Privacy, Safety, and Data Care – Policy

This policy is current as of the 16 JuLY 2026 – Version.2

INTRODUCTION

Privacy and safety are at the heart of how Polysoma works. This privacy notice explains, in plain language, what happens with your information when you connect with my practice, and how I protect it under Australian law and where applicable, I also seek to comply with overseas privacy laws, including the General Data Protection Regulation (GDPR), in relation to persons or clients located outside Australia.

When you work with me, you share details that are personal and often deeply sensitive — the kinds of things most people would only discuss within relationships of trust. This notice is here to make those boundaries transparent: what I collect, why I collect it, how it is stored, and the limits around sharing. Personal information is anything that can be used to identify you, and sensitive information is material you would not usually share outside of relationships of trust. I take this responsibility very seriously.

I treat your information as part of your care, not just “data”. If anything in this document feels unclear, heavy, or raises concern, you are warmly invited to ask questions, name what feels important to you, and explore options that support your comfort and safety. If you have any questions or concerns about how your personal or sensitive information is being handled, please reach out here.

TYPES OF PERSONAL INFORMATION I COLLECT

If you engage with me via this website, or choose to become my client I may ask to collect the following kinds of personal information from you, including:

(a) your name, email address, postal address and phone number;

(b) your age and date of birth;

(d) your IP address, and information about your browsing history to help me improve the usability and appeal of my website (more information about this is found in the section on Cookies below);

(e) emergency contact information; and

(f) any other information provided by you to me via this website, in the course of me providing services to you, or otherwise required by me or provided by you.

HOW I COLLECT PERSONAL INFORMATION

I endeavour to ensure that information I collect is complete, accurate, accessible and not subject to unauthorised access.

Where practicable I will only collect personal information about you directly from you or sources managed by you. However, in some circumstances I may obtain personal information from a third party. If I become aware that personal information has been collected in a manner that is inconsistent with this Privacy Policy or applicable privacy laws, I will take reasonable steps to address the issue, which may include correcting the collection process, restricting the use or disclosure of the information, or securely destroying or de-identifying the information where appropriate and lawful.

I may collect your personal information by various means including when:

(a) you contact me through my website;

(b) you book a consultation with me;

(d) my website automatically collects information about you and your activities on my site (including analytics and cookies – more information on this is set out below);

(e) a third-party supplies information to me, such as when you are referred or introduced to me by a mutual acquaintance;

(f) you submit any of my online forms, surveys and questionnaires; or

(g) you interact with my website, social applications, services, content and advertising.

USE OF YOUR PERSONAL INFORMATION

I collect and use personal information for the following primary purposes:

(a) to provide services or information to you;

(b) for record keeping and administrative purposes;

(c) to provide information about you on a need to know basis to my contractors, employees, consultants, agents or other third parties for the purpose of providing services to you;

(d) to improve and optimise my service offering and client experience;

(e) to comply with my legal obligations, resolve disputes or enforce my agreements with third parties;

(f) to send you administrative messages, reminders, notices, updates, security alerts, and other information requested by you; and

(g) to consider a service intake application from you;

(h) to consider an application of employment from you.

I will only collect your information:

(a) with your full awareness and consent, such as when you email me, tick a checkbox or fill in a form to provide me with information;

(b) if I need it to provide you with information or services that you request;

(d) if collecting the information is necessary to preserve life or keep someone safe from harm; and

(e) for necessary administrative processes if you become my client.

I will only send you marketing communications where you have consented to receive them or where otherwise permitted by applicable privacy laws.

I may also use your personal information for:

(a) secondary purposes closely related to the primary purpose, in circumstances where you would reasonably expect such use;

(b) such purposes where I reasonably believe that use of your confidential personal and sensitive information is necessary to lessen or prevent a serious threat to the life, health or safety of any individual, or to public health or safety, and it is unreasonable or impracticable to obtain your consent;

(d) any other purpose which is permitted or required under applicable privacy laws.

SENSITIVE INFORMATION

I recognise that some information is particularly sensitive, and that you are trusting me to keep this information confidential.

I may collect sensitive information about you while providing you with my services. I will only collect this sensitive information where you consent to such collection and either directly provide me with this information or it is provided by a referring health care practitioner.

I will only collect sensitive information by methods that are reasonably secure, such as:

(a) through my intake form in Zanda when you book an appointment:

(b) in a Zoom consultation or face to face:

(c) when you send me information in an email (please note that email may not be sufficiently secure – if the information is extremely sensitive, ask me about alternative ways to share it with me); or

(d) through psychometric tests conducted via NovoPsych.

Types of sensitive information I collect

The sensitive information I collect may include the following:

(a) cultural background including race or ethnicity,

(b) gender identity, sexual orientation and preferences, sexual activities, relationship status;

(d) political and social opinions, political association, or memberships;

(e) your social and living situation;

(f) criminal history (only if disclosed);

(g) health information (medical and psychological), history and reports, suicide and attempts at ending your life;

(h) drug, alcohol and substance use;

(i) disabilities and impairments;

(j) referring health care provider and associated referral letters;

(k) private health fund and private health insurance cover details;

(l) medicare number, healthcare identifiers or concession card or other entitlement details; and

(m) any other sensitive information provided by you or a third party to me.

How I use your sensitive information

Your sensitive information will only be used for the purpose of:

(a) providing you with my services;

(b) complying with my legal obligations, resolving disputes or enforcing my agreements with you;

(d) any other purpose which is permitted or required under applicable privacy laws.

I am committed to securely storing and handling your sensitive information. Sensitive information is stored in password protected devices with a high level of cybersecurity. Only I and authorised key personnel have access to your sensitive information, and only on a need-to-know basis. Some sensitive information may be stored securely online, or in the cloud through NovoNote and Zanda. You can find out more about their security provisions in the section on Security below.

How you can withdraw consent

If you wish to withdraw your consent to my collection, use or disclosure of your sensitive information, please message here. I will deal with all such requests within a reasonable timeframe.

RETENTION AND DESTRUCTION OF INFORMATION

I retain personal information only for as long as necessary to fulfill my obligations to you, or as required by law. Personal information is retained for at least seven years after your final consultation (or longer where required by law), after which it is securely destroyed or de-identified.

Archived data is reviewed annually, and any information no longer required is securely destroyed. Physical records are shredded, and digital records are permanently deleted from my systems, including backups.

SHARING YOUR DATA

I respect your privacy, and I will take reasonable steps to keep your personal and sensitive information confidential and protected. I may disclose your personal information on a need-to-know basis to:

(a) to provide you with the services you have requested;

(b) where disclosure is necessary to carry out your instructions, such as corresponding with someone else on your behalf, or requesting psychometric tests and evaluations;

(d) to engage in professional supervision, although any information I share under these circumstances is de-identified to preserve client confidentiality; and

(e) to refer you to other service providers and health professionals at your request.

You consent to me sharing relevant information on a strictly need-to-know basis with:

(a) people you authorise me to correspond with, as reasonably required to carry out your instructions;

(b) my subcontractors; and

accounting;
administration;
archiving;
auditing;
business consulting;
email marketing;
legal or financial advice;
professional supervision;
website maintenance;
technological services.

I will also disclose your information if required by law in response to a subpoena, discovery request or a court order, in compliance with mandatory reporting obligations, or in circumstances permitted by the Privacy Act – for example, where I have reasonable grounds to suspect that someone is engaging in unlawful activity, or misconduct of a serious nature, that relates to my work with you. I may also make a disclosure to an appropriate authority or your emergency contact if I have serious concerns about your health, safety or wellbeing.

I will use all reasonable means to protect the confidentiality of your information while in my possession or control. I will not knowingly share any of your information with any third party other than the service providers who assist me with necessary business activities or the services I am providing to you. To the extent that I do share your information with third-party service providers, I only do so if I am satisfied that the service provider has a suitably protective privacy policy of their own, or they have signed a confidentiality agreement with me. Some of my service providers may be overseas and may not be subject to Australian Privacy Laws and Privacy Principles. You can find further information under the Security section below.

If you have any concerns regarding the disclosure of your information, please do not hesitate to get in touch.

SECURITY

I take reasonable physical, technical and administrative safeguards to protect your personal and sensitive information from misuse, interference, loss, and unauthorised access, modification and disclosure.

I manage risks to your information by:

(a) storing files securely;

(b) ensuring that only I or key personnel have access to sensitive information;

(d) conducting regular audits of my security systems.

Your information may also be stored with carefully selected third‑party service providers, where it is managed under their own security and privacy policies in addition to mine . A small number of these providers may process or store your information as part of delivering my services; the current list is available to you on request but is not published online to support security and risk management.

If you are communicating with me via electronic means such as email, virtual/telehealth platforms, or contact forms, I may not have full control over the transmission or storage of any personal information disclosed (although I try to employ best practice cybersecurity standards at all times). You agree that by participating in such forms of communication you understand and accept that there is an inherent risk of disclosure or loss of your personal information for which I cannot be held responsible. If you are concerned about transferring particularly sensitive information, please ask me about alternative options that may be more secure.

In urgent or high‑risk clinical situations, I may also review publicly available information (such as your professional website or public social media profile) alongside what you have shared in therapy, where this is clinically relevant to assessing risk and supporting your safety.

I use AI-powered tools to enhance my efficiency, streamline operations, and improve the services I provide. These tools may assist with tasks such as notetaking, content drafting, scheduling, and customer interactions. I am committed to ensuring that all AI-related data processing aligns with the Australian Privacy Principles and that your information is handled securely and transparently. I take steps to minimise the data shared with AI tools, including:

(a) anonymising personal details; and

I minimise identifying information when using AI tools by:

(a) anonymising or de‑identifying personal details; and

(b) limiting AI processing to non‑sensitive information unless I have your explicit consent.

Before I adopt any AI tool, I review its privacy practices, security measures, and contractual commitments about how personal information is handled. In practice, I use a small number of AI‑assisted systems to support my work, including:

(a) a secure transcription and note‑taking assistant to help document sessions accurately and maintain clear records;

(b) drafting and reflection tools to support summarising, brainstorming, supervision, and refining therapeutic communication;

My practice does not use fully automated decision‑making systems that have a significant impact on clients. All important decisions about your care are made with human, clinical judgment and oversight.

COOKIES AND GOOGLE ANALYTICS

Cookies are small text files that are commonly used by websites to improve a user’s experience, collect statistics or marketing information and provide access to secure areas. My website uses cookies and tracking technologies to enhance user experience and analyse site performance.

You can choose to configure your browser settings not to accept cookies.

My website uses the following cookies:

WordPress – to determine whether your browser can display emojis;
Google Analytics – see below.

I use Google Analytics to collect information about your use of my website so that I can get strategic information about how my website is being used and improve its functionality. You can find out more about the information Google collects and how it is used here. Google also provides an add-on for your browser that you can use to opt-out and prevent your data being used by Google Analytics.

LINKS

My website may contain links to other websites. Those links are provided for convenience and may not remain current or be maintained. I am not responsible for the privacy practices of those linked websites and I suggest you review the privacy policies of those websites before using them.

ACCESS TO INFORMATION

You can contact me to access, correct or update your personal information at any time. Please send your message here and expect a reply within 7 days. Unless I am subject to a confidentiality obligation or some other restriction on giving access to the information which permits me to refuse you access under the Privacy Act, and I believe there is a valid reason for doing so, I will endeavour to make your information available to you within 30 days.

COMPLAINTS

If you have concerns about how I have handled your personal information or believe I have breached this Privacy Policy, or if you wish to a request a change to your personal information, you may contact me here.

If you are not satisfied with my response to your complaint you may seek a review by contacting:

NOTIFICATION OF BREACH

If I have reason to suspect that a serious data breach has occurred and that this may result in harm or loss to you, I will immediately assess the situation and take appropriate remedial action. If I still believe that you are at risk, I will notify the Office of the Australian Information Commissioner and either notify you directly, or if that is not possible, publicise a notification of the breach on this website.

FURTHER INFORMATION RELATING TO THIS PRIVACY POLICY

For further information about my privacy policy or practices, or to access or correct your personal data, or make a complaint, please contact hello at polysoma dot au. I may change this privacy policy from time to time by posting an updated copy on my website and I encourage you to check my website regularly to ensure that you are aware of my most current privacy policy. Where I make any significant changes, I will endeavour to notify you by email.

This policy is current as of the 16 JuLY 2026 – Version.2

INTRODUCTION