UltimateEAP takes the privacy of the people we support seriously. Much of our work is confidential counselling and incident support, and we handle your information with the same care we bring to that work.
1. About this Privacy Policy
This Privacy Policy describes how Ultimate Services Australia Pty Ltd (ABN 61 644 393 126), trading as UltimateEAP (UltimateEAP, we, us), collects, holds, uses and discloses personal information. We comply with the Privacy Act 1988 (Cth), including the Australian Privacy Principles, and, where we hold health information in Victoria, the Health Records Act 2001 (Vic).
“Personal information” means information or an opinion about an identified individual, or an individual who is reasonably identifiable. It includes things like your name, contact details and workplace.
“Sensitive information” is a subset of personal information that receives extra protection under the Privacy Act. It includes health information (including mental health and wellbeing), racial or ethnic origin, sexual orientation and criminal record. We only collect sensitive information with your consent, or where the law permits or requires it.
2. Overview of how we handle personal information
UltimateEAP provides employee assistance and wellbeing services to social, youth and community sector organisations. Our services include the Employee Assistance Program (EAP), critical incident stress management, professional supervision, coaching, training, manager supports and an externally managed whistleblower reporting service.
We collect personal information so we can deliver these services, run our business, and keep in touch with people who have asked to hear from us. We do not sell personal information, and we do not use it for targeted advertising.
3. What personal information we collect
What we collect depends on how you engage with us.
If you use our Employee Assistance Program or critical incident support
- Your name, phone number, email address, role and employer.
- Whether you are a staff member, manager or HR professional, the kind of support you are looking for, your preference for the gender of your social worker, and how you would like us to contact you.
- Appointment dates and attendance records.
- Notes from your sessions, which may include information about your mental health, wellbeing, relationships, family, work and other personal circumstances. This is health information.
- Information about risk to you or others, where it arises.
If you make a whistleblower report
- The organisation the report is about, the subject, and what happened, including any information about other people that you choose to include.
- Your name, phone number and email address, only if you choose to give them. You can report anonymously.
If you receive supervision, coaching or training from us
- Name, contact details, role, employer and qualifications.
- Session dates, attendance, and notes about your practice, professional development goals and wellbeing.
- Enrolment, attendance and completion records for training, and any dietary, access or support needs you tell us about.
- Responses to training evaluations.
If your organisation engages us
- Name, role and contact details of the people we work with at your organisation.
- Information you give us when you request a quote, such as your organisation’s name, number of staff and the services you are interested in.
- Contract, invoicing and ABN details.
If you subscribe to our updates or book a call
- Your name and email address.
- Details you give when booking a call through our online booking page, such as your organisation and what you would like to talk about.
- Which of our emails you open and the links you click.
If you contact us
Your name, contact details, organisation, and anything you include in your enquiry, whether by phone, email, our website forms or our website chat.
If you apply to work with us, or supply services to us
- Name, contact details, qualifications, work history and professional registrations or memberships.
- Information from referees, and from checks such as Working with Children Checks and police checks.
- ABN, billing and banking details if you are a supplier.
Website data and cookies
Our website uses cookies and analytics tools, including HubSpot and Google Analytics, to understand how visitors use the site, such as pages visited and time on site. HubSpot also runs our website chat and our cookie banner, where you can accept or decline tracking cookies, or use Cookies Settings to choose which types to allow. If you decline, a single cookie remembers your choice so you are not tracked. You can also disable cookies in your browser settings, though some parts of the site may not work as intended.
Our support request and whistleblower forms do not link what you send us to your website browsing.
4. How we collect personal information
We usually collect personal information directly from you, for example when you request support, attend a session, make a report, fill in a form, subscribe to our updates or contact us.
Sometimes we collect it from others, including:
- your employer, when they refer you for support or arrange critical incident response, supervision, coaching or training for their staff;
- a person making a whistleblower report, who may include information about you in their report;
- our booking and form platforms, when you use them;
- referees and background check providers, if you apply to work with us; and
- publicly available sources such as LinkedIn.
You can deal with us anonymously or under a pseudonym where that is practical, for example when making a whistleblower report or a general enquiry. We usually need to know who you are to provide counselling, supervision or training.
5. How we use personal information
Employee Assistance Program and critical incident support
- Arranging and providing counselling and support, and keeping records of it.
- Contacting you the way you asked us to.
- Invoicing your organisation for the services it has arranged.
Confidentiality. What you discuss with your social worker is confidential. Your employer is not told that you have used the EAP or what you discussed. We may give your organisation de-identified, combined information about how the service is used, such as the number of sessions provided, so they can understand demand. This never identifies you.
Limits to confidentiality. We may disclose information without your consent where we believe there is a serious threat to someone’s life, health or safety, where we are required to make a report under child protection or other law, or where a court or other legal authority requires it. Where it is safe and appropriate, we will talk with you before we do this.
Whistleblower reports
- Receiving, assessing and recording your report.
- Passing the substance of your report to the appropriate person at the organisation it concerns, so it can be investigated.
- Following up with you, if you gave us contact details.
We do not share your identity, or information likely to identify you, with the organisation without your consent, except where the law allows or requires it. Whistleblower reports are handled only by the person at UltimateEAP who manages them, and are never added to any mailing list.
Supervision, coaching and training
- Providing and recording sessions, and keeping records of attendance and completion.
- Confirming completion to your organisation, where they arranged it for you.
- Meeting your dietary, access or support needs, and evaluating and improving our training.
Organisations, enquiries and suppliers
- Preparing quotes, agreeing contracts and invoicing.
- Responding to your enquiry or booking.
- Considering job applications, and receiving goods and services from suppliers.
General purposes
We also use personal information for record keeping, accounting, insurance, audit, quality assurance and improving our services; for producing de-identified or combined reports; for complying with legal obligations; for managing complaints and incidents; and otherwise as permitted or required by law.
Marketing
We may send you our updates and information about our services where you have subscribed, or where you would reasonably expect to hear from us as a client organisation. Every message includes an unsubscribe option, and you can opt out at any time using the details in section 11.
We never use information from counselling, support requests or whistleblower reports for marketing, and people who contact us for support are not added to our marketing lists.
6. Who we share personal information with
In the ordinary course of our work, we may disclose personal information to:
- our social workers and other staff who deliver our services, all of whom are UltimateEAP employees bound by confidentiality obligations;
- your organisation, limited as described in section 5;
- providers of the systems we use to run our business, including our customer relationship management and forms platform (HubSpot), email, video conferencing, booking, accounting and cloud storage platforms, and our website host;
- our professional advisers, such as accountants, lawyers, auditors and insurers;
- government, legal or regulatory authorities, where we are authorised or required by law; and
- anyone else you consent to.
Overseas disclosure
We store and process most personal information in Australia. The information you send through our website forms is stored in HubSpot’s Australian data centre. Some of our service providers store or process data overseas, including in the United States, for example for website analytics, email and video conferencing. We take reasonable steps to ensure these providers handle personal information consistently with the Australian Privacy Principles.
7. Automated decisions and AI
We do not make decisions that significantly affect you using computer programs alone. Where we use software or AI tools to help with administration, such as drafting or summarising, a person at UltimateEAP reviews the output before any decision is made. We do not enter identifiable counselling notes or whistleblower reports into AI tools.
8. How we hold and protect personal information
We hold personal information mainly in electronic form, and occasionally in hard copy.
We protect it from misuse, interference, loss, and unauthorised access, modification or disclosure through measures including restricted and role-based access, multi-factor authentication, password management, encrypted platforms, secure storage of any paper records, and confidentiality obligations in our staff agreements.
If a data breach is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner as required under the Notifiable Data Breaches scheme.
9. How long we keep personal information
We keep personal information only as long as we need it for the purposes in this policy, or as long as the law requires. Counselling and other health records are kept for at least 7 years after your last session, or, if you were under 18 when you used the service, until you turn 25, whichever is later. Whistleblower reports, supervision records and training records are kept for 7 years. When we no longer need information, we securely destroy or de-identify it.
10. Accessing and correcting your personal information
You can ask to access or correct the personal information we hold about you at any time using the details in section 11. We aim to respond within 30 days. If we refuse your request, we will tell you why in writing and how to complain.
We do not charge you to make a request. If giving you access involves significant work, we may charge a reasonable fee to cover our costs, and we will tell you the amount before we proceed.
11. Questions and complaints
If you have a question or complaint about this policy, your personal information, or how we have handled it, contact our Privacy Officer:
Privacy Officer, UltimateEAP
Level 1, 2-4 Main Street, Greensborough VIC 3088
Email: privacy@ultimateeap.com
Phone: 1800 655 140
We will acknowledge your complaint, investigate it, and aim to respond in writing within 30 days.
If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner:
Office of the Australian Information Commissioner
GPO Box 5288, Sydney NSW 2001
Phone: 1300 363 992
Website: oaic.gov.au
For complaints about health information held in Victoria, you can also contact the Health Complaints Commissioner.
12. Changes to this Privacy Policy
This Privacy Policy was last updated in November 2026. We may update it from time to time and will publish the current version on our website.