How I collect, use and protect your personal information, made easy.

Found Objects Creative Therapies is run by me, Kimberly Howeler (ABN 38 271 226 735). This policy explains what personal information I collect, why I collect it, and how I keep it safe. It covers this website, enquiries, bookings, payments and sessions.  I provide health services in Australia, I follow the Australian Privacy Principles in the Privacy Act 1988.

A snap shot

• I only collect what I need to support you and run my practice.

• I never sell your information or use it for advertising.

• Anything you share in sessions is treated as confidential.

• This website collects only necessary cookies, analytics or tracking. 

• You can ask to see, correct or delete your information at any time.

What I collect

When you contact me Your name, email address, where you live, what you're interested in, and anything you write in your message. Please keep health details in the contact form brief. We can talk about them properly once we connect.

When we work together To provide safe, ethical sessions, I keep records. These may include:

• your contact details, and for young people, a parent or guardian's details

• background, goals and wellbeing information you choose to share

• session notes

• photos of artwork made in sessions, only with your permission

• for NDIS participants, your NDIS number, plan management details and invoices [remove this line if you're not NDIS-registered]

Some of this is sensitive health information. I only collect it with your consent, and only when it's needed for our work together.

When you visit this website This website doesn't use cookies, analytics or tracking tools. Like most websites, the hosting service, wix.com, may keep basic technical logs, such as IP addresses, for security.

How I use your information

• To reply to your enquiry

• To book, deliver and follow up on sessions

• To keep accurate, professional records

• To issue invoices and take payments, including NDIS claims [remove if not applicable]

• To meet my legal, insurance and professional obligations

I'll only send you news or offers by email if you've signed up for them, and you can unsubscribe at any time.

Who I share it with

I only share information when it's needed, with:

• services that help me run my practice, such as my email, booking calendar, payments and contact form providers, which may only use it to provide their service to me [list your actual tools here, e.g. Google, Stripe, etc.]

• your NDIS plan manager, if you're plan-managed, for invoicing [remove if not applicable]

• other people involved in your care or support, such as a GP or school, only with your consent

• anyone I'm required to share it with by law, or where there's a serious risk to someone's safety

I never sell or rent personal information.

Information stored overseas

Some of the services I use may store information outside Australia. I choose services with strong security and privacy protections. [If all your tools are Australian-hosted, you can remove this section entirely. If not, list where data may be stored.]

How I keep it secure

• Records are kept in secure, password-protected systems with two-step sign-in.

• My work computer is encrypted and used only for my practice.

• I keep session details out of everyday email and messaging.

• Only I can access your records.

How long I keep it

Health records are kept for at least 7 years after our last session. For young people, they're kept until the young person turns 25, if that's later. After that, they're securely deleted.

Enquiries that don't lead to sessions are deleted once they're no longer needed.

Your rights

You can ask me to:

• show you the information I hold about you

• correct anything that's wrong or out of date

• delete your information, unless I'm legally required to keep it

• stop using it for a particular purpose, or withdraw your consent

To make a request, email me at [your email address]. I'll reply within 30 days.

Young people

For children and teens, I usually collect information from a parent or guardian. Young people can ask about their own information too, and I'll take their age and maturity into account when I respond.

Concerns or complaints

If you're unhappy with how I've handled your information, please tell me first so I can put it right. If you're still not satisfied, you can contact the Office of the Australian Information Commissioner, at oaic.gov.au.

Changes to this policy

I may update this policy from time to time. The latest version will always be on this page.

​

Last updated 16 September 2026