Privacy Policy

This is a working draft, not a finished policy. It's structured around the Australian Privacy Principles as a sensible starting point, but I'm not a lawyer and this hasn't been reviewed by one. Please don't publish this live until it's been checked, either by AHPRA's privacy guidance for psychologists or a professional familiar with health-information privacy law, and every bracketed placeholder below has been filled in with your actual details. It also needs a final pass once you've decided how the enquiry form and booking system handle data, since that changes what this policy needs to say.

The information we collect

We only collect what we need to provide safe, appropriate care and to run the practice.

When you make an enquiry

Name and date of birth
Email address and phone number
What you're seeking support with

When you become a client

Health information relevant to your care, including session notes
Medicare, NDIS or private health details relevant to rebates or funding
Emergency contact details, where provided
Intake forms and correspondence with your GP, where relevant

How we use it

Your information is used only for the purpose you gave it to us, unless the law requires otherwise. That generally means:

Responding to your enquiry and arranging appointments
Providing therapy and clinical care, including record-keeping required of registered psychologists
Processing Medicare, NDIS or private health rebates where applicable
Meeting our legal and professional obligations (for example, under the Health Records and Information Privacy Act, or AHPRA's requirements)

Who we share it with

We don't sell or trade your information. It's only shared in limited circumstances:

With your GP or referring practitioner, where relevant and with your consent
With Medicare, NDIS or your private health fund, to process a rebate or claim on your behalf
With service providers who help us run the practice, for example, our booking/practice-management platform (Zanda) and the service that handles enquiry-form submissions (Netlify Forms)
Where we're required to by law, or where there's a serious risk to your safety or someone else's

Any service we use that stores or processes your information overseas needs to be listed here specifically, along with where that provider is based. This is a requirement under Australian Privacy Principle 8, not just good practice.

How we store and protect it

Client records are stored securely within Zanda's practice management system, which is encrypted and access-restricted to practice staff. We don't keep paper records.

Your rights

Access

You can ask to see the personal information we hold about you at any time.

Correction

If something we hold about you is wrong or out of date, let us know and we'll correct it.

Complaints

If you're unhappy with how we've handled your information, contact us first. If it's not resolved, you can complain to the Office of the Australian Information Commissioner (OAIC).