Sydney Child & Family Practice is committed to protecting the privacy and confidentiality of personal and health information. This Privacy Policy explains how we collect, use, store and disclose personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). As a health service provider, we recognise that health information is sensitive information and take appropriate steps to protect it.

1. What Information We Collect

Sydney Child & Family Practice may collect personal and health information that is necessary to provide psychological services. This may include:

• Name, date of birth, address and contact details

• Parent or guardian details (where the client is a minor)

• Medicare details and referral information

• Medical, developmental, and mental health history

• Assessment results and clinical notes

• Reports from other health professionals or schools

• Payment and billing information

• Emergency contact details

This information may relate to both the client and, where relevant, their parents or guardians.

2. How We Collect Information

Personal information is generally collected directly from clients or parents/guardians when:

• Completing intake or registration forms

• Attending appointments

• Communicating with the practice via phone, email or online systems

With consent, information may also be collected from third parties such as:

• General practitioners

• Paediatricians or psychiatrists

• Schools or allied health professionals

• Other healthcare providers involved in care

3. Why We Collect Personal Information

We collect personal and health information in order to:

• Provide psychological assessment and treatment

• Develop appropriate treatment plans

• Communicate with other treating professionals involved in care

• Process Medicare or other health fund claims

• Manage appointments, billing and administration

• Meet legal and regulatory obligations

4. How We Store and Protect Information

Sydney Child & Family Practice takes reasonable steps to protect personal information from misuse, loss, unauthorised access, modification or disclosure.

Client information is stored using secure electronic systems and practice management software. Sydney Child & Family Practice uses Splose, a secure practice management platform with servers located in Australia. Splose complies with the Australian Privacy Principles (APPs) and uses encryption and security safeguards to protect client data.

Paper records (where applicable) are stored securely and access is restricted to authorised personnel.

5. Disclosure of Personal Information

Personal information will only be disclosed where appropriate and permitted under law.

Information may be shared:

• With your consent

• With other treating professionals involved in care (e.g. GP, paediatrician, psychiatrist)

• With Medicare or other relevant organisations for billing purposes

• When required or authorised by law (for example, under court subpoena)

• Where there is a serious and imminent threat to the health or safety of a person

• Where mandatory reporting obligations apply under NSW child protection legislation

Only information that is necessary for the relevant purpose will be disclosed.

6. Overseas Disclosure

Sydney Child & Family Practice primarily uses Australian-based systems to store and manage information. Some service providers used by the practice may store or process data in secure cloud environments that may involve overseas servers. Where this occurs, reasonable steps are taken to ensure that providers comply with privacy and data security standards consistent with Australian law.

7. Access to and Correction of Information

Clients (or parents/guardians where appropriate) may request access to their personal information or request corrections if the information is inaccurate.

Requests should be made in writing to Sydney Child & Family Practice. Access will usually be provided within a reasonable time, unless there are lawful reasons for refusing access (for example, if providing access could pose a serious threat to the health or safety of a person).

8. Retention of Records

Sydney Child & Family Practice retains clinical records in accordance with Australian legal and professional requirements.

• Adult records are generally retained for at least seven (7) years from the last date of service.

• Records relating to children are generally retained until the client reaches 25 years of age.

After this period, records are securely destroyed.

9. Privacy Complaints

If you have concerns about how your personal information has been handled, you are encouraged to contact Sydney Child & Family Practice in the first instance so the matter can be addressed.

If the issue cannot be resolved, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC).

Website: www.oaic.gov.au

10. Changes to This Policy

Sydney Child & Family Practice may update this Privacy Policy from time to time to reflect changes in legal requirements or practice procedures. The most current version will be available upon request.

Effective Date: 01/03/2026