Privacy Policy

---

Inner North Centre for Mental Wellbeing

Privacy Policy 

This document describes the privacy policy (“Privacy Policy”) of Inner North Centre for Mental Wellbeing (ABN 63 631 783 492) (“IN”, “we”, “us” or “our”). This Privacy Policy sets out how IN collects, uses, stores, shares and discloses personal health information. This Privacy Policy has been developed in accordance with the Privacy Act 1988 (Cth) (‘Act’) and other legislation or regulations that apply to IN in certain circumstances, including but not limited to the Health Records Act 2001 (Vic) (‘Health Records Act’).

IN is a wellbeing centre that provides psychological and mental health services through individual and group treatment sessions, mental health programs and assessment. 

IN is committed to protecting the safety and security of the personal information of their clients and all other persons with whom IN interacts (“you”, “your”). Please read this Privacy Policy carefully in order to understand how your personal information is collected, held, used or otherwise processed by us. 

Personal Information that we collect 

“Personal Information” is information or an opinion about an individual whose identity is apparent, or can be reasonably ascertained, from that information or opinion (whether true or not, and whether recorded in a material form or not). The type of personal information we collect from you includes, without limitation, the following:  

· full name;

· address;

· email address;

· telephone number;

· date of birth; 

· enquiry information; 

· health fund details; 

· billing information; 

· Medicare provider number;

· referral information including reason for referral and diagnoses;

· social and background history;

· current medications;

· other information we required in order to accept a referral or schedule an appointment; 

· details of the services we have provided or that you have enquired about, including any additional information necessary to deliver those services and respond to enquiries;

· any additional information relating to you that you provide us directly through attendance at our practice, use of our services, enquiries, use of our website; and

· any other information that we deem relevant.

You may also provide us with personal information from time to time that may be considered “Sensitive Information. “Sensitive Information” is defined as information or an opinion about an individual's racial or ethnic origin, political membership, associations or opinions, religious or philosophical beliefs or affiliations, membership of a professional association or trade union, sexual orientation or practices, criminal record, health information and genetic or biometric information. The Sensitive Information we collect from you may include but is not limited to:

· racial or ethnic origin;

· political membership associations or opinions;

· religious or philosophical beliefs or affiliations;

· membership of a professional association or trade union;

· sexual orientation or practices;

· criminal record; and

· health information.

How Personal Information is collected 

We will collect Personal Information only by lawful and fair means and not in an unreasonably intrusive way. Personal Information is collected in a number of ways, including: 

· directly from you when you interact with us, including but not limited to  hardcopy forms, our “contact us” website form, correspondence via email, and interactions in person, fax or telephone with any IN staff (e.g. your clinician or our receptionist);

· passively from you, when you interact with our website (e.g. through use of cookies); and 

· from third party service providers in certain specific circumstances, including but not limited to other health care providers via referrals, correspondence and medical reports.

How we store Personal Information 

Personal Information is held in a secure filing cabinet at our premises located at 414 Rathdowne Street, Carlton North VIC 3045 or electronically using the practice management system Halaxy. Both the physical filing cabinet and Halaxy are accessible to our authorised staff and clinicians only. 

We take reasonable steps to protect your Personal Information from misuse, interference and loss, as well as unauthorised access, modification or disclosure and we use a number of physical, administrative, personnel and technical measures to protect your Personal Information. Further, we take reasonable steps to ensure that Halaxy uses industry standard security.

We cannot however guarantee the security of any personal or health information transmitted over the internet and therefore you disclose information to us at your own risk. To the maximum extent permitted under law, we are not liable for any unauthorised access, modification or disclosure, or misuse of personal or health information. 

IN retains Personal Information for 7 years from final contact with you or, if you are under the age of 18 when we last had contact with you, 7 years after your 18th birthday. All information we retain will be handled in accordance with this Privacy Policy. 

Consequences of not providing Personal Information 

If you do not wish for your Personal Information to be collected in a way anticipated by this Privacy Policy, IN may not be in a position to provide you with psychological and/or mental health services. In some circumstances, you may request to be anonymous or to use a pseudonym, which will be determined on a case by case basis. 

Why we collect your Personal Information and what we use it for

Your Personal Information is gathered and used for the purpose of:

· providing actual or anticipated mental health services, including but not limited to assessing, diagnosing and treating your presenting issue(s);

· billing you;

· verifying your identity;

· any other purpose you have consented to;

· any use which is required or authorised by law.

Disclosure of Personal Information 

Your Personal Information will remain confidential except when: 

· it is subpoenaed by a court, or disclosure is otherwise required or authorised by law; or 

· failure to disclose the Personal Information would, in the reasonable opinion of IN, place the life, health or safety of you or another person at serious risk; or 

· your prior approval has been obtained, including but not limited to: 

- provide a written report to another agency or professional (e.g. a GP or a lawyer); 

- discuss the material with another person (e.g. a parent, employer, health provider, or third party funder); 

- disclose the information in another way; 

- disclose to another professional or agency (e.g. your GP) and disclosure of your Personal Information to that third party is for a purpose which is directly related to the primary purpose for which your Personal Information was collected.

Your Personal Information is not disclosed to overseas recipients unless you consent or such disclosure is otherwise required by law. 

Your Personal Information will not be used, sold, rented or disclosed for any other purpose except for in accordance with this Privacy Policy. 

Potential cross border disclosure of Personal Information

Halaxy is a service provider that provides a secure online platform that assists in the administration and storage of information and integration with other online systems including payment, invoicing and Medicare. While Halaxy stores their data in Australia, they and IN may use third party providers who store their data offshore. In the event we share your Personal Information with Halaxy or any other third party provider, we will endeavour to ensure that the provider complies with local privacy legislation. In consenting to our use, collection and disclosure of your Personal Information you also consent to Halaxy and our third party providers to do the same.

In the event that unauthorised access, disclosure or loss of your Personal Information occurs, IN will activate its data breach plan as set out by the Office of the Australian Information Commissioner and use all reasonable endeavours to minimise any risk of consequential serious harm. If the data breach is a notifiable breach under the Act, we will endeavour to notify you as soon as practicable after we become aware of the breach.

Requests for access and correction of Personal Information  

Subject to some exceptions provided by law, you have the right to request access to and/or the correction of any of the Personal Information we hold about you at any time. Any such requests should be lodged directly with IN via the contact details below:

info@yourinnernorth.com.au

All requests will be responded to in writing within 28 days, and an appointment will be made if necessary for clarification purposes. You will be asked to complete a form and formally verify your identity as the client before further action can be taken. If you are satisfied that any Personal Information is inaccurate, out of date or incomplete, we will take reasonable steps to ensure that this information is corrected. We may charge a reasonable fee that is not excessive to cover the charges of retrieving and/or correcting your Personal Information. We will not charge you for making a request. 

Prior to provision of any requested Personal Information, your clinician may discuss your request with you. 

Concerns 

If you have any concerns about the management of your Personal Information, you may contact IN.  Upon request we can provide you with a copy of the Australian Privacy Principles, which describe your rights and how your Personal Information should be handled. If you have any queries or wish to make a complaint about the use of, disclosure of, or access to, your Personal Information, you may do so via the contact details below:

info@yourinnernorth.com.au

This Privacy Policy was last updated on 24 November 2021. 

DISCLAIMER: Your clinician may operate as an independent contractor at IN. Along with IN, you should contact your clinician for information regarding storage and disposal of your personal information and/or sensitive information.