Privacy Policy

1. About this policy

Discovery Family Therapy (we, us, our) is a private counselling practice based at Suite 5, 95 Canning Highway, South Perth, WA. This policy explains what personal information we collect, why we collect it, how we store and protect it, and how you can access or correct your own information.

As a health service provider, Discovery Family Therapy is bound by the Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs), regardless of our size or turnover. Western Australia does not have a separate state privacy law covering private practices, so the APPs are the primary legal framework that governs how we handle your information.

This policy covers your personal and health information generally. If you are a parent, guardian, or young person and want to understand specifically how we handle confidentiality, consent, and information sharing between separated parents, please see our separate Confidentiality Policy, which this document does not replace.

2. What information we collect

Depending on your circumstances, we may collect:

• Identity and contact details: name, date of birth, address, phone, email, emergency contact
• Health and clinical information: presenting concerns, session notes, treatment plans, risk information, relevant medical or psychological history
• Family and relational information: where relevant to family, child, or relationship counselling, and subject to our Confidentiality Policy
• Billing and payment information: Medicare/rebate details where applicable, payment method details processed via our payment terminal
• Referral information: from GPs, schools, EAP providers, or other referrers, where you have been referred to us
• Website and enquiry data: information you submit through our contact or booking forms

We do not collect more than we need to provide safe, effective care and to run the practice.

3. Why we collect it

We collect and use your information to:

• Provide counselling and related clinical services
• Manage bookings, reminders, and billing
• Communicate with you about your care
• Meet our legal, ethical, and professional obligations, including duty of care and reporting obligations described in our Confidentiality Policy
• Improve our services, using de-identified or aggregated data only, never individual client records

We do not use your information for marketing without your separate, explicit consent, and you can withdraw that consent at any time.

4. Sensitive information

Health information, including anything discussed in a counselling session, is classified as sensitive information under the Privacy Act and is given a higher standard of protection than general personal information. We only collect sensitive information with your consent, or a parent or guardian's consent subject to our Confidentiality Policy, and only to the extent needed to provide your care.

5. Systems and services we use to hold and process your information

We use a small number of trusted, Australian privacy compliant third party service providers to manage client information securely. We do not name individual products or platforms in this policy, as a general security precaution, but we can confirm the categories of systems in use and the safeguards attached to each.

Practice management platform

• Purpose: bookings, client records, invoicing
• Data handling: client data stored in Australia

Onshore AI assisted clinical note taking tools

• Purpose: convert session audio into a written clinical note, used only with your specific consent
• Data handling: session audio is not retained once your note is generated; notes are stored in Australia; your practitioner reviews and approves every AI generated note before it becomes part of your file

Payment processing

• Purpose: in person card payment processing
• Data handling: handled by an Australian regulated payment provider; Discovery Family Therapy does not store your full card details

Phone, messaging, and website hosting

• Purpose: calls, texts, and appointment reminders are handled through our practice phone and messaging system. Our website is used for information only; it does not include contact or enquiry forms, as all booking and client communication is handled directly through our practice management platform
• Data handling: our phone and messaging provider is based, and processes data, outside Australia. This is a genuine overseas disclosure under APP 8 for any calls, texts, or voicemails handled through that system. Our website is hosted on infrastructure that is not based in Australia; because the website does not collect personal information through forms, this mainly affects standard technical data such as IP addresses and cookies rather than client or clinical information. See section 12 for more on cookies and website data

AI assisted practice management features

(session recording, transcription, drafting of notes, reports, and letters, and historical note summarisation, built into our practice management platform)

• Purpose: administrative and clinical documentation support
• Data handling: this feature is powered by a third party AI processor located outside Australia. Recordings and text are transmitted to that processor for real time processing only. The processor operates under a zero retention agreement, meaning it does not store your information after processing and does not use it to train its models. This transmission is still a genuine overseas disclosure under APP 8, even though nothing is retained overseas. Whether a session recording is additionally saved within our onshore practice management system is a setting we control at the practice level.

We do not sell your information to any third party. Our onshore AI note taking tools do not use your information to train their models. Our overseas AI processor operates under a contractual zero retention arrangement and is independently audited, but because processing occurs outside Australia, it does not receive the same guaranteed legal protection as information handled onshore, and Australian privacy law cannot directly compel that provider's compliance the same way it can an Australian entity.

Your choice about this feature. Use of the overseas processing AI feature is optional at the practice level, not mandatory for your care. Only one AI assisted note taking option, onshore or overseas processing, is ever active in a given session; the two are never used together. You can ask your practitioner which option is being used or will be used in relation to your file. Our practice management system lets us control, at an account level, whether session recordings are saved at all and whether they are saved to your client file. If you would prefer your information never pass through the overseas processing option, tell us and we will apply that preference to your sessions.

Full names of specific service providers, and copies of their relevant privacy and security certifications, are available on request by contacting us directly. We are also happy to provide this information to your GP, another treating practitioner, or a regulator on your request or with your consent.

6. Use of AI in your care

Discovery Family Therapy uses AI assisted note taking to help our practitioners create accurate clinical notes without being distracted by manual note taking during your session. Depending on the session and practitioner, one of two options is used, and only one is ever active at a time. Verbal consent is asked for and given at the beginning of the session, before any AI assisted note taking begins.

Onshore AI note taking (data stays in Australia)

• Your practitioner will ask for your verbal consent at the beginning of your session, before this option is used
• You can decline, and your session will proceed with manual note taking instead, with no impact on your care
• You can withdraw consent at any time, including partway through a session
• Session audio is not stored after your notes are generated
• Notes are stored onshore in Australia and the tool is contractually prevented from using your information to train its models

AI assisted practice management features (data briefly processed overseas)

• This option can record and transcribe session audio in real time, draft progress notes, reports, and letters from that transcript or from your history in our system, and summarise previous session notes
• Your practitioner will ask for your verbal consent at the beginning of your session, before this option is used, in the same way as onshore note taking
• Session audio and text are sent to a third party AI processor located outside Australia for real time processing only
• The overseas processor operates under a contractual zero retention arrangement: it does not store your information after processing it, and it does not use your information to train its models. This still counts as an overseas disclosure under Australian privacy law, even though nothing is retained overseas, because your information is transmitted there in the first place
• Whether a session recording is additionally kept on file within our onshore practice management system is a setting we control at the practice level
• You can ask us whether this option has been or will be used in relation to your file, and request it not be used for your sessions

If you have questions about either option, ask your practitioner or contact our admin team.

7. How we store and protect your information

• Client records are held electronically in our practice management platform, with access restricted to practitioners and administrative staff who need it to provide your care
• Physical documents, where they exist, are stored securely and are not left accessible to unauthorised persons
• We take reasonable technical and organisational steps to protect your information from misuse, loss, unauthorised access, modification, or disclosure

Overseas disclosure (APP 8)

Most of our systems store Australian client data onshore. Where any system we use processes or stores data outside Australia, as set out in sections 5 and 6, we take reasonable steps to ensure that data receives a comparable standard of protection, and we will update this policy to reflect any change in our technology stack.

8. Data breach notification

Discovery Family Therapy is subject to the Notifiable Data Breaches (NDB) scheme under the Privacy Act. If we experience a data breach that is likely to result in serious harm to you, we will:

1. Investigate and contain the breach as quickly as possible
2. Notify the Office of the Australian Information Commissioner (OAIC)
3. Notify you directly, where practicable, explaining what happened, what information was involved, and what steps you can take to protect yourself

9. How long we keep your information

• Client clinical records are retained for 7 years from the date of last contact
• After this period, records are securely destroyed

10. Accessing and correcting your information

Under APP 12 and APP 13, you have the right to:

• Request access to the personal information we hold about you
• Request correction of information you believe is inaccurate, out of date, or incomplete

To make a request, contact us using the details in section 15. We will respond within a reasonable period, generally within 30 days. In limited circumstances, for example where access could pose a risk to your safety or that of another person, or where information relates to another person's confidentiality, access may be limited or provided through a treating practitioner rather than as a direct file release. We will explain our reasons if we limit access.

Access to information about a child or young person client is governed by our separate Confidentiality Policy.

11. Children, young people, and separated families

Discovery Family Therapy works with children, teenagers, and families, including those involving separated parents. How we collect, use, and share information in these circumstances, including our named contact intake model, consent thresholds for session content, and our position on court related requests, is set out in full in our Confidentiality Policy. That policy should be read alongside this one.

12. Cookies and website data

Our website does not include contact or enquiry forms. All bookings and client communication are handled directly through our practice management platform, not through the website.

Our website may still use cookies and embedded content, such as maps or videos, that behave the same way as if you visited the third party site directly. These third parties, and our website hosting provider, may collect standard technical data such as your IP address and browsing activity. Our website is hosted on infrastructure located outside Australia, so this technical data may be processed overseas, even though the website itself does not collect personal information from you directly.

13. Complaints

If you believe we have mishandled your personal information or breached this policy:

1. Contact us first. We will acknowledge your complaint within 7 days and aim to resolve it within 30 days.
2. If unresolved, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC): oaic.gov.au, phone 1300 363 992.

14. Changes to this policy

We review this policy at least annually, or when we change the systems or AI tools we use to handle client information. The current version will always be available on our website, with the last updated date shown at the top.

15. Contact us

Discovery Family Therapy
Suite 5, 95 Canning Highway, South Perth, WA
Phone: (08) 6114 1845
admin@discoverytherapy.com.au