Legal

Privacy policy.

How Ivy Psychology collects, stores, uses, and protects your personal and health information. We follow the Privacy Act 1988, the Australian Privacy Principles, the APS Code of Ethics, and the NDIS Quality and Safeguards Commission requirements.

Last updated: 26 May 2026

Ivy Psychology (ABN 95 667 402 128) is a clinical-psychology-led practice based in Randwick, NSW. We are a registered NDIS provider (Registration ID 4050138847). This policy explains how we handle the personal and health information of our clients, NDIS participants, referrers, supervisees, employees, and visitors to this website.

The short version. We collect the information we need to provide psychological services safely and lawfully. We don't sell it. We don't share it without your consent except in narrow circumstances required or permitted by law. You can ask to see what we hold about you, and we'll respond within 30 days.

01Information we collect

We collect personal and health information that is reasonably necessary to provide psychological services. This may include:

  • Your name, date of birth, address, phone number, and email
  • Medicare number, NDIS number, private health insurance details, or other funding identifiers
  • GP and referrer details, mental health treatment plan, or referral letters
  • Information about your physical and mental health history, current presenting concerns, family and social context, and treatment goals
  • Records of sessions - clinical notes, assessment results, reports, and correspondence
  • For NDIS participants, plan details, support coordinator details, and behaviour support information
  • Payment information (we use third-party providers; we do not store card numbers)
  • Records of your interactions with our admin team

02How we collect it

We collect information directly from you wherever possible - through our referral form, intake paperwork, phone calls, emails, and sessions. We also collect information from:

  • Your GP or referring practitioner (e.g. Mental Health Treatment Plan)
  • Your NDIS support coordinator or plan manager, with your consent
  • Other clinicians involved in your care, with your consent
  • Family members, carers, schools, or support workers, where you have authorised this
  • Third-party assessment tools (e.g. questionnaires you complete electronically)

We will tell you at the time we collect your information why we are collecting it and who we may share it with.

03Why we collect it

We use your information to:

  • Provide psychological assessment, therapy, and behaviour support
  • Coordinate with other clinicians, your GP, and (for NDIS) your support team
  • Bill Medicare, private health insurers, the NDIS, or you directly
  • Comply with our legal and professional obligations under the Psychology Board of Australia, AHPRA, and the NDIS Quality and Safeguards Commission
  • Maintain accurate clinical records as required by law and professional standards
  • Communicate with you about appointments, follow-ups, and admin matters
  • Improve our service and conduct quality assurance, in de-identified form

04Who we share it with

We treat your information as confidential. We will share it only:

  • With your consent. For example, sending a report to your GP or your NDIS support coordinator, or speaking with a family member.
  • Where required by law. This includes mandatory reporting of risk to a child, responding to subpoenas or court orders, or where there is a serious and imminent threat to your life or the life of another person.
  • Where permitted by law in narrow circumstances. For example, professional supervision (where the supervisor has the same confidentiality obligations), case conferences with other treating clinicians, or de-identified peer consultation.
  • With our service providers, who are bound by confidentiality - for example, our practice-management software (Splose), telehealth platform, secure email and file storage providers. These providers store data in Australia where possible.
  • For billing and funding, with Medicare, private health insurers, the NDIA, plan managers, or other funders as required to claim rebates or process invoices.

We do not sell your information. We do not share your information for marketing.

05How we store and protect it

Your records are held electronically in Splose, an Australian healthcare practice-management system that complies with the Australian Privacy Principles. Paper records, if any, are stored in locked filing in our clinic. We use:

  • Encrypted storage and transmission (TLS / HTTPS)
  • Role-based access - clinicians can only see records for clients they are involved with
  • Two-factor authentication for staff accounts
  • Regular review of access logs
  • Staff training on privacy and confidentiality at induction and annually

If a data breach occurs that is likely to result in serious harm, we will notify you and the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches scheme.

06How long we keep it

We are required by law and professional standards to retain clinical records for at least:

  • Adult clients: seven years from the date of last contact
  • Children and young people: until they turn 25 (i.e. seven years after they turn 18)

After this period, records are securely destroyed unless we are required to retain them for longer (e.g. legal proceedings).

07Accessing and correcting your information

You have the right to ask for a copy of the personal information we hold about you, and to ask us to correct anything that is inaccurate or out of date.

To make a request, email admin@ivypsychology.com.au or call 0405 944 637. We will:

  • Verify your identity
  • Respond within 30 days
  • Provide the information in a usable format, or explain why we are unable to (which is rare - for example, where release would risk serious harm)

There is no charge for accessing your own information. We may charge a reasonable fee for the time taken to retrieve and prepare a copy of an extensive file.

08Telehealth & video sessions

We use secure, healthcare-grade telehealth platforms. Sessions are not recorded unless you give explicit written consent. We ask you to take reasonable steps to ensure your own end of the call is private - closing doors, using headphones, and being somewhere you won't be interrupted. We recommend you do not connect over public Wi-Fi.

09NDIS participants

If you are an NDIS participant, we are required to share certain information with the NDIA, your plan manager, the NDIS Quality and Safeguards Commission, and your support team, depending on what is in your plan and what you have consented to.

Specifically:

  • Behaviour Support Plans are lodged with the NDIS Commission as required.
  • Restrictive practices in use are reported to the Commission monthly.
  • Reportable incidents are notified to the Commission within the required timeframes.
  • Service-agreement details and progress reports may be shared with your plan manager or support coordinator with your consent.

10Children and young people

For clients under 16, we usually involve a parent or guardian in the referral and intake, and in decisions about treatment. However, young people have a right to confidentiality, and we discuss with each young person what will and won't be shared with their parents. We follow the mature minor doctrine where appropriate. Mandatory reporting obligations apply to children at risk.

11Cookies and website analytics

This website does not use tracking cookies and does not run third-party advertising trackers. We may use privacy-respecting analytics to understand which pages are visited (e.g. Plausible). No personally-identifying information is collected through this website unless you submit it via the referral, contact, or feedback forms.

12Complaints

If you have a concern about how we have handled your information, please contact us first using the details below. We will respond within one business day and aim to resolve concerns directly.

If you are not satisfied with our response, you can contact:

13Changes to this policy

We may update this policy from time to time. Material changes will be flagged at the top of the page with an updated date. The current version always lives at ivypsychology.com.au/privacy-policy.

14Contact us

Privacy questions or requests: