Clinic Privacy Policy

Authentic Self Psychology & Consulting, trading as Authentic Self Psychology | ABN 52 684 607 302

​

Effective date: 14 August 2026 | Routine review: 24 months after the effective date, or earlier following a material change.

​

1. Purpose and scope

This policy explains how Authentic Self Psychology collects, holds, uses, discloses, secures, provides access to and corrects personal information and health information relating to people who enquire about, receive or have previously received services from the practice.

​

The practice is operated by Darcy Richardson, registered psychologist, and provides individual psychological therapy to adults aged 18 and over. Information is handled in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles, the Health Records Act 2001 (Vic), the Victorian Health Privacy Principles and applicable professional obligations. Where requirements differ, the requirement relevant to the information and circumstances applies.

​

The Website Privacy Policy applies to information handled through the public website. Both policies may apply when information submitted through the website is transferred into practice systems or becomes part of an enquiry or client record. This Clinic Privacy Policy governs that information once it is handled as part of the health service.

This policy should be read with the Nature of Services and Consent, relevant third-party consent or payment forms, and the practice’s other current policies.

​

2. Information the practice may collect and hold

The practice collects only information reasonably necessary to assess suitability, provide and coordinate psychological services, keep appropriate records and administer the practice. Depending on the circumstances, this may include:
​

• identity, contact and demographic details, including preferred name, pronouns, accessibility and communication preferences;

• health history, medications, diagnoses, assessments, therapy goals, risk and safety information, session notes and treatment information;

• referrals, reports and correspondence from GPs, psychiatrists, allied health professionals, hospitals, services and other authorised people;

• appointment, attendance, communication, consent, complaint, incident and administrative records;

• Medicare, private health and information required for a separately agreed funding arrangement;

• billing, invoice, receipt, payment-authority, transaction and limited private-payer information;

• information needed for access, correction, legal, insurance, continuity and records-management purposes; and

• technical and security information generated by approved online forms, portals, telehealth, communications and practice systems.

3. How information is collected

Information is usually collected directly from the person through intake and consent forms, appointments, assessment measures, email, secure upload, telehealth, payment processes and other practice communications.

​

Information may also be collected from a referrer, authorised support person, private payer, health professional, funding body, representative or service provider when appropriate authority exists, the collection is reasonably expected and related to care, or another lawful basis applies.

​

Where practicable, the practice explains why information is being collected, whether providing it is required or optional, the usual consequences of not providing it and the people or organisations to whom it is ordinarily disclosed. If reasonably necessary information is not provided, the practice may be unable to offer or continue a service, administer an appointment, process a rebate or payment, or complete another requested action.
 

4. Unsolicited information and third-party contact

The practice may receive information about a person that it did not request. It assesses whether the information could lawfully have been collected and is reasonably necessary for its functions. Information that cannot lawfully or reasonably be retained is destroyed or de-identified where lawful and practicable.

​

Contact from another person does not authorise the practice to confirm whether the named person is or has been a client, disclose information, engage in substantive liaison or action a request. A confidentiality-safe acknowledgement may be provided without confirming client status or authority.

​

As a general practice process, current and former clients may contact the practice directly if they wish to discuss or update consent for communication with a health professional or service. Where the person named in third-party correspondence is or has been a client, Darcy reviews the request with them directly in the first instance before determining whether any liaison may occur. Administration does not independently contact the named person about the third party’s request unless Darcy reviews the circumstances and directs this

​

5. Why information is handled

Personal and health information may be collected, held, used and disclosed to:​
 

• assess service suitability and provide, review and coordinate psychological care;

• maintain accurate clinical and administrative records;

• communicate about appointments, forms, access needs, fees and payments;

• process Medicare, private health or separately agreed funding claims and meet related audit or reporting requirements;

• support practice quality, supervision, continuity and safe closure where the required consent or another lawful basis exists;

• respond to feedback, access and correction requests, complaints, safety concerns and privacy incidents; and

• meet professional, insurance, taxation, legal and regulatory obligations.
  ​

6. Use, disclosure and confidentiality

Information is used or disclosed for the purpose for which it was collected, under current written and informed consent, or where another lawful basis applies. Disclosure is limited to information reasonably necessary for the relevant purpose. The practice does not sell personal information.

​

Lawful disclosure without consent

Information may be used or disclosed without consent where the applicable legal requirements are met, including:

• where obtaining consent is unreasonable or impracticable and Darcy reasonably believes use or disclosure is necessary to lessen or prevent a serious threat to the life, health or safety of a person, or to public health or safety;

• mandatory-reporting, child-safety, family-violence or other obligations required or authorised by law;

• a valid subpoena, court order, statutory notice, regulatory requirement or other legal process;

• Medicare, private health or separately agreed funding and audit requirements the person has chosen to use and authorised; or

• another circumstance permitted or required under applicable privacy, health-records or professional law.

 

Victorian information-sharing schemes

Authentic Self Psychology is not a prescribed Information Sharing Entity under Victoria’s Child Information Sharing Scheme or Family Violence Information Sharing Scheme and does not rely on those schemes as a general authority to request or disclose information.

​

7. Third-party authority and private payment arrangements

A relationship, emergency-contact role, payment role, previous involvement or copied email does not establish authority. Third-party communication, appointment support and private payment arrangements require the applicable separate written forms. Authority is applied only to the person or service, purpose and scope recorded with the practice.

​

For each authorised third party, the practice maintains one clearly identified current authority record. Withdrawn, superseded, expired or conflicting records remain in the audit history but are not relied upon operationally. Written withdrawal applies prospectively when received. New or changed authority takes effect only after the required updated form and Darcy’s documented approval.

​

Third-party arrangements are reviewed through the routine Nature of Services and Consent review, ordinarily every 24 months. If the client confirms that no change is needed, current arrangements continue. If the client wishes to review or change an arrangement, the full Third-Party Support & Communication Consent process is completed. Review may occur earlier after a requested change, withdrawal, purpose completion, an explicit end date or another relevant event.

​

Permission to acknowledge a third-party request does not authorise the practice to action it. Direct client confirmation is required before every third-party request to book, cancel, reschedule or otherwise change an appointment is actioned.

 

A private payer may receive only the financial information expressly authorised, such as an invoice or receipt, the amount due, payment status and service date appearing on the financial document. Payment does not provide access to clinical information, broader appointment or attendance information, appointment-change authority or participation in clinical decisions.

​

8. Professional liaison, supervision and continuity

Liaison with a GP, psychiatrist, allied health professional, professional psychological support service, support person or other external party outside required funding processes occurs only under current written authority identifying the professional or service, purpose and scope, unless another lawful basis applies. Valid authority permits consideration of liaison but does not require Darcy to provide every item requested or undertake a particular form of contact.

​

Relevant information may be discussed with a qualified supervisor or peer consultant only under the client’s written and informed consent, or as general consultation that does not disclose the client’s information. Recipients are bound by professional confidentiality, and identifying details are removed or minimised wherever possible.

​

If Darcy becomes unexpectedly unavailable, authorised personnel may use the minimum contact and appointment information needed to administer appointments and communicate with clients.

​

9. Recording, transcription and AI-assisted documentation

Recording and automated transcription do not occur routinely. Any use of NovoNote or another recording or transcription tool requires a documented privacy and security assessment, a defined clinical purpose and separate, specific written informed consent.

​

When optional digital scribing is activated, session audio is processed to produce a transcript and draft note. Darcy reviews, edits and approves the draft before the final clinical note is stored in the client record.

​

A client may decline, pause or withdraw consent for future use without losing access to therapy. Current technical information about processing, storage, retention, deletion and subprocessors is provided in the Digital Scribing Policy and relevant provider materials. The practice does not publish unverified technical claims in this policy.

​

10. Administrative access and service providers

Authorised administrative support may access information only to the extent required for appointments, forms, fees, payments, correspondence and other approved duties. Administrative personnel are required to maintain confidentiality, do not provide clinical advice or make clinical decisions, and may act only within approved procedures and recorded authority.

​

The practice uses principal providers including Zanda Health for practice management and health records; NovoPsych for assessments; NovoNote for optional digital scribing; Google Workspace for business email and communications; GoCardless and Stripe for payment processing; Xero for accounting; Wix and Calendly for the public website and associated enquiry functions. Minor or changeable technical services are described by category rather than exhaustively named in this policy.

​

The practice maintains a provider and data-governance register covering information handled, locations, subprocessors, safeguards, retention, deletion, incident notification, access, export, correction and account-closure arrangements. Higher-risk providers are reviewed at least annually and after material change.

​

11. Overseas handling

Some providers or their subprocessors may store, process or permit authorised access to information outside Australia. 

​

Where personal information is disclosed to an overseas recipient, the practice takes reasonable steps required by applicable privacy law, limits information shared to what is necessary and uses Australian storage or processing settings where reasonably available.

​

12. Communication, secure transfer and email

Email is used primarily for administrative communication and is not end-to-end encrypted. Authorised administrative support may monitor the practice inbox during business days. The practice does not provide therapy, clinical advice or urgent support by email.

​

Sensitive clinical documents should be sent through the designated Zanda secure-upload pathway or client portal. Provider correspondence should use the nominated secure messaging or fax channels where available. Providing a secure channel to a third party does not confirm client status or authorise liaison.

​

13. Storage, security and retention

The practice takes reasonable technical, physical and organisational steps to protect information from misuse, interference, loss, unauthorised access, modification and disclosure. Controls include role-limited access, secure authentication, supported device and malware protections, trusted networks, restricted forwarding and delegated access, secure service providers, backups, confidentiality requirements, physical and acoustic privacy controls, supervised visitor access where practicable, secure disposal and incident-response procedures.

​

No system can be guaranteed to be completely secure. Clients can reduce risk by using secure devices and networks, protecting portal credentials, checking recipients before sending information and promptly reporting suspected unauthorised access.

​

Adult client health records are retained for at least seven years after the last entry. Records may be retained longer where required by law, insurance, complaint, litigation, professional obligations or a documented continuity need. Information no longer required and not subject to a retention obligation is securely destroyed or de-identified where practicable.

​

14. Access and correction

A person may request access to, or correction of, personal or health information held about them by contacting the practice. Administration acknowledges the request and escalates it to Darcy. The practice verifies identity, authority and scope before providing access or making a correction. Verification is proportionate to the sensitivity and circumstances.

​

A representative must provide evidence of their identity and written authority or legal capacity to act. Broad or unclear requests may be clarified so the relevant information can be located, without treating clarification as a reason for unnecessary delay.

​

The practice responds without unreasonable delay and aims to respond within 30 calendar days. Health-record access requests are completed no later than the applicable 45-day maximum. Correction requests are decided no later than 30 calendar days.

​

Access may be provided by inspection, copy, summary or another appropriate method. A reasonable fee permitted by law applies for providing access and will be discussed before work begins; no fee applies merely for making the request. If access or correction is refused or limited, written reasons and available complaint options are provided where required. If a correction is not made, the person may ask for a statement of the requested correction to be associated with the record where applicable.

​

15. Privacy questions and complaints

Privacy questions and complaints should be sent to the practice using the contact details below. Administration acknowledges and escalates complaints to Darcy. Complaint records document the concern, relevant people or systems, assessment, actions, communications, outcome, responsible person and closure status, and are handled with appropriate confidentiality.

​

The practice acknowledges complaints promptly and aims to provide a substantive response within 30 calendar days where reasonably practicable. If more time is required, the practice provides an update before that deadline explaining the reason, any further information needed and the revised response date.

​

A person may also contact the Office of the Australian Information Commissioner at oaic.gov.au, the Victorian Health Complaints Commissioner at hcc.vic.gov.au, or the Australian Health Practitioner Regulation Agency at ahpra.gov.au for concerns about a registered psychologist. Raising a concern externally does not prevent direct contact with the practice.

​

16. Privacy incidents and data breaches

Actual or suspected privacy and security incidents are contained, assessed and documented. The practice takes reasonable steps to reduce harm and determines whether notification to affected people, the Office of the Australian Information Commissioner, the Victorian Health Complaints Commissioner or another authority is required or otherwise appropriate.

​

Incorrect recipients, unexplained transmissions, lost documents or credentials, suspected phishing, unauthorised access, insecure disposal and suspected overhearing are treated as possible privacy incidents and escalated promptly.

​

17. Practice closure and records continuity

If the practice closes, Darcy becomes permanently unable to practise, or passes away, records are managed under the practice continuity plan and applicable Victorian transfer or closure requirements. Clients will be given information about records access and transfer where reasonably practicable. Any authorised representative or records custodian may access and disclose information only to the extent required by their formal authority and applicable law.

​

18. Policy updates

The final policy will take effect on its approval or publication date and will be routinely reviewed 24 months later, or earlier if practice operations, technology, law or professional requirements materially change. The current version will be available on the practice website or on request. Material changes affecting current clients will be communicated where appropriate.

​

Privacy contact

• Practice: Authentic Self Psychology & Consulting, trading as Authentic Self Psychology

• Privacy contact: Darcy Richardson, Psychologist

• Email: admin@authenticselfpsychology.com.au

• Fax: 03 9125 5801

• Postal address: APSO Bell City, 215 Bell Street, Preston VIC 3072

• Website: www.authenticselfpsychology.com.au