Privacy Policy
Itty Bitty Bub – Privacy Policy
Version 2.0 · Effective [01.10.2026]
Itty Bitty Bub is the midwifery and lactation practice of Keryn Thompson (ABN 43 510 139 206). I am a registered midwife with an endorsement for scheduled medicines and an International Board Certified Lactation Consultant (IBCLC). In this policy, "I", "me" and "my" mean Keryn Thompson trading as Itty Bitty Bub.
Your privacy, and your baby's, matters to me. This policy explains what information I collect, why, how I keep it safe, who I share it with, and your rights. I follow the Australian Privacy Principles in the Privacy Act 1988 (Cth) and the Health Privacy Principles in the Health Records and Information Privacy Act 2002 (NSW).
1. What information I collect
Personal information, such as your name, date of birth, address, phone, email, emergency contact, and how you heard about me.
Health information about you and your baby, such as:
your medical, pregnancy, birth, breastfeeding and mental health history
your baby's birth details, weight, feeding and health
notes from our consultations, including assessments, observations and care plans
photos or videos you send me, or that I take with your consent, to help assess feeding (for example, a photo of a latch or a nipple injury)
information from other health professionals involved in your care
Billing information, such as your Medicare card number and private health fund details. I don't store credit card numbers; card payments are processed by my payment provider.
Website information, such as messages you send through my website and basic, non-identifying data about how people use the site (see section 9).
2. How I collect it
Mostly directly from you: through my online booking system, intake and consent forms, during consultations, and by phone, text or email.
Sometimes from others, with your consent or where the law allows, such as a referral from your GP, obstetrician, hospital or child and family health nurse. When I'm caring for your baby, I collect your baby's information from you as their parent or guardian.
You can deal with me anonymously or using a pseudonym for general enquiries. For consultations this isn't practical, because I need to identify you to provide safe care and to claim Medicare.
3. Why I collect and use it
to provide safe midwifery and lactation care to you and your baby
to keep accurate clinical records, as my professional standards and the law require
to communicate with you about appointments, your care and follow-up
to liaise with your other health professionals when needed for your care
to process payments, Medicare claims and health fund receipts
to run my practice, including administration, insurance, audits and professional supervision
to meet legal obligations
I will not use your health information for marketing, and I will never sell your information.
4. Who I may share it with
I only share what's needed, and usually with your consent. This may include:
Your care team: your GP, obstetrician, hospital or birth centre midwives, private midwife, paediatrician, child and family health nurse, and any health professional you're referred to, such as a speech pathologist, paediatric dentist, ENT, physiotherapist, osteopath or chiropractor, dietitian, or perinatal mental health professional.
Medicare (Services Australia) and your private health fund, to process claims.
Trusted service providers who help run my practice, such as my clinical records, booking and telehealth system (Cliniko), my online forms provider (Finger-Ink), my AI scribe (Heidi Health), my email, website and payment providers, and my accountant or bookkeeper. They may only use your information to provide their service to me.
My professional indemnity insurer or legal adviser, if needed to manage a claim or complaint.
Clinical supervisors or peers, for professional advice about your care. I remove identifying details wherever possible.
When I may share information without your consent. As a registered health practitioner I'm a mandatory reporter. I must share information without your consent where:
I believe a child is at risk of significant harm (I must report this to the NSW Department of Communities and Justice)
it's needed to lessen or prevent a serious threat to someone's life, health or safety
I'm required by law, a court order or subpoena, or by a regulator such as Ahpra
Where it's safe and appropriate, I'll talk with you before sharing.
5. Phone, text, email and video calls
I often speak with clients by ordinary phone call, text and email. These are convenient but not fully secure, and there's a small risk that information sent this way could be intercepted. By contacting me this way you accept that risk. If you'd prefer, tell me and we can use another method, such as discussing things in person.
Video (telehealth) consultations are held through Cliniko's secure telehealth platform. I don't record telehealth consultations.
Please don't send urgent clinical questions by email or text. If you or your baby need urgent help, call 000 or go to your nearest emergency department.
6. AI scribe
With your consent, I may use an AI scribe (Heidi Health) during consultations to help write my clinical notes. Heidi creates a transcript and draft notes in real time; the audio is not stored. Heidi stores Australian users' data in Australia and does not use it to train its AI. I check and finalise every note myself, save it into your record, and then delete the draft from Heidi. You can say no to the AI scribe at any time without it affecting your care.
7. How I store and protect your information
Your clinical record is kept electronically in Cliniko, which stores Australian practices' data on secure servers in Australia.
Some information is also held on my password-protected, encrypted laptop and on a password-protected computer at my clinic space. These devices are locked when not in use and only I can access my client files.
If I receive paper documents, I scan them into your record and securely shred the paper.
I protect your information by:
using strong passwords and two-factor login on my systems
limiting access to me and anyone working with me who is bound by confidentiality
keeping my devices and software up to date
only using service providers with appropriate privacy and security standards
No system is completely secure. If a data breach is likely to cause you serious harm, I will notify you and the Office of the Australian Information Commissioner (OAIC), as required by the Notifiable Data Breaches scheme.
8. Information stored or handled overseas
My main clinical records stay in Australia. However, some of my service providers, or their subcontractors, may store or process limited information outside Australia, for example email and SMS appointment reminders, my online forms provider (New Zealand), and my website host (United States). I choose providers who take reasonable steps to protect information in line with Australian privacy law.
9. My website
My website is hosted by Squarespace. When you visit, Squarespace and analytics tools may collect basic, non-identifying information such as your browser type, pages visited and general location, using cookies. You can turn off cookies in your browser settings.
If you contact me through a website form, I receive your name, contact details and message by email. Please don't include detailed health information in website forms; I'll collect that securely once you book.
10. How long I keep your information
As NSW law requires, I keep health records:
for adults: at least 7 years from your last appointment
for information collected about a child, including your baby: until the child turns 25
After that, I securely and permanently delete or destroy records, and keep a register of what was disposed of and when.
11. Accessing and correcting your information
You can ask to see or get a copy of the information I hold about you or your baby, or ask me to correct it. Please contact me in writing. I'll respond within 30 days. I won't charge you to make a request. I may charge a reasonable fee to cover the cost of copying, which I'll tell you about first.
In rare cases I may refuse access where the law allows, for example if access would pose a serious threat to someone's life, health or safety. If so, I'll explain why in writing.
12. Complaints
If you're worried about how I've handled your information, please contact me first so I can try to fix it. I'll acknowledge your complaint within 7 days and aim to resolve it within 30 days.
If you're not satisfied, you can contact:
the Office of the Australian Information Commissioner (OAIC): oaic.gov.au, 1300 363 992
the Information and Privacy Commission NSW (IPC): ipc.nsw.gov.au, 1800 472 679
13. Changes to this policy
I may update this policy from time to time. The current version, with its effective date, will always be on my website.
14. Contact me
Keryn Thompson, Itty Bitty Bub
Email: admin@ittybittybub.com.au
Address: 8 Elizabeth Macarthur Drive, Bella Vista NSW 2153