Earth Soul Counselling

1. What this policy covers
This Privacy Policy explains how I collect, use, store, protect and disclose personal and sensitive information when you visit my website, make an enquiry, book an appointment or engage in counselling services, including face-to-face, telephone and Telehealth counselling.

2. The information I collect

• Depending on your interaction with Earth Soul Counselling, I may collect:

• Personal information: such as your name, date of birth, address, phone number, email address and emergency contact details.

• Sensitive information: including health and mental health information, family and social history, cultural information, relationship history, court orders and other information relevant to providing counselling safely and effectively.

• Payment and billing information: including information required to issue invoices, receipts and confirm payments. I do not store full payment card details.

• Website and technical information: such as IP address, device or browser information, pages visited and information collected through cookies or analytics tools.

I only collect information that is reasonably necessary for providing counselling services, managing my practice, meeting professional or legal obligations, or operating my website.

​
3. How I collect information

I may collect information:

• directly from you during counselling sessions or consultations;

• through telephone, video, email, SMS or website communications;

• through online forms, bookings and my practice management system, Halaxy;

• from a referrer, such as a GP or another support service, with your consent or where collection is otherwise permitted or required by law; and

• where counselling is provided to a person under 18, from a parent or legal guardian where appropriate.

Where reasonable and practicable, personal information will be collected directly from you.

​
4. Why I collect and use your information

Personal and sensitive information may be collected and used to:

• provide counselling safely and effectively, including assessment, therapeutic planning, delivery and continuity of care;

• maintain appropriate clinical records;

• manage appointments, reminders, billing, payments and receipts;

• communicate with you about appointments and counselling services;

• liaise with another health professional or service where you have provided consent or where disclosure is otherwise authorised or required by law;

• meet legal, ethical and professional obligations, including professional supervision, where client information is appropriately de-identified where practicable; and

• operate, maintain and improve my website and practice.

​
5. Your choice and consent

Providing personal information is generally voluntary. However, if you choose not to provide information reasonably required for safe and ethical counselling practice, I may be unable to provide some or all counselling services.

You are welcome to provide a preferred name. Identifying information may be required where reasonably necessary for providing counselling services, billing, referrals, risk management or meeting legal or professional obligations.

Where express consent is required for a particular use or disclosure of your information, including the use of AI-assisted clinical documentation as described in Section 10, I will seek your consent before proceeding.

 
6. Confidentiality and disclosure

Information shared during counselling is treated as confidential. There are circumstances in which information may be disclosed, including where:

• you provide informed consent for information to be shared, such as with a GP or another treating professional;

• disclosure is required or authorised by law, including in response to a valid subpoena, court order or child protection requirement; or

• disclosure is reasonably necessary to prevent or lessen a serious threat to the life, health or safety of an individual or to public health or safety, as permitted by law.

Where practicable and appropriate, I will discuss a proposed disclosure with you before information is shared.

​
7. How I store and protect your information

Clinical records are stored securely in my practice management system, Halaxy, and where applicable in encrypted file storage accessible only by me.

​

I use reasonable technical, administrative and physical safeguards to protect personal and sensitive information from loss, unauthorised access, alteration, disclosure or misuse.

​

I use third-party service providers where reasonably necessary to support the delivery and administration of counselling services. These may include practice management, Telehealth, payment, website and AI-assisted clinical documentation services. I take reasonable steps to consider the privacy, security and data-handling practices of providers that process personal or sensitive information in connection with my practice.

​

I do not store full payment card details. Payments are processed through the relevant payment provider.

​

If a data breach involving personal information is likely to result in serious harm, I will take appropriate steps to contain and assess the breach and comply with the Notifiable Data Breaches scheme, including notifying affected individuals and the Office of the Australian Information Commissioner (OAIC) where required.

​

Some service providers may use cloud-based infrastructure. Where personal information is disclosed to an overseas recipient, I will take reasonable steps to manage the disclosure in accordance with the Australian Privacy Principles, including APP 8 where applicable.

​

Further information about third-party platforms and AI-assisted clinical documentation is provided in Section 10.
​
8. Retention and deletion

Clinical records are retained for the period required by applicable legal, ethical, professional and record-keeping obligations.

​

As a general practice, adult clinical records are retained for at least seven years following the last client contact. Records relating to clients who were under 18 at the time counselling was provided may be retained for a longer period in accordance with applicable requirements.

​

When personal information is no longer required to be retained, I take reasonable steps to securely destroy or de-identify it, subject to legal and professional obligations.