Privacy Policy

Willow Psychology is committed to protecting your privacy and handling your personal information in accordance with the Australian Privacy Principles set out in the Privacy Act 1988 (Cth).

Client information
Client files are held electronically in encrypted form on Australian-based servers with access restricted to authorised personnel. The information on each file includes personal information such as name, address, contact phone numbers, medical history, and other personal information collected as part of providing the psychological service. Personal information will also be collected and held in a secure internet-based appointment scheduling program. Where hard‑copy information is held, it is kept in secure storage.

Payment details may be collected and processed by our payment service provider(s). Where a third‑party provider is used, your card details are handled under that provider’s security controls and privacy policy.

Session recordings and AI transcription: Willow Psychology may, with your explicit consent, record sessions for clinical purposes (e.g., accurate note‑keeping, training or supervision) and use a secure AI transcription service under strict controls. Recordings are managed in a controlled and secure environment and used only for professional purposes. The AI transcription service is required to meet robust security standards; recordings are not retained by the service after transcription, and data is stored on servers located in Australia where applicable. Access to recordings/transcriptions is role‑based and limited to authorised personnel. Clients are not permitted to record sessions.

Retention: Health records are retained in line with legal and professional obligations. In Victoria, this typically means at least 7 years from the last date of service for adults, and until the person turns 25 for records created when the person was under 18. After statutory periods, records are securely destroyed or de‑identified.

How clients' personal information is collected
A client's personal information is collected in a number of ways during psychological consultation. These include times when the client provides information directly to Willow Psychology using hardcopy forms, correspondence via email, when the client interacts directly with employees of Willow Psychology, and when other health practitioners provide personal information to Willow Psychology via referrals, correspondence and medical reports.

Consequence of not providing personal information
If a client does not wish for their personal information to be collected in a way anticipated by this Privacy Policy, Willow Psychology may not be in a position to provide the psychological service to the client.

Purpose of holding personal information
A client’s personal information is gathered and used for the purpose of providing psychological services, which includes assessing, diagnosing and treating a client’s presenting issue. The personal information is retained in order to document what happens during sessions and enables the psychologist to provide a relevant and informed psychological service.

Disclosure of personal information
All personal information gathered during the provision of services will remain confidential except when:

  1. it is subpoenaed by a court, or disclosure is otherwise required or authorised by law; or

  2. failure to disclose the information would in the reasonable belief of Willow Psychology place a client or another person at serious risk to life, health or safety; or

  3. the client’s, or consent of a parent or guardian who is legally authorised to act on their behalf, prior approval has been obtained to:

    a) provide a written report to another agency or professional, e.g., a GP or a lawyer; or

    b) discuss the material with another person, e.g. a parent, employer, health provider, or third-party funder; or c) clinical consultation with another professional is required to provide better clinical services (identifying details will remain confidential); or

    c) disclose the information in another way; or

    d) disclose to another professional or agency (e.g., your GP) and disclosure of your personal information to that third party is for a purpose which is directly related to the primary purpose for which your personal information was collected.

A client's personal information is not disclosed to overseas recipients unless the client consents or such disclosure is otherwise required by law. Clients' personal information will not be used, sold, rented or disclosed for any other purpose.

In the event that unauthorised access, disclosure, or loss of a client’s personal information occurs the psychologist will activate a data breach plan and use all reasonable endeavours to minimise any risk of consequential serious harm.

Requests for access and correction to client information
At any stage a client may request to see and correct the personal information about them kept on file. The psychologist may discuss the contents with them and/or give them a copy, subject to the exceptions in the Privacy Act 1988 (Cth). If satisfied that personal information is inaccurate, out of date or incomplete, reasonable steps will be taken in the circumstances to ensure that this information is corrected. All requests by clients for access to or correction of personal information held about them should be lodged with Willow Psychology. These requests will be responded to in writing within 21 days, and an appointment will be made if necessary for clarification purposes.

Data Breaches
If a data breach occurs that is likely to result in serious harm, we will act promptly to contain, assess and minimise risk and, where required, notify affected individuals and the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches scheme. Our internal Data Breach Plan sets out reporting, 30‑day assessment, notification and review steps.

Concerns
If clients have a concern about the management of their personal information, they may inform Willow Psychology. Upon request they can obtain a copy of the Australian Privacy Principles, which describe their rights and how their personal information should be handled. Ultimately, if clients wish to lodge a formal complaint about the use of, disclosure of, or access to, their personal information, they may do so with the Office of the Australian Information Commissioner by phone on 1300 363 992, online at http://www.oaic.gov.au/privacy/making-a-privacy-complaint or by post to: Office of the Australian Information Commissioner, GPO Box 5218, Sydney, NSW 2001.