Privacy Policy

Summary

Belconnen Psychological Assessments Pty Ltd (BPA) is committed to protecting the privacy, confidentiality and security of personal information in accordance with the Privacy Act 1988 (Cth), applicable health records legislation, and the professional and ethical obligations of psychologists. To provide psychological assessment and related services, we collect, use, store and disclose information relevant to your care, including information provided directly by you and, where appropriate, by referring practitioners, family members, schools, and other professionals involved in your care.

We use a range of secure professional systems, healthcare platforms and government services to support clinical service delivery, communication, assessment, reporting, billing and record keeping, and take reasonable steps to protect information through measures including encryption, multi-factor authentication, access controls, identity verification procedures, staff and contractor confidentiality obligations, and the careful selection of service providers.

Personal information is generally only shared with your consent, where required for service delivery, to meet professional, legal or Medicare requirements, or where otherwise authorised or required by law. This policy explains how personal information is collected, used, stored, disclosed, protected, accessed, corrected, retained and managed throughout its lifecycle, and outlines both your rights and our responsibilities in relation to privacy, confidentiality and information security.

1. Purpose

This document describes the privacy policy of Belconnen Psychological Assessments Pty Ltd (BPA) for the management of your personal information. The psychological services provided by Belconnen Psychological Assessments Pty Ltd are bound by the legal requirements of the Australian Privacy Principles set out in the Privacy Act 1988 (Cth) and the Health Records (Privacy and Access) Act 1997 (ACT).

2. Personal information

Your information is stored securely and accessed only by your psychologist and authorised staff or authorised service providers who require access to perform clinical, administrative, or technical functions associated with the delivery of psychological services. Authorised contractors, consultants and service providers engaged by Belconnen Psychological Assessments Pty Ltd may access personal information where reasonably necessary to provide technical, administrative or professional services and are required to maintain confidentiality and privacy obligations consistent with applicable law.

2.1. Information storage

Information is predominantly stored electronically using secure cloud-based systems and professional healthcare platforms, including:

• Microsoft 365 Business services configured to utilise Australian data residency and storage locations wherever supported by Microsoft;
• Google services (including SMS messages when sent/received by Rich Communication Services (RCS));
• Xero accounting and invoicing software;
• Halaxy practice management software;
• Heidi Health clinical documentation software;
• HealthLink secure clinical messaging;
• Medical Objects secure clinical messaging;
• Medicare Online services;
• Mailchimp communication and mailing list services (where utilised);
• NAB Tap on Phone / Tap to Pay payment services;
• Tyro payment and claiming services (where utilised);
• Pearson Q-global;
• Pearson Q-interactive;;
• NovoPsych; and
• WPS Online Evaluation System.

Where possible, information entered into third-party assessment and support systems is de-identified or limited to the minimum information necessary for service delivery.

2.2. Licencing and service arrangement

The Microsoft 365 environment used by Belconnen Psychological Assessments Pty Ltd is currently provided through a licensing and service arrangement with Neuropsychological Assessment Systems Pty Ltd, which owns and administers the Microsoft 365 tenant used by the practice. Appropriate contractual, technical and administrative measures are in place to ensure confidentiality and security of personal information.

2.3. Types of information held

The information collected includes your personal details such as name, address, date of birth, email address and contact phone numbers. As part of providing a psychological service, such as a psychological assessment, consultation, treatment, or report, we will also need to collect and record other personal information that is relevant to your current situation. This may include:

• referral information;
• payment information;
• Medicare and health fund information where applicable;
• developmental, educational, medical and psychological history;
• records of consultations and appointments;
• psychological test responses and assessment results;
• reports and correspondence;
• information received from others involved in your care, such as your GP, psychiatrist, paediatrician, school, lawyer, insurer or other health professionals.

2.4. Government identifiers

Belconnen Psychological Assessments Pty Ltd may collect government-related identifiers, such as Medicare numbers and Individual Healthcare Identifiers (IHIs), where reasonably necessary or authorised for healthcare, identity verification, claiming, digital health or related functions.

BPA does not adopt a government-related identifier as its own identifier, or use or disclose a government-related identifier, except where permitted or required by law. Where applicable, Individual Healthcare Identifiers are handled in accordance with the Healthcare Identifiers Act 2010 (Cth) and other applicable legislation.

3. How your personal information is collected

There are a number of ways your personal information is collected, including when:

• You provide information directly to your psychologist during appointments and in writing such as letters, email or text messages.
• You complete intake forms, questionnaires, screening tools or assessment measures.
• You interact directly with Belconnen Psychological Assessments Pty Ltd administrative systems, including Halaxy.
• Other health practitioners, such as your GP, psychiatrist or paediatrician, provide personal information through referrals, correspondence and medical reports.
• We receive personal information from other sources, such as schools, lawyers, employers or insurance companies through correspondence or reports.
• Information is collected through specialist assessment and reporting systems used as part of your assessment.

If you have concerns that the information recorded is not correct, please discuss your concerns with your psychologist.

3.1. Anonymity and pseudonymity

Where lawful and practicable, you may make a general enquiry to BPA without identifying yourself or by using a pseudonym.

BPA will generally need to know and, where appropriate, verify your identity when providing psychological assessment or other health services, maintaining health records, establishing consent or authority, preparing reports, communicating with other persons with authority to receive information, processing Medicare or other funding claims, or where identification is otherwise required or reasonably necessary.

BPA will seek to collect only the identifying information reasonably necessary for the relevant purpose.

3.2. Unsolicited personal information

BPA may sometimes receive personal information that it has not requested, including reports, correspondence or other information provided by family members, schools, health practitioners or other persons.

Where unsolicited personal information is received, BPA will consider whether the information could lawfully have been collected for the practice’s functions or activities. Where it could not have been collected and BPA is not otherwise required or authorised to retain it, reasonable steps will be taken to destroy or de-identify the information as soon as practicable where it is lawful and reasonable to do so.

Where unsolicited information is retained, including because it is relevant to a health service or forms part of a health record, it will be handled in accordance with this policy and applicable privacy and health records legislation.

3.2. Quality of personal information

BPA takes reasonable steps to ensure that personal information it collects is accurate, up to date and complete and that personal information it uses or discloses is, having regard to the purpose of the use or disclosure, accurate, up to date, complete and relevant.

Psychological assessment frequently involves information obtained from multiple sources. Information provided by a client, parent, caregiver, teacher, referrer or other person may therefore be recorded as reported information, observation or opinion rather than as independently verified fact where appropriate.

If you believe information held about you is inaccurate, incomplete, out of date, irrelevant or misleading, you may request correction in accordance with section 15 of this policy.

4. Purpose of holding personal information

Your personal information is gathered and used for the purpose of providing psychological services to you, including psychological assessment, consultation, treatment, reporting, communication, consulting and other related professional services.

Your personal information is retained in order to document what happens during appointments and enables your psychologist to provide a relevant and informed psychological service to you. This information and record keeping is a necessary part of the services provided and guides clinical decision-making.

Your information may also be used for:

• appointment scheduling and communication;
• billing and Medicare claiming;
• preparation of assessment reports and clinical correspondence;
• consultation and supervision activities;
• quality assurance and practice administration;
• conducting or supporting research, service evaluation, quality improvement activities, professional presentations or publications where the individual has provided consent, where the activity is otherwise permitted by law, or where information has been de-identified so that individuals are not reasonably identifiable;
• seeking client feedback regarding services received and opportunities for service improvement;
• communicating with current or former clients about their current or previous engagement with BPA, including appointments, reports, service administration, material changes to service delivery, and the management, transfer, retention or storage of records;
• where the individual has consented and the communication is otherwise permitted by law, providing information about other BPA services or programs;
• meeting legal, professional, regulatory, funding and record-management obligations; and
• other purposes authorised or required by law.

5. Consequence of not providing personal information

Psychologists are required to keep clear and accurate client records as part of their professional obligations.

If you do not wish for your personal information to be collected, we may not be able to provide psychological services to you. Please discuss any concerns you have with your psychologist, or by emailing admin@belcopsychassessments.com.au.

6. Accessing your personal information

At any stage, you can request access to your personal information kept on file. There may be some exceptions that impact your ability to access the information, which are outlined in the relevant legislation.

If you would like to access your information, please discuss it with us or submit a request in writing to admin@belcopsychassessments.com.au. We will aim to respond to written requests for access to information in writing within 30 days and an appointment may be made if necessary for clarification purposes.

6.1. Identify verification

Before providing access to personal information, discussing confidential information by telephone, releasing records, or responding to requests relating to personal information, Belconnen Psychological Assessments Pty Ltd may require reasonable proof of identity and, where relevant, evidence of authority to act on behalf of another person.

Verification may include photographic identification, confirmation of personal details, verification of contact information, or other reasonable measures considered necessary to protect privacy and confidentiality.

Where identity or authority cannot be satisfactorily verified, the practice may decline the request or require additional information before releasing personal information.

7. Confidentiality of information

Personal information gathered by your psychologist will remain confidential except for certain circumstances. In most cases, any sharing of information will only occur with your consent.

Our practice will generally seek your consent before:

• Sharing information with a family member.
• Discussing your care with others, such as your GP, psychiatrist, paediatrician, employer, school, or any agency funding your services.
• Providing a written report regarding your assessment or treatment to another professional or organisation.
• Sharing information through specialist assessment and outcome-measurement systems where required for service delivery.
• Disclosing information in any way not otherwise described in this policy.

7.1. Professional development & quality assurance

Psychologists are required to engage in professional supervision, peer consultation and continuing professional development as part of maintaining professional competence, ensuring their work is of the high quality expected of the profession, and meeting regulatory obligations.

Where information is discussed for such purposes, reasonable steps will be taken to de-identify information where practicable. Any psychologists, supervisors or consultants involved are bound by professional, ethical and confidentiality obligations.

7.2. Medicare-funded services

Where psychological services are provided under a Medicare referral and a Medicare benefit is or will be claimed, Belconnen Psychological Assessments Pty Ltd is required to provide a written report or other clinical correspondence to the referring practitioner at the completion of the relevant course of treatment, assessment, or as otherwise required by the applicable Medicare Benefits Schedule requirements.

Such reports may include information relating to assessments undertaken, treatment provided, clinical findings, progress, outcomes and recommendations for future management. Communication with the referring practitioner forms part of the Medicare-funded service and supports continuity of care between healthcare providers.

7.3. Report review and co-signing

In some circumstances, reports, assessments or opinions may be reviewed, contributed to, or co-signed by another appropriately qualified psychologist or health professional. This may occur for quality assurance purposes, professional consultation, supervision requirements, credentialling requirements, NDIS-related purposes, registrar programs, or where required to meet eligibility, regulatory or funding requirements. Any professional involved in such review will be subject to appropriate confidentiality, privacy and professional obligations.

7.4. Children, young people and separated families

Where services are provided to a child or young person, the child or young person is considered to be the primary client. Belconnen Psychological Assessments Pty Ltd will manage personal information in accordance with applicable laws, court orders, parenting orders, guardianship arrangements, professional obligations and the best interests of the child or young person.

Where parents, guardians, caregivers, or other persons provide information as part of an assessment or treatment process, that information will generally form part of the child’s clinical record. Information provided by one parent, guardian, caregiver or other persons should not generally be assumed to be confidential from another person who has a lawful right to access the child’s records.

Parents, guardians and other individuals with parental responsibility may not automatically be entitled to access all information relating to a child or young person’s assessment or treatment. Access to information may be limited or refused where permitted by law, where this is considered necessary to protect the privacy, safety or wellbeing of the child or another person, or where legal restrictions apply.

Where parents or guardians are separated, Belconnen Psychological Assessments Pty Ltd may require documentation relating to parental responsibility, parenting arrangements, guardianship, consent authority or court orders before commencing services, releasing information or providing access to records.

Parents, guardians, caregivers and other persons should be aware that information provided during interviews, questionnaires, correspondence, emails or other communications may be included in clinical records and may be referred to in reports, correspondence or other records created as part of the service. Where another person has a lawful right to access those records, information provided by a parent, guardian, caregiver or other persons may become accessible through that process.

As the child or young person is generally the primary client, they may become entitled to access some or all of their clinical record in future, in accordance with applicable law and professional obligations. Parents, guardians, caregivers and other persons providing information should be aware that information they provide may therefore become accessible to the child or young person themselves through a lawful request for access to records.

7.5. Research, service evaluation and client communications

Belconnen Psychological Assessments Pty Ltd may use personal information for research, service evaluation, quality improvement activities, professional presentations, publications or other scholarly purposes where the individual has provided consent, where the activity is otherwise permitted by law, or where information has been de-identified so that individuals are not reasonably identifiable. Clients may request not to receive non-essential communications from the practice.

From time to time, Belconnen Psychological Assessments Pty Ltd may contact current or former clients to:

• request feedback regarding services received;
• notify clients of changes to services or practice operations;
• provide information about services that may be relevant to their previous or current engagement with the practice;
• communicate information relating to the management, transfer, storage or retention of records; or
• meet legal, professional or regulatory obligations.

7.6. Exceptions to Confidentiality

There are times when your psychologist may release your information without obtaining your consent, including:

• When you are an associated party rather than the primary client, and information you provide forms part of the primary client’s clinical record or is otherwise used or disclosed for the purposes of providing the psychological service;
• When a court requires information by issuing a subpoena, or providing information is otherwise required or authorised by law;
• When mandatory reporting obligations apply;
• When the psychologist believes you or another person is at risk of serious harm; or
• Where disclosure is otherwise authorised or required by law.

8. Electronic Communication

Belconnen Psychological Assessments Pty Ltd may communicate with clients, referrers and other authorised parties using email, SMS, telephone, fax and secure electronic communication systems where appropriate for service delivery.

Wherever practicable, client consent will be obtained before communicating personal information electronically.

Clients should be aware that standard email and SMS communications may not be encrypted and therefore may involve privacy and security risks. Where requested and reasonably practicable, alternative secure or encrypted methods of communication will be offered.

While reasonable steps are taken to protect information transmitted electronically, no method of electronic communication can be guaranteed to be completely secure.

9. Website and online services

When you use BPA’s website, BPA and its service providers may automatically process limited technical information such as your IP address, browser or device information, pages visited, referring information, and security-related data. This information is used to operate, secure, maintain and understand use of the website.

BPA uses Microsoft Forms for some online forms. Information you submit through these forms is collected for the purpose described at the point of collection and is handled through BPA’s Microsoft 365 environment in accordance with this policy.

BPA uses Google Site Kit and Google Analytics to understand how the website is used. These services may process information such as browser and device information, approximate location, referring information, page views and website interactions. BPA does not intentionally provide names, contact details, clinical information, patient identifiers or form responses to Google Analytics.

BPA uses Cloudflare, including Turnstile, to protect the website and online forms from spam, automated activity and security threats. Cloudflare may process technical and security information such as IP address, browser information and other signals used to identify suspicious or automated activity.

Cookies and similar technologies may be used where necessary for website functionality, security and analytics. Some service providers may process information outside Australia; further information is provided in the sections of this policy dealing with digital service providers and overseas processing.

10. Use of Digital Service Providers

To provide psychological services efficiently and securely, Belconnen Psychological Assessments Pty Ltd uses a range of professional technology providers, government providers, and health-service providers. These may include:

• Microsoft (including Outlook, Exchange, SharePoint, Teams and Microsoft Forms);
• Google services (including Google services connected through Site Kit, Google Search Console, Google Analytics where enabled, and relevant messaging services);
• Cloudflare (including Turnstile and website security services);
• Intuit products and services (including Mailchimp);
• Xero;
• Halaxy;
• Heidi Health;
• HealthLink;
• Medical Objects;
• Medicare Online Services;
• My Health Record;
• NAB payment services;
• Tyro payment and claiming services;
• Pearson Q-global;
• Pearson Q-interactive;
• NovoPsych;
• WPS Online Evaluation System; and
• other secure professional service providers reasonably required for service delivery.

These systems may be used for appointment management, telehealth, secure clinical messaging, communication, record keeping, psychometric assessment administration and scoring, clinical documentation, reporting, Medicare claiming, invoicing, payment administration, data storage and practice administration.

Some providers may incorporate artificial intelligence (AI) or machine-learning features as part of their services. Where AI-enabled functionality is available, Belconnen Psychological Assessments Pty Ltd takes reasonable steps to use such features in a manner consistent with professional, ethical and privacy obligations. The availability and functionality of AI features may change over time as software providers update their services.

We take reasonable steps to ensure that service providers are appropriate for handling health information and relevant to the services provided. Digital Service Providers maintain their own privacy, security and data-handling policies, which may be amended from time to time. Clients who wish to obtain further information about how a particular provider handles personal information, including information relating to security, data storage, subcontractors or AI-enabled functionality, may refer to the privacy information published by that provider. Further information is available from the privacy policies and security information published by providers including Microsoft, Halaxy, Heidi Health, Pearson Clinical Assessment, NovoPsych, WPS, and any other providers indicated above.

Belconnen Psychological Assessments Pty Ltd may also utilise Australian Government digital health infrastructure, including My Health Record and associated Medicare and Australian Digital Health Agency services, where authorised, available and clinically appropriate. Any access to, use of, or disclosure through such systems will occur in accordance with applicable legislation, professional obligations, system requirements and client consent requirements.

11. Artificial intelligence-assisted documentation

Belconnen Psychological Assessments Pty Ltd may use AI-enabled tools that are integrated into professional software platforms used by the practice, including Heidi Health and, where available, features incorporated into Halaxy or other platforms. These tools may assist with functions such as clinical documentation, transcription, summarisation, workflow management, correspondence drafting, or other administrative and clinical support tasks. Where AI-assisted functionality is used:

• it is intended to support efficient service delivery and administrative efficiency;
• outputs are reviewed by the psychologist before being relied upon or incorporated into the clinical record;
• professional judgement remains the responsibility of the psychologist;
• reasonable efforts are made to ensure information disclosed to AI-enabled systems is limited to what is necessary for the relevant purpose; and
• privacy, security and confidentiality obligations continue to apply.

As software providers regularly update their services, AI functionality may be introduced, modified or expanded over time. Belconnen Psychological Assessments Pty Ltd will take reasonable steps to ensure the use of such functionality remains consistent with applicable privacy legislation, professional standards and ethical obligations.

12. Overseas storage and processing

Belconnen Psychological Assessments Pty Ltd takes reasonable steps to select and use service providers that store, process and support clients’ sensitive personal information, including health information, within Australia wherever reasonably practicable and appropriate to do so.

When selecting technology and service providers, consideration is given to the sensitivity of the information involved, privacy and security requirements, professional obligations, data sovereignty, and the locations in which personal information may be stored, processed, accessed or disclosed.

Some service providers used by BPA may operate global infrastructure, technical support services, backup systems, content delivery networks, affiliated entities or subcontractors located outside Australia. Personal information may therefore, depending on the particular service and configuration, be routed, stored, processed, accessed or transmitted outside Australia.

Where BPA is aware that a product or feature stores, processes, transmits or permits access to sensitive personal information outside Australia, and a suitable Australian-based alternative is reasonably available, BPA may choose not to use that product or feature for sensitive personal information.

Overseas storage, processing or routing of personal information does not necessarily constitute a disclosure to an overseas recipient under the Privacy Act 1988 (Cth). Where BPA is likely to disclose personal information to an overseas recipient, BPA will comply with applicable requirements of the Australian Privacy Principles, including taking reasonable steps to protect that information unless an applicable exception applies. Where practicable, BPA will identify the countries in which such overseas recipients are likely to be located.

Where sensitive personal information is stored, processed, accessed or transmitted outside Australia, BPA will take reasonable steps to ensure that the handling of that information remains consistent with applicable Australian privacy legislation, professional obligations and ethical standards. BPA will continue to review its technology and service providers and implement reasonable measures to support compliance with Australian privacy and professional obligations.

13. Data breach policy

In the event that any unauthorised access, disclosure or loss of your personal information occurs, Belconnen Psychological Assessments Pty Ltd will activate its Data Breach Response Plan and use all reasonable endeavours to minimise any risk of serious harm.

Where required, affected individuals and relevant regulatory authorities will be notified in accordance with the Notifiable Data Breaches Scheme and applicable privacy legislation.

14. Retention and destruction of records

Clinical records are generally retained for the periods required or recommended by applicable legislation, professional standards and Psychology Board of Australia requirements.

Once those retention periods have expired, records may be securely destroyed, archived, anonymised or de-identified where appropriate, lawful and reasonably practicable to do so.

15. Requests for access and correction to personal information

At any stage you may request access to and correction of the personal information held about you.

Your psychologist may discuss the contents with you and/or provide a copy, subject to any exceptions contained within applicable privacy legislation.

If your psychologist is satisfied that personal information held about you is inaccurate, out of date or incomplete, reasonable steps will be taken to correct the information.

All requests for access to or correction of personal information should be directed to your psychologist or to admin@belcopsychassessments.com.au. We will aim to respond to written requests for access to information in writing within 30 days and an appointment may be made if necessary for clarification purposes.

16. Business continuity

In the event that Belconnen Psychological Assessments Pty Ltd ceases operation, is sold, or the principal psychologist becomes unable to continue practice, reasonable steps will be taken to ensure that client records continue to be managed, retained and protected in accordance with applicable legal, ethical and professional obligations.

In the event Belconnen Psychological Assessments Pty Ltd ceases operation, is sold, or the principal psychologist becomes unable to continue practice, your records may be transferred to another suitable professional or organisation for safekeeping. Reasonable efforts will be made to notify you if transfer occurs.

17. Concerns

If you have a concern about the management of your personal information, you may raise the matter directly with your psychologist. If you are uncomfortable speaking with your psychologist directly, please email admin@belcopsychassessments.com.au.

Upon request, you can obtain information regarding the Australian Privacy Principles, which describe your rights and how personal information should be handled. If you are unable to resolve concerns by emailing admin@belcopsychassessments.com.au and would like to lodge a formal privacy complaint, you may contact the Office of the Australian Information Commissioner (OAIC):

• By phone on 1300 363 992
• Online at https://www.oaic.gov.au/privacy/privacy-complaints/lodge-a-privacy-complaint-with-us
• By post to: Office of the Australian Information Commissioner, GPO Box 5288, Sydney NSW 2001