Privacy policy.

Ivy Psychology (ABN 95 667 402 128) is a clinical-psychology-led practice based in Randwick, NSW. We are a registered NDIS provider (Registration ID 4050138847). This policy explains how we handle the personal and health information of our clients, NDIS participants, referrers, supervisees, employees, and visitors to this website.

01The law that applies to us

As a private health service provider we are bound by the Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles, regardless of our size. Health service providers do not have the small-business exemption.

Because we operate in New South Wales and hold health information, we are also bound by the Health Records and Information Privacy Act 2002 (NSW) and its 15 Health Privacy Principles. Where the two sets of rules differ we apply whichever gives you the greater protection.

Alongside these we work within the Psychology Board of Australia's Code of Conduct, the Australian Psychological Society Code of Ethics, the NDIS Practice Standards and the Public Health Act 2010 (NSW) record-keeping requirements. Health information is treated as sensitive information under the Privacy Act, which means it attracts a higher standard of protection than ordinary personal information and generally cannot be collected without your consent.

02Information we collect

We collect personal and health information that is reasonably necessary to provide psychological services. This may include:

• Your name, date of birth, address, phone number, and email
• Medicare number, NDIS number, private health insurance details, or other funding identifiers
• GP and referrer details, mental health treatment plan, or referral letters
• Information about your physical and mental health history, current presenting concerns, family and social context, and treatment goals
• Records of sessions - clinical notes, assessment results, reports, and correspondence
• For NDIS participants, plan details, support coordinator details, and behaviour support information
• Payment information (we use third-party providers; we do not store card numbers)
• Records of your interactions with our admin team

03How we collect it

We collect information directly from you wherever possible - through our referral form, intake paperwork, phone calls, emails, and sessions. We also collect information from:

• Your GP or referring practitioner (e.g. Mental Health Treatment Plan)
• Your NDIS support coordinator or plan manager, with your consent
• Other clinicians involved in your care, with your consent
• Family members, carers, schools, or support workers, where you have authorised this
• Third-party assessment tools (e.g. questionnaires you complete electronically)

We will tell you at the time we collect your information why we are collecting it and who we may share it with.

04Information we did not ask for

Sometimes we receive information we did not request, such as an unsolicited referral, a report forwarded by another service, or material sent by a family member. When that happens we consider whether we could have collected it ourselves in the ordinary course of providing you a service. If we could have, we handle it under this policy in the normal way. If we could not have, we destroy or de-identify it as soon as practicable, unless the law requires us to keep it.

05Why we collect it

We use your information to:

• Provide psychological assessment, therapy, and behaviour support
• Coordinate with other clinicians, your GP, and (for NDIS) your support team
• Bill Medicare, private health insurers, the NDIS, or you directly
• Comply with our legal and professional obligations under the Psychology Board of Australia, AHPRA, and the NDIS Quality and Safeguards Commission
• Maintain accurate clinical records as required by law and professional standards
• Communicate with you about appointments, follow-ups, and admin matters
• Improve our service and conduct quality assurance, in de-identified form

06Dealing with us anonymously

You are welcome to make a general enquiry by phone or email without giving your name, and to ask questions about fees, availability or how we work before identifying yourself.

Once you become a client we do need to know who you are. We cannot provide psychological assessment, therapy or behaviour support anonymously or under a pseudonym, because we are required to keep accurate identified clinical records, to verify identity for Medicare and NDIS claiming, and to be able to act if there is a risk to your safety. If you choose not to provide information we have asked for, we will explain what effect that has, and in some cases it may mean we cannot safely provide the service.

07Who we share it with

We treat your information as confidential. We will share it only:

• With your consent. For example, sending a report to your GP or your NDIS support coordinator, or speaking with a family member.
• Where required by law. This includes mandatory reporting of risk to a child, responding to subpoenas or court orders, or where there is a serious and imminent threat to your life or the life of another person.
• Where permitted by law in narrow circumstances. For example, professional supervision (where the supervisor has the same confidentiality obligations), case conferences with other treating clinicians, or de-identified peer consultation.
• With our service providers, who are bound by confidentiality - for example, our practice-management software (Splose), telehealth platform, secure email and file storage providers. Our practice-management records are held in Australia. Section 11 explains the limited circumstances in which any information is processed overseas.
• For billing and funding, with Medicare, private health insurers, the NDIA, plan managers, or other funders as required to claim rebates or process invoices.

We do not sell your information. We do not share your information for marketing.

08Government identifiers

We collect government identifiers such as your Medicare number, NDIS number and Individual Healthcare Identifier where they are needed to claim rebates, verify eligibility or communicate with a funder. We use them only for those purposes. We do not adopt a government identifier as our own way of identifying you in our records, and we do not use or disclose one except as required or authorised by law.

09Direct marketing

We do not use your personal or health information for direct marketing, and we do not disclose it to anyone else for marketing purposes. We will never sell, rent or trade your information.

The messages we send you are about your care. Appointment reminders, results, follow-ups, invoices and practice administration such as a change to our fees or opening hours. If you subscribe to a newsletter or resource list you can unsubscribe at any time using the link in the email or by contacting our admin team, and doing so has no effect on your care.

10How we store and protect it

Your records are held electronically in Splose, an Australian healthcare practice-management system that complies with the Australian Privacy Principles. Paper records, if any, are stored in locked filing in our clinic. We use:

• Encrypted storage and transmission (TLS / HTTPS)
• Role-based access - clinicians can only see records for clients they are involved with
• Two-factor authentication for staff accounts
• Regular review of access logs
• Staff training on privacy and confidentiality at induction and annually

If a data breach occurs that is likely to result in serious harm, we will notify you and the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches scheme.

11Information sent overseas

Your clinical records, referral information and correspondence are held in Australia. Splose, our practice-management provider, stores data on Australian servers.

Two things do involve overseas processing. The website analytics and advertising tools described in section 17 are provided by Google and process website usage data on servers in the United States. Some of the software we use for email, file storage and video sessions is provided by companies that may process data outside Australia, and where that is the case we choose providers that offer healthcare-grade security, contractual privacy protections and Australian data residency wherever it is available.

We take reasonable steps to ensure any overseas recipient handles your information consistently with the Australian Privacy Principles. If we ever needed to disclose your health information overseas for a reason connected to your care, we would seek your consent first.

12How long we keep it

We are required by law and professional standards to retain clinical records for at least:

• Adult clients: seven years from the date of last contact
• Children and young people: until they turn 25 (i.e. seven years after they turn 18)

After this period, records are securely destroyed unless we are required to retain them for longer (e.g. legal proceedings).

13Accessing and correcting your information

You have the right to ask for a copy of the personal information we hold about you, and to ask us to correct anything that is inaccurate or out of date.

To make a request, email admin@ivypsychology.com.au or call 0405 944 637. We will:

• Verify your identity
• Respond within 30 days
• Provide the information in a usable format, or explain why we are unable to (which is rare - for example, where release would risk serious harm)

There is no charge for accessing your own information. We may charge a reasonable fee for the time taken to retrieve and prepare a copy of an extensive file.

14Telehealth & video sessions

We use secure, healthcare-grade telehealth platforms. Sessions are not recorded unless you give explicit written consent. We ask you to take reasonable steps to ensure your own end of the call is private - closing doors, using headphones, and being somewhere you won't be interrupted. We recommend you do not connect over public Wi-Fi.

15NDIS participants

If you are an NDIS participant, we are required to share certain information with the NDIA, your plan manager, the NDIS Quality and Safeguards Commission, and your support team, depending on what is in your plan and what you have consented to.

Specifically:

• Behaviour Support Plans are lodged with the NDIS Commission as required.
• Restrictive practices in use are reported to the Commission monthly.
• Reportable incidents are notified to the Commission within the required timeframes.
• Service-agreement details and progress reports may be shared with your plan manager or support coordinator with your consent.

16Children and young people

For clients under 16, we usually involve a parent or guardian in the referral and intake, and in decisions about treatment. However, young people have a right to confidentiality, and we discuss with each young person what will and won't be shared with their parents. We follow the mature minor doctrine where appropriate. Mandatory reporting obligations apply to children at risk.

17Cookies, analytics and advertising

This website uses Google Analytics to understand which pages are visited and how people move through the site, and Google Ads conversion tracking to measure which advertisements lead to an enquiry. Both set cookies in your browser and both are provided by Google.

The information these tools collect is limited to website usage data. It includes things like the pages you view, the approximate location your visit came from, the device and browser you used, and how you arrived at the site. We do not send any health information, clinical information, or the content of your enquiry to Google, and we have not enabled any feature that would let us identify you personally through these tools.

You can opt out at any time. Most browsers let you block or delete cookies through their settings, Google publishes a browser add-on that turns off Google Analytics, and browser privacy modes and tracker-blocking extensions will also prevent these tools from loading.

No personally-identifying information is collected through this website unless you submit it yourself through the referral, contact or feedback forms. Our referral forms are hosted by Splose, our Australian practice-management provider, and what you enter goes directly into your client record rather than through this website.

18Complaints

If you have a concern about how we have handled your information, please contact us first using the details below. We will respond within one business day and aim to resolve concerns directly.

If we cannot resolve it, we will give you a written response within 30 days. If you are not satisfied with our response, you can contact:

• The Office of the Australian Information Commissioner (OAIC) - oaic.gov.au · 1300 363 992
• The Health Care Complaints Commission (NSW) - hccc.nsw.gov.au · 1800 043 159
• The NSW Information and Privacy Commission, for complaints under NSW health privacy law - ipc.nsw.gov.au · 1800 472 679
• AHPRA - ahpra.gov.au · 1300 419 495
• The NDIS Quality and Safeguards Commission - ndiscommission.gov.au · 1800 035 544

19Changes to this policy

We may update this policy from time to time. Material changes will be flagged at the top of the page with an updated date. The current version always lives at ivypsychology.com.au/privacy-policy.

20Contact us

Privacy questions or requests:

• Email: admin@ivypsychology.com.au
• Phone: 0405 944 637
• Post: The Privacy Officer, Ivy Psychology, Suite 5, Level 2, 126–128 Avoca Street, Randwick NSW 2031