Last updated: October 2026

Exhale Psychology Centre (Exhale Psychology Centre Pty Ltd, ABN 24 658 273 520) respects your privacy. This policy explains what personal information we collect, why we collect it, how we look after it, and how you can see it, correct it or make a complaint. We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and by the confidentiality obligations that apply to psychologists and dietitians.

In this policy, "we" and "us" means Exhale Psychology Centre, and "you" means anyone whose information we hold: clients, parents and guardians, referrers, people who use our website, and people who apply to work or train with us.

What information we collect

If you are a client (or the parent or guardian of a client), we collect:

• your name, date of birth, pronouns, address, phone number and email address
• the name and contact details of a parent or guardian for clients under 18, and an emergency contact
• your Medicare number, and details of any referral or plan (for example a Mental Health Treatment Plan or Eating Disorder Treatment and Management Plan) and the GP or psychiatrist who wrote it
• NDIS, plan manager, WorkCover or private health insurance details if they are funding your sessions
• your appointments, invoices and payments
• health information, including what you would like support with, your history, assessment results, notes your clinician makes about your sessions, and letters and reports to and from your other health practitioners

Health information is sensitive information under the Privacy Act. We only collect it with your consent, or where the law allows it, and only when it is needed to provide our services.

If you use our website, we collect:

• whatever you type into a form (for example our waitlist, NDIS booking and supervision enquiry forms)
• information about your visit through Google Analytics: the pages you view, the website that sent you, your device and browser, and your approximate location. This uses cookies and is not linked to your name.
• the IP address a form was sent from, which our website provider keeps to stop spam

We also collect contact details and professional details from referrers, supervisees, people enrolling in our training, job applicants and suppliers.

Dealing with us anonymously

You can browse our website and make general enquiries about our services without telling us who you are. We only respond to questions that relate directly to the services we offer, so we don’t answer questions about other content on our website, such as our blog articles. We cannot usually provide psychological or dietetic services, or help you claim a rebate, without knowing who you are

How we collect it

We collect most information directly from you: through our forms, our online booking and client portal, by phone, by email and in sessions. With your consent, or where the law allows, we also collect it from others, such as your GP or psychiatrist, your parent or guardian, your plan manager, the NDIA, WorkCover or an insurer, and other health practitioners involved in your care.

Sometimes we receive information about you that we didn’t ask for. For example, a hospital might send us a discharge summary, or a family member might contact us about you. If the information relates to your care and we could have collected it ourselves, we will keep it on your file and protect it in the same way as all other information we hold about you. If not, we will destroy or de-identify it where it is lawful and reasonable to do so.

Why we collect, use and share it

We use your information to:

• provide our services to you and manage your care
• manage appointments and our waitlist, including matching you with a clinician
• invoice you and make claims with Medicare, the NDIS, WorkCover or your insurer
• write to the GP or psychiatrist who referred you, which Medicare requires for rebated sessions
• contact you about your appointments
• meet our legal and professional obligations, including record keeping
• improve our services, including through clinical supervision, where we do not identify you
• answer enquiries, run our training and supervision, and consider job applications
• run and improve our website

We share your information only for the purposes above, with your consent, or where the law requires or allows it. This can include:

• the GP, psychiatrist or other practitioner who referred you, and other practitioners involved in your care
• Medicare (Services Australia), the NDIA and your plan manager, WorkCover Queensland, or your insurer, for claims
• a parent or guardian of a client under 18, depending on the young person's age and maturity, which your clinician will talk with you about
• the service providers who run our systems for us (see below)
• others where the law requires it (for example a court order or a mandatory report), or where we believe it is necessary to lessen or prevent a serious threat to someone's life, health or safety

We never sell your information, and we do not use your health information for marketing.

The services we use

We use trusted providers to run our practice: practice management software (Zanda) for client records, bookings and our client portal; a shared email inbox (Front); email (Fastmail); Zoom for telehealth; Stripe to take card payments; Webflow to host our website and its forms; Google Analytics for website statistics; and Dropbox for practice documents and backups. Each provider is bound to use your information only to provide its service to us, and we stay responsible for it.

Information held outside Australia

Some of our providers store or process information outside Australia. These are the providers and the countries involved:

• Zanda (client records, bookings, client portal): Australia
• Front (shared email inbox): United States, European Union
• Zoom (telehealth video): Australia and the United States
• Stripe (card payments): United States
• Dropbox (practice documents and backups): United States
• Fastmail (email): United States
• Webflow (our website and its forms): United States
• Google Analytics (website statistics): United States

We choose providers that are bound by contract to protect your information and to use it only to provide their service to us, and we can retrieve and delete our information from them.

How we keep it safe

We keep records electronically in secure systems. Each team member has their own login with two-factor authentication where available, and sees only what their role needs. Information is encrypted when it is sent and where our systems allow, when it is stored. Our team is bound by confidentiality, and any paper is kept locked away and shredded when no longer needed.

We keep health records for at least seven years after your last appointment, or, for a client who was under 18, until they turn 25, and then destroy or de-identify them securely.

If a data breach is likely to cause you serious harm, we will tell you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

Email and text messages are not completely secure. Please do not send urgent or sensitive information that way unless you are comfortable doing so, and let us know if you would prefer we contact you another way.

Seeing and correcting your information

You can ask to see the information we hold about you, or ask us to correct it, by contacting our Practice Manager (details below). We will respond within 30 days. There is no charge to ask; we may charge a reasonable fee to cover the cost of copying a large file, and will tell you first.

In a few situations the law allows us to refuse access, for example where it would pose a serious threat to someone's life, health or safety, or would unreasonably affect someone else's privacy. If so, we will explain why in writing, and where we can we will find another way, such as giving the information to a practitioner you choose.

Our website

Our website uses Google Analytics cookies to count visits. You can block cookies in your browser, or install Google's opt-out add-on, and the site will still work.

Our online booking and client portal are run by Zanda, and our training courses by Teachable, on their own sites. Our website links to these and to other sites such as Instagram and LinkedIn, which have their own privacy policies.

Please only tell us in our forms what the form asks for. If you need urgent help, do not use a form: call 000 or Lifeline on 13 11 14.

Complaints

If you are concerned about how we have handled your information, please contact our Practice Manager. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992. Concerns about a health service can also go to Queensland's Office of the Health Ombudsman at oho.qld.gov.au or on 133 646.

Contact us

Privacy enquiries: our Practice Manager
Email: contact@exhalepsychology.com.au
Phone: (07) 2143 6001
Post: 65 Eildon Road, Windsor QLD 4030

Changes to this policy

We will update this policy when our practices change. The date at the top shows when it last changed, and the current version is always on this page.