Privacy Policy
Last Updated: September 2026
This Policy applies to Graham Psychology Pty Ltd, ABN 37 169 767 060.
Graham Psychology’s collection, use, disclosure and storage of your personal information is regulated by the Privacy Act 1988 (Commonwealth), the Australian Privacy Principles and related legislation.
Updates to this Privacy Policy will be published on our website.
If you have any questions regarding this Policy or our privacy practices generally, please do not hesitate to contact reception@grahampsychology.com.au and your enquiry will be forwarded to relevant personnel.
Purpose
The purpose of this policy is to:
Give you an understanding of the kinds of personal information that we collect and hold.
Communicate how and when your personal information is collected, disclosed, used, held and otherwise handled by us.
Inform you about the purposes for which we collect, hold, use and disclose personal information.
Provide you with information about how you may access your personal information and seek correction of your personal information.
Provide you with information about how you may make a complaint, and how we will deal with any such complaint.
Policy statement
Your privacy and trust are important to us. We are committed to keeping your personal information safe, private and confidential. We handle your information responsibly and in accordance with Australian privacy laws and professional standards.
What is personal information?
Personal information is information that identifies you or could reasonably be used to identify you. It includes your name, date of birth / age, gender, contact details, financial details as well as health information (which is also sensitive information). In this privacy policy, a reference to personal information includes sensitive / health information.
Collection of personal information
Personal information collected by us will usually fall into one of the following categories:
Contact information (name, age, address, email address and telephone numbers);
Emergency contact information;
Commonwealth identifiers (such as your National Disability Insurance Scheme (NDIS) reference number, your Medicare number or your Tax File Number);
Financial information (such as your bank card details); and
Sensitive information (such as information about your disability, health condition, medical history, assessment questionnaires and outcomes, criminal history, religious beliefs, cultural background).
We may collect personal information about:
clients;
parents, guardians and/or carers of clients and other family members of clients (where applicable);
teachers of clients (where applicable);
healthcare professionals in the course of them referring clients to us and/or providing information to us about your condition and treatment, or in the course of us engaging them to assist us to provide services to our clients; and
third parties providing a service to us
We may collect your information from you in a variety of ways including when:
we provide services to you
you visit our website (such as analytics, cookies or form submissions)
you contact us by any method, such as face-to-face, over the telephone, through an online form or portal, through a paper form or by email
Sometimes we will collect personal information from a third party or a publicly available source, for example where we have your consent, where we are required by law to do so, or if it is unreasonable or impracticable to collect the personal information directly from you (e.g. obtaining client information from a parent, guardian or carer (where applicable), or from your treating healthcare professionals).
You may choose to deal with us anonymously, under a pseudonym or preferred name where lawful and practical. Where anonymity or the use of an alternative name will render Graham Psychology unable to provide the relevant service or reasonably conduct business, we may request that you identify yourself.
You may also choose not to provide us with your personal information. Depending on the circumstances in which you do so, however, we may be unable to provide you with our services as a result.
Where we are collecting personal information from a child or young person, we will use our judgement to determine if that person has the capacity to consent. Where we are unsure, we will seek consent from a parent, guardian or carer.
Information collected is stored in Zanda, our practice management and storage program. Their privacy policy can be found here.
Why do we collect, use, disclose and store your personal information?
We collect, use, disclose and store your personal information to provide you with our services which include:
psychology and assessment services;
invoicing and processing any fees payable in relation to the services rendered;
managing our relationship with you (including if you are a health professional, client, service provider, employee, contractor, student or volunteer) and to contact you for follow up purposes;
with your consent, for NDIS auditing purposes;
verifying and updating personal information held by us;
reviewing, developing and improving our services, as well as our business, operational and IT processes and systems;
resolving any complaints and issues;
complying with our legal or regulatory obligations; and
for other purposes required or authorised by or under law, including purposes for which you have provided your express or implied consent.
We may also collect, use and store your personal information:
for marketing purposes, in order to provide you information about the services we offer;
to respond to your questions and suggestions;
to improve the quality of your visit to our website;
to assist with data analytic processes.
Graham Psychology may use your personal information to communicate with you about our services, programs and events where permitted by law. We will only use or disclose sensitive information, including health information, for direct marketing where you have provided consent as required by the Privacy Act 1988 (Cth). You may opt out of receiving direct marketing communications at any time, free of charge. If you opt out of receiving marketing information, we may still contact you in connection with the services we provide to you, such as for appointment reminders and follow-ups.
Our services, functions and activities, as well as those of our contracted service providers, may change from time to time.
Protecting and storing your personal information
We understand the importance of keeping personal information secure and safe. Some of the ways we do this are:
Requiring employees and contractors to enter into confidentiality agreements;
Securing hard copy document storage (i.e. storing hard copy documents in locked filing cabinets);
Implementing security measures for access to computer systems to protect information from unauthorised access, modification or disclosure and loss, misuse and interference;
Ensuring data storage devices such as laptops, tablets and smartphones are password protected;
Providing discreet environments for confidential discussions;
Implementing access control for our buildings including waiting room / reception protocols and measures for securing the premises when unattended; and
Implementing security protocols for our website.
Personal information may be stored in documentary form but will generally be stored electronically on our software or systems.
We will take reasonable steps to ensure that personal information that is held which is no longer required, including under any contractual or legal requirement, is destroyed or de-identified in a secure manner.
Who may we disclose your personal information to?
In order to carry out our services, functions and activities, Graham Psychology may disclose your personal information to third party suppliers or contractors such as Medicare, private health insurers, NDIS plan managers, TAC, Workcover, EAP Providers as well as cloud computing technology and data storage service providers, data analytic and marketing services, legal services providers, insurance brokers, security service providers, business advisors and financial service providers. We may disclose personal information to these third parties in connection with their provision of goods or services to us.
We may also disclose your personal information to government agencies, private sector organisations or other entities where required or permitted by law, which may include the following circumstances:
You have consented to such disclosure.
We believe that you would reasonably expect, or have been told, that information of that kind is usually passed to those individuals, bodies or agencies, and it is being disclosed for a purpose related (or directly related, in the case of sensitive information) to the reason we collected the information.
We are required or authorised to make such disclosure by law or the requirements of any professional bodies, including where we are required to do so in accordance with child safety obligations.
A permitted general situation or permitted health situation (as these terms are defined in the Privacy Act) exists in relation to the disclosure.
We believe it is reasonably necessary for enforcement related activities conducted by, or on behalf of, an enforcement body (e.g. police, ASIC, Immigration Department).
The persons and organisations which Graham Psychology may disclose your personal information to will handle your personal information in accordance with their privacy policies.
Will my personal information be disclosed overseas?
The persons to whom we disclose personal information are normally located in Australia, although personal information may be disclosed to recipients outside Australia. We may also use data hosting and cloud based service providers whose operations are located overseas (such as to the providers of certain assessment tools in the United States of America (USA)). In all instances where this occurs, we will act in accordance with the Privacy Act and this Privacy Policy.
Note Taking Tool / Transcribing Software
'Patient Notes' or 'Heidi' are software tools that clinicians may use during a session for the purpose of clinical note taking. The use of this software allows your clinician to focus entirely on you during your session, whilst still allowing them to accurately capture medical information, ensuring a comprehensive and precise record of your care.
During the completion of your New Client Intake & Consent Form, you will be asked to indicate whether you consent to your psychologist using this software. You can withdraw your consent at any time.
Further to this, all clinicians are encouraged to obtain verbal consent before using this software. Again, you can withdraw your consent at any time.
Conversations are transcribed simultaneously while they happen, meaning no recordings are ever stored. Notes that a clinician saves from your session are added confidentially to your electronic record within our securely encrypted practice management and storage system, Zanda.
Graham Psychology has reviewed each vendors' terms, confirmed that recordings are not retained, and retain responsibility for the clinical record.
More information on this software is available at heidihealth.com and www.patientnotes.app/privacy-and-compliance
Audio/Visual Recording
The Australian Health Practitioner Regulation Agency (AHPRA) requires provisional registered psychologists to record some sessions as part of the registration process. The recordings assist in professional development and enable provisional registered psychologists to receive feedback on their performance. Your psychologist will always gain your consent at the start of any session they wish to record.
The recordings will be either heard/viewed by the provisional registered psychologist and/or their AHPRA-approved supervisor/s.
All recordings will be securely maintained and destroyed after ten days of making the recording.
You have the right to request that the recording be turned off at any point during the sessions.
Accuracy of personal information
We take steps to help ensure that all personal information we collect, use or disclose is accurate, complete and up to date. Please contact us if you are aware that personal information that we hold about you does not meet this objective.
How can I access or correct my personal information and contact Graham Psychology?
You can request access to personal information that we hold about you.
The procedure for requesting and obtaining access is as follows:
All requests for access to personal information to be made in writing and addressed to us (see contact details below). All requests should specify how the information is proposed to be accessed (photocopies, electronic copy, or visual sighting).
Please provide as much detail as possible regarding the person to whom you believe your personal information has been provided and when. This will allow us to process your request more efficiently.
We will endeavour to acknowledge your request within 14 days of the request being made.
Access will usually be granted within 30 days of our acknowledgment. If the request cannot be processed within that time for whatever reason, we will let you know the anticipated timeframe for a response to be provided.
You will need to verify your identity and authority before access to personal information is granted.
We may charge a reasonable fee for access to personal information, which will be notified and required to be paid prior to the release of any information. Once the request has been processed by us, you will be notified of our response and proposal for suitable access (provision of photocopies, digital copies or visual sighting, where appropriate).
We may refuse to grant access to personal information if there is an exception to such disclosure which applies under relevant privacy legislation.
If, as a result of access being granted, you are aware that we hold personal information that you regard as being no longer accurate or correct, you may request the deletion or correction of such information.
Upon receipt of a request to correct or delete personal information, we will either make such corrections or deletions or provide written reasons as to why we declined to make such alterations.
Notifiable Data Breaches
We take the security of your personal information seriously. If a data breach occurs, we will respond promptly, assess the potential impact and take appropriate steps to contain and address the breach. Where required under the Privacy Act 1988 and Notifiable Data Breaches scheme, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC).
How do we handle complaints?
If you have any concerns or complaints about the way your personal information has been collected or handled by Graham Psychology, please advise us of your concern or complaint in writing and send it to us using the contact details. Graham Psychology will endeavour to acknowledge receipt of a written complaint within 5 business days.
Graham Psychology will investigate the complaint and attempt to resolve it within 20 business days after the written complaint was received. Where it is anticipated that this timeframe is not achievable, we will try to contact the person making the complaint to provide an estimate of how long it will take to investigate and respond to it.
It is our intention to use our best endeavours to resolve any complaint to your satisfaction. However, if you are unhappy with our response, you may contact the Office of the Australian Information Commissioner and/or the relevant privacy regulator in your State/Territory who may investigate your complaint further.
Retention of records
Records for individuals under 18 should be kept until the child turns 25, or for seven years after the last interaction, whichever is later.
In certain cases, such as when there are ongoing legal proceedings, complaints, or medico-legal issues, records may need to be kept for a longer period, potentially indefinitely.
Contact Details
reception@grahampsychology.com.au
Or via mail to:
Lauren Foreman
Graham Psychology
11/12 Maroondah Hwy
Ringwood VIC 3134
Australia