Privacy Policy

Your information is stored securely and accessed only by your psychologist or providers of the practice, as required, in accordance with the practice's policies and procedures.

Your information is stored electronically using Cliniko, the practice management system. New Cliniko accounts based in Australia store their primary data in Australia. Cliniko may use contracted subprocessors to support its services.

Breakwater Psychology applies reasonable safeguards appropriate to the sensitivity of the information held. These include restricted access, strong authentication, device security, secure systems, access controls, confidentiality requirements and appropriate handling procedures. No electronic system or method of transmission is completely risk-free.

Records are retained for the periods required by applicable law, professional standards, funding arrangements and legitimate clinical or legal needs. When information is no longer required to be retained, reasonable steps will be taken to securely destroy or de-identify it.

When providing services from consulting premises, reasonable physical and electronic safeguards are used to protect the privacy and security of personal information, including measures to maintain the confidentiality of consultations and secure access to practice systems and electronic records.

Breakwater Psychology collects only information reasonably necessary to provide psychological services and operate the practice. Depending on the circumstances, this may include:

• identity and contact details, including your name, date of birth, address, telephone number, email address and emergency contact
• demographic information and Medicare, insurer, employer, legal or funding details relevant to your care
• health information, including medical and psychological history, current concerns, diagnoses, medications, risk information and treatment goals
• clinical records, including session notes, correspondence, referrals, reports, questionnaires, assessments and treatment plans
• appointment, billing, payment and claiming information
• information supplied by your GP, specialist, allied health provider, insurer, rehabilitation provider, lawyer, employer, family member, carer or another person involved in your care, where authorised or otherwise permitted by law
• communications with the practice, including information submitted through the website enquiry form or by email
• limited technical information generated when you use the website or online services, such as device, browser, connection and security information.

Health information is sensitive information under privacy law. Breakwater Psychology generally collects it with your consent and only when it is reasonably necessary for providing the service or another permitted purpose.

Information may be collected directly from you during enquiries, registration, consent, appointments, telehealth sessions, forms, questionnaires, email correspondence and payment. It may also be received from another person or organisation involved in your referral, treatment or funding, where you have authorised this or where collection is otherwise permitted or required by law.

New clients may contact Breakwater Psychology through the website enquiry form or by email. Website enquiries are processed through the practice website and email hosting services provided by VentralIP. Please avoid including detailed or urgent clinical information in an initial website enquiry. The website enquiry form is not monitored as a crisis service.

Breakwater Psychology does not currently use advertising pixels, behavioural advertising or third-party analytics services on its website. The website host may generate limited technical and security logs required to deliver, maintain and protect the website. If additional analytics or tracking technologies are introduced, this policy will be updated as appropriate.

If you have concerns that the information recorded is not correct, please discuss your concerns with your psychologist.

Breakwater Psychology may collect, hold and use personal information to:

• assess your needs and provide psychological treatment and related services
• plan, document, review and coordinate your care
• communicate with you about appointments, forms, treatment, fees and practice administration
• communicate with referrers, healthcare providers, insurers, rehabilitation providers, lawyers or other authorised parties
• prepare reports, letters, certificates, invoices and funding documentation where authorised
• process payments, rebates and claims
• manage clinical governance, professional supervision, quality, safety and legal obligations
• respond to complaints, subpoenas, mandatory reporting requirements, serious threats to safety, or other lawful requests
• operate, secure and improve the practice and its systems.

Psychologists are required to keep clear and accurate client records as part of their professional obligations.

If the information reasonably required to provide a service is not supplied, Breakwater Psychology may be unable to accept a referral, provide or continue treatment, process a claim, or meet relevant professional obligations. You are welcome to discuss any concern about the information requested.

If Breakwater Psychology becomes aware of unauthorised access to, disclosure of, or loss of personal information, it will take prompt steps to contain the incident, assess the potential consequences, reduce the risk of harm and review the safeguards in place.

Where the incident is an eligible data breach under the Privacy Act 1988 (Cth), Breakwater Psychology will notify the Office of the Australian Information Commissioner and affected individuals as required by the Notifiable Data Breaches scheme. The notification will include information about the incident and the steps individuals may take to reduce the risk of harm.

Telehealth appointments are provided through Cliniko. Cliniko states that its telehealth calls are peer-to-peer encrypted and that it does not retain a copy of the telehealth session. Breakwater Psychology does not routinely record telehealth video or audio. If recording were ever proposed for another purpose, separate informed consent would be sought beforehand.

You are responsible for choosing a private setting and taking reasonable steps to protect your own device, internet connection and surroundings during telehealth. If privacy or safety cannot be maintained, the appointment may need to be paused, changed or rescheduled.

Breakwater Psychology may use NovoPsych, an online psychometric assessment platform, to send questionnaires or assessments for you to complete. Personal and health information entered into or generated through NovoPsych is used to send, complete, score and review assessments and to support your psychological care. Only information reasonably necessary for these purposes will be entered or used.

Assessment results and reports are reviewed by the psychologist, and clinically relevant information may be incorporated into your clinical record in Cliniko. NovoPsych supports assessment administration and scoring but does not replace the psychologist's professional judgement.

NovoPsych states that patient data is stored in Australia and that clinicians can control the extent to which identifiable patient information is included. NovoPsych uses contracted service providers to support its platform and handles information under its published privacy and security information and applicable law.

NovoPsych retains assessment data as necessary to provide its service and in accordance with clinician instructions and legal obligations. Breakwater Psychology manages information held in NovoPsych in accordance with its clinical record and retention obligations and may export or delete assessment data where appropriate.

With your informed consent, Breakwater Psychology may use Heidi Health as an AI-assisted clinical documentation tool. Heidi Health transcribes the consultation as it occurs to assist with preparing a draft clinical note. In accordance with Heidi Health's published privacy and data-handling information, appointment audio recordings are not stored, and data relating to Australian users is hosted in Australia.

Heidi Health supports clinical documentation but does not replace the psychologist's professional judgement. The psychologist reviews and edits the draft before manually transferring any information required for the clinical record into Cliniko. Breakwater Psychology does not link Heidi Health to its Cliniko practice management system.

Breakwater Psychology configures Heidi Health sessions to be retained for no longer than five days. At the end of the selected retention period, the session data is deleted in accordance with Heidi Health's published deletion practices, under which deleted session data is permanently removed from its servers and cannot be recovered.

Consent to the use of Heidi Health is voluntary and may be declined or withdrawn at any time without affecting your access to psychological services. If consent is not provided or is withdrawn, the psychologist will use another method of documentation. Further information is provided in the separate Heidi Health consent form and in Heidi Health's published privacy information.

Breakwater Psychology accepts online card payments through Cliniko's Stripe integration and also accepts bank transfer. Stripe processes card and payment information for online payments. Breakwater Psychology does not directly retain your full card number or card security code. Stripe may process or store payment-related information in Australia and other countries in accordance with its privacy policy and legal obligations.

For bank transfers, the practice bank and accounting records may show information supplied through the payment, such as the payer name, amount, date, account reference and transaction description. Payment and invoice information may be recorded in Cliniko and retained as required for taxation, accounting, funding and legal purposes.

Breakwater Psychology may use cloud accounting software such as Xero to manage bookkeeping, accounting, taxation and financial reporting. Limited personal information may be recorded in the accounting system where reasonably necessary for these purposes, including a client's name, invoice details, payment status and transaction information. Clinical notes and detailed health information are not stored in the accounting system.

Breakwater Psychology may provide an accountant or bookkeeper with access to financial records where reasonably necessary for accounting, taxation, audit or regulatory purposes. Any accountant or bookkeeper engaged by the practice will be expected to handle personal information confidentially and in accordance with applicable professional, contractual and legal obligations.

Personal information is kept confidential. Breakwater Psychology will generally obtain your consent before sharing information with another person or organisation. Depending on your circumstances and authorisation, information may be shared with:

• your GP, medical specialist, allied health practitioner or another member of your treating team
• a parent, guardian, carer, family member or support person
• an insurer, workers compensation agent, rehabilitation provider, employer, lawyer, court, funding body or government agency
• Medicare or another claiming or payment body
• an accountant, bookkeeper, auditor or professional adviser where reasonably necessary for financial, taxation, audit, legal or regulatory purposes
• technology and service providers that support the secure operation of the practice
• another person or organisation you specifically authorise.

Consent may be documented through the practice consent form, a funding or referral arrangement, or a separate written authorisation. Only information reasonably necessary for the authorised purpose will be shared.

Psychologists may obtain professional supervision or peer consultation. Where practicable, information used for this purpose will be de-identified. Supervisors and peers are bound by professional confidentiality obligations.

There are times when your psychologist may release your information without obtaining your consent such as:

• When a court requires information by issuing a subpoena, or providing information is otherwise required or authorised by law.
• When it is required because the psychologist must make a mandatory report on a concern.
• When the psychologist discloses information because they believe you or someone else is at risk of serious harm.

Where practicable and lawful, Breakwater Psychology will discuss such a disclosure with you. The amount of information disclosed will be limited to what is reasonably necessary in the circumstances.

Where services are provided to a child, young person or person who requires support to make decisions, consent and privacy arrangements will be considered in light of the person's capacity, age, circumstances, legal authority and clinical needs. Breakwater Psychology will explain who may access information and the limits of confidentiality as clearly as practicable. Independent legal advice may be recommended where authority or consent is uncertain.

The main clinical record in Cliniko for an Australian account, Australian user data processed by Heidi Health, and patient data held by NovoPsych are hosted in Australia. NovoPsych states that limited non-patient information may be stored or processed in Australia, the United States, Ireland or the United Kingdom. Some technology, communications, payment, accounting, security or support providers used by Cliniko, NovoPsych, Stripe, VentralIP, Xero or the practice may process limited information in other countries. The particular countries may change as providers update their infrastructure and subprocessors.

Breakwater Psychology takes reasonable steps when selecting and configuring service providers and reviews available privacy and security information. By using online payment, website, email, telehealth, online assessment or AI-assisted documentation services, information may be handled by the relevant provider under its privacy terms and applicable law.

At any stage, you can request to access your personal information kept on file or ask for it to be corrected if you believe it is inaccurate, out of date, incomplete, irrelevant or misleading. Requests should be sent to admin@breakwaterpsychology.com.au and should provide enough information to identify the records requested.

Breakwater Psychology may need to verify your identity before providing access. Requests will be handled within a reasonable period, generally within 30 days. Access may be provided in an appropriate form and may be subject to lawful exceptions. If access or correction is refused, you will generally be given written reasons and information about available complaint options, unless it would be unreasonable or unlawful to do so.

If you have a concern about the management of your personal information, you may inform your psychologist. Upon request you can obtain a copy of the Australian Privacy Principles, which describe your rights and how your personal information should be handled.

Ultimately, if you wish to lodge a formal complaint about the use of, disclosure of, or access to, your personal information, you may do so with the Office of the Australian Information Commissioner:

• By phone on 1300 363 992.
• Online at https://www.oaic.gov.au/privacy/privacy-complaints/lodge-a-privacy-complaint-with-us
• By post to: Office of the Australian Information Commissioner, GPO Box 5288, Sydney, NSW 2001.

This policy may be updated when legal, professional, clinical or technology arrangements change. The current version will be made available on the Breakwater Psychology website or on request. The effective date shown at the beginning of the policy identifies the current version.