Website Privacy Policy

DOWNLOAD A PDF OF THE WEBSITE PRIVACY POLICY

Last updated: 28 August 2026

1 IDENTITY, APPLICATION AND STATUS

This policy explains how James Lyra trading as FIRST Occupational Therapy ABN 37 902 564 269 (FIRST OT, we, us or our) collects, holds, uses and discloses personal information through firstot.com.au (Website), general enquiries, resource requests and professional-learning registrations.
We are covered by the Privacy Act 1988 (Cth) and the Australian Privacy Principles because we provide a health service and hold health information. This policy describes our practices. It does not replace a collection notice or consent where the law requires either.

2 WHAT AND HOW WE COLLECT

Depending on how you use the Website, we may collect: your name and contact details; the content of an enquiry; profession and resource-request details; professional-learning booking, participant and invoice information; transaction records (but not a full card number held only by a payment provider); account details if an account is used; and technical information such as IP address, device/browser information, pages viewed, approximate location and cookie or analytics events.
We collect information directly when you complete a form, request a resource, contact us, create an account or make a booking. We may receive Participant information from a school, employer or other person making a booking, and technical information automatically from the Website and its service providers. If you book for another person, you must be authorised to provide their details and must give them the applicable collection notice and access to this policy before, or promptly after, the booking. Where we hold the Participant’s email address, we may send booking confirmations and reminders directly to them.

3 HEALTH INFORMATION RECEIVED THROUGH THE WEBSITE

Please keep a general Website enquiry brief and do not attach detailed health or clinical records unless we ask you to use a suitable channel. If an enquiry contains health information about a child or another person, we will apply the handling standards described in our Client Privacy Policy from the time we receive it.
If the enquiry becomes a client matter, relevant information may form part of the clinical record and the clinical retention requirements apply. If it does not, we retain the information only for as long as reasonably needed to respond and meet legal obligations, then securely delete or de-identify it.

4 PURPOSES

We collect, hold, use and disclose personal information as reasonably necessary to: answer and manage enquiries; provide a requested document or resource; notify a requester of a material update to the requested framework or document; manage optional news and marketing preferences; process and administer professional-learning bookings, payments, attendance and programme materials; provide account functions; maintain tax, accounting and business records; operate, secure, troubleshoot and improve the Website; prevent misuse; and comply with law, resolve disputes or enforce applicable terms.
We do not sell personal information. We do not use health information for direct marketing.

5 VERSION NOTICES AND DIRECT MARKETING

A notice that is confined to supplying a requested resource or to telling a requester that the requested framework or document has materially changed is an administrative or factual message. We will keep it confined to that purpose and provide a simple way to stop receiving it.
News about courses, new products, resources or other promotions is direct marketing. We send it only where we have consent or another lawful basis, identify FIRST OT, and provide a functional unsubscribe method. Marketing consent must be optional and separate from access to a resource. We action unsubscribe requests within the period required by law and do not treat an unsubscribe as deletion of unrelated transaction or clinical records.

6 DISCLOSURES AND SERVICE PROVIDERS

We use Wix for Website hosting, forms, bookings and automated email, and Stripe to process card payments. Stripe receives payment information; FIRST OT does not receive or store a full card number. We may also disclose personal information where reasonably necessary to providers that support email and communications, information technology, professional advice, security and data storage, and where required or authorised by law or with the affected person’s consent.
We take reasonable steps to limit each provider’s access to the information needed for its function and to use providers with appropriate legal, contractual and security controls. Before connecting a new accounting or other integration to Wix or Stripe, we will review and, where necessary, update this policy to reflect any material change in handling or overseas access.

7 OVERSEAS HANDLING

Wix and Stripe may store or process personal information, or permit support personnel and subprocessors to access it, outside Australia. The countries in which overseas recipients are likely to be located include the United States and Israel. Stripe also identifies service providers in India and the European Union. Provider locations can change over time.
Where APP 8 applies to an overseas disclosure, we take reasonable steps in the circumstances to ensure the overseas recipient handles the information consistently with the Australian Privacy Principles, subject to the exceptions in the Privacy Act. We assess provider terms, access controls, security and the sensitivity of the information before making or continuing a disclosure.

8 COOKIES AND ANALYTICS

The Website may use necessary cookies to provide security, forms, bookings, accounts and other requested functions; functional cookies to remember choices; and analytics cookies or similar technologies to understand Website use and improve performance.
Your browser or device may allow you to block or delete cookies. Blocking necessary cookies may prevent parts of the Website from working.

9 RETENTION, SECURITY AND DATA BREACHES

We retain personal information only for as long as reasonably needed for the purpose for which it was collected, to manage an ongoing relationship, resolve a dispute and comply with tax, accounting and other legal obligations. A framework-request record may be kept while we continue to maintain and revise that framework so the requester can be told of material version changes, unless they opt out. Clinical information is retained under the Client Privacy Policy.
When information is no longer required, we take reasonable steps to delete it or de-identify it, subject to lawful record-retention requirements and technical backup cycles.
We use reasonable administrative, technical, and physical safeguards, including access controls and protected systems, but no internet transmission or system can be guaranteed to be completely secure. We promptly contain and assess suspected data breaches and comply with the Notifiable Data Breaches scheme when an eligible data breach occurs.

10 ACCESS, CORRECTION, COMPLAINTS AND CONTACT

You may ask to access or correct personal information we hold about you by contacting James Lyra at james@firstot.com.au. We may verify identity and will respond within a reasonable period. If an exception permits us to refuse a request, we will give written reasons where required and explain how to complain.
Privacy questions and complaints should first be sent to James Lyra, Privacy Officer, FIRST Occupational Therapy, Fyshwick ACT, at james@firstot.com.au or 0478 122 344. We will investigate and respond within a reasonable period.
If you remain dissatisfied, you may lodge a complaint with the Office of the Australian Information Commissioner via its online complaint process or at oaicintake@oaic.gov.au. A complaint concerning an ACT health service or health record may also be made to the ACT Human Rights Commission at human.rights@act.gov.au or (02) 6205 2222.
We may update this policy by publishing a revised version. The last-updated date appears at the beginning of the policy.

11 POINT-OF-COLLECTION NOTICES

Use the applicable notice beside the relevant submit or booking control and link the words ‘Website Privacy Policy’ to the published policy.

CONTACT FORM

We use these details to respond to your enquiry. Please keep the message general and do not attach detailed information about a child unless we direct you to a suitable channel. See our Website Privacy Policy.

UPDATES FORM

We use your name and email to send the updates you request. You can unsubscribe at any time. See our Website Privacy Policy.

FRAMEWORK REQUEST

We use these details to provide the requested framework and tell you if that framework is materially revised. Optional news and marketing consent must appear as a separate, unticked choice. See our Website Privacy Policy.

PROFESSIONAL-LEARNING BOOKING

We use booking and Participant details to process payment, administer attendance and provide programme access and Materials. If you book for another person, you confirm that you are authorised to provide their details and have given, or will promptly give, them this notice and access to our Website Privacy Policy. We may send booking confirmations and reminders directly to the Participant. See our Website Privacy Policy and Professional Learning Terms and Conditions.