Privacy Policy

At Paperchain Psychology, we respect your privacy and are committed to protecting your personal information. This Privacy Policy explains how we collect, use, store and disclose personal information, including health information, when you contact us, use our website, make an enquiry, book an appointment or receive psychological services from us.

We handle personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles, applicable NSW health records laws, and relevant professional obligations for psychologists in Australia.

This policy applies to information collected through our website and through our psychology practice.

1. The kinds of information we collect

We may collect personal information that is reasonably necessary for us to provide psychological services, manage appointments, communicate with you, process payments, meet legal and professional obligations, and operate our website.

This may include:

• your name, date of birth and contact details
• parent, guardian or emergency contact details, where relevant
• referral information, such as GP referral letters or Mental Health Treatment Plans
• Medicare, private health, NDIS, workers compensation, insurance or billing information, where relevant
• health information, including mental health history, current concerns, symptoms, treatment goals, diagnoses, assessments, session notes and relevant personal history
• information about medications, other treating professionals or previous treatment, where clinically relevant
• communications you send to us by email, phone, online form, booking system or other channels
• payment and invoice information
• website information, such as your IP address, browser type, device information, pages visited and interactions with our website.

Health information is sensitive information. We only collect health information where it is reasonably necessary for providing psychological services or otherwise permitted by law.

2. How we collect information

Where possible, we collect personal information directly from you.

We may collect information when you:

• contact us through the website
• email, call or message the practice
• complete an intake form, consent form, assessment form or questionnaire
• book or attend an appointment
• participate in psychological assessment or therapy
• make a payment or request an invoice.

We may also collect information from other people or organisations where you have consented, where it is clinically appropriate, or where we are required or authorised by law. This may include information from:

• your GP or referring doctor
• another psychologist or allied health professional
• a psychiatrist, paediatrician or other medical specialist
• a parent, guardian, carer or family member
• a school, workplace, insurer, NDIS provider or other organisation involved in your care, where relevant.

Our website contact forms are provided through Fluent Forms. These forms are intended for general enquiries. They are not designed for uploading clinical files or sensitive documents.

3. Why we collect and use your information

We collect and use personal information to:

• respond to enquiries
• assess whether our services are appropriate for your needs
• provide psychological assessment, diagnosis, therapy and support
• prepare and maintain clinical records
• communicate with you about appointments, forms, fees and practice updates
• liaise with referrers, GPs or other treating professionals, where appropriate
• prepare letters, reports or treatment updates, where requested or clinically necessary
• process payments, invoices, Medicare rebates or other funding arrangements
• manage waitlists, cancellations and administrative tasks
• improve our website, services and client experience
• comply with legal, ethical, regulatory and professional obligations
• manage risk, safety concerns or complaints.

If you do not provide certain information, we may be unable to provide services, respond to your enquiry, process rebates or meet our professional obligations.

4. Confidentiality and limits to confidentiality

Psychological services are confidential, and we take confidentiality seriously.

However, there are circumstances where information may need to be used or disclosed. These may include where:

• you have given consent
• disclosure is required or authorised by law
• there is a serious risk to your life, health or safety, or to the life, health or safety of another person
• there are child protection concerns or mandatory reporting obligations
• records are subpoenaed or otherwise required by a court, tribunal or legal process
• disclosure is necessary for Medicare, insurance, NDIS, workers compensation or other funding purposes
• disclosure is necessary to respond to a complaint, investigation or regulatory requirement
• consultation, supervision or professional advice is required to support safe and ethical care, and this is done in accordance with applicable consent, confidentiality and professional requirements.

The specific limits of confidentiality will also be discussed as part of the informed consent process before or during your first appointment.

5. Children, adolescents and families

When working with children and adolescents, we may collect information from parents, guardians, schools and other professionals involved in the young person’s care.

We aim to balance the privacy of children and adolescents with the responsibilities of parents and guardians, the young person’s developmental stage, safety considerations, and legal and professional obligations.

Where appropriate, we will explain how information may be shared between the young person, parents or guardians, and other professionals. This will usually be discussed at the beginning of therapy.

6. When we may disclose information

We do not sell personal information.

We may disclose personal information to third parties where necessary for the operation of the practice, the provision of services, or as otherwise required or authorised by law. This may include:

• GPs, psychiatrists, paediatricians, allied health professionals or other treating practitioners
• parents, guardians or carers, where appropriate
• schools, employers, insurers, NDIS providers or other organisations, where relevant and with appropriate consent or authority
• Medicare, private health insurers, payment processors or funding bodies
• practice management software providers
• secure booking, intake form, telehealth or communication platforms
• accountants, bookkeepers or professional advisers
• IT, website, email, hosting, cloud storage, analytics or security service providers
• legal, regulatory or professional bodies, where required
• emergency services or authorities where there is a serious safety concern.

We only disclose information where it is necessary, appropriate, and consistent with our legal and professional obligations.

7. Third-party platforms and service providers

We use trusted third-party platforms to help operate the practice and website. These include:

• Practice management software: Halaxy
• Booking and practice administration: Halaxy
• Email provider: Google Workspace
• Website contact forms: Fluent Forms
• Website analytics: Google Analytics

These providers may collect, store or process information as part of providing their services to us. Some providers may store or process information outside Australia. Where this occurs, we take reasonable steps to use reputable providers and to protect personal information in accordance with Australian privacy requirements.

8. Website privacy, cookies and analytics

When you visit our website, certain information may be collected automatically. This may include your IP address, browser type, device type, pages viewed, time spent on the website, referring website and general usage information.

We use Google Analytics to help us understand how visitors use our website and to improve website performance, content and user experience.

We may use cookies or similar technologies to:

• help the website function properly
• understand how visitors use the website
• improve website performance and content
• protect the website from spam or misuse
• remember basic preferences.

You can adjust your browser settings to block or delete cookies. Some parts of the website may not function properly if cookies are disabled.

We do not use website analytics to intentionally identify clients or collect clinical health information.

9. Online forms and email communication

If you contact us using an online form or email, the information you provide may include personal information. We use this information to respond to your enquiry and manage your request.

Our website forms are intended for general enquiries only. Please do not send highly sensitive clinical information through the website contact form.

Email and online forms may not always be secure. Please avoid sending highly sensitive or urgent clinical information through standard email or general website forms unless you are comfortable doing so.

Our website and email inbox are not monitored as crisis services. If you are in immediate danger or need urgent help, call 000 or attend your nearest emergency department. For crisis support in Australia, you can contact Lifeline on 13 11 14.

10. Marketing and mailing lists

If we offer a newsletter, downloadable resource or mailing list, we may collect your name and email address for that purpose.

We will only send marketing or practice update emails where you have consented or where otherwise permitted by law. You can unsubscribe at any time by using the unsubscribe link or contacting us directly.

We do not use clinical information for marketing purposes.

11. How we store and protect information

We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification or disclosure.

Depending on the systems used by the practice, these steps may include:

• secure electronic practice management systems
• password-protected accounts
• access controls
• secure storage of clinical records
• antivirus, firewall or device security measures
• secure backups
• limiting access to information to those who need it for their role
• secure disposal or deletion of records when legally appropriate.

No method of electronic storage or transmission is completely secure. However, we take privacy and information security seriously and review our systems and processes from time to time.

12. Retention of health records

Paperchain Psychology operates in NSW.

We retain health records for the period required by applicable NSW law and professional obligations.

In NSW, private health service providers are generally required to retain adult health records for at least 7 years from the last occasion on which a health service was provided. For a person who was under 18 when the information was collected, records are generally retained until the person turns 25.

After the required retention period has passed, records may be securely destroyed or de-identified where legally appropriate.

13. Accessing your information

You have the right to request access to personal information we hold about you, including health information.

To request access, please contact us in writing using the details below. We may need to verify your identity before releasing information.

In some circumstances, access may be refused or limited, such as where giving access would pose a serious threat to health or safety, unreasonably affect another person’s privacy, breach legal obligations, or where another legal ground for refusal applies.

We may charge a reasonable fee for administrative costs associated with providing access, where permitted by law. We will tell you about any fee before proceeding.

14. Correcting your information

We take reasonable steps to ensure the personal information we hold is accurate, complete and up to date.

If you believe information we hold about you is incorrect, incomplete, out of date or misleading, you can contact us and request a correction.

If we cannot make the correction requested, we may add a note to the record stating that you disagree with the information.

15. Privacy complaints

If you have a concern about how your personal information has been handled, please contact us first so we can try to resolve the issue.

• Privacy contact: Privacy Officer
• Email: hello@paperchain.com.au
• Postal address: Suite 2, 1A Torwood St, Sans Souci, NSW, 2219

We will acknowledge your complaint and aim to respond within a reasonable timeframe.

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner or the relevant NSW privacy authority.

16. Data breaches

If we become aware of a data breach involving personal information, we will take reasonable steps to contain, assess and respond to the breach.

Where required under the Notifiable Data Breaches scheme, we will notify affected individuals and the Office of the Australian Information Commissioner if the breach is likely to result in serious harm.

17. Links to other websites

Our website may include links to third-party websites, such as booking platforms, professional organisations, health resources, maps, social media pages or external articles.

We are not responsible for the privacy practices or content of third-party websites. You should review the privacy policies of any external websites you visit.

18. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes to our services, website, legal obligations or privacy practices.

The latest version will be published on our website with the updated date shown at the top of the page.

19. Contact us

For privacy questions, access requests, correction requests or complaints, please contact:

• Paperchain Psychology
• Privacy contact: Privacy Officer
• Email: hello@paperchain.com.au
• Address: Suite 2, 1A Torwood St, Sans Souci, NSW, 2219
• ABN: 99 843 347 025