# Privacy Policy

 

**Last updated: 10 August 2026**

 

Ardant is operated by **MBCAM Pty Ltd (ABN 20 673 942 142)** and **Margeaux Bartholomew-Carle (ABN 27 609 616 412), trading as Ardant**. In this policy, **Ardant**, **we**, **us** or **our** means those entities as applicable. Ardant provides occupational therapy services and operates a platform that connects clients with independent occupational therapists across Australia.

 

We respect your privacy and are committed to handling personal information in accordance with the *Privacy Act 1988* (Cth), the Australian Privacy Principles (APPs), applicable State and Territory health-records laws, and other laws and professional obligations that apply to our services.

 

This Privacy Policy explains how we collect, hold, use and disclose personal information. It applies to our websites, referral and booking forms, the Ardant mobile application and administration portal, our communications with you, and the occupational therapy and related administrative services we provide.

 

## 1. The information we collect

 

The information we collect depends on how you interact with Ardant.

 

### Clients, participants and people referred to us

 

We may collect:

 

- identity and demographic information, such as your name, preferred name, pronouns, gender and date of birth;

- contact information, such as your email address, telephone number, residential address, suburb, State, postcode and time zone;

- health and disability information, including diagnosed conditions, injuries, support needs, requested occupational therapy services, session preferences, clinical notes, assessments, reports, risks, alerts, cultural requirements, social circumstances and information relevant to providing safe care;

- appointment and service information, including appointment dates and locations, service type, duration, travel and non-face-to-face work;

- funding, billing and claiming information, including NDIS participant and plan-management details, Medicare details, DVA details, My Aged Care information, private billing details, plan manager or care provider details, invoice contact details, services used and amounts billed or paid;

- details of nominated contacts, such as a parent, guardian, carer, support coordinator, plan manager, care manager, general practitioner or other health professional; and

- documents and correspondence you or an authorised person provides to us.

 

Health information is sensitive information under the Privacy Act and receives a higher level of protection.

 

### Referrers, representatives and other contacts

 

If you refer a person to Ardant or are involved in their care or funding, we may collect your name, role or relationship to the client, organisation, contact details, correspondence and information about your authority to act for the client.

 

If you provide information about another person, you must be authorised to do so and, where practicable, make them aware of this Privacy Policy and the information you have provided.

 

### Occupational therapists, applicants and other service providers

 

We may collect:

 

- identity and contact details, date of birth and address;

- professional information, including AHPRA registration, qualifications, areas of practice, experience, languages, service areas and availability;

- business and payment information, including ABN, bank details, Medicare provider number and invoicing or payroll information;

- evidence of identity, insurance, police checks, Working with Children Checks, Working with Vulnerable People Checks and other required credentials;

- information about employment status, practice-management systems, professional interests and service preferences; and

- account, authentication, security and application-use information.

 

### Website, app and technical information

 

When you use our websites, forms, portal or app, we and our technology providers may collect technical information such as:

 

- IP address, browser and device type, operating system, date and time of access, pages viewed, referring page and approximate location derived from an IP address;

- cookies and similar technologies used for security, essential functionality, preferences and website analytics;

- account sign-in and security events, app version, error and diagnostic information; and

- information you choose to provide through device features, such as a receipt photo or PDF selected from your camera, photo library or files.

 

The Ardant app may keep limited appointment and practitioner information on an authorised device to support app operation and limited offline access. Sign-in credentials and app-lock information are protected using the device's secure storage where available.

 

If you enable face or fingerprint unlock, authentication is performed by your device. Ardant receives only the result of the authentication attempt and does not receive or store your face image, fingerprint or biometric template.

 

If an authorised practitioner chooses to open a client's address in Apple Maps or Google Maps, that address is sent to the selected mapping provider under that provider's privacy terms. Address suggestions entered in an Ardant online form may also be processed by Google Places.

 

## 2. How we collect personal information

 

We may collect personal information:

 

- directly from you through a referral, booking, application, registration or contact form;

- when you use our app, portal, website or services, attend an appointment, contact us, upload a document or communicate with an Ardant team member or occupational therapist;

- from a parent, guardian, carer, support coordinator, referrer or other person authorised to act for you;

- from an occupational therapist or another health or service provider involved in your care;

- from funding and government bodies, plan managers, aged-care providers, insurers and payment or claiming services;

- from our practice-management, booking and clinical-record systems, including Halaxy; and

- from professional registers and verification sources, such as AHPRA, where appropriate.

 

## 3. Why we collect, use and disclose information

 

We collect, use and disclose personal information where reasonably necessary to:

 

- receive, assess and manage referrals;

- identify an appropriate occupational therapist based on matters such as location, requested services, client age group, delivery method, practitioner skills and availability;

- contact clients, representatives, referrers and practitioners;

- arrange and deliver occupational therapy and coordinate care;

- maintain accurate clinical and service records;

- schedule and manage appointments, session logs, receipts, expenses, travel and practitioner payments;

- prepare invoices, process payments and administer claims or funding with Medicare, DVA, the NDIA, plan managers, aged-care providers, insurers and other relevant payers;

- manage bookkeeping, accounting, taxation, practitioner payments and financial reporting, including through Xero;

- recruit, onboard, credential and manage occupational therapists and other service providers;

- create and secure user accounts, authenticate users, provide support and operate our websites, app and administration systems;

- investigate incidents, respond to complaints, manage safety and quality, and meet legal, regulatory, insurance, audit and professional obligations;

- prevent fraud, misuse and unauthorised access; and

- analyse and improve our services using aggregated, de-identified or limited technical information where practicable.

 

We may use tools to assist our team to organise referrals and identify potentially suitable practitioners. Material referral and care decisions are reviewed by people. We do not currently rely on a solely automated decision that has a significant effect on a client.

 

We will not use health information for direct marketing without consent. If you choose to receive other marketing communications from us, you can opt out at any time by using the unsubscribe option or contacting us.

 

## 4. Consent and when information is required

 

We generally collect sensitive information, including health information, with your consent or the consent of an authorised representative. In limited circumstances, the law may allow or require collection without consent, including where necessary to lessen or prevent a serious threat to life, health or safety.

 

You do not have to provide all information we request. However, if required identity, contact, health, funding or safety information is not provided, we may be unable to assess a referral, match an appropriate therapist, provide safe services, bill the relevant payer or meet our legal obligations.

 

Where lawful and practicable, you may deal with us anonymously or using a pseudonym for a general enquiry. It is usually not practicable to provide clinical services, manage funding or create a secure practitioner account without confirming identity.

 

## 5. Who we may disclose information to

 

We may disclose personal information only where reasonably necessary for the purposes described in this policy, with consent, or as required or authorised by law. Recipients may include:

 

- Ardant personnel and authorised office or administration staff;

- the independent occupational therapist assigned to a client and, where necessary, other authorised health or service providers involved in the client's care;

- a client's nominated parent, guardian, representative, carer, support coordinator, plan manager, care manager, referrer or other authorised contact;

- government agencies and funding or claiming bodies, including Services Australia, Medicare, DVA, the NDIA and relevant aged-care or State insurance bodies;

- plan managers, aged-care providers, insurers, payment providers and other organisations responsible for approving or paying for services;

- technology and professional service providers that help us operate, including practice-management, booking, clinical-record, cloud hosting, database, storage, authentication, email, SMS, mapping, analytics, security, accounting, legal, audit and insurance providers;

- regulators, courts, law-enforcement agencies and other parties where disclosure is required or authorised by law or is necessary to manage a serious threat to health or safety; and

- a purchaser, successor or adviser in connection with a proposed or completed business transaction, subject to appropriate confidentiality and legal requirements.

 

Our main technology providers include Halaxy, Supabase, Wix, Vercel, Xero, Google and the device-platform services provided by Apple or Google. The providers used for a particular person depend on the form, service, device and funding pathway involved.

 

We do not sell identifiable client or patient information.

 

## 6. Overseas processing and disclosure

 

Ardant's primary clinical, referral and practice-management records are configured to be stored in Australia, including through our Australian-hosted Supabase environment and Halaxy's Australian data hosting.

 

Some providers that support our websites and ancillary services are based overseas or use overseas personnel or infrastructure. As a result, limited personal information or technical information may be processed outside Australia, including in the United States, Ireland and Israel, and in other countries where a provider or its subprocessors operate. For example:

 

- Wix states that it stores personal information in data centres in the United States and Ireland and operates from Israel;

- Vercel may process website-hosting and request information in the United States and other jurisdictions;

- Google and optional Apple or Google mapping services may process addresses and technical information overseas; and

- Xero may process accounting and related personal information in Australia, New Zealand, the United States and other countries where Xero group companies and subprocessors operate; and

- Halaxy may use overseas subprocessors for optional communications, analytics, payment or integration functions.

 

The exact country can depend on the service, configuration and network route. Before disclosing personal information overseas, we take reasonable steps appropriate to the circumstances, such as assessing the provider, limiting the information provided, using contractual and security protections, and configuring Australian data hosting where available.

 

## 7. Storage and security

 

We may hold personal information electronically in our clinical and practice-management systems, secure cloud services, business systems and authorised devices, and in hard copy where required.

 

We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. Measures may include role-based access, least-privilege database controls, multi-factor authentication, encryption in transit and at rest where supported, private file storage, secure device storage, access logging, staff confidentiality requirements, backups and security monitoring.

 

Only authorised users should access information through the Ardant app and administration portal. Practitioners are restricted to information needed for their work, and administrative access is restricted according to role.

 

No electronic system or transmission over the internet can be guaranteed to be completely secure. If you believe information has been accessed or disclosed without authorisation, contact us promptly using the details below.

 

## 8. Retention and deletion

 

We retain personal information for as long as reasonably necessary to provide services, meet clinical and professional obligations, resolve disputes and comply with legal, funding, insurance, taxation and record-keeping requirements.

 

Clinical and health records are generally retained for at least seven years from the date of the last service or entry. For a person who was under 18 when a record was made, records are generally retained until that person turns 25. We may retain records for longer where required by applicable law, a funding arrangement, professional standards, legal proceedings or another lawful reason.

 

Financial and business records are retained for the periods required by law. Enquiries, unsuccessful applications and other administrative information are retained only for as long as reasonably necessary for the purpose for which they were collected, unless a longer period is required or authorised.

 

When information is no longer required, we take reasonable steps to securely destroy it or de-identify it. Deletion from backups may occur through the provider's normal secure backup-rotation process.

 

## 9. Accessing or correcting your information

 

You may ask to access personal information we hold about you or request that inaccurate, out-of-date, incomplete, irrelevant or misleading information be corrected.

 

Please email **access@ardant.com.au** with the subject line **Privacy request**. Tell us what information you are seeking or what you believe should be corrected. We may need to verify your identity and authority before acting on a request, particularly where health information is involved.

 

We will respond within a reasonable period, generally within 30 days. We do not usually charge for making a request. If a reasonable charge is permitted for providing access, we will tell you before incurring it.

 

In some circumstances, the law permits or requires us to refuse access or correction. If that occurs, we will generally give you written reasons and explain available complaint options, unless it would be unreasonable or unlawful to do so.

 

## 10. Privacy complaints

 

If you believe we have mishandled personal information or breached this policy, please contact:

 

**Privacy Officer**  

**Ardant**  

Email: **access@ardant.com.au**  

Subject: **Privacy complaint**

 

Please describe what happened, when it happened, the information involved and the outcome you are seeking. We will acknowledge and investigate the complaint and aim to provide a response within 30 days. If we need more time, we will let you know.

 

If you are not satisfied with our response, or we do not respond within a reasonable period, you may lodge a complaint with the Office of the Australian Information Commissioner:

 

**Office of the Australian Information Commissioner (OAIC)**  

Website: [www.oaic.gov.au/privacy/privacy-complaints](https://www.oaic.gov.au/privacy/privacy-complaints)  

Telephone: **1300 363 992**

 

Depending on where you live and the nature of the matter, you may also have the right to complain to a State or Territory health-privacy or health-complaints regulator.

 

## 11. Third-party websites and services

 

Our websites and app may contain links to external websites, booking services, mapping services, social media pages or other third-party services. Those services have their own privacy practices and policies. We encourage you to review them before providing personal information.

 

## 12. Changes to this policy

 

We may update this Privacy Policy when our services, technology providers or legal obligations change. The current version will be published on our website and identified by the “Last updated” date. Material changes will be communicated where reasonably practicable.

 

## 13. Contact us

 

For questions about this policy or Ardant's privacy practices, or to request a copy of this policy in another format, contact:

 

**Privacy Officer**  

**Ardant**  

Email: **access@ardant.com.au**

 

---

 

# Referral-form collection notice

 

Place this notice immediately above the referral form's submit button. A privacy-policy link in the website footer is not, by itself, a substitute for a notice at the point health information is collected.

 

> **How we use this information**  

> Ardant collects the personal and health information in this form to assess and manage the referral, match the client with a suitable occupational therapist, arrange and provide services, maintain clinical records, and manage funding, billing and related administration. We may disclose relevant information to the occupational therapist assigned to the client, authorised representatives and care contacts, relevant funders or payers, and service providers including our practice-management and secure technology providers. Some website and support providers may process limited information overseas. If required information is not provided, we may be unable to assess the referral or provide services. Our [Privacy Policy](INSERT-WIX-PRIVACY-POLICY-LINK) explains how information is stored, how to request access or correction, and how to make a complaint. Contact us at access@ardant.com.au.

 

Required checkbox text:

 

> **I confirm that I am the client or am authorised to make this referral, that the information I have provided is accurate to the best of my knowledge, and that I consent to Ardant collecting, using and disclosing the personal and health information in this form as described above and in its Privacy Policy. If I have provided information about another person, I confirm I am authorised to do so and have made them aware of this referral where appropriate.**

 

# Occupational-therapist form collection notice

 

Place this notice immediately above the provider registration form's submit button.

 

> **How we use this information**  

> Ardant collects the information in this form to assess your application, verify your identity, qualifications and credentials, contact you, match you with suitable work, onboard and manage you as an independent service provider, operate your Ardant account, and meet legal, safety, insurance and professional obligations. We may verify information with AHPRA and other credential or background-check sources and disclose it to service providers that help us operate the platform. If required information is not provided, we may be unable to assess or progress your application. Our [Privacy Policy](INSERT-WIX-PRIVACY-POLICY-LINK) explains how we handle personal information and how to request access or correction or make a complaint. Contact us at access@ardant.com.au.

 

Required checkbox text:

 

> **I have read the collection notice and Ardant's Privacy Policy and consent to Ardant collecting, using and disclosing my personal information for the purposes described. I confirm that the information I provide is accurate and that I will notify Ardant if relevant details change.**

 

# Wix publishing checklist

 

1. Replace `INSERT-WIX-PRIVACY-POLICY-LINK` with the live Wix page URL.

2. Add the Privacy Policy link to the footer of every Wix page, the referral and provider forms, the Ardant app login/profile screens, and the admin portal login page.

3. Add the relevant collection notice and an unticked required consent checkbox to each form that collects health or practitioner information. Record the policy version and consent time with the submission where the form system supports it.

4. Review Wix's cookie banner and list any optional analytics or advertising tools actually enabled. Do not load non-essential advertising cookies before consent where consent is required.

5. Review this policy whenever a provider, integration, data location, form field, use of AI, or automated matching process changes, and at least annually.

6. Obtain a one-off review from an Australian health-privacy lawyer before treating this draft as final legal advice.