Privacy policy

Who we are

Hey Sprout (heysprout.com.au) is an Australian online speech therapy, occupational therapy and psychology service. ABN: pending. When this policy says "we" or "us", it means Hey Sprout.

Questions about privacy? Email hello@heysprout.com.au.

What we collect

• Enquiries: your name, email, phone number, the services you're interested in, and anything you write in your message.
• Screener: your answers about your child's speech, movement and feelings, plus your name and email if you ask us to get in touch.
• Bookings: your name, email and mobile; your child's first name and age; notes you want your therapist to know; and NDIS details — NDIS number, how your plan is managed, and your plan manager's name and email.
• Parent accounts: your name, email and password (we store passwords in a protected, hashed form, never as plain text).
• Therapy records: session notes and care plans written by your clinician.
• Newsletter: your email address.
• Clinician applications: name, email, phone, AHPRA number, disciplines, years of experience and the bio you send us.
• Technical information: your IP address (used to stop spam and abuse of our forms), your device and pages visited, and campaign and ad-click identifiers such as UTM values and gclid when those are present in a link (see Analytics and cookies).

You can browse this site without telling us who you are. To arrange therapy or claim NDIS funding we need your real details.

Why we collect it

• To respond to your enquiry or screener.
• To arrange and deliver therapy, including matching you with a clinician and running sessions.
• To invoice NDIS-funded sessions, including sending invoices to your plan manager.
• To run the website and your account, and keep them secure.
• To understand how the site is used so we can improve it.
• To assess applications from clinicians who want to work with us.

Health information and consent

Information about a child's health, development or wellbeing is sensitive information under the Privacy Act 1988 (Cth). We only collect it with consent — from a parent or guardian, or from the person themselves — and only when we need it to help. Our forms ask you to confirm this before you send anything. You don't have to share health information, but we may not be able to provide therapy without it.

Children's information

Most of the people we help are children. Our forms are designed to be filled in by a parent or guardian, or by an adult client for themselves. Information about a child comes from their parent or guardian and is used only to arrange and provide that child's care.

How we store and protect it

Your information is stored by the service providers listed below and sent over encrypted (HTTPS) connections. We limit access to the people who need it — for example, the clinician working with your child. No system is perfectly secure, so if you think your account has been misused, tell us straight away.

Who we share it with

• The clinician who treats your child (or you).
• Your NDIS plan manager, so your sessions can be invoiced.
• The service providers we use to run Hey Sprout (listed below).
• Others when the law requires or allows it — for example, to protect a child from harm.

We don't sell your information.

Service providers and overseas disclosure

Some providers store or process information outside Australia. The locations below reflect the current configuration where it is known. Vercel, Cloudflare and Google also use global networks. The exact production server-side Sentry destination and organisation storage region, Plausible server country, and our destination mailbox's provider and storage region still need confirmation before this interim policy is final.

• Vercel — website hosting. Our production functions run in Sydney, Australia. Vercel says its platform may process or transfer data in the United States and other countries.
• Convex — our application database. The Production deployment is in US East (Northern Virginia).
• Resend — transactional email. Resend stores customer data in the United States, regardless of the sending region.
• Zoom — video sessions. Zoom stores customer data in the United States by default and routes real-time meeting traffic through its global network.
• Cloudflare — DNS and inbound email routing. Messages are forwarded to our configured mailbox; the mailbox provider and its storage region still need confirmation.
• Sentry — error monitoring. The Production browser client sends events to Sentry's US-region ingestion host. We configure the SDK not to send default personal identifiers; the server-side destination and organisation's storage region still need confirmation.
• Google Analytics 4 and Google Tag Manager — website analytics. Google uses regional data collection centres and global processing infrastructure; data may be processed in multiple countries.
• PostHog — page views and product events. The production site sends this event data to PostHog's US cloud endpoint at us.i.posthog.com.
• Plausible Analytics — cookie-free website analytics, run on a server operated by Kaizen Brands, the company behind Hey Sprout. The server's country still needs confirmation.

Analytics and cookies

We use analytics to see which pages are useful and where the site needs work:

• Google Analytics 4 uses cookies to count visits and page views.
• PostHog records page views and product events. It doesn't capture the text of what you click, and any session recordings mask all text and everything typed into forms.
• Plausible counts page views without using cookies.
• Sentry reports errors so we can fix them.

We also use cookies to keep you signed in, and a referral cookie (kept for 90 days) when you arrive through a share link from another family. A first-visit cookie (kept for 90 days) records campaign tags, ad-click identifiers such as gclid, the referring website and landing page. We send the current page URL, including any query parameters present, and limited event metadata to analytics services. Event properties do not intentionally include names, email addresses or form answers. The attribution details are saved with an enquiry you submit. We don't currently use advertising cookies or advertising pixels. You can block or delete cookies in your browser settings; signing in needs cookies to work.

How long we keep it

• Enquiries and screener results — our current interim target is up to 24 months if you don't become a client; this period needs legal review.
• Clinical records — our current interim target is at least 7 years after your last contact with us, or until the child turns 25, whichever is later. The applicable state and territory requirements need legal confirmation.
• Newsletter — until you unsubscribe.
• Everything else — only as long as we need it for the reasons above. Then we delete or de-identify it.

Accessing and correcting your information

You can ask for a copy of the information we hold about you or your child, or ask us to correct it. Email hello@heysprout.com.au. We'll check your identity and respond within 30 days. If we can't give you access in a particular case (the law allows this in limited situations), we'll explain why.

Data breaches

If a data breach is likely to cause serious harm to anyone, we'll notify the people affected and the Office of the Australian Information Commissioner (OAIC), as the Notifiable Data Breaches scheme requires.

Complaints

If you're unhappy with how we've handled your information, please tell us first at hello@heysprout.com.au and we'll respond within 30 days. If you're not satisfied with our response, you can complain to the OAIC at oaic.gov.au or on 1300 363 992.

Changes to this policy

We'll update this page when our practices change and show the new date at the top. This is an interim policy and will be updated after legal review.