Privacy Policy
Cullen & Co Health Services
Last updated: November 2026
1. Introduction
Cullen & Co Health Services (Cullen & Co, we, us or our) is committed to protecting the privacy, confidentiality and personal information of our clients, families, employees, stakeholders and website visitors.
We recognise that the information shared with us, particularly health and personal information, is often sensitive and private. We take our responsibility to manage this information with care, respect and integrity.
This Privacy Policy outlines how we collect, use, store, disclose and protect personal information in accordance with applicable Australian privacy legislation, including the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs) and the Health Records and Information Privacy Act 2002 (NSW).
2. What information do we collect?
The type of information we collect depends on your interaction with Cullen & Co.
This may include:
Personal information
Full name, date of birth and contact details.
Residential and postal addresses.
Emergency contact details.
Information about family members, carers and nominated representatives.
Employment and relevant background information.
Health and sensitive information
Medical history, diagnoses and health conditions.
Physical, cognitive, psychological and functional information.
Information relating to disability and support needs.
Assessment results, clinical observations and therapy notes.
Information provided by other health professionals and treating teams.
NDIS plans, goals, funding information and support arrangements.
Website information
Information submitted through referral forms.
Email addresses and contact details.
Website usage information, including IP addresses, browser information and interactions with our website, where collected through cookies or analytics.
We only seek to collect information that is reasonably necessary for our business activities and the provision of our services.
3. How do we collect personal information?
We may collect personal information directly from you or from other relevant sources, including:
Online forms.
Telephone calls, emails and written correspondence.
Referrals from Support Coordinators, Local Area Coordinators, GPs and other health professionals.
Parents, family members, carers and nominated representatives, where appropriate.
NDIS plans and relevant supporting documentation.
Assessments, consultations and therapy appointments.
Other service providers involved in your care, where authorised or otherwise permitted.
Where reasonable and practicable, we will collect personal information directly from the individual concerned.
Where information is provided by another person or organisation, we will take reasonable steps to ensure that the individual is informed about the collection and how their information may be used.
4. Why do we collect personal information?
We collect and use personal information to support the safe, effective and appropriate delivery of our services.
This may include:
Responding to enquiries and processing referrals.
Determining service suitability and availability.
Providing Occupational Therapy and Speech Pathology services.
Conducting functional assessments and preparing clinical reports.
Developing therapy plans and supporting individual goals.
Coordinating care with other relevant professionals and support providers.
Communicating with clients, families and nominated representatives.
Managing NDIS funding, service agreements, invoicing and administration.
Meeting professional, legal, regulatory and record-keeping obligations.
Managing recruitment, employment and business operations.
We will not use personal information for purposes unrelated to its original collection unless permitted or required by law.
5. Disclosure of personal information
Cullen & Co respects the confidentiality of personal information.
We may share relevant information with other individuals or organisations where necessary for service delivery, administration or legal compliance.
This may include:
Support Coordinators and NDIS representatives.
General Practitioners and medical specialists.
Psychologists and other treating health professionals.
Other allied health providers.
Family members, carers or nominated representatives, where appropriate and authorised.
Government agencies and regulatory bodies where required or authorised by law.
Third-party providers who assist us with business operations, administration, technology and secure information storage.
We only disclose information where there is an appropriate purpose and a lawful basis to do so. We seek consent where required and limit disclosures to information relevant to the purpose.
We do not sell personal information to third parties.
6. Storage and security of information
We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification or disclosure.
We use appropriate administrative, technical and organisational safeguards to protect the information we hold.
These safeguards may include:
Secure electronic record-keeping systems.
Password protection and access controls.
Restricting access to authorised personnel.
Confidentiality obligations for employees and contractors.
Secure communication and information-sharing practices.
Appropriate disposal of information when it is no longer required.
While we take reasonable steps to protect personal information, no method of electronic storage or transmission can be guaranteed to be completely secure.
7. Website, cookies and third-party services
Our website may use cookies and third-party services to support website functionality, understand visitor activity and improve the user experience.
These technologies may collect information such as IP addresses, browser types, pages visited and website interactions.
We may use third-party website hosting, analytics, communication and form-processing services to support our website and business operations.
These providers may collect or process information in accordance with their own privacy policies and applicable privacy requirements.
Where personal information is disclosed to overseas recipients, we will take steps to comply with applicable Australian privacy requirements.
You may be able to manage or disable cookies through your internet browser settings. Please note that disabling cookies may affect some website functionality.
8. Accessing and correcting your information
You have the right to request access to personal information that Cullen & Co holds about you and to request corrections if you believe the information is inaccurate, incomplete, out of date or misleading.
Requests can be made by contacting us using the details provided below.
We will respond to requests in accordance with applicable privacy legislation. In certain circumstances, we may be unable to provide access to particular information where an exemption applies. If this occurs, we will explain the reasons where we are permitted to do so.
9. Consent and confidentiality
We recognise the importance of informed consent, privacy and individual choice.
Where appropriate, we will seek consent before collecting, using or disclosing personal and health information.
Individuals may withdraw or amend their consent at any time, subject to legal, professional and service-related obligations.
We understand that individuals have the right to make decisions about who is involved in their care and what information is shared.
Where information relates to a child or a person who requires support with decision-making, we will consider applicable consent, guardianship, substitute decision-making and supported decision-making requirements.
10. Retention and disposal of information
Cullen & Co retains personal and health information for as long as it is reasonably required for the purposes for which it was collected, to meet legal and professional obligations, or as otherwise permitted or required by law.
When information is no longer required, we take reasonable steps to securely destroy or de-identify it, unless we are required to retain it.
11. Privacy concerns and complaints
We take privacy concerns seriously and are committed to addressing complaints respectfully and promptly.
If you believe your personal information has been mishandled, accessed without authorisation or disclosed inappropriately, you can contact Cullen & Co using the details below.
We will review your concern, investigate where appropriate and work towards a reasonable resolution.
If you are not satisfied with our response, you may be able to lodge a complaint with the relevant privacy regulator, including:
Office of the Australian Information Commissioner (OAIC): www.oaic.gov.au
NSW Information and Privacy Commission: www.ipc.nsw.gov.au
12. Changes to this Privacy Policy
Cullen & Co may update this Privacy Policy from time to time to reflect changes to our services, business practices or applicable legislation.
The most recent version will be published on our website, including the date of the latest update.
13. Contact us
If you have questions about this Privacy Policy, wish to access or correct your personal information, or would like to raise a privacy concern, please contact:
Cullen & Co Health Services
Email: admin@cullenandco.au
Phone: 0480 564 474
Address: 2/70-72 Orlando Road Lambton NSW 2299
We welcome questions and are committed to protecting the privacy, dignity and rights of everyone we work with.