Privacy Policy

Last updated: September 2026

Dahlia Dietetics is a dietetic practice operated by Alice Carr as a sole trader (ABN 78 618 248 648). In this policy, “Dahlia Dietetics”, “we”, “us” and “our” mean Alice Carr trading as Dahlia Dietetics.

We collect, hold, use and disclose personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles, the Health Records and Information Privacy Act 2002 (NSW) and other applicable laws.

Alice Carr is an Accredited Practising Dietitian and practises in accordance with the Dietitians Australia Code of Conduct for Dietitians. Alice is also subject to the NSW Code of Conduct for non-registered health practitioners.

You are not required to provide personal information to us. However, if you do not provide information that is reasonably necessary, we may be unable to provide appropriate services, communicate with you, process payments or submit claims on your behalf.

1. What Personal Information We Collect

We collect only personal information that is reasonably necessary to provide our services and operate the practice. The kinds of information we collect are set out below.

Personal Information

  • Name and date of birth

  • Address, telephone number and email address

  • Emergency contact details

  • Details of a parent, guardian, support person, nominee or other authorised representative, where relevant

  • Appointment, booking and communication records

  • Information contained in enquiries or correspondence, including information provided through our website contact form or social media accounts

  • Other information you choose to provide that is relevant to your enquiry or care

Health Information (Sensitive Information)

As a health service provider, we collect health information that is reasonably necessary to provide safe and appropriate dietetic care. This can include:

  • Medical, mental health and eating disorder history

  • Current medications, supplements and allergies

  • Relevant diagnoses, blood test results, medical reports and referrals

  • Dietary intake, nutrition history, eating patterns and related symptoms

  • Height, weight, BMI, body composition and other clinically relevant measurements

  • Treatment goals and care plans

  • Clinical notes and professional observations

  • Information shared during consultations or, if offered, group programs

  • Relevant information provided by a parent, guardian, referring practitioner or another member of your healthcare team

  • If you choose to link with us through Recovery Record, information you enter into or share through that application, such as meal records, symptoms, behaviours, thoughts, emotions and progress information

We collect health and other sensitive information only where it is reasonably necessary for our functions and with consent, or where collection is otherwise permitted by law.

Funding and Billing Information

Where relevant to providing services, issuing accounts or processing claims, we collect:

  • Medicare details and referral or care-plan information

  • Private health insurance information

  • NDIS participant, plan-management and funding information

  • DVA information

  • WorkCover and other insurer or compensation-scheme information

  • Invoice, payment and transaction information

Payment card information is processed through our EFTPOS or online payment providers. Dahlia Dietetics records payment status and relevant transaction details.

Website Information

When you visit our website, Squarespace automatically receives technical and usage information such as:

  • IP address

  • Browser and device information

  • Pages visited and interactions with the website

  • Visit dates and times

  • Referring website or source

  • Approximate location derived from an IP address

Squarespace uses cookies and similar technologies to collect this information. If you submit a website contact form, we also collect the information you enter into that form.

2. How We Collect Your Information

We generally collect personal information directly from you or, where appropriate, from your parent, guardian or authorised representative.

We collect information when you:

  • Enquire through our website, email, telephone, SMS or social media

  • Make an online booking or complete a form through Halaxy

  • Attend an in-person or home-visit consultation, or participate in a Halaxy video consultation

  • Participate in a group program, if offered

  • Complete an intake form, questionnaire or assessment

  • Provide a referral, care plan, report or test result

  • Choose to link your Recovery Record account with us

  • Make a payment or ask us to process a Medicare or other funding claim

  • Otherwise communicate with us about your care.

Social media is not intended for detailed or urgent clinical communications. If you contact us through social media, we may ask you to continue the communication through another appropriate channel.

With your consent, or where otherwise required or authorised by law, we may also collect relevant information from:

  • A parent, guardian, carer, support person or authorised representative

  • Your GP, medical specialist, psychologist, psychiatrist, dietitian or another healthcare provider

  • Hospitals, pathology providers or other health services

  • An NDIS plan manager, support coordinator or other person involved in administering your supports

  • Medicare, DVA, WorkCover, an insurer or another funding body

  • Another person or organisation you have asked to provide information to us.

Where a client is under 18, we may collect information from their parent or guardian. We will involve the young person in privacy and consent decisions as appropriate, having regard to their age, understanding and capacity.

At or before collecting personal information, or as soon as practicable afterwards, we take reasonable steps to explain why it is being collected, how it will be used and disclosed, any legal requirement for the collection, your access and correction rights, and the consequences if it is not provided.

Where lawful and practicable, you may make a general enquiry without identifying yourself or by using a pseudonym. We generally need accurate identifying information to provide clinical services, maintain health records and process claims.

3. Why We Collect Your Information

We collect, hold and use personal information to:

  • Respond to enquiries, determine whether our services are appropriate and arrange appointments

  • Provide safe, appropriate and individualised dietetic services

  • Assess nutritional and health needs, establish goals, develop care plans and monitor progress

  • Provide in-person, telehealth and home-visit services and, if offered, administer group programs

  • Maintain accurate clinical, appointment and administrative records

  • Communicate about appointments, care, referrals and follow-up

  • Review information shared through Recovery Record where you have chosen to link your account with us

  • Coordinate care with your treating or support team, with your consent or where otherwise authorised by law

  • Issue invoices and process payments, Medicare benefits and other funding or insurance claims

  • Manage client safety, complaints, incidents, insurance and legal matters

  • Comply with legal, regulatory, insurance and professional obligations

  • Operate, secure and improve our practice, systems and website.

4. Disclosure of Personal Information

We disclose personal information only for the purpose for which it was collected, for a directly related purpose you would reasonably expect, with your consent, or where the disclosure is required or authorised by law.

Depending on your circumstances, relevant information may be disclosed to:

  • A parent, guardian, support person or authorised representative

  • Your GP, referring practitioner or another member of your treating healthcare team

  • A hospital, pathology provider, pharmacy or other health service involved in your care

  • An NDIS plan manager, support coordinator or other person involved in administering your supports

  • Medicare, DVA, WorkCover, an insurer or another funding body for payment, claiming or administration

  • Emergency services or another appropriate health or safety service

  • Service providers that assist us to operate the practice, as described in Section 5

  • A regulator, court, tribunal, government agency or enforcement body where disclosure is required or authorised by law

  • Our professional indemnity insurer or legal adviser where reasonably necessary to manage a complaint, investigation or legal claim.

Professional Supervision

Alice participates in professional supervision and may discuss clinical matters with a supervisor. Information used in supervision is de-identified so that the client is not identifiable or reasonably identifiable. If identifiable information needs to be disclosed, we will first obtain consent unless the disclosure is otherwise required or authorised by law.

Clients Under 18

When a client is under 18, we assess their capacity to make privacy decisions having regard to their age, maturity, understanding and the particular decision involved.

Where a young person has capacity to make the relevant privacy decision, we generally obtain their consent before disclosing clinical information to a parent or guardian. Where the young person does not have capacity, a parent, guardian or other authorised representative may make privacy decisions on their behalf. We will still involve the young person in those decisions as far as practicable.

At the beginning of care, we will discuss how parents or guardians will be involved, what information may be shared and the limits of confidentiality. Consent and information-sharing arrangements may be reviewed as circumstances or the young person’s capacity changes.

A parent or guardian who is responsible for bookings or payment may receive relevant appointment, invoice or payment information. This does not automatically entitle them to receive clinical information.

Group Programs

If we offer group programs, information a participant chooses to share may be heard by other participants. Participants will be asked to respect the privacy and confidentiality of others. However, Dahlia Dietetics cannot guarantee that another participant will maintain confidentiality.

Disclosures Without Consent

We may disclose information without consent where the disclosure is required or authorised by law. This can include:

  • Making a mandatory child-protection and/or vulnerable persons report

  • Lessening or preventing a serious threat to a person’s life, health or safety, or to public health or safety

  • Responding to a subpoena, court order or other lawful requirement

  • Cooperating with an authorised investigation or regulatory process.

We limit any disclosure to the information reasonably necessary for the relevant purpose.

5. Technology and Third-Party Service Providers

The principal third-party technology and service providers used by Dahlia Dietetics are:

  • Halaxy, for clinical records, online bookings, intake forms, appointment management, calendar functions, Halaxy video consultations, automated SMS messages, invoicing, Halaxy Payments and integrated Medicare or DVA claiming

  • Google Workspace, for business email

  • Squarespace, for website hosting, the website contact form, cookies and built-in website analytics

  • Recovery Record, if you and Alice agree to link through its clinician service, so that information you enter into the application can be reviewed and used as part of your care

  • Felix Mobile, for telephone calls, direct SMS communications and voicemail

  • Commonwealth Bank, for business banking and payment processing through a standalone EFTPOS terminal

  • Medicare, DVA, NDIS, WorkCover and other relevant funding or claiming systems, where required to administer services or claims.

The information processed by a provider depends on the service being used. It may include contact details, appointment information, communications, health information, payment or claim information, and technical information.

Some providers process information on our behalf, while others provide services directly to clients under their own terms and privacy policies. We take reasonable steps to select appropriate providers, configure accounts securely and limit the information processed to what is reasonably necessary.

Email, SMS, voicemail, social media and Recovery Record are not monitored continuously and should not be used for emergencies or urgent clinical concerns.

Information about overseas processing by these providers is set out in Section 8.

6. Artificial Intelligence and Automated Decision-Making

Use of Artificial Intelligence

Dahlia Dietetics may use general-purpose artificial intelligence tools to assist with general templates, document structure or wording.

We do not enter personal or health information into general-purpose artificial intelligence tools. Any information used with these tools will not identify you or reasonably enable you to be identified.

Alice reviews and verifies any AI-assisted material before it is used. AI-generated content is not relied upon as a substitute for professional knowledge, clinical reasoning or individual assessment.

Dahlia Dietetics does not use AI tools to record, transcribe or summarise consultations.

If an AI tool is proposed for direct use in your care, or would receive your personal or health information, we will explain the proposed use and obtain your informed consent before using it.

Automated Decision-Making

Dahlia Dietetics uses software for administrative support, appointment reminders, invoicing, record management and clinical calculations. These functions do not make significant decisions about clients.

Dahlia Dietetics does not currently arrange for a computer program to use personal information to make, or do something substantially and directly related to making, a decision that could reasonably be expected to significantly affect an individual’s rights or interests.

In particular, we do not use automated systems to:

  • Accept or decline clients or referrals

  • Determine appointment priority or clinical urgency

  • Assess eligibility for services or funding

  • Diagnose a condition or determine treatment

  • Generate a risk classification that determines care

  • Make another significant clinical or administrative decision.

Clinical decisions are made by Alice using professional judgement and consideration of the individual client’s circumstances.

If this position changes, we will update this policy to explain the kinds of personal information used and the kinds of decisions made or substantially assisted by computer programs, as required by law.

7. Website, Contact Forms, Cookies and Analytics

Our website is hosted by Squarespace. When you visit the website, Squarespace automatically receives technical and usage information of the kinds described in Section 1.

Squarespace uses necessary cookies and similar technologies to operate and secure the website. It also uses analytics and performance cookies to collect information about how visitors find and use the website. This information supports website administration, performance monitoring and improvement.

Squarespace analytics information may include IP addresses, device and browser information, approximate location, traffic sources, pages visited and interactions with the website. Although some analytics information is presented to us in statistical or aggregated form, the underlying information may constitute personal information and is handled accordingly.

If you submit our website contact form, the information you enter is processed through Squarespace and delivered to us through our business email. The contact form should not be used for emergencies or urgent clinical concerns.

You can use our website's cookie banner to make choices about non-essential cookies. You can also configure your browser to block or delete cookies, although this may affect how the website functions.

8. Overseas Disclosure and Processing

Some of the technology providers used by Dahlia Dietetics operate or engage service providers outside Australia. Personal information, including health information, is therefore likely to be disclosed to, processed by or accessible to overseas recipients in connection with particular services.

Halaxy states that its principal storage for Australian practice data is located in Australia. However, some Halaxy functions use overseas service providers. For example, its video consultation and SMS services use a provider located in the United States.

Other overseas processing includes:

  • Google Workspace, which may process business email and its contents outside Australia, including in the United States

  • Squarespace, which may process website, contact-form and analytics information in the United States and Ireland

  • Recovery Record, which hosts its non-European service in the United States

  • overseas service providers used in connection with Halaxy communications, payments, monitoring and technical support.

The overseas locations currently identified for the services used by Dahlia Dietetics include the United States and Ireland.

Personal information handled through Google Workspace may also be accessed or processed by Google affiliates and subprocessors in other countries identified in Google's current Workspace subprocessor information.

Before a client links with Dahlia Dietetics through Recovery Record, we will explain that the service stores and processes the client’s information in the United States and obtain the client’s consent to the proposed information sharing.

We assess the privacy and security arrangements of providers that handle personal information and take reasonable steps to ensure that overseas disclosures are permitted and appropriately protected under applicable Australian and NSW privacy requirements. However, an overseas recipient may be subject to foreign laws, and privacy protections or remedies may differ from those available in Australia.

9. How We Store and Protect Your Information

Personal information is held electronically through Halaxy and the other service providers described in Section 5. Some information may also be held in paper form.

Access to practice records is restricted to Alice and to authorised service-provider personnel where access is necessary to provide their services.

We take reasonable steps to conduct in-person, telehealth and home-visit consultations in settings that protect your privacy. If absolute privacy is not possible, we will explain the limitation and seek your permission before proceeding.

We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. These steps include:

  • Using dedicated, password-protected devices

  • Using strong account security, including multi-factor authentication

  • Restricting access to clinical and administrative systems

  • Taking reasonable steps to verify recipients before sending personal information

  • Using additional protection for sensitive email attachments where appropriate

  • Securely storing physical records with access restricted to Alice

  • Securely shredding physical records when they are no longer required

  • Securely deleting or de-identifying electronic information when it is no longer required, subject to applicable record-retention obligations.

Dahlia Dietetics maintains a data-breach response procedure. If a suspected breach occurs, we will take reasonable steps to contain, assess and remediate it. Where an eligible data breach has occurred, we will notify the Office of the Australian Information Commissioner and affected individuals as required by the Privacy Act 1988 (Cth).

10. Accessing, Correcting or Transferring Your Information

You may ask to access the personal information we hold about you, request that it be corrected, or ask us to transfer relevant health records to another healthcare provider. Requests should be made in writing to info@dahliadietetics.com.au and should include enough information for us to identify the records concerned.

Before acting on a request, we may need to verify your identity or the authority of a person making the request on your behalf.

We will respond within a reasonable period, ordinarily within 30 calendar days, and within any applicable statutory deadline. Access may be provided by giving you a copy of the information, allowing you to inspect it, providing a summary, or using another reasonable method appropriate to the request.

There is no charge for making an access request. We may charge a reasonable fee reflecting the actual cost of providing access, such as copying or postage costs. If a fee will apply, we will tell you in advance.

We may refuse or limit access only where permitted by law. If we do so, we will generally provide written reasons and explain the available complaint options, unless the law permits or requires otherwise.

If information we hold about you is inaccurate, out of date, incomplete, irrelevant or misleading, we will take reasonable steps to correct it. If we do not agree that a correction should be made, we will explain why and, if requested, take reasonable steps to associate a statement of the requested correction with the information.

With your consent or other appropriate authority, we will take reasonable steps to provide requested records, or an agreed summary, securely and promptly to another healthcare provider. We will verify the recipient’s details before transferring the information.

Requests involving a child or a person acting as a representative will be handled consistently with Section 4, including consideration of the young person’s capacity, wishes and privacy interests, and the authority of the person making the request.

11. Retention and Disposal of Records

We retain health information for at least the minimum periods required by the Health Records and Information Privacy Act 2002 (NSW):

  • Health information collected while an individual was an adult is retained for 7 years from the last occasion on which Dahlia Dietetics provided a health service to the individual

  • Health information collected while an individual was under 18 years of age is retained until the individual reaches 25 years of age.

Records may be retained for longer where required by law or where reasonably necessary in connection with a complaint, legal claim or other applicable professional obligation.

Other personal information is retained only for as long as reasonably necessary for the purpose for which it was collected or as required by law.

When information is no longer required, we take reasonable steps to securely destroy or permanently de-identify it. This may include securely shredding paper records and securely deleting or de-identifying electronic information. We retain records of the disposal or transfer of health information where required by NSW law.

12. Privacy Complaints

We take privacy complaints seriously. If you have concerns about how your personal information has been handled, please contact:

Alice Carr

Dahlia Dietetics

Email: info@dahliadietetics.com.au

Please describe your concern, any relevant dates or communications, and the outcome you are seeking.

We will acknowledge your complaint promptly, investigate it fairly, keep you informed where appropriate, and aim to provide a written response within 30 calendar days. We may contact you if we need further information. Your complaint will be handled sensitively, and you will not be disadvantaged for making a complaint in good faith.

If you are not satisfied with our response, or we have not responded within 30 days, you may lodge a privacy complaint with:

  • the Office of the Australian Information Commissioner, which handles complaints under the Privacy Act 1988 (Cth), at www.oaic.gov.au

  • the NSW Privacy Commissioner through the Information and Privacy Commission NSW, which handles complaints under the Health Records and Information Privacy Act 2002 (NSW), at www.ipc.nsw.gov.au.

Concerns about the quality or safety of a health service, or a practitioner’s professional conduct, may also be raised with the NSW Health Care Complaints Commission at www.hccc.nsw.gov.au. A complaint alleging a breach of the Dietitians Australia Code of Conduct by an Accredited Practising Dietitian may be made to the Dietitian and Nutritionist Regulatory Council through Dietitians Australia at www.dietitiansaustralia.org.au.

13. Changes to This Policy

The current version will be published on our website and will identify when it was last updated. Where a proposed new use or disclosure requires consent, we will seek that consent.

Contact Us

Alice Carr, Accredited Practising Dietitian & Credentialled Eating Disorder Clinician

Dahlia Dietetics

Email: info@dahliadietetics.com.au

Website: www.dahliadietetics.com.au

If you have questions about this Privacy Policy or how your personal information is managed, or wish to make a request or complaint, please contact us using the details above.