About this policy
This policy explains how Fly2 Health Group Pty Ltd (ABN 76 656 481 202), trading as Fly2Health, handles personal information. It covers our clients, their families and carers, people who refer to us, job applicants and visitors to our website.
We follow the Privacy Act 1988 (Cth), the Australian Privacy Principles and state and territory health records laws. As a registered NDIS provider, we also follow the NDIS Practice Standards and Code of Conduct. This policy does not cover records about our own employees, which the Privacy Act treats separately.
What we collect
We collect only what we need to provide and manage our services. This can include:
- your name, date of birth, address, phone number and email
- NDIS, Medicare and funding details, such as your NDIS number, plan and plan manager
- health information, such as referrals, diagnoses, assessments, session notes, goals and reports
- details of family members, carers, schools and other professionals involved in your support
- billing and payment details
- our emails, messages and phone calls with you, including call recordings
- photos or videos, only when needed for your service and with your consent
- what you give us when you apply for a job
Many of our clients are children. We usually collect a child’s information from their parent or guardian.
How we collect it
We collect information from you, or from someone acting for you, such as a parent, guardian or nominee. With your consent, or where the law allows, we also collect it from referrers, other health and education professionals, support coordinators, plan managers and the NDIA.
We collect it when you call, email, text, book online, fill in a form or attend a session.
You can make a general enquiry without giving your name. To provide a service, we need to know who you are.
How we use it
We use your information to:
- provide, plan and coordinate your services, including scheduling clinician visits to your community
- communicate with you and the people involved in your support
- write reports and share the updates you have agreed to
- send invoices and make claims to the NDIS, plan managers or Medicare
- keep our services safe and of good quality, train our staff, and handle complaints and incidents
- meet our legal and NDIS obligations
- tell you about our services, such as when appointments open near you (you can opt out at any time)
We do not use it for anything else unless you agree or the law allows.
Who we share it with
We share your information only when needed, with:
- people involved in your support, with your consent, such as your parent, guardian, nominee, GP, other health professionals, school, support coordinator or plan manager
- the NDIA, the NDIS Quality and Safeguards Commission and NDIS auditors, where required
- service providers who help us run our business, such as technology, communication, payment and document-signing services, who must keep it confidential. This includes overseas service providers and offshore operational staff we engage to assist us with administrative and back-office functions
- professional advisers, such as auditors, lawyers, accountants and insurers
- others when the law requires or allows it, such as to protect someone’s life, health or safety, or for child protection
We never sell your personal information.
AI and automated decisions
We use secure digital tools, including AI, to help our team. They may sort and prioritise enquiries, suggest draft replies, notes and reports, summarise phone calls and summarise information we already hold about your services.
These tools may use what you tell us, such as your name, contact details and the reason you contacted us. They may also use information we already hold, such as your appointments and records.
People stay in charge:
- Decisions made only by a computer program: none that significantly affect you, such as whether you receive a service or decisions about your care.
- Decisions a computer program helps with: the order and urgency in which we handle enquiries. Our systems set each enquiry’s first priority, and a staff member handles every enquiry and can change it.
- Checks: a staff member checks every reply before it is sent, and a qualified clinician checks and approves all clinical records and reports.
The staff member who handles your enquiry or checks a reply may be one of our offshore operational staff in the Philippines or South Africa.
The AI tools our team uses with your information run in Australian data centres. The people who build and maintain our systems also use AI assistants based in the United States, which may see information we hold while fixing a problem.
To improve suggested replies, our systems learn from our own guides and from past replies with names, contact details and other identifying details removed. We keep these examples for no more than 12 months. Your information is not used to train AI models run by other companies.
Phone calls
Calls to and from our team may be recorded to keep accurate records, check quality and train staff. Call recordings and voicemails are stored in Australia. Some call details, such as phone numbers and call times, have the United States as the processing location. Your call may be answered by one of our offshore operational staff in the Philippines or South Africa.
Our website and advertising
Our website uses cookies and similar tools to work properly, understand how it is used and measure our advertising. You can block cookies in your browser settings.
When you book, we may send an advertising partner a scrambled (one-way “hashed”) copy of your email address and phone number. They use it only to match the booking to an ad. We never share your health information with advertising partners.
We may send you news about our services. You can opt out at any time using the unsubscribe link or by replying STOP.
Information stored overseas
Our main systems, including client records and scheduling, are hosted in Australia. Some services we use store or process information overseas, mainly in the United States:
- email, messaging and contact management
- online agreement signing
- website hosting
- phone call details
- mapping, to work out travel distances and drive times (an approximate location only, such as a suburb, never your name or contact details)
- advertising partners (scrambled contact details only)
- AI assistants used to maintain our systems
- offshore operational staff who help with administrative and back-office functions, in the Philippines and South Africa
Before disclosing information to overseas recipients, we take reasonable steps to ensure they handle your information securely and in line with the Australian Privacy Principles.
How we protect and keep it
Only staff who need your information can see it, including our offshore staff. We use strong sign-in protection, encryption and activity logs. All staff, wherever they are based, must keep your information confidential.
We keep health records for at least 7 years after your last service, or until a child turns 25 if that is later. We keep other information only as long as we need it. We then securely destroy it or remove anything that identifies you.
If a data breach is likely to cause serious harm, we will tell you and the Office of the Australian Information Commissioner (OAIC).
Access, correction and consent
You can ask to see the information we hold about you, or to correct it. We will respond within 30 days and won’t charge you to ask. If we can’t give access or make a change, we will tell you why in writing.
A parent or guardian can usually ask on a child’s behalf. Young people who can make their own decisions can ask for themselves.
You can withdraw or change your consent at any time, although this may affect the services we can provide.
Complaints and Contact Information
For privacy questions, requests or complaints, contact Fly2 Health Group Pty Ltd:
- Email: hello@fly2health.com.au
- Phone: 1300 163 665
- Post: 40 Robbs Road, West Footscray VIC 3012
If you are worried about how we have handled your information, please contact us. We will acknowledge your complaint within 3 business days and aim to resolve it within 21 business days.
If you are not satisfied with our response, you can contact:
- the Office of the Australian Information Commissioner: oaic.gov.au or 1300 363 992
- for NDIS supports, the NDIS Quality and Safeguards Commission: ndiscommission.gov.au or 1800 035 544
- for health records, the health complaints body in your state or territory
Changes to This Privacy Policy
We review this policy regularly and update it when our practices change. The latest version is always on our website, with the date it was last updated. You can ask us for a free copy of this policy or of our Privacy and Dignity Policy.
Updated 21 October 2026