Privacy
Privacy policy
How I collect, use, store and protect your personal and health information.
Who I am
This policy covers the personal information I handle as Benjamin Melody, a behaviour support practitioner, in connection with enquiries about — and the provision of — positive behaviour support. I am not myself an NDIS-registered provider: specialist behaviour support is delivered in partnership with, and under the NDIS registration of, Tranquil Trails Counselling and Therapy. Where a service proceeds, your health records are created and held under Tranquil Trails Counselling and Therapy's information-management obligations as the registered provider, and their privacy policy also applies.
I handle personal and health information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles, together with the health-records privacy laws that apply in New South Wales and the Australian Capital Territory.
This policy also covers this website itself, and the free self-serve tools published on it — which anyone can use without contacting me or becoming a client. Those tools work quite differently, and are covered separately below.
What I collect
Depending on how you contact me and whether support proceeds, I may collect:
- contact and enquiry details you provide through this website, by phone or by email — such as your name, email address, phone number, and what you tell me about the support you're looking for; and
- where support proceeds, health, disability and behaviour-related information relevant to providing behaviour support — for example assessments, behaviour support plans and progress notes.
- basic technical information created whenever anyone visits this website — your IP address, browser type and the pages you requested — which the hosting service records automatically, together with an anonymous count of page visits. See Free tools on this website below for what is and isn't measured.
Health information is treated as sensitive information under the Privacy Act, which means stricter protections apply to how it is collected, used and disclosed.
Why I collect it
I collect personal information to respond to enquiries and referrals, to assess and provide positive behaviour support, to communicate with participants, families and the wider support team, and to meet my legal, professional and regulatory obligations — including under the NDIS Code of Conduct and NDIS Practice Standards.
Consent
I collect sensitive information only with your consent, and only for the purpose of providing behaviour support. You can ask what information is being collected, and why, at any time, and you can withdraw your consent — though this may affect my ability to provide a service.
How I store and protect it
I take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. Access is limited to those who need it to provide or support your service.
The website and the referral form run on Amazon Web Services in Australia (Sydney), with information encrypted in transit and at rest. My email is protected with a strong password and multi-factor authentication, and the devices I use are encrypted. I keep only the information I need, and remove it securely once it is no longer required.
Anything you create in the free tools on this website is a deliberate exception: it is never sent to me, so there is nothing for me to store or protect — and nothing that could be exposed if my systems were ever compromised.
How long information is kept
Your clinical records — assessments, behaviour support plans and progress notes — are held and retained by Tranquil Trails Counselling and Therapy as the registered NDIS provider, under their records, retention and consent policies. Health records are generally kept for at least seven years from the date a service was last provided, and for a person under 18, until they turn 25 — in line with NSW and ACT health-records law and NDIS record-keeping obligations.
The information I hold directly — your enquiry, intake details and our email correspondence — I keep only for as long as I need it. Any clinical detail is recorded in Tranquil Trails Counselling and Therapy's records, and I remove it from my own email and files once it is no longer needed. Enquiries that don't lead to a service are securely deleted.
Who I share it with
I may share personal information with Tranquil Trails Counselling and Therapy as the registered NDIS provider through which services are delivered; with others involved in your support where you consent (such as your support coordinator, family or treating professionals); and with the NDIS Quality and Safeguards Commission or others where required or authorised by law. I never sell personal information.
Handling emails
My email is handled through Amazon Web Services in the United States. So anything you send me by email — or through the referral form, which reaches me as an email — is processed and stored in the United States. The website itself is hosted in Australia. If you email me a board, schedule or file, it is handled the same way — it reaches me as an email attachment, and is processed and stored in the United States. Apart from email, I do not disclose your personal information to recipients overseas.
Free tools on this website
This website offers free tools that anyone can use. You don't need to be a client, and you don't need to contact me to use them.
These tools work differently from the rest of this policy, so it's worth being clear about how.
Everything stays on your device
When you build a routine, a First/Then board or a timer, it is saved on the phone, tablet or computer you built it on — in your web browser's own storage. That includes:
- the routines and boards you make — their steps, and the name you give each one;
- any photos you add to them;
- your timer settings — the lengths you save, how the timer looks, and whether it plays a sound at the end; and
- where you got up to today in a routine — which steps are ticked off, and which one you are on. This is cleared when the date changes, so nothing carries over to another day.
The tools also remember a few small things in this browser, so you don't have to set them again: the routine you had open last, the timer length you used last, the symbols you picked recently, whether you have seen the First/Then message, whether you closed the card asking if you want the tool on your home screen, how you chose the screen to look, and the date you last saved a backup file.
That is the whole list.
None of it is sent anywhere. There is no account, no login, no server and no upload — not switched off by default, but genuinely not built. The tool is checked automatically each time the website is published, and the check fails if any part of the tool tries to send information over the internet.
I have no access to anything you build. I can't look it up, I can't retrieve it, and I can't delete it for you — not because I won't, but because it never reaches me and there is nothing on my side to look at. I don't know that you've used the tool at all.
Deleting everything
You are in control of this, entirely. On the tool's What's saved on this device page there is a Delete everything button that removes all of it from that device. You can also clear the website's stored data through your browser settings, or by deleting the app from your home screen if you added it there.
Deleting on one device doesn't touch another. If you've built the same routine on two devices, or sent it to someone, you'll need to clear each one.
Photos
A photo you add is kept on the device with everything else, and it is never sent anywhere. Photos are shrunk and re-saved when you add them, which removes the hidden location and camera information that phones attach to pictures.
The tool doesn't decide anything about you
It isn't an assessment, it doesn't determine anything about you or the person you're supporting, and no decision about anyone's support is made by the tool or reaches me from it.
Accessing or correcting your information
You can ask to see the personal information I hold about you, and ask me to correct it if it is inaccurate, out of date, incomplete or misleading. Contact me using the details below and I will respond within a reasonable time.
This doesn't extend to anything you've created in the free tools on this website — not because it's off limits, but because it is already entirely in your hands. It sits on your own device, I have no copy, and you can view, change or delete all of it yourself at any time.
Making a complaint
If you have a concern about how your personal information has been handled, please contact me first using the details below so I can look into it. If you are not satisfied with my response, you can complain to the Office of the Australian Information Commissioner (OAIC). In New South Wales you can also contact the Information and Privacy Commission NSW, and in the ACT the ACT Human Rights Commission, which handles health records complaints under ACT law.
Changes to this policy
I update this policy when what I do changes — when a new tool is published, when the way information is handled changes, or when the law does. The date at the top tells you when it last changed.
If a change materially affects information you've already given me, I'll tell you directly rather than relying on you to notice the date.
How to contact me
For any questions about this policy or how your personal information is handled, contact me at benjamin@benjaminmelody.com.au.
You can also call me on 0447 487 030.