Privacy policy

Personal information: name, date of birth, contact details, emergency contact, referrer, funding details (Medicare, insurer, claim number, employer where relevant).

Health information: presenting concerns, relevant history, assessment results, session notes, correspondence with your GP or other treating practitioners, and treatment plans.

This information is collected because it is reasonably necessary to provide safe, competent psychological care, to communicate with your referrer, and to meet record-keeping obligations under the Health Practitioner Regulation National Law and applicable funding schemes.

Directly from you: through email or the online booking system, intake paperwork, and what you tell me in session. Sometimes from third parties with your consent, such as your GP, nominated treating doctor, insurer, case manager or a family member.

Online bookings, appointment reminders (SMS and email), intake forms and video sessions are handled through Halaxy, the practice management system described below.

Enquiries you send by email or through the online booking system are read only by me (Luca Falcone). Please don't include detailed clinical information in an enquiry.

Records are held in Halaxy, an encrypted, Australian-hosted practice management system with access restricted to the treating psychologist. Paper records, where they exist, are held in locked storage. Devices are encrypted and password protected.

Adult clinical records are retained for a minimum of seven years from the date of last contact. Records for clients seen as minors are retained until the client turns 25. Records are securely destroyed after that period.

If I use any artificial intelligence (AI) tool in your care, such as note-taking software, I'll explain what it does and where data goes, and ask for your written consent before it is used.

Your information is not disclosed without your consent, except where the law requires or permits it.

• To Medicare, for rebate processing where you claim one
• To your insurer, case manager, rehabilitation provider and nominated treating doctor where treatment is funded under a workers compensation or CTP claim, limited to what the scheme requires (progress, function and capacity), not verbatim session content
• To your referring GP or specialist, in the form of a brief progress letter
• To an EAP or employer-funded program, where that program funds the sessions, limited to attendance and session counts
• Where there is a serious and imminent risk to your life, health or safety, or that of another person
• Where disclosure is required by law, including subpoena, court order, or mandatory reporting obligations

You can request access to your records, and you can ask for information you believe is inaccurate, out of date or misleading to be corrected. Requests should be made in writing to the practice and will be responded to within 30 days. Access may be limited in the narrow circumstances permitted by the Australian Privacy Principles (for example where access would pose a serious threat to someone's life or health), and reasons will be given in writing.

The practice complies with the Notifiable Data Breaches scheme. If a breach occurs that is likely to result in serious harm, affected individuals and the Office of the Australian Information Commissioner will be notified as soon as practicable.

Raise a privacy concern with the practice first, at admin@thinkfirstpsychology.com.au. Complaints are acknowledged within five business days.

If you are not satisfied with the response, you can contact the Office of the Australian Information Commissioner (oaic.gov.au, 1300 363 992), the NSW Information and Privacy Commission (ipc.nsw.gov.au, 1800 472 679), or the Health Care Complaints Commission (hccc.nsw.gov.au, 1800 043 159). Concerns about a practitioner's conduct can also be raised with AHPRA (ahpra.gov.au, 1300 419 495).

The quick-message form collects your name and email address, and an optional mobile number and message, only so I can reply to you. Messages are stored securely in Lovable Cloud, with access restricted to me (Luca Falcone), and are deleted after 90 days. Please don't include health information. Bookings and referrals remain on Halaxy.

Apart from the quick-message form described above, the website doesn't collect personal information. Online bookings and referral forms are handled on Halaxy's secure site. The website's hosting provider records standard technical information (such as IP address, browser type and pages visited) for security and aggregate visitor statistics. The site does not use advertising trackers and no information is sold to third parties.

This website is hosted by third-party technology providers, which may store website data outside Australia. Reasonable steps are taken to ensure they handle it consistently with the Australian Privacy Principles. Clinical records are never stored on this website.