Cedar Allied Health (ABN 35 694 619 522) provides psychology services to children, young people and their families. To do that well, we need to collect and hold personal information, including health information.

This policy explains what we collect, why we collect it, how we look after it, and what to do if you have a concern. If anything here is unclear, please ask us — we would rather explain it than have you wondering.

The laws we work under

Two sets of rules apply to us, and we follow both:

• The Privacy Act 1988 (Cth) and the Australian Privacy Principles
• The Health Records Act 2001 (Vic) and the Health Privacy Principles, which apply to health information held by private health services in Victoria

What we collect

We collect only what we need to provide a safe and useful service. Depending on your situation, that may include:

• Your child’s name, date of birth, address and contact details
• Your name and contact details as a parent or carer, and those of anyone else with parental responsibility
• Medicare, NDIS or private health details where these are used for claiming
• Referral details from a GP, paediatrician or other professional
• Developmental, medical, family and school history relevant to the reason for referral
• Information from assessments, questionnaires and rating scales
• Notes made during and after sessions
• Reports we write, and reports others have provided with your consent
• Appointment and billing records
• Any information you send us through our website contact form
• Information about your visit to our website (see “Our website” below)

Health information is treated as sensitive information under both Acts, and we collect it only with consent or where the law requires or allows it.

How we collect it

Usually directly from you, and from your child in a way that suits their age and understanding. We may also collect information from a referrer, a school, or another professional — but only with your consent, unless the law requires otherwise.

Note-taking. Your psychologist may use the AI-assisted note-taking built into Splose to help draft session notes. We ask for your consent before using it, and you can say no or change your mind at any time without it affecting your care. Splose states that the AI processing is done under an agreement that the information is not kept or used to train AI models.

How we hold it

Client records are held in Splose, an Australian practice management system built for allied health. Splose states that data for Australian users is stored in Australia, encrypted in transit and encrypted at rest using AES-256 encryption. Access is limited to the people directly involved in your care and to authorised administrative staff, and only to the extent their role requires.

Telehealth sessions are held on Zoom or Microsoft Teams. We do not record sessions, unless you have agreed to AI-assisted note-taking (see above).

Where we hold anything on paper, it is kept in locked storage and added to our electronic record where practical.

Where your information is held, and whether it goes overseas

Your child’s clinical record is held in Splose, which states that Australian users’ data is stored in Australia.

A few things sit outside that, and we would rather state them than leave them out:

• Enquiries you send through our website arrive in our email system, which is provided by Google. Google operates data centres in many countries and may store or process that information outside Australia. This affects the details in your enquiry — your name, your contact details and whatever you choose to write to us. It does not affect your clinical record. If you would rather not send personal details by web form, please phone us instead.
• Telehealth and AI note-taking. Zoom and Microsoft Teams are United States companies, and some of their processing may happen outside Australia. Splose’s AI note-taking is processed by OpenAI, also a United States company; Splose states the information is not kept or used for training.
• Our website tools. Google and Meta are United States companies, so information collected by the tools described under “Our website” may be stored and processed outside Australia, including in the United States.

If this ever changes, we will update this page before it changes, not after.

Why we collect it

• To assess, understand and support your child
• To plan and deliver sessions, and to record what happened in them
• To write reports you have asked for or consented to
• To manage appointments, invoices, and Medicare or NDIS claims
• To meet our legal, professional and insurance obligations
• If you agree, to understand how our website is used and to show Cedar ads on Facebook and Instagram

If you would prefer not to provide it

You can decline. We may not be able to provide a service, or the service may be less useful, if we do not have what we need — we will tell you plainly if that is the case rather than proceeding and hoping.

Dealing with us anonymously. You can make a general enquiry without giving us your name — if you want to ask about our services, our approach or whether we might be the right fit, you are welcome to phone and simply ask.

Once we begin providing a service to your child, we do need to identify them: we cannot keep clinical records, write reports, claim a Medicare or NDIS rebate, or meet our legal obligations without knowing who we are treating.

Confidentiality, and its limits

What you and your child tell us stays confidential. There are situations where the law requires or permits us to disclose information, and we would rather you knew about them at the start than discovered them later. These include:

• Where we are subpoenaed by a court, or disclosure is otherwise required or authorised by law
• Where we are required to act as mandatory reporters
• Where, in our reasonable belief, not disclosing would place your child or another person at serious risk to life, health or safety. This includes risk arising from suicidal or homicidal ideation, self-harm, or family violence or abuse. In these situations we will aim to support you through it and to involve you wherever it is safe and appropriate to do so
• Where you would reasonably expect us to share information with another professional involved in your child’s care, such as your GP, and the sharing is directly related to the reason we collected it
• When we consult colleagues or take part in professional supervision. Your identity and any identifying details are concealed
• Where you have given us prior consent to write a report for, or speak with, another person or organisation such as a school, GP or lawyer

Where more than one Cedar practitioner is involved in your child’s care, they may share what is necessary to provide that care, and no more.

Children’s and young people’s information

Parents and guardians can usually access their child’s information. As young people mature, we take their views about their own information into account. If you are separated, or a court order affects parental responsibility, please let us know so we can follow it. If you ask for information on someone else’s behalf, we may ask for proof of your authority.

How long we keep it

We are required to keep health records for seven years after the last occasion we provided a service, or — for information collected while a person was under 18 — until they turn 25, whichever is later. After that, records are securely destroyed.

Accessing and correcting your information

You have a right to ask for a copy of the personal information we hold about you or your child, and a right to ask us to correct anything that is wrong, out of date or incomplete.

To make a request, contact us using the details below. We may need to confirm your identity, or your authority to make the request on someone else’s behalf.

We will acknowledge your request within 2 business days and respond within 30 days, or explain why we need longer. We will discuss the different forms access can take — you can ask to see the record, receive a copy, or have it explained to you.

There are limited circumstances where the law allows us to refuse access, for example where providing it would pose a serious threat to someone’s life or health, or would unreasonably affect another person’s privacy. If we refuse, we will tell you why in writing, and tell you what you can do about it.

We do not charge a fee for making a request. A fee may apply to the work of providing access — supervising an inspection, or preparing a copy or summary. Any fee is capped in accordance with the Health Records Regulations 2023 (Vic). We will tell you the amount in writing before any cost is incurred, and you can decide then whether to proceed.

If something goes wrong

If personal information is lost, accessed without authorisation, or disclosed when it should not have been, we act on our data breach response plan to contain it and limit any harm.

Where we suspect a breach may be serious, we assess it promptly and within 30 days.

Where that assessment confirms a breach is likely to result in serious harm, we notify the people affected and the Office of the Australian Information Commissioner as soon as practicable, in accordance with our obligations under the Notifiable Data Breaches scheme.

Our website

Like most websites, ours uses cookies: small files your browser saves so the site works properly. Our contact form and the fonts on our pages also use services from Google, which receive basic details about your device, such as its internet address, to check that messages come from a person and to display the page.

With your agreement, we also use two tools that collect information about your visit. Information collected this way can be personal information, so we treat it with the same care as anything else we hold.

• Google Analytics shows us how people use our site, such as which pages are read (including pages about our services) and how visitors found us, so we can make it more useful. We see totals, not names, and we’ve switched off Google’s options to use this information for its own purposes.
• The Meta Pixel is a small piece of code from Meta, the company behind Facebook and Instagram, that lets us show Cedar ads to people there. It runs only on a few general pages (our home page, About, Our Services and News and Articles), never on pages about particular services, our articles or our contact form. When it runs, it tells Meta that your device visited, with details such as your browser and internet address, which Meta may link to your Facebook or Instagram account. Meta handles this under its own privacy policy.

Your cookie choices

Both tools stay off until you turn them on. When you first visit, a short notice lets you:

• Accept all: turn on Google Analytics and the Meta Pixel
• Essential only: use only what the site needs to work
• Customise: turn each one on or off

You can change your mind at any time using the “Cookie settings” link at the bottom of every page. You can also manage the ads you see in your Facebook or Instagram settings, or block cookies in your browser, although parts of our site may not work properly if you block them all. Saying no won’t affect our services in any way.

Concerns or complaints

If you are unhappy with how we have handled personal information, please tell us. Most concerns are resolved quickly once we know about them.

Step 1 — Contact our Privacy Officer.

• By post: Privacy Officer, Cedar Allied Health, PO Box 4050, Langwarrin, VIC 3910
• By phone: 1300 233 211
• Through our contact form

Step 2 — We will look into it. We will acknowledge your complaint within 2 business days and aim to resolve it within 30 days. If we need longer, we will tell you why and when to expect an answer.

Step 3 — If you are not satisfied, you can take it further. Two bodies can help, and you can approach either:

• Office of the Australian Information Commissioner — 1300 363 992, oaic.gov.au
• Health Complaints Commissioner (Victoria) — 1300 582 113, hcc.vic.gov.au

The Commissioner will usually expect you to have raised the matter with us first.

Changes to this policy

We review this policy at least once a year, and whenever we change what information we collect, how we hold it, or the tools we use to handle it. Any updated version is published here with a new date at the top, and the date at the top of this page tells you when it was last reviewed.

If a change materially affects how we handle your child’s information, we will tell you directly rather than relying on you to notice it here.