Privacy Policy

Effective date: 30 July 2026

Multi-Coached Pty Ltd (“Multi-Coached”, “we”, “us”, “our”) is committed to protecting your privacy and the security of your personal information. This Privacy Policy explains how we collect, use, store, and disclose personal information in compliance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). It applies to all users of our services, including our product OT-Me., and covers personal information collected through our websites, applications, and other interactions.

Because OT-Me. is used by children and handles health-related information provided through parents, schools, and clinicians, this policy explains in detail how that information is collected, who is responsible for it, and how it is processed.

1. Information we collect

1.1 Account holders

For parents, clinicians, teachers, and school or clinic administrators, we collect your name and email address. Where a paid subscription applies, billing details are collected and processed securely by our payment provider (Stripe). We do not store your full card details.

1.2 Children and students

Information about a child is entered by a supervising adult — a parent, guardian, clinician, or teacher. We collect:

• The child’s first name and last initial only. Full surnames are not stored.
• The child’s date of birth.
• Information entered to build the child’s support plan, including areas of need, goals, activities, activity completion, and progress data.

Date of birth is collected for the sole purpose of delivering age-appropriate goals, activities, and strategies, and to move a child to the next age band as they grow. It is not used for any other purpose.

1.3 Sensitive and health information

Some information collected to build a child’s support plan may constitute sensitive information or health information under the Privacy Act 1988 (Cth). We collect sensitive and health information only where it is reasonably necessary to provide the service, and only where the individual, their parent or guardian, or another person legally authorised to act for them has provided consent, or where the collection is otherwise permitted by law. We use this information only to provide the OT-Me. service and not for any secondary purpose.

1.4 Technical and usage information

When you use our website and platform, we collect technical and usage information, which may include personal information such as IP addresses, device identifiers, browser information, and account activity. This is described further in section 10.

2. How we collect information

• Directly from you when you register, subscribe, or use OT-Me.
• From parents, schools, and clinicians when they enter information about a child in their care (see section 4 for who is responsible in each case).
• Automatically through cookies and similar technologies when you use our website and platform.

3. How we use your information

We use personal information to:

• Provide, maintain, and improve the OT-Me. service.
• Deliver personalised, age-appropriate content to each child.
• Manage subscriptions, licences, and billing.
• Communicate service updates and relevant information.
• Comply with legal and regulatory obligations.

We do not use personal information for marketing without your prior consent.

4. Parent, school, and clinician accounts

How information is collected and who is responsible for it depends on the type of account:

• Parent subscriptions. Where a parent subscribes directly, Multi-Coached usually collects the child’s information directly from the parent, and the parent is responsible for the information they enter.
• School accounts. Where a school holds the account, the school is generally responsible for obtaining the appropriate authority from families and for providing any required collection notices to parents and carers. Multi-Coached processes the information in accordance with its agreement with the school.
• Clinician accounts. Where a clinician holds the account, the clinician is generally responsible for obtaining informed consent from the client or their parent or guardian before entering information. Multi-Coached processes the information in accordance with its agreement with the clinician or clinic.

In all cases, Multi-Coached handles information according to its agreements with these organisations. If your child’s account is administered by a school or clinician, you may need to make an access, correction, or deletion request through that organisation, and we will assist where appropriate.

5. Where your information is stored and processed

Our primary application database and file storage are hosted in Australia, in the Sydney region. Certain operational, email, artificial-intelligence, application-delivery, payment, and support information may be processed or stored overseas by the providers listed below. Technical logs and metadata may also be processed through these providers’ global infrastructure.

We take reasonable steps to ensure that overseas service providers handle personal information consistently with the Australian Privacy Principles, including through encryption in transit and at rest and appropriate access controls. Where required, we obtain express consent before disclosing sensitive or health information to an overseas service provider.

6. How we use artificial intelligence

OT-Me. uses OpenAI’s API to help generate draft support plans, goals, and strategies. This applies only when a support plan is created; it is not used to record or track a child’s day-to-day activities.

• What is sent: the child’s first name, the child’s age, and the areas of need and goals identified in the assessment. The child’s date of birth and surname are not sent.
• Drafts, not final decisions: the generated content is a draft. Where a clinician is involved, it is reviewed and may be adjusted by the clinician. It is intended to support, not replace, professional judgement.
• Not used for training: we have configured our use of the OpenAI API so that the information submitted is not used to train OpenAI’s models.
• Retention by OpenAI: OpenAI may retain inputs and outputs for a limited period (generally up to 30 days) for security and abuse monitoring, after which they are deleted.
• Minimisation: we limit the identifying information submitted, and we recommend that users do not enter any information that is not needed to generate the plan.

7. Disclosure of information

We may disclose personal information to:

• The service providers listed in section 5, for the purposes described.
• Legal or regulatory authorities, where required by law or to prevent harm.

We do not sell personal information, and we do not disclose it for third-party advertising.

8. Data security

We implement reasonable measures to protect personal information, including:

• Encryption of data in transit and at rest.
• Role-based access controls and database-level access restrictions, so that users can only access the information they are authorised to see.
• Access limited to authorised personnel.
• A documented data-breach response process (see section 13).

No method of transmission or storage is completely secure, and you are responsible for maintaining the security of your own account credentials.

9. Children’s privacy

OT-Me. is designed to be used by children under the supervision of a parent, guardian, clinician, or teacher.

• A child’s account is created and controlled by a supervising adult. Children do not sign up independently.
• Children are identified by first name and last initial only. Full surnames are not stored.
• A child’s information is used only to deliver their activities, games, goals, and rewards, and to track progress for the supervising adult.
• We apply privacy-protective defaults, collect only what is needed, and do not profile children.
• We do not show advertising to children, and we do not sell or share children’s personal information for advertising or marketing.
• A supervising adult can view, correct, or request deletion of a child’s information at any time (see section 11).

We monitor developments in Australian law relating to children’s privacy, including the Children’s Online Privacy Code, and will update our practices as requirements come into effect.

10. Cookies, analytics, and tracking

Our website uses cookies and similar technologies, including tag-management and analytics tools provided by Google, to understand how the site is used and to improve it. These tools may set cookies and collect technical and usage information, which can include IP addresses, device identifiers, browser information, and site activity, and which may constitute personal information.

Essential cookies are needed for the website and platform to function. You can control or reject non-essential cookies through your browser settings, though some features may be affected. We do not use behavioural tracking to profile children.

11. Access to and correction of your information

Under the Privacy Act 1988 (Cth), you have the right to access the personal information we hold about you and to request corrections to information that is inaccurate, out of date, or incomplete.

• How to make a request: contact us at hello@multicoached.com with details of the information you wish to access or correct.
• Verifying your identity and authority: we will take reasonable steps to verify your identity before acting on a request. Where a request relates to a child’s information, we will require you to demonstrate that you are the child’s parent, guardian, or otherwise authorised to act for the child. Where the account is administered by a school or clinician, we may direct or assist you to make the request through that organisation.
• Response time: we aim to respond to access and correction requests within 30 days.
• When access may be limited: in some cases we may be unable to provide access or make a correction — for example, where doing so would be unlawful, would affect another person’s privacy, or where an exception under the Privacy Act applies. If we refuse, we will explain why and how you can respond.

12. Dealing with us anonymously

You may contact us with a general enquiry without identifying yourself. However, we may need identifying information to create and manage an account, deliver personalised support plans, process payments, provide technical support, or respond to an access, correction, or deletion request.

13. Retention, deletion, and data-breach response

13.1 Retention and deletion

We retain personal information only for as long as needed to provide the service or as required by law. You may close your account at any time from within the app or by contacting us.

Following account closure, personal information — including any children’s information linked to the account — is ordinarily scheduled for deletion after a 30-day recovery period. Some information may remain temporarily in secure backups, system logs, or records that we are required to retain by law. Such information remains protected and is deleted or de-identified in accordance with our retention schedule.

Where an occupational therapist creates clinical records through OT-Me., those records may be subject to professional and legal health-record retention obligations, which can require them to be kept for a defined period. In those cases, retention is governed by the applicable obligations rather than the standard deletion period above.

You can request deletion of your personal information at any time by contacting hello@multicoached.com.

13.2 Data-breach response

We comply with the Notifiable Data Breaches (NDB) scheme. A data breach occurs when personal information is lost, accessed without authorisation, or disclosed without authorisation.

In the event of a breach, we will:

1. Identify and assess the incident promptly — generally within 30 days — to determine its nature and scope and whether it meets the threshold for notification.
2. Contain it by disabling affected systems or accounts, resetting credentials, and isolating affected data.
3. Evaluate the risk of serious harm, considering the type of information involved, the potential consequences, and the likelihood of misuse.
4. Notify affected individuals directly and submit a notification to the Office of the Australian Information Commissioner (OAIC) where a breach is likely to result in serious harm.
5. Remediate the underlying cause and update our security measures and practices to prevent recurrence.

If you are notified of a breach, we recommend reviewing the notice, taking protective steps such as changing passwords and monitoring your accounts, and contacting us for guidance.

14. Complaints

If you have a privacy complaint, please contact us first at hello@multicoached.com. We will acknowledge your complaint within a reasonable period, investigate it, and aim to provide a written response within 30 days. We may contact you for further information to help us resolve it.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC): Website: www.oaic.gov.au Phone: 1300 363 992

15. Updates to this policy

We may update this Privacy Policy from time to time. Changes will be posted on our website and, where appropriate, communicated by email. Continued use of our services after an update constitutes acceptance of the revised policy.

16. Contact us

Multi-Coached Pty Ltd Perth, Australia Email (general and privacy enquiries): hello@multicoached.com

By using OT-Me., you acknowledge that you have read and understood this Privacy Policy and understood this Privacy Policy.