Telehealth Waiting Room

Introduction

Elementa Psychology Pty Ltd (we, us, our) is committed to best practice in relation to the management of information we collect and protecting your privacy. We comply with applicable privacy legislation including the Privacy Act 1988 (Cth) (‘the Privacy Act’) and its Australian Privacy Principles (‘APPs’), and the Health Records Act 2001 (Vic) and its Health Privacy Principles (‘HPPs’)..

This Privacy Policy describes how we collect and manage personal information and safeguard privacy, and is designed to inform you of:

• ​the kinds of information that we collect and hold, which, as a psychology practice, is likely to be ‘health information’ for the purposes of the Privacy Act;

• how we collect and hold personal information;
• the purposes for which we collect, hold, use and disclose personal information;
• the location of persons to whom we may disclose your information;
• how you may access your personal information and seek the correction of that information;
• how you may complain about a breach of your privacy and how we will deal with such a complaint;
• whether we are likely to disclose personal information to overseas recipients.

What is ‘personal information’?

This Privacy Policy applies to our handling of personal information. ‘Personal information’ means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information is true or not and whether the information is recorded in a material form or not.

Personal information includes ‘sensitive information’, which is a particular type of personal information. Sensitive information includes identifying ‘health information’ about you (such as details of your health and medical history, and health services you seek or receive).  Sensitive information also includes information about racial or ethnic origin, political opinions or associations, religious or philosophical beliefs, and sexual orientation or practices.

What kinds of personal information do we collect?

We may collect the following personal information from patients, to the extent this is necessary for the services we provide:

• ​your name, address, date of birth, marital status, email and contact details, and if you are under 18, the details of your parent or guardian;
• details of your emergency contacts, including their name, phone number and relationship to you;
• your Medicare number, DVA number and other government identifiers, although we will not use these for the purposes of identifying you in our practice;
• other health information and sensitive personal information about you, including:
  • notes of your general, physical and mental health status and history;
  • other medical reports and forms if relevant;
  • lifestyle information;
  • employment status;
  • your prescriptions and other pharmaceutical purchases;
  • any diagnosis or treatments provided to you by healthcare professionals;
  • your appointment and billing details;
  • your healthcare identifier; and
  • any other information about your race, sexuality or religion if relevant.

​If you are a person other than a patient, such as a service provider, contractor or other third party we engage with, we will collect your personal information to the extent necessary for our functions or activities, and to work, transact or engage with you. 

You are not required to disclose your personal information to us.  However, if you do not provide the information requested, you may not be able to receive our services or engage with us effectively.

How do we collect your personal information?

We will collect your personal information in a lawful and fair way and in a manner that is not unreasonably intrusive.

We will only collect your personal information where you have consented, or otherwise in accordance with the law.

If you are a patient, we will generally collect personal information from you directly when you provide your details to us. This might be via a face-to-face discussion, telephone conversation, registration form (offline or online), when you communicate or interact with us via our website, appointment booking form, online chat, email, subscription form, social media channels or when you decide to include your personal details when responding to an online advertisement for our services.

We may occasionally need to collect personal information about you from a third party. This may include, but is not limited to, collection from the following third parties. We will only do this with your consent, or where this is otherwise permitted by the privacy laws:

• from a person responsible for you (for example if you are under 18 years old) or other persons you have authorised to provide your information to us;
• other health professionals involved in the provision of health services to you, the My Health Record system, Medicare, or your health insurer; and
• from our third party practice management and payment software providers: Coreplus (practice management software – see https://www.corepluspm.com/data-security) and Pin Payments (payment service provider – see https://pinpayments.com/terms#schedule-one-to-exhibit-two-privacy-policy) to the extent this is needed for us to process your appointment bookings and payments. Unless you expressly consent otherwise, we do not see or have access to any personal information that you may provide to these third parties. Further information on how these third parties maintain the privacy of the information they collect and hold is found on their websites (see the links above).

If you are person other than a patient, such as service providers, contractors and third parties we engage with, we will generally collect your personal information directly from you, and we may collect your personal information from third parties. For example, if you are a service provider we may collect information from your referees.

When we collect your personal information, we will as soon as is practicable take reasonable steps to notify you of the details of the collection (including notifying you through this Privacy Policy), such as the purposes for which the information was collected, the organisations (if any) to which the information will be disclosed, and also notify you that this Privacy Policy contains details on how you may access or correct your information, or raise any complaints. 

Why do we collect your personal information?

We collect personal information from you so that we can provide our services to you, or where this is otherwise necessary for our functions or activities.

If you are a patient we may collect your personal information:

• ​to provide health services to you, including telehealth services through secure online portals or over the telephone, and to communicate with you about those services;
• to inform you about the health services we provide using email (direct) marketing, where you have expressed an interest in our services and have consented to receive such information. Note you may opt out of direct marketing at any time – see ‘Unsubscribing From Direct Marketing’ below;
• to administer our website; to personalise our website for you and to enable your access to and use of the website services;
• to help us manage our accounts and administrative services, including billing, arrangements with health funds, pursuing unpaid accounts, management of our ICT systems; and
• for identification and insurance claiming.

If you are a person other than a patient, such as a service provider, contractor or other third party we engage with, we will collect your personal information to the extent necessary for our functions or activities, and to work, transact or engage with you. 

You are not required to disclose your personal information to us.  However, if you do not provide the information requested, you may not be able to receive our services or engage with us effectively.

How do we use your personal information?

How we use your personal information will depend on why you are dealing or engaging with us and in what capacity.

We will generally only use your personal information for the main purposes for which you have provided it to us.

If you are a patient, we generally use your personal information for the following main purposes:

• ​to provide health services to you, including telehealth services through secure online portals or over the telephone, and to communicate with you about those services;
• to administer our website; to personalise our website for you and to enable your access to and use of the website services;
• to help us manage our accounts and administrative services, including billing, arrangements with health funds, pursuing unpaid accounts, management of our ICT systems;
• for identification and insurance claiming;
• if you have a My Health Record, to upload your personal information to, and download your personal information from, the My Health Record system; and
• for research purposes, provided only de-identified information is used (information which does not identify you) subject to approval by an authorised ethics committee.

If you are a person other than a patient, such as service providers, contractors and third parties we engage with, we may use your personal information to manage our relationship with you.

We may also use your personal information where we are otherwise required or authorised by law to do so, which may include the following:

• where we use your information for purposes which are directly related to the main purpose for which we collected it, in circumstances where you would reasonably expect us to use your information for these purposes; or
• for funding, management, planning, monitoring improvement or evaluation of our services, or the training of staff, where we take all reasonable steps to de-identify that information; or
• where it is unreasonable or impracticable to obtain your consent and the use is necessary to lessen or prevent a serious threat to the life, health or safety of any individual, or to public health or safety.

With your consent, our health practitioners may use NovoNote, a third-party AI note-taking tool, to help prepare clinical notes during your consultation sessions.

NovoNote helps by transcribing the session and then provides our practitioners with a summary of that session.

No audio recordings are permanently stored by NovoNote. The audio of the session is immediately converted into a redacted text based transcript, and we retain the session summary as part of your patient file. NovoNote’s default settings are for transcripts to be deleted after use.

All notes generated by NovoNote are reviewed by your health practitioner before being added to your patient file.

You may decline or withdraw consent to the use of NovoNote at any time, without affecting your access to care.

NovoNote operates on secure servers located in Australia, and encrypts all data both in transit and at rest.

Further information about NovoNote, and how it complies with the APPs is found here: https://novopsych.com/novonote-security/

Do we disclose your personal information to others?

We will generally only disclose your personal information to other persons for the main purposes for which you have provided it to us, which if you are a patient will usually be for the purposes of you receiving health services from us.

If you are a patient, we may disclose your personal information:

• to any of our contracted health practitioners who deliver health services to you;
• to other health professionals involved in the provision of your healthcare (e.g., your GP) where you would reasonably expect such information to be disclosed and the disclosure of that information is for a purpose directly related to the primary purpose for which your personal information was collected;
• to comply with our legal obligations, including, but not limited to, circumstances where we are required to provide your information under law or a court order (e.g., a subpoena), or for mandatory reporting under applicable child protection legislation;
• to the My Health Record system, to upload your personal information to the My Health Record system;
• to your health fund, government and regulatory bodies such as Medicare, the Department of Veteran's Affairs and the Office of the Australian Information Commissioner (OAIC) (if you make a privacy complaint to the OAIC), as necessary.

Please tell us if you do not wish for your personal information to be disclosed to a particular health professional or organisation.

If you are a patient, with your consent we may disclose your personal information to NovoNote for the purposes related to the use of the NovoNote note-taking tool described above.

If you are a person other than a patient, such as service providers, contractors and third parties we engage with, we may disclose your personal information to manage our relationship with you.

We will otherwise only disclose your personal information to other persons:

• for purposes which are directly related to these main purposes for which the information was collected, in circumstances where you would reasonably expect us to disclose your information for these purposes;
• where we are otherwise required or authorised by law to do so, for example where it is unreasonable or impracticable to obtain your consent and we reasonably believe disclosure is necessary to lessen or prevent a serious threat to the life, health or safety of any individual, or to public health or safety; or
• for other purposes for which you have provided consent.

Your personal information will not be used, sold, rented or disclosed for purposes not described above.

Automated decision making and use of artificial intelligence (AI)

With your consent, our health practitioner staff may use the NovoNote note-taking tool described as described in this Privacy Policy above.

All notes generated by NovoNote are reviewed by your health practitioner before being added to your patient file.

We do not make decisions which could reasonably be expected to significantly affect the rights or interests of patients or other individuals solely by means of automated decision making or the use of AI, and all AI use is subject to human oversight and clinical judgement.

We will inform you through this Privacy Policy if in future we use any other computer programs or AI systems that use personal information to make automated decisions that could reasonably be expected to significantly affect the rights or interests of an individual. This will include information about the kinds of personal information used in, and types of decisions made by, such computer programs or AI systems that use personal information to make such decisions.

Will we transfer your personal information interstate or overseas?

We will comply with the requirements of the APPs and HPPs if it is necessary to disclose your personal information interstate or overseas.

It may be necessary to disclose your personal information to persons or organisations interstate or overseas to provide you with ongoing healthcare (for example, where we refer you to a health professional located interstate or overseas).

We will only disclose your personal information interstate or overseas if we would be lawfully permitted to disclose it to a recipient in Australia, and:

• we have taken reasonable steps to ensure that the interstate or overseas recipient of your personal information does not breach the APPs or HPPs; or
• the interstate or overseas recipient is subject to a law, binding scheme or binding contract that provides substantially similar protection to the APPs and HPPs which you can access and enforce; or
• the disclosure interstate or overseas is otherwise required or authorised by law.

How can you access and correct your personal information?

You have a right to seek access to, and correction of, the personal information which we hold about you.

In certain circumstances, we may refuse to allow you access to your personal information where this is authorised by the law, such as where providing access would have an unreasonable impact on the privacy of other individuals, providing access would pose a serious threat to the life or health of any person or to public health or safety, or giving access would be unlawful.

If you believe that the personal information we hold about you requires correction (for example, because the information is inaccurate, out-of-date, incomplete, irrelevant or misleading), you may request that the information be corrected using our contact details set out below.

If we refuse your request for access or correction, we will provide you with reasons for the refusal in writing, and details about how you may complain about the decision.

For details on how to request access to or correction of your personal information, please contact us as noted below under ‘Contact Details’.

We may recover the reasonable costs associated with supplying you with your personal information, which will not be excessive and will be subject to the prescribed fees under the Health Records Act 2001 (Vic). There will be no application fee to make an access request.

We will normally respond to your request within 30 days.

We may also require you to provide identification or validation, or require you to attend our office(s) in person to verify your identity or provide you with certain records. We may also (in our absolute discretion) decline to provide information over the phone, or via email, or post for information security purposes. You acknowledge and agree that the transmission of information over the internet (including email) is inherently insecure, and we cannot guarantee the security of data sent over the internet.

From time-to-time, we may ask you to verify that your personal information held by our practice is correct and up-to-date.

How do we hold your personal information?

Our staff are trained and required to respect and protect your privacy. We take reasonable steps to protect information held from misuse, interference and loss, and from unauthorised access, modification or disclosure. This includes the following technical and organisational measures:

• ​access to personal information being restricted on a ‘need to know’ basis;
• using strong password protections on all electronic systems and databases to protect electronic information from unauthorised interference, access, modification or disclosure;
• holding your information on an encrypted database/ secure cloud storage/ industry compliant software package/ Cloud-based business software called Microsoft Office 365 in a unique electronic medical record (eMR) created by the practice;
• storing your personal information on Cloud-based business software which complies with the International Standard for Cloud Privacy called ISO27018, and which encrypts data at rest;
• any paper-based documents containing your personal information being destroyed in confidential and secure waste bins once the information is uploaded into your electronic medical record;
• holding any hard copies of your personal information in a lockable cabinet;
• our practice having robust document retention and destruction policies; and
• our staff signing confidentiality agreements.

We securely hold your personal information for the time periods required by law. When your personal information is no longer required (and in the case of your health information, the information has been retained for the required periods under the HPPs or otherwise under law) we will take steps to securely destroy the information or to ensure that the information is permanently de-identified. The minimum required retention period for health information under the HPPs is usually 7 years from the date of last service for adults, or for health information collected from a child it must be retained until they are 25 years of age.

Anonymity and pseudonyms

The Privacy Act provides that individuals must have the option of not identifying themselves, or of using a pseudonym, when dealing with our practice, except in certain circumstances, such as where it is impracticable for us to deal with you if you have not identified yourself.

We have determined that it is generally impracticable for us to deal with patients anonymously or via a pseudonym. The provision of health services is likely to be impacted, and billing via Medicare or a health insurer where applicable is likely to be impracticable. Therefore, generally we require that you use your name and not a pseudonym.

Please contact us on the telephone if you are concerned about identifying yourself, for more information on our normal operating practices.

​Updates to this Privacy Policy

This Policy will be reviewed from time-to-time to take account of new laws and technology, changes to our operations and other necessary developments. Updates will be publicised on the practice's website.

Cookies and other website tracking

Our website uses "cookies" to help personalise your online experience.

A cookie is a text file or a packet of information that is placed on your hard disk by a web page server to identify and interact more effectively with your computer. There are two types of cookies that may be used at our website: a persistent cookie and a session cookie. A persistent cookie is entered by your web browser into the "Cookies" folder on your computer and remains in that folder after you close your browser, and may be used by your browser on subsequent visits to our website. A session cookie is held temporarily in your computer’s memory and disappears after you close your browser or shut down your computer. Cookies cannot be used to run programs.

Cookies are uniquely assigned to you, and can only be read by a web server in the domain that issued the cookie to you. In some cases, cookies may collect and store personal information about you. We extend the same privacy protection to your personal information, whether gathered via cookies or from other sources.

You can configure your internet browser to accept all cookies, reject all cookies or notify you when a cookie is sent. Please refer to your internet browser’s instructions to learn more about these functions. Most web browsers automatically accept cookies, but you can usually modify your browser settings to decline cookies if you prefer. If you choose to decline cookies, you may not be able to fully experience the interactive features of our website.

Why we use cookies

Our website uses cookies in order to:

• ​remember your preferences for using our website;
• manage the signup process when you create an account with us;
• recognise you as logged in while you remain so. This avoids your having to log in again every time you visit a new page;
• facilitate e-commerce transactions, to ensure that your order is remembered between pages during the checkout process;
• show relevant notifications to you (e.g., notifications that are relevant only to users who have, or have not, created an account or subscribed to newsletters or email or other subscription services;, and
• remember details of data that you choose to submit to us (e.g., through online contact forms).

Many of these cookies are removed or cleared when you log out but some may remain so that your preferences are remembered for future sessions.

Third party cookies

In some cases, third parties may place cookies through our website. For example:

• Google Analytics, one of the most widespread and trusted website analytics solutions, may use cookies de-identified data about how long users spend on our website and the pages that they visit;
• Google AdSense, one of the most widespread and trusted website advertising solutions, may use cookies to serve more relevant advertisements across the web and limit the number of times that a particular advertisement is shown to you;
• third party social media applications (e.g., Facebook, Twitter, LinkedIn, Instagram, etc) may use cookies in order to facilitate various social media buttons and/or plugins in our website.

Re-marketing

We may use the Google AdWords and/or Facebook re-marketing services to advertise on third party websites to previous visitors to this site based upon their activity on this site. This allows us to tailor our marketing to better suit your needs and to only display advertisements that are relevant to you. Such advertising may be displayed on a Google search results page or a website in the Google Display Network or inside Facebook. Google and Facebook may use cookies and/or pixel tags to achieve this. Any data so collected by Google and/or Facebook will be used in accordance with their own respective privacy policies. None of your personal Google and/or Facebook information is reported to us.

You can set preferences for how Google advertises to you using the Google Ads Settings page (https://www.google.com/settings/ads). Facebook has enabled an AdChoices link that enables you to opt out of targeted advertising.

Privacy-related questions and complaints

If you have any questions about privacy-related issues or wish to complain about a breach your privacy, you may lodge your complaint in writing to (see ‘Contact details’ below for details). We will normally respond to your request within 30 days.

If you are dissatisfied with our response, or if you do not wish to raise a question or complaint with us directly, you may wish to contact:

• the Office of the Australian Information Commissioner (OAIC). See www.oaic.gov.au; or
• the Victorian Health Complaints Commissioner (HCC). See hcc.vic.gov.au.

Contact details for privacy-related issues

If you would like to contact us regarding any privacy matters, including where you would like to request access to or correction of your personal information, or you have a complaint or feedback, you may contact us in writing by:

Emailing us on info@elementapsychology.com.au

Writing to us via post at Elementa Psychology Pty Ltd, 5/91 Darebin Street, HEIDELBERG. VIC. 3084

3470-2198-6376, v. 1

1. You acknowledge and agree that:

(a) you must only access the telehealth services we provide (Services) while you are located in Australia;

(b) you must provide true and correct responses to any questions we provide you, and during any consultations we have with you, in connection with the Services;

(c) you must provide true and correct information to our Clinical Psychologists during the course of the Services. If you provide false or misleading responses to us in connection with the Services, this may affect your assessment and treatment outcomes and/or may result in injury and loss to you;

(d) if you have been referred for the Services by a medical practitioner or other health practitioner, you are responsible for attending any follow up appointments with this practitioner and following their advice as they have directed;

(e) there are limitations to health services delivered via telehealth, for example, where it may be necessary for the patient and practitioner to be in each other’s physical presence for provision of health service. If, because of the limits of technology, you are advised to seek alternative consultation arrangements (e.g., an in person face-to-face consultation), you are responsible for arranging and attending such consultation;

(f) our Clinical Psychologists may refer you to another health practitioner or other third party service, or an in person face-to-face consultation with them, where in their clinical judgment such referral is appropriate for the continuation of your care;

(g) our Clinical Psychologists can only provide Services within their scope of practice and functionality of the telehealth platform we use (Healthdirect);

(h) the Services are not an emergency service.  If you require urgent medical attention, you must call 000 or immediately attend the emergency department or urgent care facility of your nearest hospital; and

(i) while the Services will be provided with all due care and skill and in accordance with applicable professional standards, we do not warrant or guarantee that the Services will provide you with an improvement or desired outcome in respect of any issue or condition for which you have sought the Services.

2. You must not make any part of the telehealth platform we use available as part of another application or website or system in any manner without our express written consent.
3. You must not use any device, application, software, item or equipment, or take any action, which does or may affect the operation of the telehealth platform we use.
4. You must be at least 18 years of age to access the Services independently.
5. Services for persons under the age of 18 (children or child) must be attended by a parent, guardian, or other authorised representative, unless otherwise permitted or required by law (including any informed consent requirements).
6. Your Clinical Psychologist will provide you with further details on Services proposed to be provided to you including:

(a) the nature of the Services and why they are recommended; and

(b) the expected benefits and risks of the Services proposed and any alternatives (and any consequences of not proceeding).

7. You can raise any questions you have about the Services, and your Clinical Psychologist will discuss this with you.
8. If you attend a telehealth appointment with a child in the capacity of their parent, guardian, or other authorised representative, we may take reasonable steps to verify your age, and if applicable that you are a child’s parent, guardian, or other authorised representative. This may include us requesting copies or to sight information or documents such as government-issued identification, or a written or electronic declaration or documentation confirming your relationship to the child. Any information we collect for such age or relationship to child verification purposes will be used only to confirm identity, age or authority, will be handled in accordance with our Privacy Policy.
9. By agreeing to these Telehealth Terms of Service and Consent Statement below, you acknowledge and agree to the following:

(a) you agree to all the terms above;

(b) you understand the potential risks and limitations related to telehealth, as detailed in the terms above; and

(c) you will be provided with opportunity to discuss and ask questions regarding your proposed Services with your Clinical Psychologist.