assessment), photos, incident reports, family law/custody orders, consent authorities, referral letters, medication lists, and NDIS plan information/participant identifiers.
– The “Website and Online Information” section mentions cookies and IP addresses, but doesn’t mention analytics identifiers or tracking technologies that may be “reasonably identifiable” when combined with other data. (OAIC has specific guidance for tracking pixels.)^[17]

(c) Recommended clause (replace/expand the “What Information We Collect” section):
In addition to the information listed above, we may collect and hold:
• Referral and care coordination information (e.g., referral letters, reports from other clinicians, school/kindergarten reports, care plans, discharge summaries).
• NDIS-related information (where applicable), including plan management details, service bookings, support coordinator contact details, and documentation required for claims, audits, or quality assurance.
• Medicare and other government-related identifiers (only where necessary for billing/claims or identity verification), noting we do not adopt these identifiers as our own patient identifier unless authorised by law.
• Images, audio or video recordings (e.g., for clinical assessment, progress tracking, telehealth, or with separate consent where required).
• Communications and interaction records (e.g., emails, SMS reminders, phone call notes, feedback/complaints, and appointment history).
• Information about parents/guardians/carers where relevant to a child’s care (e.g., contact details and authority to consent), including any court orders or arrangements you provide to guide access and consent.
• Online identifiers and usage data where you use our website or online forms (e.g., device/browser information, log data, and cookie identifiers).
Why this matters: APP 1.4(a) expects the privacy policy to clearly describe what you collect, and health information is “sensitive information,” so transparency supports lawful consent-based collection.^[18]

Lawful collection and consent mechanisms

(a) Coverage: Partially covered. The draft says: “We only collect information that is necessary…” and implies consent via intake/registration forms. That aligns conceptually with APP 3’s “reasonably necessary” standard and the requirement that sensitive information generally requires consent.^[19]

(b) Gaps / weaknesses (with draft examples):
– The draft does not clearly distinguish express vs implied consent, nor how consent is recorded, withdrawn, or refreshed for new secondary uses (e.g., photos, recordings, marketing). Under APP 3, sensitive information (health info) generally requires consent unless an exception applies.^[19]
– The draft does not address child capacity and who can consent in a paediatric context. OAIC guidance emphasises capacity is assessed case-by-case; if not practical, you may generally assume capacity over 15 unless unsure.^[20]

(c) Recommended clause (add a “Consent” subsection):
Consent
We generally collect and use health information (which is sensitive information) with consent. Consent may be:
• implied (for example, when you provide information during an appointment so we can provide care), or
• express (for example, when you sign or electronically accept a consent/authority form).
Where we seek express consent, we will explain what you are agreeing to and any material risks (for example, where information may be shared with another provider or where a telehealth platform is used).
You can withdraw consent at any time by contacting us. Withdrawal will not affect care already provided or actions already taken, but it may affect our ability to provide ongoing services.
Children and young people
We assess a child or young person’s ability to consent on a case-by-case basis. If a child has capacity to make their own privacy decision, we will generally seek their consent directly and may limit parent/guardian access in accordance with applicable law and clinical safety.
This is grounded in: APP 3 sensitive information consent requirements and OAIC children/young people guidance.^[21]

Direct and indirect collection

(a) Coverage: Mostly covered for direct collection; partially for indirect. The draft states you collect information directly, and also from third parties like referrals. APP 3 also expects collection from the individual unless unreasonable/impracticable.^[19]

(b) Gaps / weaknesses (with draft examples):
– The draft says you may collect from “referrals from GPs, specialists, schools, or other allied health providers,” but it does not link this to notification obligations (APP 5.2(b): if collected from someone else, the individual must be told the fact/circumstances of that collection).^[22]
– It doesn’t address uncommon but important situations: information provided by a separated parent, NDIS support coordinator, or reports from schools where the child/young person may not understand what has been provided.

(c) Recommended clause (add a “If we collect from someone else” sentence):
If we collect personal information from someone other than you (for example, a referrer, school, or another provider), we will take reasonable steps to ensure you are aware of the circumstances of that collection, unless it would be unreasonable or impracticable.
This aligns with APP 5.2(b).^[22]

Use and disclosure purposes

(a) Coverage: Partially covered. The draft outlines broad purposes (“provide services,” “billing,” “improve services”) and has a disclosure list (referrers, funding bodies, IT providers, legal requirement). This is directionally consistent with APP 1.4(c) and APP 6’s primary/secondary purpose rules.^[23]

(b) Gaps / weaknesses (with draft examples):
– The draft says “We may disclose information… to other healthcare providers with your consent,” but it does not fully describe care-team disclosures that are often directly related to treatment (e.g., sharing progress reports with the referrer) and when these are based on consent vs reasonable expectation/primary purpose.^[24]
– It states “when required by law” but does not provide examples relevant to health practice (e.g., serious threat disclosures, enforcement bodies), which helps set patient expectations. OAIC health privacy guidance discusses “serious threat” situations.^[25]

(c) Recommended clause (tighten “How We Use Your Information” and “Disclosure”):
We use and disclose personal information to:
• provide and manage health services (assessment, treatment, care coordination, and follow-up)
• communicate with you about appointments, care, and administrative matters
• obtain payment and manage billing (including Medicare/NDIS/private billing where applicable)
• liaise with other providers involved in care (e.g., referrers and treating team members) where you consent or where permitted by law
• support clinical quality and business operations (e.g., accreditation, audits, training, and improving services) using de-identified information where practicable
• comply with legal obligations and manage safety risks (for example, where disclosure is necessary to lessen or prevent a serious threat to life, health, or safety, where permitted).

Third-party processors and cross-border transfers

(a) Coverage: Not adequately covered. The draft mentions “IT service providers” but does not meet the APP 1.4(f)–(g) requirement to address overseas disclosures (whether likely; and countries if practicable).^[26]

(b) Gaps / weaknesses (with draft examples):
– Draft example: “We use secure cloud-based practice management systems and IT service providers…” but it does not say whether those vendors store/process data overseas.
– It does not reflect APP 8’s “reasonable steps” requirement before disclosing personal info to an overseas recipient.^[27]

(c) Recommended clause (add a “Service providers and overseas disclosures” section):
Service providers (processors)
We use third-party service providers to help us operate our clinic. This may include practice management software, clinical record systems, secure messaging, telehealth/video platforms, online forms, email/SMS providers, payment processors, accountants, and IT support.
We only provide these providers with access to personal information where necessary for them to perform services for us, and we require appropriate confidentiality and security protections.
Overseas disclosures
Some of our service providers (or their subcontractors) may store or process personal information outside Australia. Where we are likely to disclose personal information to overseas recipients, we will take reasonable steps to ensure the overseas recipient does not breach the Australian Privacy Principles in relation to that information.
[If practicable: list countries/regions here or link to a maintained list.]
This is driven by APP 1.4(f)–(g) and APP 8.1.^[3]

Data security measures (encryption, access controls, backups)

(a) Coverage: Partially covered. The draft says you take reasonable steps and use “administrative, physical and technical safeguards.” That aligns with APP 11.1 at a high level.^[28]

(b) Gaps / weaknesses (with draft examples):
– Draft example: “restricted access” and “secure systems” are not specific enough to reassure patients or demonstrate a mature security posture in a health context.
– APP 11.3 clarifies that steps include “technical and organisational measures,” and OAIC security guidance expects controls proportionate to risk.^[5]

(c) Recommended clause (add a concise “How we protect information” list):
Security safeguards (summary)
We use a combination of technical and organisational measures appropriate to the sensitivity of health information, such as:
• role-based access controls and least-privilege access
• strong authentication (including multi-factor authentication where available)
• encryption in transit (e.g., TLS) and encryption at rest where supported by our systems
• audit logs and monitoring of access to clinical systems
• secure backups and tested recovery procedures
• secure disposal processes for paper and electronic records
• staff confidentiality obligations and privacy/security training.
Grounding: APP 11.1–11.3 and OAIC security guidance.^[5]

Breach detection, notification and response procedures

(a) Coverage: Missing. There is no data breach procedure or NDB statement.

(b) Gaps / weaknesses (with draft examples):
– There is no section describing how you detect, contain, assess, and notify a breach, despite Privacy Act Part IIIC (NDB scheme) applying to APP entities.^[29]

(c) Recommended clause (add a “Data breaches” section and adopt a breach response plan):
Data breaches
If we suspect personal information has been lost, accessed, or disclosed without authorisation, we will take steps to contain and investigate the incident.
Where required under the Privacy Act’s Notifiable Data Breaches (NDB) scheme, we will notify the Office of the Australian Information Commissioner (OAIC) and affected individuals (or those at risk) as soon as practicable.
Relevant sources: Part IIIC exists in the Act; OAIC guidance expects entities to prepare and follow a breach response process/plan.^[4]

A practical breach-response flow (recommended to align your internal procedure to this structure):
flowchart TD
A[Potential incident detected] –> B[Contain: stop access, isolate systems, preserve evidence]
B –> C[Initial triage: what data? whose data? scope?]
C –> D[Risk assessment: likelihood of serious harm]
D –>|Eligible data breach likely| E[Notify OAIC + affected individuals ASAP]
D –>|Not eligible / low risk| F[Document decision + remediate]
E –> G[Provide support to affected people + remediation steps]
F –> G
G –> H[Post-incident review: root cause, control improvements, staff training]

Data retention and deletion policies (including “until 25”)

(a) Coverage: Partially covered. The draft says: “For pediatric clients, records are generally kept until the child turns 25 years old…”

(b) Gaps / weaknesses (with draft examples):
– It does not state adult retention periods, nor how destruction/de-identification decisions are made under APP 11.2 (“no longer needed” and not required by law).^[30]
– It does not mention keeping a record of destruction/transfer where required by state regimes (important if operating in those jurisdictions). NSW law, for example, prescribes minimum retention: 7 years for adults and until age 25 for information collected while under 18, and also requires a record when health information is deleted/disposed or transferred.^[31]
– Victorian provider-facing guidance similarly reflects retaining at least seven years since last service, or if last treated under 18, until they reach 25.^[32]

(c) Recommended clause (replace the retention section with a schedule-based statement):
Retention and disposal
We retain health records and related personal information in accordance with the Privacy Act and any applicable State/Territory health records laws and professional obligations.
As a general guide, we retain:
• adult clinical records for at least 7 years after the last date of service, and
• records for clients last treated while under 18 until at least the client turns 25,
unless a longer period is required or appropriate (e.g., for legal, safety, complaint handling, or funding requirements).
When we no longer need personal information (and we are not required by law to retain it), we take reasonable steps to securely destroy it or permanently de-identify it.
Grounding: APP 11.2 destruction/de-identification rule; NSW retention rules and Victorian retention guidance for providers.^[33]

Access and correction procedures and timeframes

(a) Coverage: Partially covered. The draft provides a process and contact channel.

(b) Gaps / weaknesses (with draft examples):
– Draft example: “We will respond… within a reasonable timeframe” but it does not state a timeframe target. OAIC guidance indicates 30 days is generally a reasonable period for organisations to respond to access requests, and also that correction should generally not exceed 30 days.^[34]
– If operating under NSW health privacy law, private sector providers must respond to an access request within 45 days and may require evidence of identity/authority.^[31]
– The draft doesn’t address parent/guardian requests for a child’s records where the child has capacity; OAIC health privacy guidance explains this must be considered case-by-case.^[35]

(c) Recommended clause (make timeframes explicit and add child-access handling):
Access and correction
We respond to requests for access and correction as soon as practicable. As a general guide, we aim to respond within 30 days (and within any shorter or longer period required under applicable State or Territory law).
We may ask for proof of identity and, where relevant, proof of authority to act for a child (including any relevant court orders or guardianship documentation).
Where a request relates to a child or young person, we will consider whether the child has capacity to make the request and whether access by a parent/guardian is appropriate in the circumstances.
Grounding: OAIC access/correction guidance; OAIC child capacity/access guidance; NSW access response timeframe.^[36]

Privacy impact assessments (PIAs)

(a) Coverage: Missing.

(b) Gap: No commitment to conducting PIAs for new systems (e.g., new online forms, new telehealth platform, new practice management software). OAIC recommends PIAs as part of risk management and planning and provides a PIA guide/tool.^[37]

(c) Recommended clause:
Privacy risk management
When we introduce new systems or change how we handle personal information (for example, new online forms, software, or telehealth platforms), we assess privacy risks and may undertake a Privacy Impact Assessment (PIA) where appropriate.
^[37]

Staff training and confidentiality obligations

(a) Coverage: Mostly missing. The draft references safeguards but not staff obligations.

(b) Gap: APP 1.2 requires reasonable steps to implement practices, procedures, and systems to ensure compliance and handle inquiries/complaints—this is the legal “hook” for training, access governance, and confidentiality systems.^[38]
If you provide NDIS supports, the NDIS Practice Standards also expect participants to be advised of confidentiality policies in an accessible way and to understand/agree to what personal information will be collected and why (including recordings).^[9]

(c) Recommended clause:
Our people
All staff and contractors are required to keep personal information confidential and only access information needed to perform their role. We provide privacy and security training and investigate inappropriate access or disclosure.
Grounding: APP 1.2 (practices/systems) and NDIS standards expectations (where relevant).^[39]

Privacy by design and default

(a) Coverage: Missing.

(b) Gap: The draft does not state that privacy protections are built into processes and systems. OAIC guidance under APP 1 encourages embedding privacy protections into design (“privacy by design”).^[40]

(c) Recommended clause:
Privacy by design
We aim to embed privacy and security protections into how we design and operate our systems and workflows, including collecting only what we need and limiting access on a need-to-know basis.
^[40]

Cookies and online tracking

(a) Coverage: Partially covered. The draft mentions cookies and IP addresses.

(b) Gap: It does not address:
– whether third-party analytics/advertising tools are used (and if so, what they collect and disclose),
– how users can opt out, and
– tracking pixels (OAIC has specific expectations, including direct marketing opt-out where used for targeted ads).^[17]

(c) Recommended clause (replace the website section):
Website analytics and cookies
We may use cookies and similar technologies to operate our website and understand how it is used (for example, analytics). These tools may collect online identifiers, device information, and usage data.
Where we use third-party analytics or tracking tools, those providers may also collect information according to their own privacy practices. You can manage cookies through your browser settings and, where available, through any cookie preference tools on our website.
^[17]

Marketing and communications opt-in/opt-out

(a) Coverage: Missing.

(b) Gap: APP 7 restricts direct marketing and requires an easy opt-out mechanism; sensitive information can only be used/disclosed for direct marketing with consent.^[41]
Also, where communications are “commercial electronic messages,” the Spam Act requires an unsubscribe facility and specific operational rules.^[42]

(c) Recommended clause (add a “Communications” section):
Communications and marketing
We may contact you about appointments, care, accounts, and service administration. These messages are not marketing.
If we send marketing communications (for example, newsletters promoting services), we will do so only where permitted by law and you can opt out at any time using the unsubscribe/STOP option or by contacting us. We do not use health information for direct marketing without your consent.
^[6]

Special provisions for NDIS, Medicare, telehealth, and referrals

(a) Coverage: Partially covered (NDIS named), otherwise weak.

(b) Gaps / weaknesses:
– NDIS: The draft says “funding bodies such as Medicare or NDIS” but doesn’t name typical NDIS recipients (plan managers, support coordinators) or explain the purposes (claims, audits, service delivery). NDIS Practice Standards emphasise participant understanding/consent regarding what info will be collected and why (including audio/visual).^[9]
– Telehealth: The draft doesn’t explain what info is shared with a telehealth provider, whether sessions are recorded, or consent for other parties attending. RACGP guidance emphasizes consent when other parties participate.^[43]
– Medicare / identifiers: The draft does not explicitly mention Medicare card numbers, Healthcare Identifiers, or similar identifiers—commonly processed in health settings (where applicable).^[44]
– Referrals: The draft mentions disclosure to referrers “with consent” but doesn’t describe the common flow of providing reports back to referrers as part of care coordination; OAIC health privacy guidance discusses use/disclosure in care contexts and serious threat exceptions.^[25]

(c) Recommended clause (add an “Health system interactions” section):
NDIS, Medicare, referrals and telehealth
NDIS: Where services are funded through the NDIS, we may share necessary information with the participant (and/or their nominee/guardian), plan manager, support coordinator, or the NDIA for purposes such as service delivery, bookings, claims, and audits, where permitted.
Medicare: Where Medicare billing applies, we may collect and use identifiers necessary for Medicare claiming and compliance.
Referrals and shared care: We may share relevant information with your referrer and other treating providers involved in care coordination, where you consent or where permitted by law.
Telehealth: If you receive services via telehealth, we may use a video/telehealth service provider. We will explain what information the platform receives (e.g., contact details or meeting links) and obtain consent for recordings or for other parties to join the session.
Grounding: NDIS Practice Standards privacy/dignity indicator; telehealth consent expectations; OAIC health privacy guide for use/disclosure; healthcare identifiers oversight exists.^[45]

Complaints handling and OAIC escalation

(a) Coverage: Partially covered. The draft invites complaints and references OAIC escalation.

(b) Gap: APP 1.4(e) requires the privacy policy to explain how individuals may complain and how the entity will deal with the complaint. The draft references contacting OAIC but does not describe your internal handling steps/timeframes (acknowledgement, investigation, outcome, escalation).^[46]

(c) Recommended clause (replace complaints section):
Privacy complaints
If you have a privacy concern, please contact our Privacy Officer using the details below.
We will:
• acknowledge your complaint promptly,
• investigate and respond in writing within a reasonable time, and
• explain any steps taken to address the issue.
If you are not satisfied with our response, you may complain to the OAIC.
^[38]

Template wording for consent and authority to share

These templates are typically best placed in intake forms, telehealth consent forms, and “authority to release information” forms (and referenced by the privacy policy).

Authority to share with referrers/schools/NDIS:
I authorise Motion Health Kids to collect, use and disclose relevant personal and health information about [Child’s Name] for the purpose of providing and coordinating care, including communicating with:
• the referring GP/specialist and treating health professionals,
• school/kindergarten (where relevant to care goals),
• NDIS participants/nominees and relevant NDIS contacts (e.g., plan manager/support coordinator) where applicable.
I understand I can withdraw this authorisation at any time by contacting the clinic, but this may affect service coordination.
This aligns with consent-based collection/disclosure for sensitive information and transparency expectations.^[47]

Telehealth participation/recording consent:
I consent to receiving services via telehealth and confirm who will be present during the session.
I consent / do not consent (circle one) to the session being recorded.
RACGP telehealth guidance emphasizes confirming consent when other parties are present; recording should be explicit.^[43]

Photos/video for clinical purposes:
I consent / do not consent (circle one) to clinical photographs or video being captured for assessment/treatment.
I understand how the images will be stored, who can access them, and that separate consent is required for use beyond care (e.g., marketing).
OAIC guidance indicates consent is usually required for patient images and encourages consent even where de-identified.^[48]

APP compliance summary

This table reflects whether the draft policy text meaningfully addresses each APP topic at a privacy-policy level (not whether the clinic’s internal practices are compliant in operation).

APP Status (policy text) Notes

APP 1 Partial Has a policy and describes collection/use broadly, but missing overseas disclosures detail and stronger complaint-handling description required by APP 1.4(e)–(g).^[26]

APP 2 Missing/Weak No anonymity/pseudonymity statement (“where lawful and practicable”).^[49]

APP 3 Partial Mentions “necessary,” but should more clearly articulate sensitive info consent basis and exceptions.^[19]

APP 4 Missing No handling of unsolicited information (destroy/de-identify where applicable).^[22]

APP 5 Weak Policy exists, but no explicit “collection notice” content; should ensure notice practices exist (APP 5.2 matters).^[22]

APP 6 Partial Use/disclosure described but not mapped to primary/secondary purposes and common health exceptions; needs clearer categories.^[50]

APP 7 Missing No direct marketing section, no opt-out process.^[41]

APP 8 Missing No cross-border disclosure handling or “reasonable steps” narrative; must be added if any overseas recipients exist.^[51]

APP 9 Missing No statement about not adopting government identifiers as own identifier (optional but recommended if Medicare/HI numbers processed).^[52]

APP 10 Weak No commitment to data quality (accuracy, completeness) beyond general statements.^[30]

APP 11 Partial “Reasonable steps” noted but needs clearer controls + retention/destruction triggers and breach readiness.^[28]

APP 12 Partial Access described, but needs timeframes and identity/authority checks (and child capacity handling).^[53]

APP 13 Partial Correction mentioned; should state timeframe target (~30 days) and process.^[54]

Prioritized remediation checklist

Effort estimates assume you already have the draft policy and need to update it plus align forms and internal procedures.

Priority Effort Item Suggested implementation steps

High Medium Overseas disclosures + vendor/processor transparency (APP 1.4(f)–(g), APP 8) Map all systems/vendors (PMS, telehealth, email/SMS, forms, storage), identify hosting countries, update policy clause + internal due diligence approach.^[3]

High Medium Data breach response + NDB compliance Adopt an incident response plan, train staff on escalation, document assessment and notification pathway, add policy section.^[4]

High Medium Security controls (patient-facing summary + internal alignment) Confirm MFA, role-based access, backups, encryption, logging; update policy; ensure contracts require security controls.^[5]

High Low–Medium Direct marketing + communications preferences Decide whether you send marketing; if yes, implement consent + unsubscribe; update policy and templates.^[55]

High Medium Child consent/capacity + parent access handling Add policy text; align intake workflow to document who has authority, note court orders, and handle requests case-by-case.^[7]

High Medium Retention schedule and secure disposal Add adult retention and destruction/de-identification triggers; ensure your actual retention practice matches “until 25” where applicable; document disposal logs where required.^[33]

Medium Low Collection notice alignment (APP 5) Ensure intake forms/online forms provide APP 5.2 matters (who you disclose to, overseas, consequences, etc.).^[22]

Medium Low PIAs + privacy-by-design statement Add brief policy commitments; create an internal checklist for new tools/forms.^[56]

Medium Low Cookies/tracking specificity Inventory tracking tools; update policy; add opt-out guidance.^[17]

Medium Low–Medium NDIS/telehealth/referrals specificity Add plain-English “who we share with and why;” separate care vs admin vs funding disclosures; ensure telehealth recording consent is explicit.^[57]