Privacy & Client Information Policy

This Privacy Policy applies to all personal and health information collected by TAO Psychotherapy (we, us, or our) via our website and in the course of providing psychotherapy services.

1. What Information We Collect

The nature of the information we collect depends on how you interact with our website and services. Because we provide psychotherapy services, we routinely collect Personal Information and Sensitive Information (including Health Information).

This information may include:

  • Contact Details: Name, email address, phone number, physical address, date of birth, and emergency contact details.

  • Administrative Details: Occupation, payment details, engagement statistics with our website or e-newsletters, and signatures.

  • Health & Clinical Information: Reasons for seeking therapeutic support, mental health history, history of support services accessed, past relevant medical background, alcohol and other drug usage history, and consent records for session recordings (where applicable).

2. Types of Information

Under the Privacy Act 1988 (Cth) (Privacy Act):

  • Personal Information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether true or not and whether recorded in a material form or not.

  • Sensitive Information is a subset of personal information that includes health information, racial or ethnic origin, political opinions, religious or philosophical beliefs, criminal record, or trade union membership.

As a health service provider, any clinical background or therapeutic notes fall under Sensitive Information. We collect and handle Sensitive Information solely: a) For the primary purpose of providing individual psychotherapy and mental health services;

b) For secondary purposes directly related to primary care (e.g., administrative processing, regulatory compliance); and

c) With your explicit consent, or where required or authorised by Australian law (e.g., mandatory reporting requirements or subpoenas).

3. How We Collect Information

a) Direct Collection: We collect information directly from you when you complete intake paperwork, book appointments, or communicate with us.

b) Appointment Scheduling (TidyCal): We offer an online self-scheduling tool provided by TidyCal for your convenience. Use of TidyCal is entirely optional; if you prefer not to use a third-party booking system, you can schedule appointments directly with us via email or phone.

c) Website Analytics & Cookies: We use cookies and similar technologies to improve website functionality and user experience. Cookies do not generally identify you personally.

d) Third Parties: Where reasonable and practicable, we collect information directly from you. If we receive information about you from a third party (such as a GP referral), we will take reasonable steps to inform you.

4. Purpose of Collection & Use

a) Service Delivery: We collect personal and sensitive information to assess suitability for therapy, deliver psychological support, and manage practice operations.

b) Third-Party Service Providers: We share personal information only with secure third-party applications that assist us in operating our practice (e.g., Microsoft 365 for secure file storage, TidyCal for scheduling, and SendFox for communications). These service providers are bound by strict security and confidentiality obligations.

c) Newsletters & Direct Marketing: We do not use Sensitive/Health Information for marketing purposes. If you choose to subscribe to our newsletter via SendFox, we will use your name and email address to send you practice updates and resources. You may opt out or unsubscribe from these emails at any time using the link at the bottom of any newsletter.

5. Security, Access, and Retention

a) Storage & Security: We store personal and health information using enterprise-grade electronic systems protected by multi-factor authentication (MFA), role-based access controls, and encryption both at rest and in transit. Primary client files and records are hosted within sovereign Australian data centres using Microsoft 365 Business infrastructure.

b) Retention Periods:

  • Client records for adults are retained for a minimum of 7 years from the date of the last service entry, in accordance with Australian health record-keeping obligations.

  • Client records for individuals seen under the age of 18 are retained until the individual reaches 25 years of age (7 years past the age of majority).

  • Once records are no longer legally or clinically required, we take reasonable steps to permanently delete or de-identify them.

c) Access and Correction: Under Australian Privacy Principles 12 and 13, you have the right to request access to the personal information we hold about you and request corrections if it is inaccurate. To submit a request, please contact us in writing.

6. Overseas Data Processing & Hosting

Primary client records, clinical notes, and sensitive health information are hosted and stored securely within Australian data centres using Microsoft 365 Business.

Certain administrative and communication tools we use—specifically TidyCal for optional online booking and SendFox for newsletter distribution—are managed by service providers based in the United States (Sumo Group Inc.). These providers comply with international data protection standards, including the EU General Data Protection Regulation (GDPR), and employ encryption protocols to safeguard data in transit and at rest.

7. Complaint Procedure

If you have concerns about how your personal or health information is being handled:

  1. Please contact Tristan Avella-O'Brien in writing using the details below. We take privacy concerns seriously and will review and respond to your complaint promptly.

  2. If we agree that a privacy issue occurred, we will consult with you on appropriate remedial steps.

  3. If you remain dissatisfied with our response, you may refer your complaint to the Office of the Australian Information Commissioner (OAIC) via www.oaic.gov.au or call 1300 363 992.

8. European Union Residents (GDPR Notice)

Our services are primarily directed at individuals residing in Australia. While European Union residents may access the website, our services are not explicitly targeted at EU consumers. Where the General Data Protection Regulation (GDPR) applies by law, relevant EU residents hold rights under those regulations.

9. Contact Us

For privacy queries, access requests, or complaints, please reach out to:

Tristan Avella-O'Brien

TAO Psychotherapy

Email: tristan@tao-psychotherapy.com.au

Last reviewed: Monday, 7th September 2026