How GriefGap looks after personal information

Last updated 23 October 2026

For students: the short version

Your workbook is private. Only you can read what you write in it. Your facilitator and your school can't, unless you choose to show them.
Your school and your parent or carer agreed to you taking part before you started.
If you tell your facilitator something that means you or someone else might not be safe, they have to tell a safe adult at your school so you can get help.
We never sell your information or use it for ads.
You or your parent or carer can ask us to delete your workbook at any time.

1. Who we are

GriefGap is a childhood grief programme for schools, based in Victoria, Australia (ABN 51 354 733 954). In this policy, "we", "us" and "our" mean GriefGap.

We follow the Australian Privacy Principles in the Privacy Act 1988 (Cth) for all the personal information we handle, and we will follow the Children's Online Privacy Code once it takes effect. Because our work involves children and sensitive information, we hold ourselves to these standards whether or not the law strictly requires it.

2. What we collect

When you visit this website

Our website host, Netlify, keeps standard server logs, such as your IP address, browser type and the pages you visit. We don't use advertising or tracking cookies, and we don't run analytics that build a profile of you.

When you book a call

Bookings are made through Calendly. We collect your name, email address, school, role and anything you choose to tell us in the booking form. Calendly sets its own cookies to run the booking calendar; see Calendly's privacy policy.

When a school runs GriefGap

From the school: each participating student's name and year level, the name and contact details of the school's named contact, and, before Week 1, whether a student has been recently bereaved.
From parents and carers: signed consent forms, including separate consent for 1:1 support.
During the programme: attendance, 1:1 session logs, and responses to short outcome surveys at the start and end of the programme.

We do not ask students to tell us how someone died, and we don't record those details.

The interactive workbook

Students who use the online workbook get a personal login. We store their login details and the entries they write. Entries are private to the student: facilitators, other students and schools cannot see them.

Payments and email

Schools pay by invoice through Square. We don't see or store full card details. If you sign up to our email newsletter, we store your name and email address in Mailchimp, and you can unsubscribe at any time.

3. Sensitive information

Information about a young person's grief, loss or wellbeing can be sensitive information, including health information, under the Privacy Act. We only collect it with consent, we collect as little as we need to run the programme safely, and we never use it for any other purpose.

4. Children and consent

Students take part only through their school, and only with the written consent of a parent or carer. For students under 15, we rely on that parent or carer consent. We also explain to every student, in plain language, what we record and who can see it. Students can stop taking part at any time.

5. How we use information

To arrange and deliver the programme with your school.
To keep students safe, including following our referral pathway and our duty-of-care obligations.
To give the school a report on programme outcomes. These reports use combined, de-identified results and never include workbook entries.
To reply to enquiries and bookings, and to invoice schools.
To send our newsletter, if you have signed up.

We publish case studies only with the school's written approval, and they never identify a student.

6. Who we share information with

The school: attendance and de-identified outcome reports. If a facilitator has a safeguarding concern, we tell the school's named contact.
When the law requires it: including mandatory reporting to child protection authorities, or to prevent a serious threat to someone's life, health or safety.
Service providers who help us run GriefGap: Netlify (website hosting), Calendly (bookings), Supabase (workbook logins and entries), Mailchimp (newsletter), Resend (account emails) and Square (payments). They may only use the information to provide their service to us.

We never sell personal information, and we never share it for advertising.

7. Overseas storage

Some of our service providers store information overseas, mainly in the United States. Workbook logins and entries are stored with Supabase in [region, ideally Sydney, Australia]. We choose providers with strong security and take reasonable steps to make sure they protect information in line with the Australian Privacy Principles.

8. Security and how long we keep information

We protect information with access controls, encrypted connections and accounts that only we can use. Workbook entries are protected so that only the student who wrote them can read them.

Workbook entries: deleted [3 months] after the student's programme ends, unless the student or their parent or carer asks us to keep them longer.
Consent forms and 1:1 session logs: kept for as long as the law and the school's record-keeping rules require, then securely destroyed.
Booking and invoice records: kept for as long as we need them for business and tax purposes.

9. Access, correction and deletion

You can ask to see the personal information we hold about you or your child, to correct it, or to delete it. A student, or their parent or carer, can ask us to delete the student's workbook at any time. Email us and we will respond within 30 days.

10. Questions and complaints

Contact us at [GriefGap email]. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days. If you're not satisfied, you can contact the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

11. Changes to this policy

We may update this policy as our programme or the law changes. We'll post the new version here with the date it was updated, and tell participating schools about any significant change.