Privacy Policy

Effective Date: 8 July 2026

1. Introduction

Sanctum Psychology is an Australian private psychology practice providing psychological therapy, assessment and related professional services.

Sanctum Psychology respects the privacy of clients, prospective clients, website visitors and other individuals whose personal information it handles. We are committed to protecting personal information and health information and to managing that information responsibly, securely and transparently.

Sanctum Psychology manages personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

This Privacy Policy explains:

• the kinds of personal information we collect and hold;
• how we collect, use and disclose personal information;
• how personal information is stored and protected;
• how individuals may request access to or correction of their personal information; and
• how privacy questions or complaints may be raised.

This Privacy Policy applies to personal information handled through Sanctum Psychology’s psychological services, assessments, administrative activities, website, online enquiry forms and communications.

In this Privacy Policy, “Sanctum Psychology,” “the Practice,” “we,” “us” and “our” refer to Dean James McManus trading as Sanctum Psychology, ABN 71 472 690 311.

2. What Information We Collect

Sanctum Psychology collects personal information that is reasonably necessary to provide psychological services, respond to enquiries and operate the Practice.

The kinds of information we may collect and hold include the following.

2.1 Identity and contact information

This may include: name; date of birth; address; telephone number; email address; preferred name and  pronouns; emergency contact details; and parent, guardian or support-person details where relevant.

2.2 Health and clinical information

This may include information about: current and previous psychological or mental health concerns; medical, developmental, psychiatric and family history; medications and other treatment; symptoms,  diagnoses and functional difficulties; risk and safety concerns; personal circumstances and significant life experiences; relationships, family circumstances, education and employment; disability and support needs; treatment goals, progress and outcomes; clinical consultations and communications; and other information relevant to the psychological service being provided.

Health information is sensitive information under Australian privacy law.

2.3 Referral and healthcare information

This may include: referral letters; Mental Health Treatment Plans; medical reports; correspondence from general practitioners, psychiatrists and other health practitioners; information about other services involved in a person’s care; and information required to coordinate treatment or assessment.

2.4 Psychological assessment information

Where Sanctum Psychology provides an assessment, we may collect and hold: developmental, educational, occupational and psychosocial history; responses to interviews, questionnaires and psychological tests; behavioural observations; test scores and assessment results; school, medical or other relevant records; information provided by parents, partners, teachers, employers or other collateral informants; audio, video or observational material where this forms part of an assessment and appropriate consent has been obtained; and assessment reports, diagnostic opinions and recommendations.

Information supplied by a collateral informant may form part of the client’s clinical record and may not always be able to be kept confidential from the person being assessed.

2.5 Administrative, payment and funding information

This may include: appointment and attendance information; billing and payment records; Medicare details; private health insurance information; referral and rebate information; workers’ compensation, NDIS or other third-party funding details; information required by an insurer, funding body or referring organisation; and records of consent, service agreements and practice-policy acknowledgements.

Sanctum Psychology does not ordinarily retain complete payment-card details. Payments may be processed through a third-party payment provider or practice-management platform.

2.6 Communications and enquiry information

When a person contacts Sanctum Psychology by website form, email, telephone, voicemail or another communication method, we may collect: their name and contact details; the nature of their enquiry; the service they are seeking; availability and appointment preferences; information they voluntarily provide about their circumstances or health; and records of communications with the Practice.

People should avoid providing extensive or highly sensitive clinical information through the general website enquiry form unless requested.

2.7 Website and technical information

When a person visits the Sanctum Psychology website, limited technical information may be collected automatically, including: internet protocol address; browser and device type; operating system; pages visited; date and time of access; referring website; general geographic information; and information collected through cookies or website analytics tools.

This information is generally used to operate, secure and improve the website and may not identify a person directly.

2.8 Information about other people

During therapy, assessment or an enquiry, a person may provide information about family members, partners, children, colleagues or other individuals.

Sanctum Psychology will only collect and use this information where it is reasonably relevant to the service being provided or another legitimate function of the Practice. Where appropriate, individuals should avoid providing unnecessary identifying information about other people.

2.9 Anonymous or pseudonymous contact

Where practicable, individuals may make a general enquiry anonymously or using a pseudonym.

However, Sanctum Psychology will usually need accurate identifying information to provide psychological services, conduct assessments, manage clinical risk, verify referrals, process Medicare or other funding claims, maintain clinical records and comply with legal and professional obligations.

3. How We Collect Personal Information

Sanctum Psychology may collect personal information directly from the individual concerned or, where appropriate, from another person or organisation.

3.1 Information collected directly from individuals

We may collect personal information when a person:

• submits an enquiry through the Sanctum Psychology website;
• contacts the Practice by email, telephone, voicemail or another communication method;
• completes an intake form, consent form, questionnaire or service agreement;
• creates or updates information through the Practice’s client-management system;
• attends a psychological consultation, assessment or other appointment;
• participates in a telehealth consultation;
• provides documents, reports, records or correspondence;
• completes psychological tests or assessment measures;
• makes a payment or provides Medicare, insurance or funding information; or
• otherwise communicates with Sanctum Psychology.

Information may be collected verbally, in writing, electronically or through direct clinical observation.

3.2 Information collected from other people or organisations

Where reasonably necessary for the service being provided, Sanctum Psychology may collect personal information from:

• a parent, guardian, partner, family member or support person;
• a general practitioner, psychiatrist, psychologist or other health practitioner;
• a school, teacher, university or other educational provider;
• a hospital, allied health service or community organisation;
• an employer, lawyer, insurer, workers’ compensation authority, NDIS provider or other funding body;
• a referring practitioner or organisation;
• a previous treating practitioner;
• a government agency, court or other authority where authorised or required by law; or
• another person involved in an assessment or the individual’s care.

Where practicable and appropriate, Sanctum Psychology will obtain the individual’s consent before requesting information from another person or organisation.

In some circumstances, information may be provided to Sanctum Psychology without the Practice having first requested it. For example, a referrer, family member or other person may send information they believe is relevant. Sanctum Psychology will handle that information in accordance with this Privacy Policy and applicable privacy obligations.

3.3 Collection through Halaxy and other practice systems

Sanctum Psychology uses electronic systems to support appointment management, intake, clinical recordkeeping, billing, payments, Medicare claiming, communications and related administrative functions.

Personal information may be collected through Halaxy or other service providers used by the Practice. Information submitted through those systems may also be subject to the provider’s own privacy and security practices.

Sanctum Psychology takes reasonable steps to use reputable service providers and to configure practice systems in a manner appropriate for handling health information.

3.4 Website enquiry forms

Information submitted through a website enquiry form is transmitted to Sanctum Psychology for the purpose of responding to the enquiry and considering whether the requested service may be suitable.

Submitting a website enquiry does not establish a psychologist–client relationship and does not guarantee that an appointment or service will be offered.

Website forms should not be used for emergencies or urgent mental health concerns. Individuals should avoid including unnecessary detailed clinical information in a general enquiry form.

3.5 Telephone, voicemail and email

Sanctum Psychology may keep records of telephone calls, voicemail messages, emails and other communications where this is reasonably necessary for clinical, administrative, safety, legal or professional purposes.

Email and ordinary text messaging may not always be completely secure. Individuals should consider this when choosing what information to communicate through those channels.

3.6 Collection during psychological services

During therapy, assessment or consultation, Sanctum Psychology may collect information through: clinical interviews; discussion of symptoms, history and current circumstances; behavioural and mental-state observations; psychological questionnaires and standardised measures; cognitive, educational, developmental or diagnostic assessments; review of medical, educational, employment or other relevant records; and information supplied by collateral informants.

Clinical notes may be made during or after an appointment and retained as part of the individual’s clinical record.

3.7 Unsolicited personal information

Sanctum Psychology may occasionally receive personal information that it did not request.

Where this occurs, the Practice will consider whether the information could lawfully have been collected. If the information is not reasonably necessary for the Practice’s functions or cannot lawfully be retained, Sanctum Psychology will take reasonable steps to destroy or de-identify it, where lawful and practicable.

3.8 Recording consultations

Sanctum Psychology does not ordinarily audio-record or video-record psychological consultations without the knowledge and consent of the people involved.

Where recording is clinically or professionally appropriate, such as for a particular psychological assessment, supervision, training or quality-assurance purpose, the reason for recording and the proposed use, storage and retention of the recording will be explained and appropriate consent will be obtained.

Clients and other participants must not record consultations without the prior agreement of the psychologist and any other person participating in the consultation.

4. Why We Collect, Hold, Use and Disclose Personal Information

Sanctum Psychology collects, holds, uses and discloses personal information where reasonably necessary to provide psychological services, operate the Practice and meet legal, professional and administrative obligations.

4.1 Providing psychological services

Personal information may be used to: assess a person’s presenting concerns, needs and circumstances; provide psychological therapy, consultation and support; conduct psychological, cognitive, developmental, diagnostic, educational or functional assessments; formulate clinical opinions and diagnoses where appropriate; develop and review treatment or support plans; monitor progress, outcomes, risk and safety; coordinate care with other professionals or services; prepare reports, letters, recommendations and other clinical documents; and provide continuity of care over time.

4.2 Psychological assessment and report preparation

Where Sanctum Psychology conducts an assessment, personal information may be used to: determine the scope and suitability of the assessment; select and administer appropriate assessment measures; interpret test results and clinical information; compare information obtained from different sources; obtain relevant collateral information; consider developmental, educational, medical, occupational and psychosocial history; formulate diagnostic or clinical conclusions; prepare assessment reports and recommendations; and communicate findings to the client, referrer or another authorised recipient.

Sanctum Psychology will only prepare or release reports in accordance with the agreed scope of service, applicable consent arrangements and relevant legal and professional obligations.

4.3 Communication and care coordination

Personal information may be used to: respond to enquiries; communicate about appointments, referrals, assessments, reports and treatment; send appointment confirmations and reminders; liaise with general practitioners, psychiatrists and other health professionals; communicate with parents, guardians, support people, schools or other involved parties where authorised or otherwise permitted by law; and coordinate services where more than one provider or organisation is involved.

4.4 Appointment and practice administration

Personal information may be used to: assess whether Sanctum Psychology is able to offer a requested service; arrange, confirm, reschedule or cancel appointments; maintain waiting lists; administer intake and consent processes; maintain clinical and administrative records; manage invoices, receipts, payments and outstanding accounts; administer cancellation and non-attendance policies; respond to questions, feedback or complaints; and manage the day-to-day operation of the Practice.

4.5 Medicare, insurance and third-party funding

Where applicable, personal information may be used or disclosed to: verify referrals and eligibility; process Medicare claims and rebates; process private health insurance claims; administer workers’ compensation, compulsory third-party insurance, NDIS or other funding arrangements; communicate with insurers, funding bodies, case managers or referring organisations; provide invoices, attendance information, reports or treatment updates where authorised or required; and comply with the conditions of an agreed funding arrangement.

The information provided to a funder or third party will generally be limited to what is reasonably necessary for the relevant purpose, subject to consent and any legal or contractual requirements.

4.6 Legal and professional obligations

Personal information may be collected, held, used or disclosed where reasonably necessary to: comply with the Privacy Act 1988 (Cth) and other applicable laws; comply with subpoenas, court orders, warrants or other lawful requirements; meet professional, ethical, registration and recordkeeping obligations; respond to a complaint, investigation, audit, legal claim or regulatory process; manage professional indemnity or insurance matters; maintain appropriate clinical governance and quality assurance; manage serious risks to the life, health or safety of an individual or another person; and establish, exercise or defend legal or equitable claims.

4.7 Safety and risk management

Personal information may be used to assess and respond to concerns involving: suicide or self-harm; harm to another person; abuse, neglect or exploitation; family or domestic violence; child safety; impaired decision-making or vulnerability; medical or psychiatric emergencies; or other serious risks to life, health or safety.

Where a serious risk is identified, Sanctum Psychology may use or disclose relevant information to an appropriate person, service or authority where the disclosure is authorised or required by law.

4.8 Service improvement and business operations

Sanctum Psychology may use personal information where reasonably necessary to: improve practice systems, forms and administrative processes; review service quality and clinical governance; maintain website security and functionality; manage service providers and professional advisers; conduct audits and compliance activities; and support business continuity, data recovery and information security.

Where practicable, information used for service evaluation, training, supervision, quality assurance or statistical purposes will be de-identified.

4.9 Supervision, consultation and professional development

Psychologists may discuss aspects of clinical work in professional supervision, peer consultation or case consultation where this is reasonably necessary to support safe, ethical and effective practice.

Where practicable, identifying information will be removed or minimised. Any professional involved in supervision or consultation is expected to maintain appropriate confidentiality.

Where identifiable information needs to be shared beyond what a client would reasonably expect, consent will ordinarily be obtained unless the use or disclosure is otherwise authorised or required by law.

4.10 Research, teaching and publication

Sanctum Psychology will not ordinarily use identifiable client information for research, teaching, presentations or publication without appropriate consent.

Where information is used for these purposes, it will generally be de-identified unless the individual has provided specific informed consent for identifiable information to be used.

4.11 Direct marketing

Sanctum Psychology does not use sensitive health information for direct marketing without consent.

The Practice may occasionally send administrative or service-related information to existing clients or people who have requested it. Individuals may ask not to receive non-essential communications at any time.

4.12 Consequences of not providing information

Individuals are not required to provide all personal information requested by Sanctum Psychology.

However, if necessary information is not provided, the Practice may be unable to: determine whether a service is suitable; conduct a valid or comprehensive assessment; provide safe and informed psychological care; communicate with relevant treating professionals; process Medicare, insurance or funding claims; prepare a requested report; or meet legal and professional obligations.

Where practicable, Sanctum Psychology will explain why particular information is required.

5. Storage, Security and Retention of Personal Information

Sanctum Psychology takes reasonable steps to protect the personal information it holds from misuse, interference, loss and unauthorised access, modification or disclosure.

Because no method of electronic transmission or storage is completely secure, Sanctum Psychology cannot guarantee absolute security. However, the Practice uses administrative, physical and technical safeguards appropriate to the sensitivity of the information it handles.

5.1 How information is stored

Personal information may be stored in: secure electronic clinical and administrative records; the Practice’s electronic practice-management system; encrypted or access-controlled computers and devices; secure email, cloud-storage, payment, assessment and communication platforms; electronic backups; paper files stored in secure premises or locked storage, where applicable; and records held by contracted service providers acting on behalf of the Practice.

Clinical records may include intake documents, consent forms, correspondence, clinical notes, assessment materials, reports, referral information, billing records and other documents relating to the services provided.

5.2 Electronic practice systems

Sanctum Psychology currently uses Halaxy to support functions that may include: client registration and intake; appointment scheduling and reminders; clinical recordkeeping; billing and payment processing; Medicare claiming; forms and questionnaires; telehealth; secure communications; and related practice administration.

The Practice may also use other reputable technology providers for functions such as email, website hosting, online forms, psychological assessment, document storage, payment processing, telecommunications and data backup.

Third-party providers may store or process personal information on behalf of Sanctum Psychology. The Practice takes reasonable steps to select providers with privacy and security practices appropriate to the nature of the information being handled.

5.3 Security safeguards

Depending on the system and information involved, safeguards used by Sanctum Psychology may include: passwords and multi-factor authentication; access controls that restrict information to authorised users; device encryption and security software; secure practice-management and cloud-based systems; locked storage for paper records; secure backup and recovery arrangements; procedures for verifying identity before releasing information; confidentiality requirements for contractors and service providers; secure destruction or deletion processes; software updates and other cybersecurity measures; and policies and procedures for responding to privacy incidents and data breaches.

Access to personal information is limited to people who reasonably require access to perform clinical, administrative, legal or professional functions.

5.4 Staff, contractors and service providers

Any employee, contractor, locum, consultant or service provider who is permitted to access personal information is expected to: maintain confidentiality; access information only where authorised and reasonably necessary; use information only for the purpose for which access was provided; follow applicable privacy and information-security requirements; and report suspected privacy or security incidents promptly.

Where appropriate, these obligations are supported by contractual confidentiality and privacy requirements.

5.5 Email, text messages and electronic communication

Sanctum Psychology may use email, text messaging, telephone, voicemail, online forms, telehealth and electronic practice systems to communicate with clients and prospective clients.

Although reasonable precautions are taken, ordinary email and text messaging may not always be completely secure. There is a risk that electronic communications may be intercepted, misdirected, accessed by another person or stored on systems outside the Practice’s direct control.

Individuals should avoid sending unnecessary sensitive information through unsecured communication channels. Sanctum Psychology may recommend a more secure method where particularly sensitive documents or information need to be exchanged.

5.6 Client portals and account security

Where a client portal, online form or other account-based system is provided, individuals are responsible for taking reasonable steps to protect their own login details and devices.

Individuals should notify Sanctum Psychology promptly if they believe:

• their account or device has been accessed without authority;
• a communication has been sent to the wrong person;
• their contact details have changed; or
• personal information held by the Practice may be inaccurate or insecure.

5.7 Psychological test materials

Psychological test forms, protocols, scoring materials, stimulus materials and other assessment resources may be subject to professional, ethical, contractual and intellectual property restrictions.

Access to some assessment materials may therefore be limited where release would: compromise the validity or security of a psychological test; breach copyright or licensing requirements; disclose protected test materials; affect the rights or privacy of another person; or otherwise be restricted by law.

Where access to raw assessment data or test materials cannot appropriately be provided directly, Sanctum Psychology may discuss another suitable means of providing access or explaining the relevant results.

5.8 Retention of clinical records

Sanctum Psychology retains clinical records for the period required by applicable laws and professional obligations.

As a general practice: records relating to an adult client will ordinarily be retained for at least seven years from the date of the last psychological service or last relevant clinical entry; and records created while a client was under 18 years of age will ordinarily be retained until the client reaches at least 25 years of age.

Some records may be retained for longer where reasonably necessary or where required because of: applicable Commonwealth, state or territory law; professional or registration obligations; an assessment involving a child or young person; an ongoing or anticipated legal proceeding; a complaint, investigation, subpoena or regulatory process; an insurance or funding requirement; continuing clinical relevance; risk-management considerations; or another lawful purpose.

Administrative, financial, website and enquiry records may be retained for different periods depending on their purpose and applicable legal requirements.

5.9 Destruction and de-identification

When personal information is no longer required for a lawful purpose and is not required to be retained, Sanctum Psychology will take reasonable steps to securely destroy it or ensure that it is appropriately de-identified.

Secure destruction may include: permanent deletion from active electronic systems, where practicable; secure disposal of electronic storage media; confidential shredding or destruction of paper records; and requiring an authorised service provider to securely delete or destroy information.

Information contained in routine backups may remain for a limited period until the backup is overwritten or securely retired, provided it is not ordinarily accessible for general use.

5.10 Transfer, closure or sale of the Practice

If Sanctum Psychology closes, transfers, restructures or sells all or part of the Practice, personal information may need to be transferred to another appropriately qualified practitioner, custodian or service provider.

Any such transfer will be managed in accordance with applicable privacy, professional and legal obligations. Where reasonably practicable, affected clients will be notified and provided with information about how their records will be managed.

5.11 Loss of capacity or death of the Practice Principal

Sanctum Psychology maintains arrangements intended to support the secure management of clinical records if the Practice Principal becomes seriously unwell, loses capacity, dies or is otherwise unable to continue managing the Practice.

An appropriately authorised person or professional records custodian may be given limited access where necessary to: protect and preserve clinical records; notify affected clients; respond to lawful access requests; facilitate continuity or transfer of care; and meet legal and professional recordkeeping obligations.

Any person acting in this capacity will be required to maintain privacy and confidentiality.

6. Disclosure of Personal Information

Sanctum Psychology treats personal information and health information as confidential.

Personal information will generally only be disclosed: for the purpose for which it was collected; with the individual’s consent; for a directly related purpose the individual would reasonably expect; where the disclosure is required or authorised by law; or where another exception under the Privacy Act 1988 (Cth) applies.

6.1 Disclosure with consent

With appropriate consent, Sanctum Psychology may disclose relevant information to: a general practitioner, psychiatrist, psychologist or other health practitioner; a parent, guardian, partner, family member or support person; a school, university, employer or support service; an insurer, workers’ compensation authority, NDIS provider or other funding body; a lawyer or other professional adviser; a referring practitioner or organisation; or another person or organisation nominated by the client.

Consent may be written or verbal, depending on the circumstances. Sanctum Psychology may request written consent where the information is particularly sensitive or a report or clinical record is being released.

Consent may be limited by: the information to be disclosed; the recipient; the purpose of disclosure; and the period for which the consent applies.

A person may withdraw consent for future disclosures, subject to any legal or professional obligations that continue to apply.

6.2 Coordination of healthcare

Sanctum Psychology may use or disclose health information for a purpose directly related to the provision of healthcare where: the individual would reasonably expect the use or disclosure; and the information is reasonably necessary for that purpose.

This may include communication with a referring practitioner or another health professional involved in the individual’s care.

Where practicable, the Practice will discuss this communication with the client beforehand.

6.3 Reports, letters and assessment information

Clinical reports, assessment reports, treatment summaries and letters will only be provided to an authorised recipient in accordance with: the agreed purpose and scope of the service; the client’s consent; any relevant funding or referral arrangement; and applicable legal and professional obligations.

Where an assessment involves a child, guardian, collateral informant, school or other third party, the Practice will consider: who commissioned the assessment; who provided consent; who is legally entitled to receive the report; the purpose for which the report was prepared; and the privacy interests of all people involved.

6.4 Medicare, insurers and funding bodies

Where a service is funded or rebated by Medicare, an insurer, workers’ compensation authority, NDIS arrangement or another third party, Sanctum Psychology may disclose information reasonably necessary to: verify eligibility; process claims or payments; confirm attendance; provide invoices; communicate treatment progress; provide reports required under the funding arrangement; or comply with lawful audit or administrative requirements.

The nature and extent of information supplied may depend on the funding arrangement. Clients are encouraged to ask what information a funder may require before agreeing to use that funding pathway.

6.5 Serious threats to life, health or safety

Sanctum Psychology may disclose relevant personal information where: 

• it is unreasonable or impracticable to obtain consent; and
• the Practice reasonably believes the disclosure is necessary to lessen or prevent a serious threat to the life, health or safety of an individual or to public health or safety.

Depending on the circumstances, information may be disclosed to:

• emergency services;
• a hospital or crisis service;
• a treating health practitioner;
• a parent, guardian, partner or support person;
• child-protection or adult-safeguarding services; or
• another appropriate authority or person able to assist.

Only information reasonably necessary to respond to the risk will be disclosed.

6.6 Child safety, abuse and neglect

Sanctum Psychology may disclose personal information where required or authorised by laws relating to: child abuse or neglect; risk of significant harm; family or domestic violence; elder abuse; abuse, neglect or exploitation of a person with impaired capacity; or other safeguarding concerns.

Any disclosure will be made in accordance with the applicable legal and professional requirements.

6.7 Legal proceedings and compulsory disclosure

Personal information may be disclosed where required or authorised by law, including in response to: a subpoena; a court order; a warrant; a statutory notice; a coronial or regulatory investigation; a lawful request from a government agency or authority; or another compulsory legal process.

Where appropriate and lawful, Sanctum Psychology may seek legal or professional advice before releasing information.

The Practice cannot guarantee that clinical records will remain confidential if they become subject to a valid legal requirement for production.

6.8 Complaints, claims and professional regulation

Personal information may be disclosed where reasonably necessary to:

• respond to a complaint;
• manage a legal or insurance claim;
• notify or liaise with a professional indemnity insurer;
• obtain legal advice;
• respond to an investigation by a registration board, regulator or professional body; or
• establish, exercise or defend a legal or equitable claim.

Disclosure will be limited to information reasonably relevant to the matter.

6.9 Service providers

Sanctum Psychology may provide limited access to personal information to service providers that assist with: practice-management software; appointment scheduling and reminders; clinical record storage; telehealth; email and communications; website hosting and enquiry forms; payment processing and Medicare claiming; psychological assessment platforms; document storage and backup; information technology support; accounting, legal and insurance services; and secure record destruction.

These providers are expected to handle personal information only for the authorised purpose and in accordance with applicable privacy and confidentiality requirements.

6.10 Business transfer, closure or records custody

Personal information may be transferred to an appropriately qualified practitioner, records custodian or successor practice if Sanctum Psychology: closes; is sold or transferred; restructures; becomes unable to continue operating; or needs to arrange continuity of care or lawful records management.

Any transfer will be managed in accordance with legal, professional and privacy obligations.

6.11 Information about other people

Clinical records may contain information about family members, partners, collateral informants or other individuals.

When considering access to or disclosure of this information, Sanctum Psychology will take reasonable steps to protect the privacy of those third parties and may redact or withhold information where permitted or required by law.

6.12 Minimum necessary disclosure

Where personal information is disclosed, Sanctum Psychology will take reasonable steps to limit the disclosure to information that is relevant and reasonably necessary for the purpose.

6.13 No sale or rental of personal information

Sanctum Psychology does not sell, rent or trade personal information.

The Practice does not disclose personal information to third parties for their independent advertising or marketing purposes.

7. Overseas Disclosure

Sanctum Psychology aims to use service providers with privacy and security practices appropriate for handling personal and health information.

Some technology providers used by the Practice may store, process, back up or support information using infrastructure, personnel or subcontractors located outside Australia.

This may include providers involved in: cloud hosting; email; website hosting; website forms; data backup; telecommunications; payment processing; psychological assessment platforms; practice-management software; or technical support.

Where personal information is disclosed to an overseas recipient, Sanctum Psychology will take reasonable steps to ensure that the information is handled in a manner consistent with applicable Australian privacy requirements, unless an exception under the Privacy Act 1988 (Cth) applies.

The countries in which information may be processed or accessed may vary depending on the provider and its current service arrangements.

Further information about the location or privacy practices of a particular service provider may be requested from Sanctum Psychology.

Sanctum Psychology will not intentionally disclose clinical information to an overseas recipient for an unrelated purpose without consent or other lawful authority.

8. Cookies and Website Analytics

The Sanctum Psychology website may use cookies and similar technologies to support website functionality, security and performance.

A cookie is a small data file stored on a person’s device when they visit a website.

Cookies may be used to: remember preferences; support website navigation and functionality; maintain website security; understand how visitors use the website; identify technical errors; measure website traffic and performance; and improve website content and usability.

The website may also use analytics services, such as Google Analytics or similar tools, if enabled.

Analytics providers may collect information including: pages visited; time spent on the website; browser and device information; approximate location; referring website; and internet protocol address.

This information is generally aggregated or pseudonymised and is used to understand website performance and visitor behaviour.

Website visitors may be able to control or disable cookies through their browser settings. Disabling cookies may affect the functionality of parts of the website.

The website may contain links to third-party websites. Sanctum Psychology is not responsible for the privacy practices, security or content of those external websites.

9. Access to and Correction of Personal Information

Individuals may request access to personal information held about them by Sanctum Psychology.

Requests should be made in writing to the Practice Principal or Privacy Officer using the contact details in section 12.

Before providing access, Sanctum Psychology may need to verify the identity and authority of the person making the request.

Access may be provided by: allowing the individual to inspect the information; providing a copy; discussing or explaining the information; providing a written summary; or arranging another appropriate form of access.

Sanctum Psychology may refuse or limit access where permitted or required by law, including where access would:

• pose a serious threat to the life, health or safety of any person;
• unreasonably affect another person’s privacy;
• relate to existing or anticipated legal proceedings;
• prejudice an investigation or lawful process;
• reveal commercially sensitive evaluative information;
• breach legal professional privilege;
• disclose restricted psychological test materials; or
• otherwise be unlawful.

If access is refused or limited, Sanctum Psychology will generally provide written reasons, unless it would be unreasonable or unlawful to do so.

A reasonable administrative fee may be charged for providing access where permitted by law. No fee will ordinarily be charged merely for making a request.

Individuals may also request correction of personal information they believe is inaccurate, incomplete, out of date, irrelevant or misleading.

Where Sanctum Psychology is satisfied that correction is required, reasonable steps will be taken to update the information.

Where a correction request is not accepted, the individual may request that a statement be attached to the record noting that the accuracy of the information is disputed.

Sanctum Psychology will aim to respond to access and correction requests within a reasonable period, ordinarily within 30 days.

10. Data Breaches

Sanctum Psychology maintains procedures for identifying, assessing and responding to privacy and data-security incidents.

A data breach may involve the loss of, unauthorised access to or unauthorised disclosure of personal information.

If a suspected breach occurs, Sanctum Psychology may:

• take immediate steps to contain the incident;
• investigate what occurred;
• assess the type and sensitivity of information affected;
• evaluate the likelihood of serious harm;
• take steps to reduce or prevent harm;
• seek legal, technical or professional advice;
• notify affected individuals where appropriate; and
• notify the Office of the Australian Information Commissioner where required.

Where the breach is an eligible data breach under the Privacy Act 1988 (Cth), Sanctum Psychology will comply with the Notifiable Data Breaches scheme.

Individuals who believe their personal information may have been compromised should contact Sanctum Psychology promptly.

11. Privacy Concerns and Complaints

Individuals may contact Sanctum Psychology if they have a question or concern about how their personal information has been handled.

A privacy complaint should include:

• the person’s name and contact details;
• a description of the concern;
• relevant dates, communications or documents; and
• the outcome sought.

Sanctum Psychology will:

• acknowledge the complaint;
• review the relevant circumstances;
• request further information where necessary;
• take reasonable steps to investigate the concern; and
• provide a response within a reasonable period.

Sanctum Psychology will aim to respond to privacy complaints within 30 days, although more complex matters may take longer.

The Practice will not disadvantage a person merely because they have raised a privacy concern or complaint.

If a person is not satisfied with the Practice’s response, they may contact the Office of the Australian Information Commissioner.

The Office of the Australian Information Commissioner may be contacted through its website, by telephone or by post.

12. Contact Details

Privacy enquiries, access requests, correction requests and complaints may be directed to:

Privacy Officer / Practice Principal
Sanctum Psychology
Dean James McManus trading as Sanctum Psychology
ABN 71 472 690 311

Telephone: 0431 061 567
Email: [email protected]
Website: sanctumpsychology.com.au

Gold Coast practice:
Suite 2, 3 Millennium Circuit, Helensvale QLD 4212

Sydney location by prior arrangement:
Suite 302, 116-118 Christie St, St Leonards NSW 2065

Where appropriate, correspondence may also be sent through the contact form on the Sanctum Psychology website. Sensitive clinical information should not be included in a general website enquiry unless requested.

13. Changes to This Privacy Policy

Sanctum Psychology may update this Privacy Policy from time to time to reflect: changes to the Practice’s services or systems; changes to legal, regulatory or professional requirements; changes to technology or service providers; or improvements to privacy and information-security practices.

The current version will be published on the Sanctum Psychology website and will take effect from the effective date stated at the beginning of the policy.

Individuals are encouraged to review the Privacy Policy periodically.

Where a change is significant and directly affects existing clients, Sanctum Psychology may provide additional notice where reasonably practicable.