Privacy Policy

About this policy

This policy describes how Pendulum Psychology collects, uses, discloses, and stores your personal information. It is bound by the Australian Privacy Principles (APPs) set out in the Privacy Act 1988 (Cth), the Health Records (Privacy and Access) Act 1997 (ACT), and the Australian Psychological Society Code of Ethics (2007).

What personal information we collect

In order to provide psychological services, we may collect the following types of information:

• Your name, date of birth, address, phone number, and email address
• Emergency contact details
• Referral information (including from GPs, psychiatrists, or other health professionals)
• Medicare, DVA, or private health insurance details
• Relevant medical and mental health history
• Session notes and clinical records
• Any other information you provide during the course of assessment or treatment

Much of this information is classified as “sensitive information” under the Privacy Act, including health information. We will only collect sensitive information with your consent, or where required or authorised by law.

How we collect your information

We collect personal information directly from you wherever possible - through intake forms, during sessions, and via correspondence. We may also collect information from third parties such as your GP, referring professional, or other treating practitioners, with your knowledge and consent unless otherwise required by law.

Why we collect, use, and disclose your information

Your personal information is collected and used for the primary purpose of providing psychological services, including assessment, diagnosis, treatment planning, and ongoing care. We may also use or disclose your information for directly related secondary purposes that you would reasonably expect, such as:

• Communicating with your GP or other members of your care team (with your consent)
• Processing Medicare, DVA, or private health insurance claims
• Meeting professional supervision requirements (using de-identified information)
• Complying with legal obligations, including mandatory reporting requirements under child protection legislation, and court orders

We will not use or disclose your personal information for purposes unrelated to your care without your consent, unless required or authorised by law.

Limits to confidentiality

There are legal and ethical circumstances in which confidentiality may be limited. These include:

• Where there is a serious and imminent risk to your life or health, or to the life or health of another person
• Where there is a mandatory obligation to report suspected child abuse or neglect
• Where disclosure is required by law or court order
• Where disclosure is necessary for the management of a health service complaint

These limits will be discussed with you at the start of treatment.

How we store and protect your information

Your personal information is stored securely using the following systems:

• Halaxy - an encrypted, cloud-based practice management system designed for health professionals and compliant with the Privacy Act 1988 (Cth). Halaxy is used for client records, scheduling, and billing.
• Heidi Health - an AI-assisted clinical documentation tool used to support session note-taking. Heidi Health processes audio in real time to generate clinical notes, and does not retain audio recordings after processing. Data is encrypted in transit and at rest, and stored within Australian-based infrastructure.

Access to your records in both systems is restricted to authorised personnel only. We take reasonable steps to protect your information from misuse, interference, loss, and unauthorised access, modification, or disclosure.

Any hard-copy documents are stored securely and destroyed by cross-cut shredding when no longer required.

Clinical records are retained for a minimum of 7 years after the last contact for adult clients, or until the client turns 25 (whichever is longer) for clients who were minors at the time of treatment, in accordance with professional and legal requirements.

Accessing and correcting your information

You have the right to request access to the personal information we hold about you, and to request corrections if you believe it is inaccurate, out of date, or incomplete. Requests should be made in writing to the practice. We will respond within 30 days. Access may be refused in limited circumstances permitted under the Privacy Act, and we will provide reasons if this occurs.

Anonymity and pseudonymity

Where it is lawful and practicable, you may deal with us anonymously or under a pseudonym. However, in most cases this will not be possible given the nature of psychological services.

Notifiable data breaches

In the event of a data breach that is likely to result in serious harm, we will comply with the Notifiable Data Breaches scheme under the Privacy Act. This includes notifying affected individuals and the Office of the Australian Information Commissioner (OAIC) as required.

Complaints

If you believe your personal information has been handled in a way that is inconsistent with this policy or the Australian Privacy Principles, please raise your concern with us directly so we can work to resolve it.

If you are not satisfied with our response, you may contact:

Changes to this policy

This policy may be updated from time to time to reflect changes in legislation or practice procedures. The current version will always be available on this page.

Contact

Pendulum Psychology
David O’Donohue - Clinical Psychologist
Unit 5, 10 Thesiger Court, Deakin, ACT 2600
hello@pendulumpsychology.com.au