This document describes the privacy policy of Arran Rose Psychology (ARP) for the management of clients’ personal information. Arran Rose Psychology provides a psychological service that is bound by the legal requirements of the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth) as well as other relevant state privacy laws.

Client personal information

Personal information refers to details that identify the client as an individual. Client files at ARP are held in a secure electronic document management system (Zanda), which is accessible only to authorised employees engaged with ARP and requires multi-factor authentication. Client files include personal information such as name, address, email address contact phone numbers, date of birth, emergency contact details, Medicare information, private insurance information, referral information psychological and mental health information, assessment results, clinical notes, correspondence, billing and payment information, information provided by other health professionals, information provided by parents, carers or other authorised representatives, and other personal information collected as part of the psychological service provided by ARP. Card payments are encrypted. Following their legal and ethical obligations, ARP secures clinical information. ARP uses Zanda to securely store client information and files, which requires multi-factor authentication.

How clients’ personal information is collected

When engaging with ARP, a client’s personal information is collected directly from the client or from other people/organisations where appropriate and permitted by law. Personal information is collected when provided by the client directly to their psychologist, such as via email correspondence and hard copy forms. Personal information is collected during administrative interactions such as enquiries, intake forms and telephone calls. Personal information is collected when health practitioners provide referrals, medical reports and correspondence to ARP regarding the client. Personal information is collected when correspondence or reports are received from lawyers, employers or insurance companies. Personal information is collected when clients provide informed consent for psychologists at ARP to use Artificial Intelligence Software such as NovoNote to generate sessions notes and summaries. ARP only uses AI-enabled clinical documentation tools that have been assessed as appropriate for use in the practice and that provide appropriate privacy and security safeguards, including data storage requirements and adherence to Australian Privacy Standards.

Consequence of not providing personal information

ARP may not be able to provide psychological services to clients who do not want their personal information collected in the ways described by this Privacy Policy.

Purpose of holding personal information

Personal information is collected, stored and used for the purpose of providing psychological services, booking and managing appointments, communicating with clients, billing and payment, Medicare and private health insurance administration, responding to enquiries, communicating with referrers, preparing reports, managing referrals, complying with legal obligations, maintaining clinical records and managing the practice. Psychological services include assessing, diagnosing and treating a client’s presenting issue. Documentation of sessions allows ARP to provide an informed psychological service, relevant to the client’s needs.

Disclosure of personal information

A client’s personal information will generally be kept confidential. Information may be disclosed in the following circumstances:

1. where disclosure is required or authorised by law, including where information is subject to a court subpoena.
2. where the treating psychologist reasonably believes that disclosure is necessary to prevent a serious risk to the life, health or safety of the client or another person; or
3. where the client has provided consent for their information to be disclosed, including to:
4. provide a report to another health professional, agency or organisation, such as a GP or lawyer.
5. discuss relevant information with another person, such as a parent, employer, health professional or third-party funder; or
6. disclose the information for another purpose authorised by the client.

ARP does not routinely disclose clients’ personal information to overseas recipients. Where personal information is disclosed to an overseas recipient, ARP will take reasonable steps to ensure that the disclosure is handled in accordance with applicable privacy laws.

In the event of unauthorised access, disclosure or loss of a client’s personal information, ARP will activate its data breach response plan and take reasonable steps to minimise any risk of consequential serious harm

Retention of personal information

ARP retains client health information in accordance with applicable legal and professional requirements. In Victoria, health records are generally retained for the minimum period required under the Health Records Act 2001 (Vic).

Requests for access and correction to client information

Clients may request to see and correct the personal information that has been collected by ARP, relevant to them.

Subject to exceptions of the Privacy Act 1988 (Cth), the psychologist may discuss the contents with the client and/or provide them with a copy of the personal information. Reasonable actions will be taken to ensure that inaccurate, incomplete or out of date information is corrected. Clients should lodge a request for access or correction of personal information directly with ARP. Requests will be responded to in writing within 30 days, and an appointment will be offered if necessary

 Concerns

If you have any questions, requests or concerns about the handling of your personal information, please contact Arran Rose Psychology at arranrosepsychology@gmail.com or [phone]. The Australian Privacy Principle can be provided upon request. If a client wishes to lodge a formal complaint about the use of, disclosure of, or access to, their personal information, they may do so with the Office of the Australian Information Commissioner by phone on 1300 363 992, online at https://www.oaic.gov.au/privacy/privacy-complaints/lodge-a-privacy-complaint-with-us or by post to: Office of the Australian Information Commissioner, GPO Box 5218, Sydney, NSW 2001. If you have a concern about how your personal or health information has been handled, you may contact the Office of the Victorian Information Commissioner (OVIC) or, where the matter relates to health privacy, the Health Complaints Commissioner (HCC) for further information or to make a complaint.

Updates to the Privacy Policy

This Privacy Policy may be changed or amended from time to time. Any changes are effective as soon as the updated Privacy Policy is published on our website. Users are understood to agree to such changes through continued use of our website and engagement with our services. If you do not agree with the terms of this Privacy Policy, you must cease usage of our website and inform us immediately prior to receiving any further psychological services.

Last updated – September 2026