PRIVACY POLICY

Peekaboo Psychology
Last updated: 28th July 2026

Our commitment to your privacy

Peekaboo Psychology ("we", "us", "our") is committed to protecting the privacy and confidentiality of personal and health information we collect from our clients, their guardians/carers, and website visitors.

As a health service provider, we are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), regardless of our annual turnover — the "small business" exemption in the Privacy Act does not apply to organisations that provide a health service and hold health information. In Victoria, we are also bound by the Health Records Act 2001 (Vic) and its Health Privacy Principles (HPPs), which apply specifically to health information handled by health service providers operating in this state.

This policy explains what personal and health information we collect, why we collect it, how we use, store, and disclose it, and how you can access, correct, or make a complaint about your information.

What information we collect

Depending on your interaction with us, we may collect:

• Identifying information: name, date of birth, address, contact details, emergency contact details
• Health information: presenting concerns, clinical history, assessment results, treatment notes, session records, diagnoses, referral letters, correspondence with other treating practitioners
• Sensitive information: information about mental health, disability, family relationships, and (where relevant to treatment) information such as sexuality, cultural or religious background
• Billing and funding information: Medicare details, private health fund details, NDIS plan details and participant number, referral information, invoicing and payment records
• Website and communication data: enquiry form submissions, email correspondence, and limited technical data such as browser type when you visit our website (see Section 8)

Where a client is a child or a person with a guardian or authorised representative, we may also collect information from and about parents, guardians, or other authorised decision-makers.

How we collect information

We generally collect information directly from you or your guardian, through:

• Intake and registration forms (completed in person, by email, or via our website)
• Consultations and therapy sessions
• Telephone, email, or other correspondence with you

We may also collect information from third parties, but only where you have consented, it is required or authorised by law, or where necessary to provide safe and effective care — for example:

• Referring GPs, psychiatrists, or other health practitioners
• Other treating professionals involved in your care (with your consent)
• NDIS planners or support coordinators (where you are an NDIS participant)
• Medicare or private health insurers, for billing and rebate purposes
• Parents, guardians, or carers, where a client is a minor or unable to provide information themselves

Why we collect, use, and disclose your information

We collect, hold, use, and disclose personal and health information for purposes including:

• Providing psychological assessment, treatment, and support
• Coordinating care with other treating practitioners (with consent, or as permitted by law)
• Billing, claiming, and processing payments (including Medicare, NDIS, and private health fund claims)
• Complying with our legal, professional, and reporting obligations (including mandatory reporting obligations where they apply)
• Practice administration, such as appointment scheduling and reminders
• Responding to enquiries made through our website or by phone/email

We will only use or disclose health information for a secondary purpose (i.e. one unrelated to why it was collected) where you have consented, where you would reasonably expect it, or where permitted or required by law — for example, where there is a serious threat to someone's life, health, or safety, or where disclosure is required by a court order, subpoena, or mandatory reporting obligation.

We do not sell or trade your personal or health information.

Disclosure to third parties and service providers

We use a small number of third-party platforms and service providers to support the practice's operations. These providers may have access to personal and/or health information as necessary to deliver their service, and are bound by confidentiality and privacy obligations:

• Halaxy — practice management, clinical records, and appointment scheduling
• Microsoft Outlook / Microsoft 365 — email and calendar management
• Google Workspace — document storage and collaboration
• Xero — billing, invoicing, and accounting

Some of these providers may store or process data on servers located outside Australia. Where this occurs, we take reasonable steps to ensure overseas recipients handle your information consistently with the Australian Privacy Principles, in accordance with APP 8.

Storage and security of your information

We take reasonable steps to protect personal and health information from misuse, interference, loss, unauthorised access, modification, or disclosure. This includes:

• Secure, access-controlled clinical record systems
• Password protection and multi-factor authentication on key systems
• Restricting access to personal and health information to staff who need it to perform their role
• Regular review of our IT systems and security practices

We retain health records for the period required by law and professional guidelines. In Victoria, health service providers are generally required to retain records for at least 7 years from the date of the last entry (or until a child client turns 25, whichever is later), in line with the Health Records Act 2001 (Vic) and relevant professional board requirements.

Access and correction

You have a right to request access to, and correction of, the personal and health information we hold about you, under APP 12 and APP 13, and the equivalent Health Privacy Principles under Victorian law.

We will respond to access and correction requests within a reasonable time. In limited circumstances permitted by law (for example, where access would pose a serious threat to your health or safety, or that of another person, or where it would unreasonably impact the privacy of another individual), we may need to provide access in a modified way or decline part of a request. Where we refuse a request, we will explain our reasons in writing.

To make a request, contact us using the details in Section 11.

Our website

Our website may collect limited technical information automatically, such as browser type, device type, and pages visited, for the purpose of maintaining and improving the site. 

If you submit an enquiry through our website contact form, the information you provide will be used only to respond to your enquiry and, where relevant, to arrange an appointment.

Automated decision-making

We do not currently use automated decision-making software or artificial intelligence to make decisions that significantly affect our clients' rights or interests. Should this change, we will update this policy to comply with the transparency requirements coming into effect under the Privacy Act from December 2026.

Data breaches

In the event of an eligible data breach involving personal or health information that is likely to result in serious harm, we will comply with our obligations under the Notifiable Data Breaches scheme, including notifying affected individuals and the Office of the Australian Information Commissioner (OAIC) as required.

Complaints and contact details

If you have a concern about how we have handled your personal or health information, please contact us in the first instance:

Peekaboo Psychology
245 Pakington St, Newtown, Victoria 3220
48 High St, Bannockburn, Victoria 3331
Phone: (03) 4251 0366
Email: hello@peekaboopsychology.com

We will investigate your complaint and respond within a reasonable time, generally within 30 days.

If you are not satisfied with our response, you can escalate your complaint to:

Office of the Australian Information Commissioner (OAIC)
Website: www.oaic.gov.au
Phone: 1300 363 992

Health Complaints Commissioner (Victoria)
Website: www.hcc.vic.gov.au
Phone: 1300 582 113

Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in law, technology, or our practices. The current version will always be available on our website, with the date of last update shown at the top of this page.