Privacy statement
Privacy and Confidentiality Statement
How STEP Wellbeing collects, uses, protects and discloses information during its engagements. De-identified by default. Secure. Accountable.
STEP Wellbeing is committed to handling information carefully, lawfully and in a privacy-aware way in every engagement. This statement explains how Lachlan Marchant, trading as STEP Wellbeing (ABN 23 800 706 145), collects, uses, stores, discloses and protects information when providing services to schools and organisations.
How to read this statement
STEP provides systems-level consultancy to school leadership, staff and organisational systems. STEP does not work with individual students in a therapeutic, clinical or case-management capacity, and does not require identifiable student information to deliver its services. This statement is written for that context.
Purpose and scope
This statement applies to all STEP Wellbeing services, including the Wellbeing Capacity Review, Supervising Well, Implementation Partnerships, Operating Partnerships and Practice Advisory, whether delivered online or in person. It sits alongside the STEP Master Services Terms and the STEP Child Safety and Wellbeing Policy.
STEP aims to operate to high standards of confidentiality, de-identification and privacy-aware practice. STEP applies the spirit of the Australian Privacy Principles under the Privacy Act 1988 (Cth) as a matter of good practice, recognising that the specific legal obligations that apply may depend on STEP’s business structure, turnover and the nature of each engagement.
Information STEP may collect
| Information type | Examples | Purpose |
|---|---|---|
| Client contact and procurement | Names, roles, work emails, phone numbers, billing details, purchase order information. | Communication, quoting, invoicing and engagement administration. |
| School context | Enrolment size, staffing profile, wellbeing and inclusion structures, roles, meeting rhythms, referral pathways, placement student numbers. | Diagnostic review, implementation planning and service delivery. |
| Operational documents | De-identified process documents, role descriptions, meeting templates, supervision tools, referral flow diagrams. | Review of systems, readiness, risk and capacity. |
| Consultation notes | Themes from leadership, wellbeing team or staff consultation. | Analysis, recommendations and reporting. |
| Feedback and testimonial | Feedback, evaluation comments, case study notes and testimonial wording where consent is provided. | Quality improvement and agreed proof or case study use. |
Identifiable student, family and staff information
STEP does not require identifiable student, family or staff case information for standard services. Clients should de-identify information wherever possible before providing it to STEP.
Clear boundary
STEP is not engaged to provide individual student advice, risk assessment, therapy, counselling, clinical supervision or crisis response. Where student-level information is unavoidably shared, it is used only for the agreed purpose and handled in line with this statement.
- Avoid names, dates of birth, student numbers, addresses, specific family details or other identifying information unless expressly agreed and necessary.
- Discuss examples at a systems level rather than as individual case consultation.
- Do not send confidential student records, clinical notes, incident reports or sensitive case files unless specifically agreed in writing and necessary for the scope.
How information is used
- Deliver agreed STEP services, including diagnostics, implementation support, governance review, resource updates and practice support.
- Prepare proposals, reports, recommendations, summaries and agreed deliverables.
- Manage invoicing, scheduling, records, service quality and client communication.
- Improve STEP tools, language and processes using de-identified learning only.
- Use testimonial or case study material only where written permission has been provided.
Disclosure of information
STEP will
- Keep client information confidential and use it only for the agreed engagement.
- Disclose information only where authorised in writing, required by law, or reasonably necessary to manage a serious risk to a person’s safety.
- Share information with an insurer or professional adviser only where they are bound by confidentiality.
STEP will not
- Sell, rent or trade client information to any third party.
- Identify a school as a client, pilot site, STEP Partner School or case study unless agreed in writing.
- Disclose confidential information for marketing or unrelated purposes without consent.
Storage and security
- STEP takes reasonable steps to store information securely using STEP-controlled accounts, folders and devices, kept separate from any employer systems.
- Access is restricted to STEP personnel, or approved contractors who need access for the engagement and are bound by equivalent confidentiality.
- STEP avoids using personal email, employer systems or unmanaged storage for client information.
- Where documents are shared through a client’s own system, the client remains responsible for permissions and access controls on that system.
Artificial intelligence and digital tools
STEP will not enter identifiable student, family, staff or confidential client information into public AI tools without prior written approval. Where AI-enabled tools are used for drafting, structuring or administrative support, information is de-identified first and used consistently with client instructions and privacy expectations.
Retention and deletion
- STEP may retain engagement records, proposals, invoices, reports, signed agreements and key project notes for business, legal, insurance and professional record-keeping purposes.
- Working notes or documents containing sensitive information may be deleted or returned at the end of an engagement where agreed and operationally possible.
- A client may request deletion or return of specific information. STEP will respond reasonably, subject to legal, insurance, accounting or dispute-related retention needs.
Access and correction
A person or organisation may contact STEP to request access to, correction of, or clarification about information STEP holds about them or their organisation. STEP will respond within a reasonable time, subject to lawful and practical limitations.
Confidentiality in STEP Network or group settings
- Schools participating in STEP Network or group learning activities must not share identifiable student, family or staff information.
- Schools must respect the confidentiality of other participating schools, and must not copy, publish or redistribute another school’s information without permission.
- Examples are to be discussed in de-identified, systems-level terms.
Privacy or confidentiality incidents
If STEP becomes aware of a suspected privacy or confidentiality incident involving client information, STEP will take reasonable steps to contain the issue, assess the risk, notify relevant client contacts where appropriate, and cooperate with reasonable response steps. STEP will also consider whether any notification obligation applies under law.
Contact
Lachlan Marchant, Founder, STEP Wellbeing
Email lachlan@stepwellbeing.com.au
Web stepwellbeing.com.au
Post Woori Yallock VIC 3139
Related documents: STEP Master Services Terms · STEP Child Safety and Wellbeing Policy · STEP Conflict of Interest Policy and Management Plan · STEP Client Intake and Procurement Form · STEP Insurance Evidence Register. The signed original of this statement is available to client schools on request.