Privacy Policy

1. About this policy

PsyAus Health Pty Ltd (ABN 61 702 794 563) provides psychology, counselling, ADHD coaching, and adult ADHD and autism assessments by telehealth to adults across Australia. In this policy, "we", "us" and "our" mean PsyAus Health Pty Ltd.

We must follow the Privacy Act 1988 (Cth) (the Privacy Act) and the Australian Privacy Principles (APPs) in that Act. The APPs set rules for how we collect, use, share, store, protect and dispose of personal information. They also give you the right to access and correct it. Our psychologists must also keep what you tell them private. This is a duty under the Health Practitioner Regulation National Law. Our counsellors and ADHD coaches follow the codes of their professional bodies.

This policy covers information we collect through our website, our booking and enquiry forms, and by phone and email. It also covers information we collect when we provide services to you. You can read the APPs on the website of the Office of the Australian Information Commissioner (OAIC).

Your consent

When you book with us, you consent to your practitioner and our staff using your information to provide your care. Only people who need your information for your care can see it. If we want to use it for any other purpose, we will ask you first.

2. What personal and health information means

Personal information is information or an opinion about you, where you are identified or can reasonably be identified. It counts whether or not it is true, and whether or not it is recorded.

Sensitive information includes health information. It also covers matters such as racial or ethnic origin, sexual orientation and criminal record. The Privacy Act gives it a higher level of protection.

Health information needs the most care. In a psychology practice, it includes:

• your mental and physical health, wellbeing, disability, symptoms, history and the concerns you raise
• session notes, questionnaire answers, assessment results, diagnoses and the written reports your practitioner prepares
• Mental Health Treatment Plans, care plans and recommendations, including those prepared by your GP
• referrals, letters and reports we send to, or receive from, your other health providers
• the names of medicines you tell us you take, as prescribed by your doctor
• appointment details, including bookings, cancellations, attendance, dates, times, session length and video or phone
• Medicare claims, payment records, invoices and any receipts you give to your health fund
• input from someone who knows you, given with your consent, during an ADHD or autism assessment

3. The information we collect

We only collect information that is reasonably necessary to provide our services and run our practice. Depending on how you deal with us, this may include:

• Identity and contact details: your name, date of birth, address, email, phone number and contact preferences.
• Emergency contact details: the name and number of a person we can call in an emergency.
• Referral and care details: your GP's details, any referral letter and your Mental Health Treatment Plan.
• Government identifiers: your Medicare card number and, where we need it, your Individual Healthcare Identifier (IHI).
• Health information: all the types of health information listed above, collected before and during your care.
• Payment information: records of fees charged and paid. Our payment providers process card and Afterpay payments.
• Website information: technical details about your visit, as explained in the cookies section of this policy.

4. How we collect information

Where it is reasonable and practicable, we collect information directly from you. We do this when you:

• fill in our booking and intake form on our website
• send us an enquiry through a form on our website
• call, email or message us about your care or booking
• attend your sessions and complete questionnaires or other assessment tasks

Online forms

Each form on our website has a short notice about how we use your information, with a link to this policy. Forms that collect health information ask for your express consent. You give it by ticking a box that is not ticked for you. Any marketing option is a separate box, and it is optional.

When you send a form, our website server processes it and emails it to our practice inbox. The email goes through a form delivery service that runs on Cloudflare and uses Amazon Web Services Simple Email Service (AWS SES). That service also keeps a log of the fields you sent, so no submission is lost. The overseas disclosure section has more detail.

Information from other people

Sometimes we collect information from other people. We do this with your consent, or where the law allows it. This includes referrals and reports from your GP, psychiatrist or other health providers. It includes Medicare information when we process claims. It also includes questionnaires that someone who knows you completes during an assessment. If we collect information about you from someone else, we will take reasonable steps to let you know.

5. Anonymity and pseudonymity

Due to the nature of the health services we provide, it is generally impracticable for us to deal with individuals who have not identified themselves. Accurate identification is required to ensure the safety and continuity of clinical care, to comply with our legal and professional obligations under applicable health legislation, and to meet the requirements of Medicare and private health insurance billing.

You can still ask general questions, such as about our services or fees, without giving your name.

6. Unsolicited information

From time to time, we may receive personal or health information that we did not solicit. Where we receive unsolicited personal information, we will promptly assess whether that information is of a kind we could have collected under our standard collection practices.

If we could not have collected it, we will destroy or de-identify it as soon as practicable, where it is lawful and reasonable to do so. If we could have collected it, we will handle it in line with this policy.

7. How we use and disclose information

We use and share your information for the main reason we collected it. That reason is to provide psychology, counselling, ADHD coaching, and ADHD and autism assessment services. We may also use or share it for a directly related purpose you would reasonably expect. We may do so with your consent, or where the law requires or allows it. This includes:

• assessing your needs, and planning, giving and reviewing the care that you receive
• sending your GP the reports your Mental Health Treatment Plan needs, with consent
• referring you to, and coordinating care with, another health provider, with your consent
• processing Medicare claims for eligible psychology sessions when you have a current plan
• running the practice, including billing, appointment reminders and our replies to your enquiries
• clinical supervision, quality checks and training, using de-identified information wherever we reasonably can
• meeting the legal, professional, insurance and audit duties that apply to our practice

Limits of confidentiality

What you share with your practitioner is confidential. In a few cases, the law allows or requires us to share information without your consent. This can happen where:

• we reasonably believe it will prevent or lessen a serious threat to life, health or safety
• a state or territory child protection law requires us to make a report about a child
• a court order, subpoena or other legal process requires us to produce the information or records
• the Health Practitioner Regulation National Law requires us to make a notification about a registered practitioner
• we need to help locate a missing person, where the law allows us to share information
• we need to establish, exercise or defend a legal or equitable claim relating to our services
• we take part in a confidential alternative dispute resolution process, and sharing it is strictly necessary
• any other Australian law requires or authorises us to share that information without asking you first

We also share information with providers who help us run the practice. These include our telehealth video platform, our practice management system, IT support, email delivery and payment providers. They may only use it to provide services to us. We do not sell personal information.

8. Telehealth and your privacy

Your sessions take place by video or phone. Video sessions run through our telehealth video platform. To protect your privacy and safety:

• your practitioner will confirm who you are at your first session, and may check again later
• your practitioner will confirm your location each session, so help can be sent in an emergency
• your practitioner will confirm who else, if anyone, is present on either side of the call
• no session is ever recorded unless you have first given your express consent to the recording
• we suggest you join from a private space with headphones, and that you avoid public wifi

Telehealth is not right for every concern. If your practitioner thinks it is not right for you, they may suggest in-person care, a GP review or another service. We will share the information needed for that step with your consent, unless the law requires or allows otherwise.

9. Direct marketing

We only send marketing, such as newsletters or service updates, if you have given your express consent. For example, you might tick the separate, optional marketing box on one of our forms. We never use your health information to target marketing to you.

Every marketing email has a way to unsubscribe. You can also opt out at any time by contacting us. Messages about your care are not marketing. These include appointment confirmations, reminders and invoices.

10. Cookies, analytics and website data

Visiting health pages can reveal sensitive details about you. So we keep website tracking to a minimum.

• Our website uses essential tools it needs to work. These include spam protection on our forms, and checks that stop the same form being sent twice. Our forms may not work if you block these tools in your browser.
• If a link you follow carries campaign details, we may keep them in your browser for up to 30 days, with your landing page and referring website. They go with any form you send. They never include health information.
• Our website does not currently use analytics or advertising pixels, such as Google Analytics or the Meta Pixel. We will not add an advertising pixel without your express, separate opt-in. We never send health form content to those providers.

You can clear or block local storage and cookies in your browser settings. Some parts of the website may not work as intended if you do.

11. Overseas disclosure and data storage

We aim to keep health records in Australia. Some providers we use may process or store information outside Australia:

• Website form delivery: a service on Cloudflare's network processes form submissions and emails them using Amazon Web Services Simple Email Service. It keeps a log of submitted fields in a Cloudflare database.
• Practice systems: our practice management system and our telehealth video platform, which hold your booking details, session notes, reports and other clinical records, and the messages we send you about your care.
• Email and office tools: our business email provider and office software, which may hold your enquiries, booking requests, form submissions and any messages, files or documents you send to us by email.

Our providers store data in Australia where possible. If a provider stores data overseas, we take reasonable steps to make sure it is protected to the standard the Australian Privacy Principles require.

Before we share information with an overseas recipient, we take reasonable steps to make sure they handle it in line with the APPs. This includes contract terms and security requirements. By sending a form or using our services, you consent to your information being handled this way. If you would rather not use our online forms, you can phone us instead.

12. Medicare and healthcare identifiers

We collect your Medicare card number, and may collect your Individual Healthcare Identifier (IHI), only where we need to. We use them to identify you correctly, process Medicare claims and communicate securely with other health providers. The Healthcare Identifiers Act 2010 (Cth) and the Privacy Act allow this.

We do not use government identifiers, such as your Medicare number, as our own way of identifying you. We do not use or share them for any other purpose unless the law requires or allows it.

13. My Health Record

PsyAus Health does not currently upload records to My Health Record. If this changes, we will update this policy and ask for your consent where the law requires it.

If this changes, we will update this policy. You can manage your own My Health Record, including who can see it, at myhealthrecord.gov.au.

14. Artificial intelligence and automated tools

Your practitioner makes every decision about your care. They also write every finding and recommendation. We do not use automated tools to make decisions about your care.

If your practitioner wants to use an AI tool, such as transcription or note-taking software, they will ask for your express consent first. You can say no. The information is handled in line with this policy, and your practitioner reviews every note the tool produces.

15. How we store and protect information

We take reasonable steps to protect your information from misuse, interference and loss. We also protect it from unauthorised access, change or disclosure. These steps include:

• keeping your clinical records only in our secure, access-controlled practice management system
• limiting access to people who need it and are bound by confidentiality
• using strong sign-in checks and encrypted connections for all of our systems
• reviewing our own security practices and the safeguards our service providers use

No way of sending information over the internet is completely secure. Please take care when sending information by email. Contact us if you would like another way to share it.

16. How long we keep information

We keep clinical records for at least seven years from the date of the last entry in the record, or longer where the health records law of your state or territory requires it. We may keep them for longer if the law, a legal claim or a professional duty requires it.

We follow the Privacy Act, the record-keeping standards of the Psychology Board of Australia and the health records law that applies to our practice. We review these periods when the rules change.

Enquiries that do not lead to a booking are kept only as long as we need to reply and keep reasonable records. When we no longer need information, we take reasonable steps to destroy it securely or de-identify it permanently.

17. Notifiable data breaches

We are covered by the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act. If we suspect a data breach, we will act quickly to contain it. We will take all reasonable steps to finish an assessment within 30 days.

If the breach is likely to cause serious harm to anyone whose information is involved, we will notify them and the OAIC as soon as practicable. We will explain what happened and suggest steps you can take. You can read more about the scheme on the OAIC website.

18. Accessing and correcting your information

You can ask to see the personal and health information we hold about you. You can also ask us to correct it if you think it is wrong, out of date, incomplete, irrelevant or misleading.

• Please send your request in writing to our Privacy Officer.
• We will check your identity before we release any information.
• We aim to respond within 30 days of your request.
• Requests are free. We tell you about copying fees first.

In a few cases, the law allows us to refuse access. One example is where access would pose a serious threat to someone's life, health or safety. If we refuse access or a correction, we will explain why in writing and tell you how to complain. If we do not agree to correct information, you can ask us to attach your statement to the record.

19. Questions and complaints

If you have a question or concern about how we have handled your information, please contact our Privacy Officer first. We will acknowledge your complaint promptly and look into it. We aim to reply in writing within 30 days.

If you are not satisfied with our reply, you can contact the Office of the Australian Information Commissioner:

• Website: oaic.gov.au/privacy/privacy-complaints
• Phone: 1300 363 992
• Post: GPO Box 5288, Sydney NSW 2001

You can raise a concern about a psychologist's conduct with the Australian Health Practitioner Regulation Agency (ahpra.gov.au). You can raise a concern about a counsellor, an ADHD coach or a health service with the health complaints commissioner in your state or territory.

20. Changes to this policy

We may update this policy when the law, our services or our providers change. The current version is always on this page. The date at the top shows when we last updated it.

21. Contact our Privacy Officer

• Privacy Officer, PsyAus Health Pty Ltd
• ABN 61 702 794 563
• Email: [email protected]
• Phone: 0450 374 670

PsyAus Health is not a crisis service. If you are in immediate danger, call 000. For 24/7 crisis support, call Lifeline on 13 11 14.