Your privacy matters.

1. About This Policy

Lauren Poulos Psychology is committed to protecting your privacy and handling your personal and health information with care, professionalism and respect.

This Privacy Policy explains how we collect, hold, use, disclose and protect your personal information when you visit our website, contact the practice or receive psychological services.

We manage personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), applicable Australian laws, and the professional standards and Code of Conduct of the Psychology Board of Australia.

Health information is sensitive information under Australian privacy law and is treated with a high level of confidentiality and security.

In this Privacy Policy, "we", "our" and "us" refer to Lauren Poulos Psychology (ABN 34 268 932 376). By engaging our services, you acknowledge that your personal information will be managed in accordance with this Privacy Policy.

This Privacy Policy describes our general information-handling practices. It does not replace the informed-consent process undertaken at the start of psychological services, including discussions about confidentiality and the circumstances in which information may be disclosed.

2. Information We Collect

Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable. Health information is a form of sensitive information and receives additional protection under Australian privacy law.

We only collect personal and sensitive information that is reasonably necessary to provide our services, operate the practice or meet our legal and professional obligations. Sensitive information is collected with your consent, unless its collection is otherwise authorised or required by law.

The information we collect generally falls into two categories: administrative information and clinical information.

2.1 Administrative Information

Administrative information is collected to manage enquiries, appointments, communication, payments, funding and the general administration of the practice. This may include:

• your name, date of birth, address and contact details;

• your preferred method of communication;

• emergency contact details;

• details of a parent, guardian or other authorised representative, where applicable;

• Medicare and Individual Healthcare Identifier information, where applicable;

• private health insurance or other funding information, where applicable;

• referral information and details of your GP or other referring practitioner;

• payment, billing and rebate information;

• appointment and attendance history;

• consent forms and intake forms;

• relevant identification documents, where reasonably required; and

• correspondence relating to your enquiries, appointments or care.

2.2 Clinical Information

Clinical information is collected to assess your needs and provide appropriate psychological services. Depending on the services provided, this may include:

• your presenting concerns and reasons for seeking psychological services;

• psychological, psychiatric and medical history;

• medications and other treatment information;

• family, relationship and social history;

• educational and employment history;

• lifestyle information relevant to your care;

• risk assessments and safety plans;

• psychological assessment results and responses;

• observations made during consultations;

• session and progress notes;

• diagnoses or clinical formulations, where applicable;

• treatment plans, recommendations and outcomes;

• reports and other professional correspondence relating to your care;

• information provided by your referring practitioner, other healthcare providers or other authorised persons; and

• other information reasonably relevant to the psychological services being provided.

2.3 Clinical Records

Psychologists are legally and ethically required to maintain clinical records that are accurate, current and sufficient to support safe and effective practice. Information cannot be omitted from your clinical record where it is relevant to your care or required under professional standards.

Clinical records may contain factual information, professional observations and clinical opinions reasonably relevant to your assessment, treatment and care.

You may raise concerns about information in your record and request that it be corrected, or that a statement setting out your position be associated with the record. See section 13, Correction of Personal Information.

3. Why We Collect Your Information

We collect, hold, use and disclose personal information where reasonably necessary to provide psychological services, operate the practice and meet our legal and professional obligations. This includes to:

• respond to enquiries and determine whether our services are suitable for your needs;

• arrange, confirm and manage appointments;

• verify your identity and contact details;

• assess your needs and provide appropriate psychological assessment, treatment and care;

• develop, implement and review treatment plans;

• assess and manage risks to your safety or the safety of others;

• communicate with you about your care and the operation of the practice;

• communicate with your referring practitioner, treating healthcare providers or other authorised persons, where appropriate;

• prepare reports, letters, treatment summaries or other documents, where authorised or required;

• process payments, rebates and claims through Medicare, private health insurers or other funding bodies;

• meet record-keeping, clinical governance and professional supervision requirements;

• respond to complaints, incidents, legal proceedings, audits or regulatory enquiries;

• comply with applicable legal, regulatory and professional obligations;

• maintain and improve the quality, safety and administration of our services; and

• protect the lawful interests, rights and safety of clients, practitioners and other persons.

Where practicable, information used to review or improve the quality of our services will be de-identified.

We will generally only use or disclose personal information for the purpose for which it was collected, for a directly related purpose you would reasonably expect, with your consent, or where otherwise authorised or required by law.

3.1 If You Do Not Provide Requested Information

You are not required to provide all the information we request. However, if you do not provide information that is reasonably necessary, we may be unable to:

• determine whether our services are appropriate for you;

• provide psychological services safely or effectively;

• properly assess or manage clinical risks;

• communicate with relevant healthcare providers;

• prepare an accurate report or assessment;

• process Medicare rebates, insurance claims or other funding arrangements; or

• continue providing services where doing so would be unsafe or inconsistent with professional obligations.

Where possible, we will explain why particular information is being requested and the consequences of not providing it.

4. How We Collect Information

Where reasonable and practicable, we collect personal information directly from you. We may collect personal information when you:

• make an enquiry by telephone, email or through our website;

• book or attend an appointment;

• complete an intake, consent, assessment or questionnaire form;

• participate in a telephone or telehealth consultation;

• communicate with us about your care;

• provide documents, reports or correspondence; or

• make a payment or provide information for a Medicare or other funding claim.

We may also collect personal information through our website, online booking system, practice-management software and other electronic platforms used to provide and administer our services.

4.1 Information Collected from Other Sources

In some circumstances, we may collect personal information about you from another person or organisation, including:

• your GP, psychiatrist, paediatrician, psychologist or other healthcare provider;

• your referring practitioner;

• a parent, guardian, carer, family member or other person involved in your care;

• a school, support provider or authorised representative;

• Medicare, an insurer or another funding body;

• a legal representative, court, tribunal or government agency; or

• another person or organisation authorised by you.

We will generally only collect personal information from another source where:

• you have consented to the collection;

• it is unreasonable or impracticable to collect the information directly from you;

• the information is reasonably necessary to provide psychological services safely and effectively; or

• the collection is authorised or required by law.

Where reasonable, we will take steps to make you aware that the information has been collected, where it came from and how it may be used or disclosed.

4.2 Unsolicited Personal Information

We may occasionally receive personal information that we did not request, for example from a family member, healthcare provider or other third party.

Where this occurs, we will determine whether we could have lawfully collected the information if we had requested it. If the information is reasonably necessary for our services, or we are otherwise authorised or required to keep it, we will handle it in accordance with this Privacy Policy.

If not, we will take reasonable steps to securely destroy or de-identify it, where lawful and practicable.

5. Children and Young People

Lauren Poulos Psychology mainly provides psychological services to adults aged 18 and over. Where we provide services to children and young people under 18, we consider their age, maturity, capacity, circumstances and best interests in deciding how consent, privacy and confidentiality will be managed.

Before services begin, we will seek to clarify:

• who has legal authority to consent to the services;

• whether the young person is able to provide informed consent;

• the role of each parent, guardian or authorised representative;

• any relevant parenting, guardianship or court orders;

• what information may be shared with parents, guardians or others; and

• the circumstances in which confidentiality may need to be limited.

5.1 Consent and Capacity

Depending on their age, maturity and understanding, a young person may be able to provide informed consent to psychological services and make decisions about how their personal information is handled.

Where a child or young person is not able to provide informed consent, consent may be obtained from a parent, guardian or other person with lawful authority. We may request evidence of parental responsibility, guardianship or other decision-making authority where reasonably necessary.

5.2 Parents, Guardians and Separated Families

Where parents are separated, we may request information about parenting arrangements and copies of any relevant parenting plans, parenting orders, guardianship orders or other court documents.

We do not determine disputes between parents or guardians. Where there is uncertainty or disagreement about consent, access to information or participation in treatment, we may delay or decline to provide services until the relevant authority or arrangements are clarified.

A parent, guardian or other person arranging or paying for services does not automatically have unrestricted access to everything discussed in sessions.

5.3 Confidentiality

Children and young people are entitled to an appropriate level of privacy and confidentiality. At the start of services, we will explain, in a way suited to the young person's age and understanding:

• what information will remain confidential;

• what information may be shared with a parent, guardian or other person;

• how progress or safety concerns may be communicated; and

• the circumstances in which information may be disclosed without consent.

Where appropriate, we will discuss with the young person what will be shared before communicating with a parent, guardian or other person.

5.4 Access to Information

Requests by a parent, guardian or authorised representative to access a child or young person's information will be considered having regard to the young person's age, maturity and capacity; the requester's legal authority; the young person's privacy and best interests; the confidentiality arrangements explained at the start of services; the privacy of other people; and applicable legal and professional obligations.

Access may be limited or refused where permitted or required by law.

5.5 Safety and Legal Obligations

Information relating to a child or young person may be disclosed where:

• the young person, or an authorised representative, has provided informed consent;

• disclosure is reasonably necessary to address a serious threat to a person's life, health or safety;

• a child protection, mandatory reporting or other legal obligation applies;

• disclosure is required by a valid court order, subpoena or other lawful process; or

• disclosure is otherwise authorised or required by law.

Where practicable and legally permissible, we will discuss the disclosure with the young person and their parent, guardian or authorised representative.

6. Use, Disclosure and Limits of Confidentiality

We treat your personal and health information as confidential. We will generally only use or disclose your personal information:

• for the purpose for which it was collected;

• for a directly related purpose that you would reasonably expect;

• with your informed consent; or

• where the use or disclosure is otherwise authorised or required by law.

Where practicable, we will only use or disclose the minimum information reasonably necessary for the relevant purpose.

6.1 Disclosure With Your Consent

With your informed consent, we may disclose relevant personal information to:

• your GP, psychiatrist or referring practitioner;

• another psychologist or healthcare provider involved in your care;

• an allied health professional or support provider;

• a parent, guardian, carer, family member or authorised representative;

• a school, employer or other organisation, where relevant to the services requested;

• Medicare, an insurer or another funding body;

• a legal representative; or

• another person or organisation authorised by you.

Before seeking your consent, we will take reasonable steps to explain what information would be disclosed, who would receive it, why, and any reasonably foreseeable consequences of the disclosure.

You may withdraw or change your consent to future disclosures by letting us know. Withdrawing consent will not affect a disclosure that has already lawfully occurred. It may affect our ability to provide particular services, prepare reports or communicate with others involved in your care.

6.2 Medicare and Your Referring Practitioner

If you are attending under a Mental Health Treatment Plan, we are required to provide progress reports to your referring medical practitioner to support ongoing Medicare-rebated sessions. We will discuss what these reports include with you.

6.3 Disclosure Without Consent

There are limited circumstances in which we may use or disclose personal information without your consent. These may include where:

• the disclosure is authorised or required by an Australian law;

• the disclosure is required by a valid subpoena, court order, warrant or other lawful process;

• a child protection, mandatory reporting or other reporting obligation applies;

• it is unreasonable or impracticable to obtain your consent, and we reasonably believe the disclosure is necessary to lessen or prevent a serious threat to the life, health or safety of any person, or to public health or safety;

• the disclosure is reasonably necessary to establish, exercise or defend a legal or equitable claim;

• the disclosure is required for a lawful Medicare, insurance, funding, audit or regulatory purpose; or

• the use or disclosure is otherwise permitted under applicable privacy legislation.

Where a subpoena, court order or other legal request is received, we may obtain legal or professional advice before responding.

Where practicable and legally permissible, we will discuss a disclosure with you before it occurs, or notify you after it has occurred.

6.4 Third-Party Funded or Requested Services

Where services are funded or requested by another person or organisation, such as an insurer or employer, we will explain before services begin who has requested or funded them, their purpose and scope, what information may be provided and to whom, and the limits of confidentiality that apply.

We will not assume that a person or organisation paying for services is entitled to unrestricted access to your clinical information.

6.5 Information About Other People

Information about family members, partners, carers or other people may be discussed or recorded where it is relevant to your care. We will take reasonable steps to protect their privacy.

Your right to access your records may be limited where providing access would unreasonably affect another person's privacy, or where another lawful ground for refusing access applies.

7. Professional Supervision and Consultation

Psychologists may participate in professional supervision or consultation to support safe, effective and high-quality practice and to meet their professional obligations. This is explained as part of the informed-consent process.

Where your information is discussed in supervision or consultation:

• information will be de-identified where reasonably practicable;

• only information reasonably necessary for the purpose will be shared;

• identifiable information will only be shared with your informed consent, or where otherwise authorised or required by law; and

• supervisors and consultants are expected to maintain appropriate privacy and confidentiality.

Where information arising from supervision or consultation is relevant to your assessment, treatment or safety, the relevant information or resulting clinical decision may be recorded in your clinical record.

8. Third-Party Service Providers

We use third-party service providers to help us provide psychological services and operate the practice. These may include:

• practice-management, clinical record and appointment-booking providers;

• cloud-storage providers;

• telehealth providers and AI note-taking tools (used only with your consent);

• email and SMS communication providers;

• payment-processing and Medicare-claiming providers;

• website-hosting and technical-support providers;

• accountants, legal advisers and professional indemnity insurers; and

• other administrative or professional service providers.

Third-party providers are only given access to personal information where reasonably necessary for them to provide their services, or where otherwise authorised or required by law. Not all providers have access to clinical information; where access is necessary, it is limited to the minimum reasonably required.

We take reasonable steps to select reputable providers and to assess their privacy, confidentiality and security arrangements. Where appropriate, we require providers to use personal information only to provide their services, restrict access to authorised personnel, maintain appropriate safeguards, and securely return, delete or de-identify information when it is no longer required.

Some providers may process personal information outside Australia. See section 11, Where Your Information Is Stored.

9. Storage and Security

We take reasonable steps to protect the personal information we hold from misuse, interference, loss, and unauthorised access, modification or disclosure.

Personal information may be stored:

• electronically within our practice-management and clinical record systems;

• through secure cloud-based service providers;

• within email, telehealth, payment and communication systems; and

• on password-protected computers or other authorised devices.

Our security measures include:

• password protection and multi-factor authentication;

• access controls that limit information to authorised persons;

• encryption where appropriate and available;

• secure data transmission and backup processes;

• antivirus, firewall and software security measures;

• confidentiality obligations for anyone who may access information; and

• procedures for securely destroying or deleting information when it is no longer required.

Using a third-party provider does not remove our responsibility to take reasonable steps to protect the personal information we hold. No electronic system can guarantee absolute security.

You can help protect your information by:

• keeping your contact details current;

• using secure devices and internet connections when communicating with us;

• protecting passwords and access details for any online services; and

• telling us promptly if you believe your information has been sent to the wrong person or accessed without authority.

Our response to privacy and security incidents is set out in section 14, Data Breaches.

10. Retention and Destruction of Records

We retain personal and clinical information for as long as reasonably necessary to provide our services and meet our legal, professional, insurance and record-keeping obligations.

Unless a longer period is required, clinical records are generally retained for at least seven years from the date of the last entry for an adult client, or until the client turns 25 where they were under 18 when the record was created.

Records may be retained for longer where reasonably necessary, including where:

• services are ongoing;

• the information may be relevant to a complaint, investigation, legal proceeding or insurance matter;

• a court, tribunal, regulator or government agency requires the information to be retained;

• another legal or professional obligation applies; or

• retention is reasonably necessary to establish, exercise or defend a legal or equitable claim.

When personal information is no longer required, we will take reasonable steps to securely destroy or permanently de-identify it. This may include permanently deleting electronic records, securely disposing of any physical records, and instructing relevant service providers to delete or de-identify information.

Some information may remain temporarily in secure system backups until those backups are overwritten or deleted through ordinary processes. While in a backup, it remains subject to appropriate security and access controls.

De-identified information that can no longer reasonably identify you may be kept for lawful practice administration, service evaluation, quality improvement or statistical purposes.

11. Where Your Information Is Stored

Our clinical records and practice-management information are stored in Australia.

Telehealth appointments are conducted using Google Meet, provided by Google. Google operates data centres around the world, and information relating to video appointments, such as connection and meeting data, may be processed outside Australia, including in the United States. We use a business Google Workspace account, which is covered by Google's data processing terms. Google Meet is not used to record or transcribe appointments. Where AI note-taking is used with your consent, it is provided through Halaxy and stored in Australia (see section 17, Telehealth).

Some other service providers, such as website-hosting, email or analytics providers, may also store or process limited information outside Australia.

Before engaging a provider that handles personal information outside Australia, we take reasonable steps to assess its privacy, confidentiality and security arrangements. Where required by the Australian Privacy Principles, we take reasonable steps to ensure overseas recipients handle personal information consistently with Australian privacy requirements.

12. Access to Personal Information

You may request access to the personal information we hold about you by contacting us using the details in section 22, Contact Details.

We may ask you to make the request in writing, provide enough detail to identify the information requested, and verify your identity or authority to access it.

We will respond within a reasonable period, generally within 30 calendar days.

Where reasonable and practicable, we will provide access in the form you request. This may include:

• an electronic or printed copy of the information;

• allowing you to inspect the information;

• explaining the information to you;

• providing access through an appropriately qualified healthcare professional; or

• sending the information to another healthcare professional authorised by you.

We will not charge a fee for making an access request. We may charge a reasonable, non-excessive fee for the cost of preparing and providing access, and will tell you about any fee before processing the request.

A request for a new report, opinion or treatment summary is different from a request to access information we already hold, and may be subject to a separate professional fee.

12.1 When Access May Be Limited or Refused

We may limit or refuse access where permitted or required by law, including where:

• providing access would pose a serious threat to the life, health or safety of any person, or to public health or safety;

• providing access would have an unreasonable impact on another person's privacy;

• the request is frivolous or vexatious;

• the information relates to existing or anticipated legal proceedings and would not otherwise be accessible through that process;

• providing access would reveal our intentions in negotiations with you in a way that would prejudice those negotiations;

• providing access would be unlawful, or denying access is authorised or required by law or a court or tribunal order;

• providing access would be likely to prejudice an investigation or enforcement activity; or

• another lawful ground for refusing access applies.

Where direct access cannot be provided, we will consider whether access can reasonably be given another way, such as by removing information about another person or providing access through an appropriately qualified healthcare professional.

If we refuse or limit access, we will generally give you written reasons and explain how to make a complaint, unless providing reasons would be unreasonable or unlawful.

13. Correction of Personal Information

We take reasonable steps to ensure the personal information we hold is accurate, current, complete, relevant and not misleading.

You may ask us to correct personal information you believe is inaccurate, out of date, incomplete, irrelevant or misleading, using the details in section 22, Contact Details. We may ask you to put the request in writing, identify the information concerned, explain why it needs correcting, and provide supporting information where appropriate.

We will respond within a reasonable period, generally within 30 calendar days. We do not charge a fee for a correction request, for correcting information, or for associating a statement with your record.

13.1 Clinical Records and Professional Opinions

A clinical observation, assessment or professional opinion is not necessarily inaccurate because you disagree with it. However, we will consider whether the record:

• clearly identifies the information as an observation or professional opinion;

• correctly records the information available at the time; and

• remains accurate, current, complete, relevant and not misleading for its purpose.

Where appropriate, a correction may be made by updating, clarifying or adding to the record rather than deleting the original entry. This preserves the integrity and chronology of the clinical record while ensuring it is not misleading.

13.2 If We Refuse a Correction Request

If we refuse to make a requested correction, we will generally give you written notice explaining the reasons (unless this would be unreasonable or unlawful), how to make a privacy complaint, and your right to request that a statement setting out your position be associated with the information.

If you request this, we will take reasonable steps to associate your statement with the information so that it is apparent to anyone who later uses or accesses the record.

13.3 Notification of Corrections

Where we correct personal information we previously disclosed to another person or organisation, you may ask us to notify them of the correction. We will take reasonable steps to do so, unless it would be impracticable or unlawful.

14. Data Breaches

A data breach may occur where personal information is lost, accessed or disclosed without authorisation, or otherwise compromised.

If we become aware of a suspected or actual data breach, we will take reasonable steps to:

• contain the incident and prevent further unauthorised access or disclosure;

• identify the information and individuals affected;

• assess the nature and potential consequences of the incident;

• take remedial action to reduce the risk of harm;

• seek appropriate legal, technical, insurance or professional advice;

• notify affected individuals and relevant authorities where required; and

• review the incident and put measures in place to reduce the risk of it happening again.

14.1 Notifiable Data Breaches

Under the Notifiable Data Breaches scheme, a breach is an eligible data breach where personal information has been lost or subject to unauthorised access or disclosure, the breach is likely to result in serious harm to one or more individuals, and we have not been able to prevent that likely risk of serious harm through remedial action.

Where we suspect an eligible data breach may have occurred, we will undertake a reasonable and timely assessment. Where we have reasonable grounds to believe one has occurred, we will notify the Office of the Australian Information Commissioner (OAIC) and affected individuals as required by law.

A notification may include our identity and contact details, a description of the breach, the types of personal information involved, and recommended steps to reduce the risk of harm.

14.2 Reporting a Suspected Breach

If you believe your personal information has been lost, accessed without authority, sent to the wrong person or otherwise compromised, please contact us as soon as possible using the details in section 22, Contact Details.

15. Website, Cookies and Online Enquiries

15.1 Information You Provide

We may collect personal information when you submit an online enquiry, complete a contact, intake or booking form, request information about our services, subscribe to communications, or otherwise contact us through the website.

This information is used to respond to your enquiry, manage appointments, provide requested information or help you access our services. It may be stored by our website host, booking provider, practice-management provider or another authorised service provider.

Please avoid including detailed or sensitive clinical information in an initial online enquiry. Website enquiries are not monitored continuously and should not be used for urgent matters or crisis support.

15.2 Information Collected Automatically

When you use our website, certain technical information may be collected automatically, including your IP address, browser and device information, the date and time of your visit, pages viewed, the website or search engine that referred you, and general location derived from your IP address.

This information is used to operate and secure the website, identify technical issues and understand how visitors use our services.

15.3 Cookies and Analytics

Our website may use cookies and similar technologies. Cookies are small data files stored on your device. They may be used to remember preferences, enable website and booking functions, maintain security, and measure website traffic and performance.

Where we use third-party analytics services, information about your use of the website, such as IP addresses, device identifiers and website activity, may be provided to those services.

You can usually change your browser settings to block or delete cookies. Disabling cookies may affect how some website functions work.

15.4 Marketing

We will not use clinical or health information for direct marketing without your express consent.

Where our website uses advertising, remarketing or social-media tracking technologies, this will be disclosed in this Privacy Policy and, where required, appropriate consent mechanisms will be provided.

You may opt out of marketing communications at any time by unsubscribing or contacting us. Administrative communications about appointments, payments or services are not marketing.

15.5 External Links

Our website may link to websites operated by other organisations. We are not responsible for their privacy practices. Please review their privacy policies before providing personal information.

16. Email and SMS Communication

We may use email and SMS to communicate with you about appointment confirmations, reminders and changes; intake forms and administrative documents; invoices, receipts and payment information; Medicare and funding matters; and other administrative matters relating to your care.

Clinical information may be communicated by email or SMS where appropriate and discussed with you. Where practicable, we limit sensitive information in electronic communications and may use secure document-sharing for particularly sensitive material.

Email and SMS may be handled through third-party providers and may be stored in our systems and added to your clinical record where relevant. These methods carry some risks, including messages being sent to or viewed by the wrong person, unauthorised access to your device or accounts, interception or delay, and storage by third-party providers.

Please tell us if your contact details change, if you no longer wish to be contacted by a particular method, or if you believe a message has gone to the wrong person. You may change your communication preferences at any time, although this may affect our ability to send reminders or other important information.

Email and SMS are monitored during business hours only and should not be used for urgent matters, emergencies or crisis support.

17. Telehealth

Lauren Poulos Psychology provides psychological services by video conference or telephone using platforms selected for their privacy, confidentiality and security features. However, no internet-based communication system can guarantee absolute security.

Before providing telehealth services, we will explain how telehealth works, its privacy and security risks and limitations, what happens if the connection is interrupted, and how emergencies or safety concerns will be managed.

You are encouraged to attend telehealth appointments:

• from a private and appropriate location;

• using a secure internet connection and device;

• taking reasonable steps to prevent others overhearing or viewing the consultation; and

• without recording, or allowing another person to participate, unless this has been discussed with us beforehand.

At the start of a telehealth appointment, we may confirm your identity, current location and contact details. We may also ask for an emergency contact or appropriate local support service where reasonably necessary for your safety.

If another person is present during an appointment, their identity and role should be disclosed. We may discuss whether their attendance is appropriate and how confidentiality will be managed.

Telehealth appointments will not be audio-recorded, video-recorded or transcribed, except as described below with your informed consent.

With your consent, we may use Halaxy AI, the artificial intelligence (AI) tools within our practice-management system, to help prepare clinical notes by transcribing and summarising a session, or to summarise documents such as referral letters. When AI transcription is used, session audio is processed in real time and is not stored. Only the resulting transcript and summary are saved to your clinical record. This information is stored in Australia, is not shared with third parties, and is not used to train AI systems.

Your psychologist reviews all AI-assisted notes and remains responsible for the accuracy of your clinical record. You can decline or withdraw consent at any time, and this will not affect your care.

If the connection is interrupted, we may try to contact you using the phone number or other details you have provided. Information shared during telehealth is handled and recorded in the same way as any other consultation.

Telehealth may not be appropriate in every circumstance. Where it cannot be provided safely or effectively, we may recommend face-to-face services, another provider or an alternative form of support.

18. Payment, Medicare and Other Funding

We collect and use payment, Medicare and funding information where reasonably necessary to process fees, issue invoices and receipts, process Medicare claims and rebates, verify eligibility for funded services, submit claims to insurers or other funding bodies, respond to lawful audits, and maintain financial and administrative records.

Payments and claims may be processed through third-party payment providers, financial institutions, our practice-management system, Medicare or other authorised funding systems. We only give these parties the information reasonably necessary to process the relevant payment, claim or rebate.

Payment-card details entered through a third-party payment provider are handled under that provider's privacy and security arrangements. We do not store complete payment-card details in our clinical records.

Where a Medicare rebate is paid into your nominated bank account, relevant account information may be provided to Medicare or an authorised payment provider for that purpose.

We will not assume that a person or organisation paying for psychological services is entitled to unrestricted access to your clinical information. See section 6, Use, Disclosure and Limits of Confidentiality.

19. Social Media

We maintain social media accounts for general educational, professional and informational purposes. Our social media content is not psychological treatment, crisis support, diagnosis or individual advice. Viewing or interacting with our content does not create a psychologist–client relationship.

To protect your privacy, confidentiality and professional boundaries, please do not use social media to discuss clinical or sensitive personal information, request urgent help, make or change appointments, or send documents relating to your care.

Public interactions with our accounts, such as following, liking, commenting, tagging, reviewing or sharing, may make your association with us visible to others. We cannot control how other users or platforms collect, use or disclose information about those interactions.

We will not publicly acknowledge whether a person is a current or former client, including in response to comments, reviews or other public communications.

We will not publish client information, testimonials, case examples, images or other identifying material without informed consent and any other consent required by professional or legal obligations. Where educational material draws on clinical experience, identifying details will be removed or altered so individuals are not reasonably identifiable.

Social media messages are not monitored regularly and should not be used for urgent matters, emergencies or crisis support. Please contact us using the details in section 22, Contact Details. Social media platforms are operated by third parties and are subject to their own privacy policies.

20. Privacy Complaints

If you believe we have mishandled your personal information or failed to meet our privacy obligations, you may make a complaint verbally or in writing using the details in section 22, Contact Details.

To help us investigate, please include your name and contact details, a description of your concern, relevant dates or circumstances, anyone involved, and the outcome you are seeking. We may ask for further information or to verify your identity where reasonably necessary.

20.1 How We Handle Complaints

We treat privacy complaints seriously, respectfully and confidentially. We will acknowledge your complaint, review the circumstances and relevant records, consider whether corrective action is required, tell you the outcome, and take reasonable steps to prevent similar issues from happening again.

We aim to provide a substantive response within 30 calendar days. If we need more time, we will explain why and, where possible, tell you when to expect a response.

Making a complaint will not affect your access to services or how you are treated.

20.2 External Complaints

If you are dissatisfied with our response, or we have not responded within a reasonable period, you may lodge a privacy complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

Complaints about a health service, or about the health, conduct or performance of a psychologist, may be made to the Queensland Office of the Health Ombudsman at www.oho.qld.gov.au.

21. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our services or practices, the systems and providers we use, our legal or professional obligations, or how we handle personal information.

The current version will be published on our website, identified by the "Last updated" date at the top of this policy. Where changes materially affect how we handle personal information, we will take reasonable steps to bring them to the attention of affected clients.

22. Contact Details

For questions about this Privacy Policy, or to request access to or correction of your personal information, change your communication preferences, report a suspected data breach or make a privacy complaint, please contact:

Lauren Poulos Psychology
ABN: 34 268 932 376
Privacy contact: Lauren Poulos
Email: hello@psychologistlauren.com
Website: www.laurenpoulospsychology.com.au
Postal address: PO Box 50, New Farm, Brisbane QLD 4005

Please do not include detailed clinical or highly sensitive information in an initial email. We may ask you to verify your identity or authority before discussing or providing access to personal information.