Our Privacy Policy: How We Collect, Use, and Protect Your Information

Your privacy matters to us. This policy explains how Kidera Pty Ltd collects, uses, discloses and looks after your personal information, in line with the Privacy Act 1988 and the Australian Privacy Principles.

Kidera does several different things, so this policy is sorted by how you deal with us. Read the part that applies to you, plus "Everyone" and "How we look after your information".

  • Part A, everyone. Visiting the website.

  • Part B, occupational therapy clients.

  • Part C, if you buy something from us.

  • Part D, if you download a free resource or join our email list.

  • Part E, if you use The Kidera Decks.

Part A: everyone

When you visit kidera.com.au we collect basic technical information such as the pages you looked at, roughly where in the world you are, and the type of device and browser you used. This comes from our website platform and from cookies.

We use it to understand which pages are useful and to fix things that are broken. We do not use it to identify you personally.

You can block or delete cookies in your browser. Some parts of the site may not work properly if you do.

Part B: occupational therapy clients

What we collect

In the course of providing occupational therapy we collect personal information such as your child's name, age, contact details and family circumstances.

We also collect sensitive information, which under the Privacy Act includes health information: health history, conditions, test results, examination findings, diagnoses, clinical opinions and functional assessments. We only collect sensitive information with your consent, or where the law requires or permits it.

How we collect it

Through intake forms, in sessions, by phone and by email. We may also receive information from third parties where you have given consent for them to share it with us, such as a school, a paediatrician or another therapist.

Why we collect it

To assess your child's needs, to plan and provide therapy, to report on progress, and to meet our obligations to funders such as the NDIS.

Who we share it with

With your authority, we may share information with your child's doctor, school, childcare or other providers involved in their care. We may also disclose information where the Privacy Act or another law requires or permits it.

If information you give us is incomplete or inaccurate we may not be able to provide the service you are seeking.

Part C: if you buy something from us

This covers physical products and digital products bought through our website.

What we collect

Your name, email address, billing address, shipping address where relevant, and the details of your order.

Payments

Payments are processed by Stripe. Your card number goes directly to Stripe and is never seen or stored by us. We can see the last four digits, the card type and whether the payment succeeded. Stripe handles your payment information under its own privacy policy.

Who else sees it

  • Australia Post or a courier, if we are sending you something physical

  • Our accountant and the Australian Taxation Office, as part of ordinary business record-keeping

We do not sell customer information to anyone, and we do not share it with advertisers.

Part D: if you download a free resource or join our email list

What we collect

Your email address, and your first name if you give it. Nothing else is required.

Where it goes

Your email address is stored in Mailchimp, which is the service we use to send our email list. Mailchimp records whether you opened an email and whether you clicked a link in it, and we use that to work out which emails are worth sending.

What we send

Occasional emails about play, sensory needs, child development and new Kidera resources. Every email has an unsubscribe link at the bottom, and unsubscribing takes effect immediately.

If you unsubscribe

We remove your details from our active list. Mailchimp keeps a record that you unsubscribed, which is what stops you being added back by mistake.

Part E: if you use The Kidera Decks

The Kidera Decks is a web app for sorting cards about a child. This part explains exactly what happens to what a child says.

The card answers never leave the device

When a child sorts the cards, every answer is held in the browser on the device being used. Those answers are not sent to us, not stored on any server, and not visible to anyone at Kidera. We could not read them if we wanted to.

The summary and the PDF are built on the device from those same answers. If you close the tab without downloading the PDF, the answers are gone, including from our side, because we never had them.

What we do collect

If you use a free deck, we ask for your email address before showing the summary. That address goes to Mailchimp and Part D applies to it. We do not attach any card answers to it.

If you buy the decks, we hold your email address and your purchase record in Stripe. We use your email address to send you an access link, and to let you get a new link if you lose the first one.

The access link

Your access link contains your email address and an expiry date, signed so it cannot be altered. We do not keep a database of who has access. The link itself, plus your record in Stripe, is the whole system. Access runs for 3 months from purchase.

Services involved

  • Vercel hosts the app

  • Stripe processes the payment and holds the purchase record

  • Resend sends the access email

  • Mailchimp holds email list subscriptions

How we look after your information

Sending information overseas

Some of the services we use are based outside Australia and store information on servers overseas, mainly in the United States. This means your personal information may be disclosed to, and stored in, other countries.

  • Squarespace, website hosting and form submissions. United States.

  • Stripe, payments and purchase records. United States and Ireland.

  • Mailchimp (Intuit), the email list. United States.

  • Resend, sending access emails. United States.

  • Vercel, hosting The Kidera Decks. United States.

We take reasonable steps to use services that handle personal information securely and that are bound by contractual obligations to protect it. Clinical records for occupational therapy clients are held in Australia and are not sent to any of the services above.

How long we keep things

  • Clinical records for OT clients. Kept for the period required by the record-keeping obligations that apply to registered health practitioners. Records for children are kept longer than records for adults.

  • Order and payment records. 7 years, as required by Australian tax law.

  • Email list subscriptions. Until you unsubscribe.

  • Website analytics. Up to 26 months.

  • Card deck answers. Never collected, so never kept.

Security

We take reasonable steps to protect your information from misuse, loss and unauthorised access. This includes secure hosting, encrypted payment processing through Stripe, and limiting access to client records to those who need it.

If something goes wrong

If a data breach occurs that is likely to cause serious harm, we will notify you and the Office of the Australian Information Commissioner, as the Privacy Act requires.

Seeing and correcting your information

You can ask for a copy of the personal information we hold about you, and ask us to correct anything that is wrong. Email referrals@kidera.com.au. We will respond within 30 days. In limited circumstances the Privacy Act allows us to refuse access, and if that happens we will tell you why in writing.

Complaints

If you think we have mishandled your personal information, email referrals@kidera.com.au and we will investigate and respond. If you are not satisfied with our response you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

Changes to this policy

We review this policy from time to time.

Last updated: 14 August 2026