Privacy Policy

Last updated: 2 September 2026

Clinical Psychology Services Australia Pty Limited (CPSA, we, us or our) respects your privacy and handles personal and health information in accordance with applicable Australian privacy law, including the Privacy Act 1988 (Cth), the Australian Privacy Principles and, where applicable, the Health Records and Information Privacy Act 2002 (NSW).

This policy explains how we collect, use, store and disclose information when you contact us, use our website, make an enquiry or booking, receive services from us, or deal with us as a parent, guardian, carer, referrer or other authorised person.

Information we collect

Depending on your relationship with CPSA, we may collect:

• identity and contact information, such as your name, date of birth, address, email address and telephone number;
• information about a child, dependant, partner or other person receiving support, and the enquirer’s relationship to that person;
• health information, including presenting concerns, relevant history, symptoms, assessments, diagnoses, treatment, clinical notes, reports and correspondence;
• appointment information, clinician and location preferences, availability, cancellations and rescheduling requests;
• referral, funding and billing information, including information relevant to Medicare, NDIS, private health, workers compensation, CTP, DVA, EAP or another funding arrangement;
• information supplied by a GP, referrer, insurer, plan manager, support person or another health professional where authorised or otherwise permitted by law;
• payment and transaction information. Where payment or card details are collected through Halaxy or another payment provider, those details are handled by that provider and are not stored in the CPSA website enquiry database; and
• technical information generated when you use our website, such as IP address, browser and device information, timestamps, pages visited, cookies, security events and diagnostic logs.

We try to collect information directly from you. We may also collect it from an authorised representative, parent or guardian, referrer, health professional, funding body, insurer, service provider, or another source where you have consented or where collection is authorised or required by law.

Why we collect and use information

We collect, use and disclose information where reasonably necessary to:

• respond to enquiries and determine an appropriate service, clinician or location;
• provide psychological services, assessments, reports, recommendations and continuity of care;
• create and maintain accurate clinical and administrative records;
• identify or create the correct patient record and avoid duplicate or mismatched records;
• arrange, confirm, change or cancel appointments;
• communicate with you, an authorised representative or a referrer;
• process fees, rebates, invoices, claims and funding arrangements;
• coordinate care with other professionals or organisations where authorised;
• manage quality, safety, supervision, training, complaints, legal obligations and practice administration;
• protect our systems, investigate misuse and maintain website reliability; and
• respond to a serious threat to health or safety, or comply with a lawful requirement.

If you do not provide information we reasonably need, we may be unable to respond fully, match you safely to an existing record, arrange an appointment, process a claim, or provide the requested service.

Website enquiries

Information submitted through the CPSA website is stored in our secured WordPress administration system. The website may use the information to find or create a patient record in Halaxy and to create a labelled enquiry note for reception and the clinical team. A limited notification is also sent to the CPSA reception inbox so staff can act on the enquiry. If a record cannot be matched confidently, the enquiry is held for manual review rather than being attached to an uncertain patient.

Please do not use the website enquiry form for emergencies. If there is an immediate risk or emergency, call 000 or attend the nearest emergency department.

Halaxy

CPSA uses Halaxy as its practice-management and clinical-record system. Information held in Halaxy may include patient details, contacts, appointments, clinical notes, forms, reports, invoices, payments, claims and communications.

Our website may send enquiry information to Halaxy, display limited appointment information after a strict identity match, or direct you to Halaxy to complete an online booking, intake form or payment step. When you continue to Halaxy, Halaxy also handles information under its own privacy terms. You can read Halaxy’s Australian Privacy Policy.

Heidi AI-assisted clinical documentation

With your knowledge and consent, a CPSA clinician may use Heidi, an AI-assisted clinical documentation tool, during a consultation. Heidi transcribes the consultation and helps prepare a draft clinical note or related document. The clinician remains responsible for reviewing, correcting and approving any material before it is used or transferred to the official clinical record. Heidi does not replace the clinician’s professional judgement.

For ambient scribing, Heidi states that consultation audio is processed for real-time transcription and is not retained as an audio recording. Transcripts and draft notes may be retained within Heidi according to the retention settings selected by the clinician or practice and can be deleted after the required information has been transferred to the clinical record. Heidi states that patient consultation data is not used to train its AI models.

You may decline or withdraw consent to the use of Heidi. This will not affect your ability to receive care from CPSA; the clinician will document the consultation using another method. In some circumstances, such as a particularly sensitive consultation or where consent cannot be obtained, the clinician may decide not to use Heidi.

Heidi processes information under its own privacy terms. You can read Heidi Health’s Australian Privacy Policy and Heidi’s safety and data information.

Who we may disclose information to

Where necessary for the purposes described above, and subject to consent or another lawful basis, we may disclose information to:

• CPSA psychologists, authorised administration staff, supervisors and contractors who need the information to perform their role;
• Halaxy, Heidi and other technology, hosting, security, backup, email, communications or payment providers supporting our services;
• your GP, referrer, other treating professionals, schools, support coordinators or other people involved in your care where authorised;
• Medicare, Services Australia, NDIS participants’ plan managers, NDIA, private health funds, insurers, employers or other funding bodies where relevant and authorised;
• professional advisers, auditors, insurers, accreditation bodies or regulators where reasonably necessary; and
• police, courts, government agencies or other parties where disclosure is authorised or required by law, or necessary to respond to a serious threat to health or safety.

We do not sell identifiable patient information.

Children, dependants and information about other people

A parent, guardian, carer, referrer or other person who gives us information about someone else should only provide information they are authorised to share. We may need to verify identity, authority or consent before acting on a request or releasing information. A child or young person’s capacity, wishes, safety and applicable legal rights will be considered when information is collected, used or disclosed.

Website hosting, cookies and analytics

Our website and related services may be hosted or supported by WordPress.com, Automattic, Jetpack, Cloudways or other contracted providers. These services may process technical information needed to deliver, secure, back up and measure use of the website.

The website may use cookies or similar technologies for essential functions, security, login sessions, preferences and aggregate site statistics. You can restrict cookies through your browser, although some website functions may not work correctly. For information about WordPress.com and Jetpack visitor data, see Automattic’s Privacy Notice for visitors to users’ sites.

Storage, security and overseas processing

We take reasonable administrative, physical and technical steps to protect information from misuse, interference, loss and unauthorised access, modification or disclosure. These measures include role-based access, authentication, encryption where supported, backups, staff confidentiality obligations and controlled access to clinical systems.

Some contracted providers may use infrastructure or subprocessors outside Australia. Where this occurs, we assess the service and rely on contractual, technical and organisational safeguards appropriate to the information and the service. Provider locations and practices can change, so you should also review the linked provider privacy policies.

No internet transmission or electronic system can be guaranteed completely secure. Please contact us promptly if you believe information has been sent to the wrong person or accessed without authority.

Retention and disposal

We retain clinical and administrative records for the periods required by law, professional obligations, funding arrangements and legitimate clinical or business needs. Different records may have different retention periods. Website submissions, audit records and temporary working material are retained only for as long as reasonably required for their purpose, subject to legal and safety obligations. When information is no longer required, we take reasonable steps to securely destroy or de-identify it.

Access and correction

You may ask to access personal information we hold about you or request that inaccurate or incomplete information be corrected. We may need to verify your identity and authority. In some circumstances the law allows or requires us to refuse access or limit what is provided; if that happens, we will explain the reason where permitted.

Privacy questions and complaints

To ask a privacy question, request access or correction, or make a complaint, contact CPSA:

• Email: [email protected]
• Phone: (02) 4981 8409
• Post: PO Box 100, Medowie NSW 2318
• Online: use the CPSA contact page

Please describe your concern and the outcome you are seeking. We will acknowledge and investigate privacy complaints and respond within a reasonable period. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner.

Changes to this policy

We may update this policy when our services, systems, providers or legal obligations change. The current version will be published on this page with its last-updated date.