At Counselling Appraisal Consultants Pty Ltd (also trading as Care Pathways Australia) (ABN 45 007 421 981) (CAC), we are committed to protecting your privacy in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles and applicable state and territory health privacy laws.  

 

This Privacy Policy applies to all of CAC’s services, including:

• Occupational rehabilitation services that help people with work-related and non-work-related injuries or medical conditions, including those that are the subject of a workers’ compensation, motor accident (such as CTP or TAC), life insurance or superannuation claim, to recover at and return to work;

• Specialist rehabilitation and treatment services, including occupational therapy; and

• Care Pathways Australia services, which provide allied health therapy services, assessments and consulting to individuals of all ages, their families and organisations, including early childhood therapy for children with developmental delays and disabilities.

 

We provide services and manage claims across all Australian states and territories, either through our own employees and consultants or through contractors engaged by CAC. Our employees, consultants and contractors may be located in a different state or territory from you.

 

In this Privacy Policy, “we”, “us” and “our” refer to CAC. This Privacy Policy explains how we collect, hold, use and disclose personal information. It also explains how you can access and correct the personal information we hold about you and how you can complain about a breach of privacy laws.

 

What information do we collect and how do we use it? 

​We collect the personal information we need to provide our services to you. Depending on the service, this may include your name, address, contact details, date of birth, employment details, emergency contact details, the names and contact details of your treating practitioners and information about your health, including details of your injury or condition, treatment and reports from your treating practitioners.

 

For occupational rehabilitation services, this may also include certificates of capacity and information about your claim. Health information is sensitive information. We collect it only with your consent (or where otherwise permitted by law) and only where it is reasonably necessary to provide our services. We collect financial information only where it is needed for a specific service, for example information about your pre-injury earnings for an income protection claim, or bank account details to process a payment. If you give us information about another person (for example, an emergency contact), please let them know that you have done so and refer them to this Privacy Policy.

 

​If you, or a person you care for, receive services from Care Pathways Australia, we also collect information about the client and, where relevant, their family, carers and support network. This may include the client’s name, date of birth and Medicare details, information about their development, health and disability, relevant health and medical records, NDIS participant and plan details, how their NDIS plan is managed and their plan manager or support coordinator details, service agreements and risk assessments and, for children, details of their childcare, kindergarten or school. We may also collect the names and contact details of parents, guardians, carers, nominees and other people involved in the client’s care. Where the client is a child, or an adult who is not able to make their own decisions, we collect information from and seek consent from, their parent, guardian or other authorised representative wherever possible. Where we provide consulting services to an organisation, we collect the contact details of the people we work with in that organisation.

 

​We use your personal information to provide, manage and administer our services. For occupational rehabilitation services, this includes assessing your work capacity, developing and monitoring your return to work plan and communicating with the people involved in your rehabilitation. To do this, we may need to collect information about you from others, such as your employer, your treating practitioners and your workers’ compensation agent, insurer or other referrer (including a motor accident insurer, life insurer or superannuation fund). We may disclose relevant information to your employer, your treating practitioners and other medical providers, your workers’ compensation agent, insurer or other referrer and government agencies and their service providers, where this is necessary to provide our services or to enable your claim to be considered. When we speak with your treating practitioners, we discuss only matters relating to the injury or condition for which we are providing services. For workers’ compensation clients, this means only your work-related injury.

 

​For specialist rehabilitation and treatment services, we use your information to assess your needs, plan and deliver your treatment and communicate with your treating practitioners and, where relevant, the person or organisation funding your treatment.

 

​For Care Pathways Australia, we use information about you, the person you care for and your family to assess needs, plan and deliver therapy and assessments and work with the client’s family, carers and the other people involved in their care and support. We may disclose relevant information to the National Disability Insurance Agency (NDIA), the client’s plan manager or support coordinator and other health practitioners and, with consent, the client’s childcare, kindergarten, school, employer or other support providers. We may also disclose information to the NDIS Quality and Safeguards Commission, child protection authorities or other safeguarding authorities where we are required or authorised by law to do so.

 

​Some of our services, including occupational therapy and rehabilitation services in some states and territories, are delivered by contractors engaged by CAC. We give contractors only the information they need to provide services to you or the person you care for. They must keep it confidential and handle it in accordance with the Privacy Act 1988 (Cth) and any applicable state or territory health privacy law. They must also store and access it in Australia.

 

Do we use your information for direct marketing?

​We do not use your health information, other sensitive information or any information about children for direct marketing. We may occasionally use your contact details to send you information about services we provide, but only where permitted by the Privacy Act 1988 (Cth) and the Spam Act 2003 (Cth). Agreeing to receive marketing is not a condition of receiving our services. Every marketing communication will include a simple way to opt out and you can opt out at any time by contacting us at reception@cac.com.au. We will then stop sending you marketing communications.

 

What if you don’t provide some information to us? 

You do not have to provide us with personal information. However, if you do not provide the information we ask for, we may not be able to provide our services to you or the person you care for fully, or at all. Where it is lawful and practicable, you may deal with us anonymously or by using a pseudonym, for example when making a general enquiry. It is generally not practicable for us to provide rehabilitation, treatment or therapy services without identifying the client.

 

Do we disclose your information overseas? 

CAC is owned by Howden Pacific Holdings Pty Ltd (ABN 14 652 840 514) and is part of the Howden group of companies, whose ultimate parent company is Howden Group Holdings Limited in the United Kingdom. CAC stores and handles your personal information in Australia. We do not disclose your personal information to recipients located outside Australia, including Howden group companies outside Australia. Howden group companies and their directors and staff do not access, use or disclose client information except in limited circumstances, such as where this is required by Australian law or is necessary to deliver or support our services. Howden group companies do not use client information for their own purposes, including marketing.

 

Our administration, data storage and IT systems providers store your personal information in Australia and it can be accessed only from within Australia.

 

Our websites use third-party analytics, advertising and video services, including those provided by Google and Vimeo. These providers may process website usage data, but not your client records, on servers outside Australia, including in the United States. These providers handle that data in accordance with their own privacy policies.

 

How do we hold and protect your information? 

​We take reasonable steps to keep the personal information we hold accurate, up to date and complete and to protect its privacy and security. We keep personal information only for as long as is reasonably necessary for the purpose for which it was collected, including to respond to any future claims or enquiries about our services, or to comply with any applicable legal, regulatory, professional or record-keeping requirements. When we no longer need personal information and are not required by law to keep it, we take reasonable steps to securely destroy it.

 

We hold and store the information we collect from you electronically. If we receive paper copies of information from you, we scan and store a copy electronically and then place the paper copies in our onsite secure shredding bin for destruction. In some cases, your file may be archived and sent to an external data storage provider for a period of time. We use only storage providers that are located in Australia and bound by the Privacy Act 1988 (Cth).

 

We take reasonable steps to protect your information from misuse, interference, loss and unauthorised access, modification and disclosure. We maintain physical security over our paper and electronic records and our premises, using locks and security systems. We also maintain computer and network security, including firewalls and other security systems such as user identifiers and passwords, to control access to the computer systems where your information is stored. If a data breach is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.

 

Who do we disclose your information to? 

We do not sell, trade or rent your personal information to others.

 

In addition to the disclosures described above, we may provide your information to contractors who supply services to us (for example, therapy and rehabilitation contractors, administration and IT systems providers, mailing services and external data storage providers) and to other companies in the event of a corporate sale, merger, reorganisation, dissolution or similar event. We take reasonable steps to ensure that these organisations protect your information as required by the Privacy Act 1988 (Cth) and they are required to store and access your information in Australia.

We may also disclose your information where we are required or authorised to do so by law, where you have consented to the disclosure, or in other circumstances permitted by the Privacy Act 1988 (Cth).

 

How can you access or correct the information we hold about you?

If you ask for access to the personal information we hold about you and give us enough information to identify you and the information, we will give you access, subject to the exceptions in the Privacy Act 1988 (Cth). We will respond to your request within a reasonable period, usually within 30 days. If you tell us that personal information, we hold about you is inaccurate, out of date, incomplete, irrelevant or misleading, we will take reasonable steps to correct it.

 

To access or correct your personal information, please write to CAC at 50 Boundary Street, South Melbourne VIC 3205 or email reception@cac.com.au.

​

We do not charge you for making a request for access or correction, or for correcting your information. If a request for access is complex and will take considerable time to respond to, we may charge a reasonable fee for giving you access. We will tell you about any fee before we proceed and it will not be excessive.

 

In some limited circumstances permitted by law, we may refuse a request for access or correction. If so, we will tell you in writing as soon as practicable, explain the reasons for our refusal (unless it would be unreasonable to do so) and tell you how you can complain about the refusal.

 

What happens if you want to complain? 

If you have concerns about whether we have complied with the Privacy Act 1988 (Cth), any applicable state or territory health privacy law or this Privacy Policy, you may contact the Privacy Officer for the Howden group in Australia:

 

By post or in person: Level 23, 20 Bond Street, Sydney NSW 2000;

By email: privacy.pacific@howdengroup.com; or

By telephone: 1300 904 503.

 

We will consider your complaint through our internal complaints resolution process and aim to respond with a decision within 30 days of receiving it. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or on 1300 363 992. If your complaint relates to health information, you may also be able to contact the health complaints or privacy regulator in the state or territory where you received our services, such as the Health Complaints Commissioner (Victoria), the Information and Privacy Commission NSW or the ACT Human Rights Commission. If your complaint relates to NDIS supports, you may also contact the NDIS Quality and Safeguards Commission.

 

Your consent 

Where we need your consent to collect, use or disclose your personal information (for example, to collect health information from your treating practitioners), we will ask you for it, usually in writing through a client information or consent form. For children and for adults who are not able to make their own decisions, we ask a parent, guardian or other authorised representative (such as an NDIS nominee) to consent on their behalf. Your consent will be limited to the purposes explained to you at that time. You may withdraw your consent at any time by contacting us, although this may affect our ability to provide our services to you or the person you care for.

 

Website data​

When you visit our websites, we and our service providers may collect information about your visit, such as your IP address, the pages you view, the date and time of your visit and the type of browser and device you use. We use this information to operate and improve our websites, to understand how they are used and, where you have agreed, for advertising purposes. Google may link information collected through its advertising cookies to your Google account, in accordance with Google’s privacy policy.

 

Cookies

To collect this information, we and our service providers use cookies and similar technologies. Cookies are small text files that websites place on your device. Some cookies are essential for our websites to work. Others, such as analytics and advertising cookies, are optional. You can manage your cookie preferences when you visit our websites and you can adjust your browser settings to block or delete cookies. For more details about the cookies we use, please see our Cookie Policy page.

 

Forms 

Our website allows visitors to submit information through our “General contact queries” form. Information submitted through this form is not encrypted. Alternatively, you can email your query to reception@cac.com.au. If you are concerned about the confidentiality of information about your claim, rehabilitation, treatment or therapy, we recommend that you call us on 1300 786 860.

 

Information submitted through the “General contact queries” form is sent to our offices by email (which is not encrypted) and is also stored in a password-protected database that is accessible by CAC.

 

We use information submitted through our website to respond to your enquiry and to manage our relationship with you.

 

We may also use your information internally to help us improve our services and resolve any problems.

 

Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The current version will always be available on the CAC and Care Pathways Australia websites. This Privacy Policy was last updated on 3 November 2026.