Privacy Policy – Bayside Psychotherapy

Last updated: 26 September 2026

About this policy

Bayside Psychotherapy (ABN 42 974 696 687) is a counselling, psychotherapy and hypnotherapy practice at 8/539 Highett Road, Highett VIC 3190, offering sessions in clinic and online. This policy explains how we collect, use, share and protect personal information, including health information, about our clients, people who contact us, customers of our online shop and visitors to our website.

We handle your information in line with the Privacy Act 1988 (Cth), including the Australian Privacy Principles, and the Health Records Act 2001 (Vic), including the Health Privacy Principles.

Our psychologist is registered with Ahpra and follows the Psychology Board of Australia’s Code of conduct. Our other practitioners are counsellors, psychotherapists, hypnotherapists and social workers. Ahpra doesn’t register these professions. They follow Victoria’s General Code of Conduct for health services, and those who belong to a professional association also follow its code of ethics.

Confidentiality in therapy

What you share in therapy stays confidential. We only share it:

with your consent
when it’s directly related to your care and you’d reasonably expect it. For example, if you see our psychologist or our Accredited Mental Health Social Worker with a Medicare rebate, Medicare requires a report to the doctor who referred you at the end of each course of treatment
when the law requires or allows it, for example a subpoena or court order, a child protection report, or to lessen or prevent a serious threat to someone’s life, health or safety.

If we ever need to share something without your consent, we’ll talk with you first wherever it’s safe and lawful to do so.

Our practitioners have regular clinical supervision. They may talk about their work with you there, but not in a way that identifies you.

In couples counselling, confidentiality belongs to the couple as a whole. We won’t share what’s said in your sessions with anyone else unless you both agree, or the law requires or allows it. Your practitioner will explain at the start how they handle anything one of you shares with them alone.

Information we collect

Depending on how you deal with us, we may collect:

Contact and identity details: your name, date of birth, address, phone number, email and emergency contact.
Health information: why you’re seeking help, your mental and physical health history, medications, session notes, assessment results, referral letters, Mental Health Treatment Plans and reports.
Funding and payment details: Medicare details, referral details, private health insurance or NDIS details, invoices and payment records. Card payments are handled by our payment providers, and we don’t store full card numbers.
Enquiries: what you tell us when you call, email or use a form on our website. Our contact forms also record the page you sent them from and your IP address, which helps us reply and block spam.
Online shop orders: your name, email, phone, billing address, the recordings you buy, your order history, and technical details such as your IP address and browser.
Website use: see “Our website, cookies and analytics” below.

If you tell us about other people, such as a partner or family member, we handle their information with the same care.

How we collect it

We collect information directly from you: when you call or email us, fill in a form on our website, book or complete intake forms through Halaxy, buy from our online shop or attend a session. With your consent, or where the law allows, we may also receive information from others, such as your GP or another health professional, a parent or guardian, an NDIS plan manager or someone you’ve asked to help you.

We only collect health information with your consent, or where the law allows us to without it. Your consent must be voluntary and informed, and you can withdraw it at any time, although this may affect our ability to provide some services.

If you’re under 18, we’ll usually ask a parent or guardian for consent. A young person who understands the decision may be able to consent for themselves, and your practitioner will talk this through with you.

Staying anonymous

You can browse our website and ask general questions without telling us who you are, or by using a different name.

To provide therapy, we usually need to know who you are, so we can care for you safely. Medicare, health funds and the NDIS also need your details if you claim through them.

If you’d rather not give us some information, just tell us. Without it, we may not be able to provide a service, process a claim or get back to you. We’ll explain what that means for you.

How we use your information

We use your information to:

provide, coordinate and review your care
manage bookings, send appointment reminders, and handle payments and claims (Medicare, health funds or NDIS, where your practitioner offers them)
respond to your enquiries
process and deliver online shop orders
meet our legal and professional obligations, such as keeping clinical records, insurance and handling complaints
improve our services and website, using de-identified or combined information where we can.

We never sell or rent your information, and we don’t use your health information for marketing.

We only share your information when it’s needed for the purposes above, or where the law requires or allows it. This may include:

practitioners and admin staff in our practice who need it to provide or support your care. Everyone who works with us must keep your information confidential and follow this policy. Some of our practitioners are independent contractors, and a few keep clinical records in their own secure system. If yours does, they’ll tell you at the start, and you can ask them or us to see your records
your GP or other health professionals, with your consent, or when Medicare requires a report to the doctor who referred you
Medicare (Services Australia), your health fund or NDIS plan manager, for claims you ask us to make
service providers who help us run the practice, such as our practice software, telehealth, email, website and payment providers, and our professional advisers and insurers. We only give them what they need, and they must protect it
a debt collection agency, if an account stays unpaid
courts, government agencies or others where the law requires or allows it
anyone you’ve asked us to share it with.

Services we use

Halaxy: our practice management system for bookings, intake forms, client records, invoicing and appointment reminders. Halaxy stores its data in Australia. Most of our practitioners keep their clinical records in Halaxy.
Payments: session payments made through Halaxy are processed by Braintree (part of PayPal). Online shop payments are processed by Commonwealth Bank’s BPOINT service.
Online sessions: Zoom, Doxy.me and phone. We don’t record sessions unless you agree.
AI note-taking: some practitioners use an AI scribe, such as Heidi, to help write session notes, only if you agree (see “Use of AI tools”).
Email: hosted by Fluccs, an Australian provider.
Our website: hosted in Sydney, Australia, and protected and delivered by Cloudflare. Our online shop runs on WooCommerce.
Matomo: website statistics that run on our own website server in Sydney. The data isn’t sent to Matomo’s makers or anyone else.
Google: Google Maps, if you choose to show a map, and YouTube, for the videos on some of our pages.

Information stored outside Victoria or overseas

Most of your information is stored in Australia, and some of it may be stored outside Victoria, in other Australian states.

Some providers store or process information overseas:

Zoom and Doxy.me, in the United States
Google (Maps and YouTube) and Cloudflare, in the United States and other countries where they have data centres
Braintree (part of PayPal), which processes card payments made through Halaxy, in the United States and other countries

We choose providers with strong security and privacy commitments. We take reasonable steps to make sure they protect your information in line with Australian privacy law, and we remain responsible for it.

Use of AI tools

Some of our practitioners use an AI scribe, such as Heidi, to help write clinical notes. It transcribes the session as it happens and drafts a note for your practitioner. It doesn’t keep a recording of the session. We ask for your consent on our intake form. Saying yes is optional, and you can change your mind at any time without it affecting your care. In couples sessions, your practitioner will check that you both agree before using it.

Your practitioner checks every note and remains responsible for it. Heidi stores information in Australia and doesn’t use it to train its AI. We delete transcripts and draft notes from Heidi once they’re no longer needed.

We don’t put your personal information into public AI tools, such as free chatbots.

We don’t use computer programs to make decisions about you that could significantly affect you. Our Find a Therapist Wizard only suggests therapists who may suit you. You decide who to see.

Find a Therapist Wizard

The wizard asks anonymous questions, such as whether you’d prefer online or in-clinic sessions, to suggest therapists who may suit you. It doesn’t ask for your name or contact details. Your answers are sent to our website only to work out the suggestions. Matomo, our own statistics tool, counts visits to the wizard, how far people get through it and clicks on its suggestions, but not your answers. Your suggested therapists, and the topics picked up from what you wrote (never your words), are kept in your browser tab for up to an hour, so they are still there if you go back to them, and are cleared when you close the tab. If you then book or enquire, the information you give us is handled as described in this policy.

The last step is optional: you can write a few words about what’s bringing you here. What you write stays in your browser. It’s matched against a list of topics to sort and describe your suggestions. It isn’t sent to us or saved, and our analytics tools don’t record it. Our own website statistics only count whether the box was used, which kind of help you chose and how many topics were picked up. If you use your keyboard’s microphone, your phone’s own speech service turns your voice into text under its own privacy terms, and we don’t receive the recording.

Our website, cookies and analytics

We use a small number of cookies and similar technologies:

Essential: to keep our website secure (Cloudflare and our website firewall), and run the shopping cart and checkout.
Visitor counts: Cloudflare gives us simple visitor counts. It doesn’t use cookies and doesn’t identify you.
Website statistics (Matomo): we run Matomo, a statistics tool installed on our own website, to count page visits and which buttons and links are used, such as “Connect now”, “See times” and links to our booking pages, so we can make booking easier. It doesn’t use cookies, shortens your IP address before anything is stored, and doesn’t record what you type into forms or the Halaxy booking calendar. The data stays on our server in Australia and isn’t shared with anyone. Because it’s set up so it doesn’t identify you, it runs on all pages without asking.
Videos: some of our pages include YouTube videos, shown in YouTube’s privacy-enhanced mode. When one of these pages opens, your browser connects to YouTube (part of Google), which receives technical details such as your IP address and the page you’re on. YouTube says that in this mode, what you watch isn’t used to personalise YouTube or the ads you see.

We don’t use advertising cookies or Google Analytics, and we don’t use analytics to identify you or show you ads. We delete Matomo’s detailed visit data after 14 months. We stopped using Google Analytics on 26 September 2026. Google keeps the data it collected before then for up to 14 months.

You can block or delete cookies in your browser at any time. For how Google handles data from Maps and YouTube, see policies.google.com/privacy.

Our online shop

When you buy a self-hypnosis recording, we use your details to process payment, deliver your download and help if something goes wrong. Card payments are processed by Commonwealth Bank’s BPOINT service, and we don’t store your card number. Because the recordings you buy can say something about your health, we keep your order details confidential and don’t use them for marketing. We keep order records for 5 years, as tax law requires.

Marketing

We don’t send newsletters or marketing campaigns. Some of our emails, such as booking confirmations, replies to your enquiries and order emails, include information about our services, like how to book a session. If we ever start sending marketing, we’ll only do it if you’ve agreed, and you’ll always be able to unsubscribe. We’ll never use your health information for marketing.

How we protect your information

We keep your information electronically, mainly in Halaxy. We take reasonable steps to protect your information from misuse, loss and unauthorised access or disclosure. For example, we use secure, password-protected systems with restricted access, and everyone who works with us must keep information confidential.

Email and website forms aren’t the safest way to share health details. If you’d like to tell us about your health before your first session, please use Halaxy’s secure intake forms, or tell us when we speak.

How long we keep it

Health records: at least 7 years after your last session or the last entry in your record, whichever is later. If you were under 18 when you saw us, we keep them at least until your 25th birthday, if that’s later. After that, we securely destroy or de-identify them.
Online shop and financial records: 5 years, as tax law requires.
Website enquiries: we delete the copy on our website after 90 days. Your enquiry also reaches us by email. If you become a client, it becomes part of your record. If not, we keep it only as long as we need it, or the law requires, then delete it.
Website statistics: detailed Matomo data for up to 14 months.

If our practice closes or changes hands, we’ll let you know how your records will be managed, as the Health Records Act requires. If your practitioner leaves our practice, we’ll talk with you about where your records will be kept and how you can continue your care.

Accessing and correcting your information

You can ask us whether we hold information about you, and ask to see it or get a copy. You can also ask us to correct it. Just contact your practitioner or our Privacy Officer (details below). We’ll need to confirm your identity first.

We’ll respond as soon as we can, usually within 30 days and no later than 45 days. There’s no charge to make a request. We may charge a fee for copies or a written summary, within the limits set by Victorian law, and we’ll tell you the cost first.

In rare cases the law lets us refuse or limit access, for example if giving access would pose a serious threat to someone’s life or health. If so, we’ll explain why in writing and tell you how to complain. If we refuse because of a risk to your health, you can nominate another health professional to review the information. They can decide whether you should see it, and talk it through with you.

You can also ask us to send a copy or summary of your information to another health professional, such as a new therapist or your GP.

Corrections are free, and we’ll respond within 30 days. If we correct information we’ve already shared with others, we’ll let them know if you ask. If we don’t agree a change is needed, we’ll explain why, and you can ask us to add a note to your record with your view.

Data breaches

If something goes wrong, we’ll act quickly to contain it and reduce any harm. If a data breach is likely to cause you serious harm, we’ll let you know and notify the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

Questions and complaints

If you have a question or concern about your privacy, please contact our Privacy Officer:

Adam Szmerling, Privacy Officer
Email: [email protected]
Phone: 03 9557 9113
Post: 8/539 Highett Road, Highett VIC 3190

We’ll acknowledge your complaint within 5 business days, look into it, and aim to give you our answer in writing within 30 days. If your concern is about Adam, you can contact the organisations below directly.

If you’re not happy with our response, you can contact:

the Office of the Australian Information Commissioner (OAIC): 1300 363 992 or www.oaic.gov.au
the Health Complaints Commissioner (Victoria), about your health information or any health service: 1300 582 113 or www.hcc.vic.gov.au.

If your concern is about a practitioner’s professional conduct:

for our psychologist, you can contact Ahpra: 1300 419 495 or www.ahpra.gov.au
for our other practitioners, you can contact the Health Complaints Commissioner. They follow Victoria’s General Code of Conduct. You can also contact their professional association, if they belong to one
if you’re an NDIS participant, you can also contact the NDIS Quality and Safeguards Commission: 1800 035 544 or www.ndiscommission.gov.au.

Changes to this policy

We may update this policy from time to time. The current version is always on this page, with the date it was last updated.

Other formats

If you’d like this policy in another format, such as a printed copy, please contact us.

Where we provide our services

We don’t offer our services or products to people living in the European Union, the United Kingdom or Switzerland.