Changes Psychology Privacy Policy

  1. Who we are and roles
    • Administrative/billing “provider” – Changes Psychology only manages bookings, billing and Medicare/private health claims on behalf of your practitioner.
    • Your treating “practitioner” (psychologist, clinical psychologist, social worker, counsellor, therapist or other type of therapist) are responsible for your assessment, treatment and clinical care.
    • You are the “client”– You may be the person enquiring about booking, or receiving psychological services or the parent/guardian arranging services for a child or adolescent or another adult.
  1. Collecting information directly from people

Provider and collects client personal Information when receives phone calls, voice messages, emails, sms’, website contact forms, faxes or other communications containing a client’s information from the client directly.

  1. Collecting information from third parties

Provider collects Personal Information about Individuals from third parties when:

    • parents and guardians provide information about their children or children in their care.
    • third parties send Provider or their practitioner email, faxes, or containing Personal Information about the client. E.g. A GP faxing a copy of a referral.
    • a client provides written or verbal information consent for their practitioner or provider to communicate with a third party e.g a child’s teacher or a clients GP to request a copy of the referral
    • people visit the changespsychology.com.au website or submit a form hosted on this website
  1. Types of Information that Provider collects and holds

Using processes described in this Policy, Provider collects the following categories of Personal Information about Individuals:

    • (Content) whatever Personal Information, including Sensitive Health information, that is included in content Individuals or third parties share via Provider’s Services;
    • (Identity Information) name, signature, date of birth, Medicare details, private health insurance member details, bank account or credit/debit card details, family details, educational information, or other information required to facilitate appointments.
    • (Contact Information) email address, phone numbers, residential or postal addresses,
    • (Internet Data) website form submissions, webpage views, IP address, referring web site addresses, location, browser type, operating system, domain name, access times and other data typically collected by analytics services like Google Analytics; 
  1. Sensitive Information

Australian Privacy law categorise certain types of Personal Information as “sensitive information”, including:

    • information or an opinion (that is also Personal Information) about an Individual’s:
      • racial or ethnic origin;
      • political opinions;
      • religious beliefs or affiliations;
      • philosophical beliefs;
      • criminal record; and/or
      • sexual orientation or practices;
    • health information about an Individual, including:
      • any information or opinion about the Individual’s health, health services, or wishes regarding health care; and
      • information collected to provide, or in providing, a health service of any kind.

Provider collects health information from Individuals in providing the Services. If Individuals disclose other sensitive information to their Practitioner, this may be included in records and sometimes managed or is accessible to the Provider and it’s staff. Practitioners, not the Provider, take responsibility for storing sensitive information disclosed to them during appointments (ie casenotes or session records).

  1. How Provider stores Personal Information

Provider holds and stores Personal Information using:

    • (Storage Services) third party data storage services with servers based in Australia and overseas including, but not limited to, Google apps (eg Gmail, Drive, Calendar), Amazon Web services apps, National Australia Bank (NAB) Transact, Notion, Slack, Xero and any other applications and software used for business operations; NOTE: Provider has login access to, and stores information, in the email and practice management software used by Practitioners: Halaxy /Zanda/Coreplus. Once the provider ceases being the provider for a specific practitioner or practice of practitioners, provider no longer has use access to information in the practitioners practice management software or administration email account for a practitioner.
    • (Provider Devices) devices operated by contractors to and employees of Provider’s business; and
    • (Paper Files) documents printed on paper.
  1. Security
    • Provider will take reasonable precautions to protect Personal Information from unauthorised access. This includes measures to secure the Provider’s physical facilities and electronic networks. Provider secures Personal Information that Provider collects with requirements and agreements between Provider and employees and contractors used by the provider.
    • Provider limits access to personal information to those with a valid reason for using that information.
    • Provider’s and practitioners document storage includes security measures such as passwords, pins, encryption, session expiries, firewalls, SSL network encryption, SSL certificate and website transmission encryption, the use of reputable vendors (eg Amazon, Google, Halaxy, Zanda, Coreplus), physical locks and storage on physical files and datacentres housing servers.
  1. Digital service providers can access personal information

When Provider uses the services of various hosting and saas service providers their staff may get access to the Provider’s data, including Personal Information. Provider will only share Personal Information with these third parties to the extent reasonably necessary to perform their functions. Such third party services may include:

For more information on security, please contact Provider using the details in the “contacting us” section below.

  1. Why data is held, used and disclosed

Provider’s handling of Personal Information includes holding, using and sometimes sharing the Personal Information with relevant parties so that Provider can:

    • facilitate the booking of appointments with practitioners;
    • manage records about Individuals’ appointments and psychological health and treatment;
    • offer surveys and questionnaires;
    • transact with Individuals to collect card details and process payments;
    • facilitate medicare and health insurance claims;
    • assess and improve the Services; and
    • provide secure access to the Services.
    • For more information on when Provider shares Personal Information, see below.
  1. Disclosing Personal Information

Provider shares Personal Information with others in the following ways:

    • sharing information with the treating health practitioners, governmental institutions including Medicare and private healthcare insurers or organisations paying for sessions; and
    • sharing information with administration staff and business service providers and contractors that support provider’s services.
    • facilitating the sharing of information about sales, inquiries, processing Medicare rebates, invoices and payments;
  1. Information requests from clients or 3rd parties (eg lawyers/subpoenas)
  • Clients are able to make a written request for copies of their personal information from practitioners. The provider will pass any requests for information onto the practitioner for them to facilitate the request which may include clinical notes and information recorded by the practitioner.
  • Clients need to give practitioners at least 21 days notice to action information requests and can nominate which parties are sent the collated documents and information E.g. the client’s lawyers.
  • The practitioner is entitled to bill the client pro-rata for their time taken to review and collate the clients documents and this fee needs to be paid before the notes are released to the party the client nominates.
  • The practitioner is obligated to identify any person requesting information and ensure the client consents to the information req uest and it’s intended purpose. If the information request is in relation to a person under 18 years, the parent or guardian that has initiated the engagement of psychological services must be made aware of the information request and provide consent for other parties (ie other parents) to receive information about that young person.
  1. Disclosing information overseas
  • The provider discloses Personal Information to overseas contracted staff members in the Philippines for the purposes of administration and data-processing support.
  • The Provider’s use of various saas applications listed above, that have data servers and staff based outside of Australia which results in the storing or processing some Personal Information overseas.
  • By providing Provider with Personal Information, Individuals consent to the transfer of their Personal Information to overseas recipients as contemplated by this privacy policy.
  • Provider takes reasonable steps to ensure that the Personal Information that we transfer to overseas recipients will not be held, used or disclosed by the recipient of the information inconsistently with the APPs.
  1. Contacting us
  • Individuals contact the Provider using the details below if they want to access, correct or delete Personal Information or lodge a complaint. Privacy Officer – steve@changespsychology.com.au
  • Provider reserves the right to refuse access or correction where there are reasonable grounds for doing so, for example if providing access would be unlawful or would compromise the privacy of another person or could be used to cause risk or harm to someone.
  1. Complaints process
  • If Individuals have a complaint about privacy, they can contact Provider using the details listed above. Provider will respond to complaints in writing within a reasonable period (usually 10 business days from the day Provider receives an email).
  • Provider will try to work with Individuals to resolve complaints entirely within 21 days business days, although that period may be longer if it is reasonable to take longer given the nature of the complaint.
  • If Individuals are unsatisfied with our response, they may refer the complaint to the Office of the Australian Information Commissioner (http://www.oaic.gov.au/).
  1. Amendment
  • Provider may amend the Privacy Policy at its sole discretion. Individuals that continue to use the Services agree to be bound by the Privacy Policy as amended.
  1. Definitions
  • Individual, Individuals – means a natural person.
  • Personal Information – means information about an Individual whose identity is apparent, or can reasonably be ascertained, from that information. This includes information like names, telephone numbers, email addresses and physical addresses.
  • Policy, Policies – means this document, drafted in accordance with the Privacy Act 1988 (Cth).
  • Provider – means Changes Psychology Pty Limited and its staff and contractors.
  • Practitioner – means your treating psychologist, social worker, counsellor or other allied health professional providing therapy or assessment services to you.
  • Service, Services – means the following services:
    • arranging appointments with practitioners
    • facilitating medicare and private health insurance claims in relation to appointments;
    • facilitating electronic payment, invoicing or processing of billing/rebates for appointments;
    • managing the documentation and records associated with appointments.
    • other tasks related to supporting appointments with practitioners.