Privacy
1. Introduction
Sandstone Psychology ("we", "us", "our", "the practice") is committed to protecting the privacy and confidentiality of the personal and health information of our clients, referrers, and website visitors. As a registered psychology practice, we are bound by the Australian Privacy Principles (APPs) contained in the Privacy Act 1988 (Cth), the Health Records and Information Privacy Act 2002 (NSW) and its associated Health Privacy Principles (HPPs), and the ethical and professional obligations set out in the Australian Health Practitioner Regulation Agency (Ahpra) Code of Conduct and the Australian Psychological Society Code of Ethics.
Health service providers such as Sandstone Psychology are covered by the Privacy Act regardless of annual turnover. This means we are required to comply with the APPs even though we operate as a small business.
This policy explains what personal and health information we collect, how we collect it, why we collect it, how we store and protect it, who we may share it with, and the rights you have in relation to your information. It applies to information collected through our website, our telehealth consultations, our practice management system, and any other interaction you have with our practice.
2. About our practice
Sandstone Psychology is a sole practitioner psychology practice providing telehealth psychological services across Australia, including individual therapy, psychological and functional capacity assessments, treatment and support plans, clinical supervision for provisional and registered psychologists, and reports for the National Disability Insurance Scheme (NDIS), Medicare, general practitioners, and other referrers. Services are delivered remotely using secure video conferencing and are supported by cloud based practice management, communication, and payment systems.
3. What information we collect
The information we collect depends on the nature of your relationship with our practice. This may include the following categories.
3.1 Personal information
Name, date of birth, gender, address, phone number, and email address
Emergency contact and next of kin details
Medicare number, Department of Veterans Affairs number, NDIS participant number, or private health fund details where relevant to your care or billing
Referral information from your general practitioner, psychiatrist, or other treating professional
Payment and billing details processed through our payment provider
3.2 Health information
As a treating practitioner, we collect sensitive health information, which is subject to additional protection under the Privacy Act and the HRIP Act. This may include:
Information about your mental health, presenting concerns, psychological history, and diagnosis
Clinical notes made during assessment, therapy, and supervision sessions
Results of psychometric testing, functional capacity assessments, and other formal assessments
Information relevant to risk of harm to yourself or others
Information provided by third parties involved in your care or support, such as family members, support coordinators, disability support workers, or other treating professionals, where relevant and appropriate
Information relevant to NDIS plan reviews, functional capacity, and support needs
3.3 Website information
If you visit our website, we may collect limited technical information such as browser type, device type, and pages visited, for the purpose of maintaining and improving the website. We do not use this information to identify you personally.
4. How we collect information
We collect information directly from you, wherever reasonably practicable, through intake forms, telehealth consultations, email, and our client portal. We may also collect information from other sources where necessary for your care or where you have consented, including:
Referring general practitioners, psychiatrists, and other health professionals
The NDIS Commission, support coordinators, or plan managers, where you are an NDIS participant
Medicare and other government agencies, for billing and rebate purposes
Other treating professionals involved in your care, such as allied health providers or specialists
Provisional psychologists and registrars, where information is shared for the purpose of clinical supervision
Where information is collected from a third party, we will take reasonable steps to ensure you are aware of the collection, consistent with our obligations under the APPs and the HPPs.
5. Why we collect, hold, and use your information
We collect, hold, and use personal and health information for the following purposes:
To provide psychological assessment, therapy, and treatment planning, using evidence based approaches including Cognitive Behavioural Therapy, Acceptance and Commitment Therapy, Dialectical Behaviour Therapy, and Schema Therapy
To prepare reports, assessments, and treatment plans for you, your referrer, the NDIS, insurers, or other relevant bodies, with your consent
To conduct functional capacity assessments and NDIS plan reviews
To provide clinical supervision to provisional and registered psychologists
To process Medicare rebates, invoicing, and payments
To communicate with you about appointments, invoices, and administrative matters
To meet our legal, regulatory, and professional obligations, including mandatory reporting requirements and Ahpra registration standards
To manage complaints, incidents, or risk to safety
We will only use your information for the purpose it was collected, or a related purpose you would reasonably expect, unless you have consented to a different use or the law otherwise permits or requires it.
6. Confidentiality and limits to confidentiality
We treat all client information as confidential. Information shared in sessions, assessments, or supervision is not disclosed to third parties without your consent, except in the following circumstances, consistent with our professional and legal obligations:
Where there is a serious risk of harm to you or to another person
Where disclosure is required by law, such as under a subpoena, court order, or mandatory reporting obligation concerning the safety of a child or vulnerable person
Where required for reporting to Ahpra or another regulatory body regarding professional conduct
Where necessary to coordinate your care with other treating professionals, and you have consented to this coordination
Where required for supervision purposes, in which case identifying details may be limited or de identified where clinically appropriate
Any disclosure outside routine treatment and administrative purposes will, wherever possible, be discussed with you in advance.
7. Third party service providers and where your information is stored
We use a small number of trusted third party providers to deliver our services securely. These providers are contractually and legally required to protect your information, and we take reasonable steps to satisfy ourselves of their security standards before use. Current providers include:
Zanda, our cloud based practice management system, used to store clinical records, appointment bookings, and client communications
Stripe, our payment processor, used to process card payments and invoicing
Google Workspace, including Gmail and Google Meet, used for secure email communication and telehealth video consultations
We do not sell, rent, or trade your personal or health information to any third party for marketing purposes.
8. Telehealth consultations
Our services are delivered by telehealth using secure video conferencing software. Sessions are not recorded by our practice unless you have given specific written consent, such as for training or supervision purposes with all identifying information handled in accordance with this policy. We recommend you attend telehealth sessions from a private location to protect your own confidentiality, and we take reasonable steps to ensure our own environment is private and secure.
9. Data security
We take the security of your information seriously and maintain reasonable administrative, technical, and physical safeguards, including:
Multi factor authentication on practice management and payment systems
Restricted access to client records, limited to those directly involved in your care or supervision
Secure, encrypted storage of clinical records through our practice management system
Regular software updates and cyber security measures, including cyber liability insurance
Verification procedures prior to any financial transfer, to protect against fraud
While we take reasonable steps to protect your information, no method of electronic storage or transmission is completely secure, and we cannot guarantee absolute security.
10. Data breach notification
If we become aware of a data breach involving your personal or health information that is likely to result in serious harm, we will comply with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act. This includes assessing the breach, taking steps to contain and remediate it, and notifying affected individuals and the Office of the Australian Information Commissioner (OAIC) where required.
11. Retention of records
We retain health records in accordance with our professional and legal obligations. Under NSW health records legislation, records are generally retained for a minimum of seven years from the date of your last consultation. If you were under eighteen years of age at your last consultation, we retain your record until you turn twenty five. Records may be retained for longer where required by law, for an active complaint or legal matter, or where clinically appropriate.
Once the applicable retention period has expired and there is no ongoing legal or clinical reason to retain your information, we will securely destroy or de identify it.
12. Access to and correction of your information
You have the right to request access to the personal and health information we hold about you, and to request correction of that information if it is inaccurate, out of date, incomplete, irrelevant, or misleading. Requests can be made in writing to the contact details below.
We will respond to access and correction requests within a reasonable timeframe, generally within thirty days. In limited circumstances permitted under the Privacy Act or the HRIP Act, such as where access may pose a serious risk to your mental health or the safety of another person, we may provide access through a treating professional rather than directly, or may need to withhold or redact part of a record. We will explain our reasons if access is limited or refused.
We may charge a reasonable administrative fee to cover the cost of retrieving and providing copies of records, consistent with applicable regulations.
13. Anonymity and pseudonymity
Where lawful and practicable, you may interact with us without identifying yourself, for example when making a general enquiry. However, providing psychological treatment, issuing Medicare rebates, or preparing reports for the NDIS or other bodies requires us to collect identifying information, so anonymity is not practicable once you become a client of the practice.
14. Clinical supervision
As a Board approved supervisor, Sandstone Psychology may discuss deidentified or limited client information during supervision sessions with provisional and registered psychologists, for the purpose of supporting safe and competent clinical practice. Identifying details are shared only where necessary and appropriate, and supervisees are bound by the same confidentiality obligations that apply to registered psychologists.
15. NDIS specific information
Where we provide services to NDIS participants, including functional capacity assessments and plan reviews, we handle your information consistent with the NDIS Code of Conduct and the NDIS Practice Standards, in addition to our obligations under the Privacy Act and the HRIP Act. Reports prepared for the NDIS are shared only with your consent, or as otherwise required by the NDIS Commission.
16. Children and young people
We provide services to children and young people in accordance with professional and legal requirements regarding consent and parental involvement. Where a young person has capacity to consent to their own treatment, we respect their right to confidentiality within the limits set out in section 6 of this policy. Where a parent or guardian consents to treatment on behalf of a child, information may be shared with them consistent with the child's best interests and applicable law.
17. Cookies and website analytics
Our website, www.sandstone-psychology.com, may use cookies or similar technologies to support basic website functionality and to understand general visitor patterns. You can adjust your browser settings to refuse cookies, though this may affect some website functionality. We do not use website data to identify you personally, and we do not use tracking for advertising purposes.
18. Complaints
If you have a concern about how we have handled your personal or health information, please contact us in the first instance using the details below. We will investigate your complaint and respond within a reasonable timeframe, generally within thirty days.
If you are not satisfied with our response, you may lodge a complaint with:
The Office of the Australian Information Commissioner (OAIC), www.oaic.gov.au
The NSW Privacy Commissioner, via the Information and Privacy Commission NSW, www.ipc.nsw.gov.au
The Health Care Complaints Commission (HCCC) NSW, for complaints relating to health service provision, www.hccc.nsw.gov.au
The Australian Health Practitioner Regulation Agency (AHPRA), www.ahpra.gov.au, for concerns regarding professional conduct
19. Changes to this policy
We may update this policy from time to time to reflect changes in our practices, technology, or legal requirements. The updated version will be posted on our website with a revised effective date. We encourage you to review this policy periodically.
20. Contact us
If you have any questions about this policy, wish to access or correct your information, or wish to make a complaint, please contact us at:
Sandstone Psychology- ABN: 72369632659
Email: support@sandstone-psychology.com
Website: www.sandstone-psychology.com