Earth Soul Counselling

1. What this policy covers
This policy explains how I collect, use, store, and disclose your personal information when you visit my website, make an enquiry, or engage in counselling (in person, phone, or telehealth).

2. The information I collect

• Personal information: name, date of birth, address, phone, email, emergency contact.

• Sensitive information (as defined by the Privacy Act): health and mental health information, family and social history, cultural background, court orders, and other information you share that is necessary for counselling.

• Payment information: invoices and payment confirmations (I do not store full card details).

• Website/technical data: IP address, device/browser details, pages visited, and cookies/analytics data (see Section 9).

​
3. How I collect information

• Directly from you (verbally in sessions; by phone/video; via email/SMS/forms).

• Through my online booking and practice management system (Halaxy).

• From a referrer (e.g., GP or support service) with your consent, or where permitted by law.

• For clients under 18, from a parent/legal guardian providing consent.

​
4. Why I collect and use your information

• To provide counselling safely and effectively (assessment, planning, delivery, and continuity of care).

• To manage bookings, reminders, billing, receipts, and record-keeping.

• To communicate with you about appointments and service updates.

• To meet legal, regulatory, and professional obligations (e.g., clinical records, supervision in de-identified form).

• To operate and improve my website and services.

​
5. Your choice and consent
Providing personal information is voluntary, but if you choose not to provide information needed for safe and ethical practice, I may be unable to offer services. You may use a preferred name, however a legal name (as per ID) is required for clinical and legal records.

6. Confidentiality and disclosure
I keep information confidential unless disclosure is:

• Required or authorised by law (e.g., subpoena, child protection, court order), or

• Needed to prevent or lessen a serious threat to life, health, or safety, or

• Made with your informed consent (e.g., liaising with a GP or another provider).

​
7. How I store and protect your information
Clinical records are stored securely in my practice management system (Halaxy) and in encrypted file storage accessible only by me. I apply reasonable technical, administrative, and physical safeguards to protect against unauthorised access, alteration, or misuse.
 
I may use a transcription/note-assist provider during sessions to generate draft clinical notes or letters (currently Novo Note; I may change to Heidi Health). These tools process live audio to create text; session audio is not retained by the provider. Drafts are reviewed by me and, once finalised, saved to your Halaxy record.

 These tools are not used for bookings, reminders, or payments. (See Section 10 for provider details and links.)
 
I do not store full card details; payments are processed by a compliant payment provider.
 
If a data breach is likely to cause serious harm, I will follow the Notifiable Data Breaches scheme (assess, contain, notify affected individuals and the OAIC as required).
Some systems may use cloud infrastructure located in or outside Australia. I take reasonable steps required by the Australian Privacy Principles, including APP 8, to ensure any overseas handling is consistent with the APPs. I remain responsible for your information.
​
8. Retention and deletion
I retain clinical records for at least 7 years after the last contact, or longer where required (for clients under 18, records are generally retained until at least age 25).
 
When no longer required, information is securely destroyed or de-identified, subject to legal obligations.