Privacy, Confidentiality & Digital Technology Policy

Phuong Tran Psychotherapy & Counselling

Counselling · Psychotherapy · EMDR Therapy · Clinical Supervision · Spiritual Care

Version: 4.0 — Draft for final review
Effective date: To be confirmed upon approval
Website: https://phuongtran.com.au

1. Our Commitment to Privacy, Dignity and Confidentiality

At Phuong Tran Psychotherapy & Counselling, privacy and confidentiality are fundamental to the professional relationship.

We recognise that people seeking counselling, psychotherapy, EMDR therapy, clinical supervision or spiritual care may share highly personal information, including experiences of trauma, illness, grief, loss, relationships, family circumstances, cultural identity, religious or spiritual beliefs, and matters they may not have discussed elsewhere.

We respect the trust involved in sharing this information.

Our commitment is to handle personal and health information carefully, lawfully, ethically and transparently, with respect for each person’s dignity, autonomy, cultural background and individual circumstances.

This policy explains what information we collect, why it is needed, how it is managed, who may receive it, and the rights and choices available to you.

It also describes our use of digital practice management systems, screening and assessment tools, artificial intelligence (AI), AI-assisted clinical documentation, transcription, audio and video recording, smart glasses and other intelligent technologies.

We believe that privacy should be reflected in everyday practice, not simply in a written policy.

2. About the Practice and Scope of This Policy

Phuong Tran Psychotherapy & Counselling provides professional services in Australia, including:

• Counselling and psychotherapy.

• Eye Movement Desensitisation and Reprocessing (EMDR) therapy.

• Individual and group clinical supervision.

• Spiritual and pastoral care.

• Relevant professional training and education.

Services may be delivered in person, by telephone or via telehealth, in English, Vietnamese or a combination of both languages.

This policy applies to information handled in connection with our Australian practice, including information relating to clients, prospective clients, supervisees, trainees, referrers, professional contacts and website visitors.

It covers enquiries, registration, assessment, appointment booking, professional services, payments, documentation, digital communication and related administration.

Where services are provided in another jurisdiction, additional local legal obligations may apply.

This policy is intended to operate alongside our service agreements, professional consent arrangements and other applicable policies.

3. Applicable Laws and Professional Responsibilities

We aim to handle personal and health information in accordance with applicable Australian laws and relevant professional obligations, including:

• The Privacy Act 1988 (Cth) and Australian Privacy Principles (APPs).

• The Health Records Act 2001 (Vic) and Health Privacy Principles (HPPs).

• Applicable Victorian laws concerning private conversations, recording and surveillance devices.

• Relevant child protection, mandatory reporting and other legal obligations.

• The Australian Counselling Association (ACA) Code of Ethics and Practice.

• The Psychotherapy and Counselling Federation of Australia (PACFA) Code of Ethics and Professional Conduct and relevant guidance.

• Applicable Spiritual Care Australia (SCA) professional standards and ethical expectations.

We also consider relevant guidance from the Office of the Australian Information Commissioner (OAIC), the Victorian Health Complaints Commissioner and other appropriate authorities.

Guidance published by the Australian Health Practitioner Regulation Agency (Ahpra) regarding artificial intelligence and healthcare may inform our approach to safe digital practice. Reference to this guidance does not imply that the practitioner is registered with Ahpra or the Psychology Board of Australia.

Our services are provided within the practitioner’s qualifications, professional credentials and scope of practice.

4. What Information We Collect

Depending on the service you request or receive, we may collect the following information.

Personal and contact information

• Name, preferred name and date of birth.

• Contact details and residential address.

• Preferred language and communication method.

• Emergency contact details, where relevant.

• Information needed to confirm identity where reasonably necessary.

Health and wellbeing information

• Relevant physical and mental health history.

• Presenting concerns, symptoms and experiences.

• Trauma, grief, bereavement or other significant experiences, where relevant.

• Medication, treatment or referral information when appropriate.

• Safety and risk-related information where necessary.

• Goals, progress and matters relevant to professional care.

Personal, cultural and spiritual information

• Family and relationship circumstances.

• Cultural and linguistic background.

• Religious or spiritual beliefs, where voluntarily shared and relevant.

• Personal values, identity, life transitions and support networks.

• Other sensitive information relevant to the services provided.

Professional and administrative information

• Enquiries, intake and registration forms.

• Consent forms and consent decisions.

• Appointments and attendance records.

• Screening and assessment responses and results.

• Professional notes, reports and relevant correspondence.

• Supervision or training information, where applicable.

• Billing, invoices, payment status and transaction references.

Digital information

• Information submitted through website and booking forms.

• Relevant website and device usage information.

• Data processed through authorised practice systems.

• Audio, transcripts or AI-assisted documentation where a specific and lawful process has been appropriately authorised.

We aim to collect only information reasonably necessary for a legitimate service, professional, administrative or legal purpose.

5. How We Collect Information

Information may be collected directly from you through enquiries, registration, booking, intake forms, assessments, appointments, telephone conversations and electronic communication.

Information may also be received from referrers, healthcare practitioners, family members or other sources where appropriately authorised or otherwise permitted by law.

We generally seek to collect information directly from the person concerned where reasonable and practicable.

If relevant information is obtained from a third party, we will handle it according to applicable privacy requirements and provide any required notification.

You may ask why particular information is requested.

Where appropriate, we will explain whether supplying the information is optional or necessary for safe and suitable service provision.

If essential information is not provided, our ability to offer a particular service may be affected.

6. Anonymity and Pseudonymity

You may make a general enquiry without sharing detailed personal or health information.

Where lawful and practicable, we will consider requests to communicate anonymously or using a pseudonym.

However, appropriate identification may be required for professional services, clinical safety, record-keeping, legal requirements, payment or continuity of care.

If anonymity is not practicable, we will explain the relevant reason.

7. Why We Use Personal Information

We use personal information only for lawful and appropriate purposes, which may include:

• Responding to enquiries.

• Assessing suitability for a requested service.

• Registering clients and arranging appointments.

• Providing professional services.

• Conducting appropriate screening and assessments.

• Preparing and maintaining relevant records.

• Communicating about appointments, care and referrals.

• Coordinating care with other professionals where authorised or permitted.

• Managing payment, invoicing and refunds.

• Meeting applicable legal, regulatory, ethical and professional obligations.

• Responding to significant safety concerns.

• Protecting our practice systems and information.

• Managing appropriate professional administration and service quality.

We do not use confidential therapeutic information for unrelated advertising or marketing without an appropriate legal basis.

8. Confidentiality and Its Limits

Information shared during counselling, psychotherapy, EMDR therapy, supervision and spiritual care is treated as confidential.

We do not ordinarily disclose identifiable client information to family members, employers, colleagues, insurers, other practitioners or third parties without consent or another appropriate legal basis.

However, professional confidentiality is subject to legal and ethical limits.

Information may need to be disclosed where required or permitted by law, including in circumstances involving:

• A serious threat to life, health or safety where the legal conditions for disclosure are satisfied.

• Child protection or mandatory reporting obligations.

• A valid court order, subpoena or other lawful requirement.

• A legal or regulatory obligation.

• Another disclosure authorised or permitted under applicable privacy or health records legislation.

Where lawful and reasonably practicable, we will discuss a proposed disclosure with you.

We aim to disclose only the information reasonably necessary for the relevant purpose.

A request for records from another person or organisation does not, by itself, authorise disclosure.

9. Professional Records and Session Notes

We maintain appropriate professional records to support continuity, accountability, safety and quality of services.

Records may include presenting concerns, relevant history, assessments, consent decisions, professional observations, agreed goals, interventions, progress, referrals, risk considerations and significant communications.

Session notes are professional summaries. They are not necessarily a word-for-word transcript of everything discussed.

Depending on the context, notes may be handwritten, typed, dictated or prepared using an appropriately assessed digital documentation system.

The practitioner remains responsible for deciding what information is relevant and appropriate to include in the final record.

Professional records should be accurate, respectful, relevant and proportionate to the purpose for which they are maintained.

Routine professional note-taking is different from making or retaining an audio or video recording.

10. Digital Platforms Used by Our Practice

We use selected external technology providers to support website operation, administration, bookings, assessment, documentation and payments.

Different systems handle different information. Not every platform receives confidential session content, and not every feature is activated during an appointment.

GoDaddy — Website Hosting

GoDaddy provides website hosting and related infrastructure for phuongtran.com.au.

Website visits, submitted forms and associated technical information may be processed through the hosting environment and connected website services.

The location of hosting, backups, support access and processing depends on the applicable service configuration.

We do not assume that all website information is stored or accessed exclusively within Australia.

Zanda Health — Practice Management, Registration and Booking

Zanda Health is used for practice management, registration, appointments, booking-related communication, administration and professional records, including session notes.

Depending on enabled features, it may process contact details, intake and consent forms, booking information, invoices, relevant professional documentation and communications.

Access is intended to be limited to persons and providers authorised for legitimate practice purposes.

Any AI-assisted functionality that processes identifiable session information is subject to the relevant privacy and consent requirements.

NovoPsych — Screening and Assessment

NovoPsych is used for relevant screening questionnaires, assessment measures and associated results or reports.

Assessment information may contain sensitive health information.

Results support professional consideration and interpretation; they do not, by themselves, replace a comprehensive professional assessment.

The meaning, suitability and limitations of results must be considered within the practitioner’s training and scope of practice.

NovoNote / NovoPsych Notes — AI-Assisted Documentation

NovoNote, associated with NovoPsych, may be used to assist with dictation, transcription and preparation of professional documentation.

The information processed depends on the feature and settings used, including whether live speech, a recording, text or practitioner dictation is provided.

Where identifiable session speech or other sensitive content is proposed for processing, appropriate information and informed consent must be provided before use.

Heidi Health — AI-Assisted Documentation

Heidi Health may be used to assist with transcription, practitioner dictation, draft notes and related documentation tasks.

Different functions may involve temporary processing of audio, transcription or retention of draft materials.

The relevant function, data handling and available choices must be explained before identifiable session content is processed.

ChatGPT — Website and Educational Writing

ChatGPT is used to assist with drafting, editing and refining general website content, public educational information and other non-confidential writing.

It is not treated as the practice’s confidential clinical record system or as an independent provider of therapy, supervision or diagnosis.

Identifiable client health information and confidential session materials are not authorised for routine entry into general-purpose AI writing tools for website editing.

Any proposed use of identifiable information for a different AI purpose would require separate consideration of necessity, lawfulness, privacy safeguards and informed consent where required.

Stripe — Payment Processing

Stripe is used for applicable online card payments.

Payment information is processed under the relevant payment arrangements and provider terms.

We aim to avoid including unnecessary sensitive clinical details in payment descriptions or transaction records.

Bank transfer may also be available as an agreed payment method.

Other Technology Providers

Other providers may support email, website security, backups, telecommunications, telehealth or related administration.

We aim to limit information provided to external services to what is reasonably necessary for the relevant purpose.

We review material privacy implications when introducing or changing technologies that may process sensitive information.

11. Artificial Intelligence, Intelligent Digital Systems and Emerging Technologies

Our Approach

Artificial intelligence can assist with language processing, speech recognition, transcription, organisation of information and draft documentation.

These technologies may be useful, but they also present risks involving privacy, confidentiality, accuracy, bias, security and professional accountability.

AI must not replace professional judgement, client autonomy or the therapeutic relationship.

We take a cautious approach to the use of AI involving identifiable or sensitive information.

AI and Superintelligence

Some discussions of future technology use the term superintelligence or artificial superintelligence to describe hypothetical systems with capabilities far beyond current general AI applications.

We do not represent the tools currently used by our practice as superintelligent systems.

Any future technology that materially changes how sensitive information is collected, processed or used would require an appropriate privacy, ethical and professional assessment and additional disclosure or consent where necessary.

Privacy and AI Data Processing

Before using an AI system to process identifiable confidential information, we consider relevant matters such as:

• The necessity and suitability of the system.

• Its intended and reasonably foreseeable purposes.

• The information collected and generated.

• Provider and subcontractor access.

• Security and available access controls.

• Audio, transcript and note retention.

• Data deletion and backup arrangements.

• Processing or access outside Australia.

• Model training, product improvement or other secondary uses.

• Risks of inaccuracies, bias or unintended disclosure.

• Available alternatives.

We do not assume that information is automatically deleted when an AI session ends or that every provider uses identical storage arrangements.

Accuracy and Practitioner Responsibility

AI-generated transcripts, summaries and notes may contain errors, omissions or information that was not stated.

This is particularly relevant where people use more than one language, have different accents or use culturally specific expressions.

The practitioner remains responsible for checking and correcting draft documentation before it becomes part of the professional record.

AI output is not accepted as automatically accurate and does not independently determine professional decisions about care.

12. Recording, Transcription and AI-Assisted Documentation

No Automatic Session Recording

Private professional sessions are not routinely audio-recorded or video-recorded.

The fact that an appointment occurs in person, by telephone or through telehealth does not mean that it is automatically recorded.

We do not activate optional AI listening, audio recording, video recording or automated session transcription without appropriate prior explanation and informed consent.

Different Activities Require Appropriate Consent

The following activities are distinct:

• Conventional handwritten or typed professional notes.

• AI assistance with practitioner-prepared notes.

• Transcription of practitioner dictation.

• AI listening to live session conversation.

• Temporary processing of live audio.

• Creation and retention of audio recordings.

• Creation and retention of transcripts.

• Video recording or image capture.

• Use of recordings or identifiable information for training, research or publication.

Consent for one activity does not automatically authorise another.

What We Explain Before Use

Before proposing identifiable live AI listening, recording or transcription, we explain the relevant technology and purpose, including:

• Which system is proposed.

• Whether microphones or cameras will be used.

• What personal or health information may be processed.

• Whether audio or video will be saved.

• Whether transcripts will be created or retained.

• Who may access or process the information.

• Relevant storage, security and deletion arrangements.

• Any relevant international processing.

• Material limitations and privacy risks.

• Available alternatives and the right to decline.

Appropriate specific informed consent is obtained before the proposed function is activated.

Temporary Audio Processing

Some technologies process audio temporarily to prepare documentation without keeping a permanent replayable recording.

Other technologies may store uploaded recordings, transcripts, generated summaries or draft notes.

These are different processing activities.

Temporary audio processing can still involve sensitive personal information and must be assessed accordingly.

Audio and Video Recording

Retained audio or video recordings require specific consideration of purpose, necessity, lawful use, confidentiality, security and consent.

Consent to a live transcription process does not automatically authorise keeping a permanent audio file.

Consent to audio processing does not automatically authorise video recording.

Use for Other Purposes

Routine documentation consent does not authorise identifiable materials to be used for unrelated training, public presentations, research, publication, advertising or AI model training.

Separate lawful authority and any necessary consent would be required.

13. Our Pre-Appointment Recording and AI Consent Process

Before an initial appointment, clients are sent relevant registration and booking documents by email through Zanda Health, including the Recording, Transcription & AI-Assisted Clinical Documentation Consent Form.

This allows clients to read information about the proposed technologies, consider the available choices and ask questions before attending.

The form addresses, as applicable:

• AI-assisted note preparation.

• Live AI listening and speech processing.

• Audio recording.

• Transcription and retention of transcripts.

• Video recording.

• Relevant privacy risks and alternatives.

• The right to decline optional technology.

Receiving the form, opening an email or accepting the general Privacy Policy does not itself constitute consent to recording or AI processing.

Before using an optional live AI listening, recording or transcription function, the practitioner checks that the relevant consent has been obtained and that the proposed use falls within the scope of that consent.

Where necessary, consent may be clarified verbally and documented in the professional record.

A client’s choice not to use optional AI technology is respected.

Where services can reasonably be delivered using conventional documentation, declining optional AI processing will not, by itself, prevent access to those services.

The consent process may be revisited if circumstances, technology or data-handling arrangements materially change.

14. Withdrawing Consent or Requesting an Alternative

You may ask questions about optional recording or AI-assisted processing before or during an appointment.

You may ask that an optional AI listening, recording or transcription process be paused or stopped.

You may also withdraw consent for future optional processing by informing your practitioner.

We will explain any practical implications and available alternatives.

Withdrawal of consent does not necessarily require the deletion of information already lawfully processed or incorporated into professional records that must be retained.

If you prefer that no optional AI listening or transcription be used, ordinary professional documentation may still be maintained as appropriate.

Consent will be considered in the context of the specific technology and purpose rather than treated as blanket permission for all future AI applications.

15. Smart Glasses, AI Glasses, Wearable Cameras and Connected Devices

Smart glasses, AI-enabled glasses, wearable cameras, smartphones, smart watches and other connected devices may include microphones, cameras, automated transcription, livestreaming or AI assistants.

Some functions may operate without obvious signs of recording.

These devices can create particular privacy risks during confidential professional appointments.

To protect everyone involved:

• The practitioner will not secretly record, photograph, livestream or transcribe private sessions using smart or wearable devices.

• Proposed professional use of recording or AI-listening functions must be explained in advance and appropriately authorised.

• Clients, supervisees, visitors, accompanying persons and other participants are asked not to activate recording, livestreaming or AI-transcription functions without prior agreement.

• Where a device creates a reasonable privacy concern, we may request that its recording or listening functions be disabled or that the device be put away.

• Where several people are involved, the rights, privacy and consent requirements of all affected participants must be considered.

These expectations apply to both in-person and telehealth appointments.

Use of recording or surveillance technology must comply with applicable law.

Our practice expectations are not intended to suggest that every recording made without prior permission is necessarily unlawful in all circumstances.

16. Telehealth and Electronic Communication

Services may be provided via telephone or telehealth where appropriate.

We take reasonable steps to use suitable technologies and maintain professional confidentiality.

However, no electronic communication system can be guaranteed entirely risk-free.

For telehealth appointments, clients are encouraged to:

• Attend from a private and suitable location.

• Use a reasonably secure internet connection.

• Protect their device with appropriate access controls.

• Inform the practitioner if another person is present.

• Avoid public or shared locations where the conversation may be overheard.

• Avoid enabling recording or AI transcription without prior agreement.

Telehealth sessions are not automatically recorded.

Email and SMS may be used for enquiries, registration, consent forms, appointment reminders and relevant administration.

Ordinary email or SMS may not offer the same protections as a dedicated secure clinical communication platform.

Please avoid sending extensive or highly sensitive personal information through ordinary email unless an appropriate arrangement has been discussed.

We cannot guarantee that ordinary electronic communications will be delivered or read immediately.

17. Clinical Supervision, Consultation and Training

Clinical supervision and professional consultation may involve discussion of complex professional situations and sensitive information.

We expect information shared in these contexts to be handled responsibly and with respect for confidentiality.

Where client cases are discussed for supervision or professional consultation, identifying details should be removed or minimised wherever practicable.

Where identifiable information is necessary, the legal basis and relevant consent arrangements must be considered.

Supervisees and trainees are responsible for observing applicable professional, legal and organisational confidentiality obligations.

For group supervision, participants are expected to respect the privacy of others and not disclose confidential case material outside the agreed professional context.

However, absolute confidentiality by independent group participants cannot be guaranteed.

Recording, transcription or AI listening during supervision requires appropriate prior discussion, consideration of all affected individuals and any necessary consent.

Identifiable materials must not be used for teaching, research or publication without the appropriate authority.

18. Spiritual Care, Beliefs and Cultural Information

Spiritual care may involve deeply personal matters, including religious beliefs, spirituality, cultural practices, grief, serious illness, end-of-life concerns, values, identity and meaning.

We respect each person’s right to hold religious or spiritual beliefs, different beliefs or no religious beliefs.

Such information is not disclosed merely because it was discussed during spiritual care.

Sensitive cultural, religious and spiritual information is collected and handled only for an appropriate purpose and in accordance with applicable privacy obligations.

We aim to provide a culturally respectful environment in which people may express themselves in English, Vietnamese or a combination of both languages.

19. Children, Young People, Families and Other Participants

Privacy and informed consent arrangements may require additional consideration when services involve children, young people, couples, families, interpreters, support persons or people needing assistance with decision-making.

The relevant requirements depend on the person’s capacity, legal authority, the nature of the service and applicable law.

A parent, guardian, partner or family member does not automatically have unrestricted access to every confidential statement or record concerning another person.

Where an appointment includes multiple participants, any proposed recording or AI-assisted processing must account for everyone whose information may be captured.

If necessary consent or another appropriate legal basis is unavailable, optional recording or AI processing will not proceed.

20. Sharing Information with Other Professionals and Organisations

We may share relevant information with another professional or organisation where there is an appropriate legal basis.

This may include:

• Authorised healthcare or professional service providers.

• Referrers involved in appropriate care.

• Professional consultants or advisers acting within legitimate confidential roles.

• Relevant insurers or funding bodies where lawfully authorised.

• Regulatory authorities or courts where disclosure is required or permitted.

• Digital service providers processing information for an authorised practice function.

Where appropriate, consent may be documented through a separate release-of-information or information-exchange form.

We do not assume that a request from another organisation entitles it to receive confidential information.

Information sharing is limited to what is reasonably necessary for the relevant purpose.

21. Overseas Processing and Disclosure

Some digital providers operate across several countries and may use international infrastructure, technical support teams or subcontractors.

The location of a provider’s head office does not necessarily identify every location where information is stored, processed or accessed.

Likewise, choosing an Australian data region does not necessarily exclude all authorised overseas access or support.

We take reasonable steps to understand the data-handling arrangements of providers processing sensitive information.

Where personal information is likely to be disclosed to overseas recipients, we will comply with relevant notice, protection and disclosure requirements, including identifying relevant recipient countries where reasonably practicable.

Details of a particular AI or documentation provider may also be explained through the applicable pre-appointment consent process.

We do not guarantee that every item of information processed by the website or third-party services remains exclusively in Australia.

22. Website Privacy, Cookies, Analytics and External Links

Our website is https://phuongtran.com.au and uses GoDaddy hosting services.

Website and associated systems may process technical information such as:

• IP address and connection information.

• Browser and device characteristics.

• Website pages accessed and relevant timestamps.

• Information submitted through online forms.

• Cookies and similar technical identifiers.

Depending on enabled website features, cookies may support functionality, security, performance measurement or analytics.

Third-party content, embedded services and external links may involve additional processing under the relevant provider’s privacy arrangements.

We aim to describe tracking and analytics technologies accurately according to the tools actually enabled.

We do not assume that all website usage information is anonymous, as technical identifiers may constitute personal information in some circumstances.

Sensitive information submitted in relation to healthcare services must not be used for unrelated advertising profiling without an appropriate lawful basis.

You may be able to manage certain cookies through your browser or available website settings.

We are not responsible for the privacy practices of external websites and encourage you to review their policies before providing personal information.

23. Website Enquiries, Booking Forms and Communications

When you submit an enquiry or booking request, we may receive your name, contact information and other details you choose to provide.

Please avoid including extensive health history or highly sensitive details in a general website contact form unless necessary.

Registration and booking forms may contain additional information needed for the requested professional service.

Where forms are handled by an external platform, that platform may process the submitted information in accordance with its relevant service arrangements.

An initial enquiry does not automatically create an ongoing therapeutic relationship.

Communications may be retained where reasonably necessary for administration, safety, legal compliance or professional record-keeping.

24. Payment and Financial Information

We collect relevant financial and administrative information to manage fees, invoices, receipts, payments, refunds and accounting obligations.

Depending on the arrangements offered, payments may be processed through Stripe or by bank transfer.

We seek to minimise sensitive health information included in payment records.

Financial information is handled for lawful payment, administration and compliance purposes.

Payment processing providers may handle information under their own applicable privacy and security arrangements.

25. Information Security

We take reasonable steps to protect personal and health information against misuse, interference, loss, unauthorised access, modification and disclosure.

Safeguards may include, where available and appropriately configured:

• Password-protected devices and accounts.

• Multi-factor authentication.

• Access permissions appropriate to professional roles.

• Secure practice management systems.

• Software updates and device protection.

• Security and backup arrangements.

• Careful use of email and electronic communication.

• Review of technology providers and integrations.

• Data minimisation and limiting unnecessary access.

• Appropriate disposal of records and devices.

We also consider the risks associated with portable devices, cloud services, AI-assisted tools, wearable technology and remote access.

Although reasonable steps are taken to protect information, no physical or electronic system can be guaranteed completely secure.

26. Data Breaches and Privacy Incidents

If a suspected privacy or security incident occurs, we will assess the nature of the incident, the information affected, the potential consequences and any steps needed to contain or reduce harm.

We will investigate and respond as appropriate.

Where required by applicable law, we will notify affected individuals and relevant authorities, including under the Australian Notifiable Data Breaches scheme where applicable.

We will also consider corrective steps to reduce the likelihood of similar incidents.

27. Record Retention, Destruction and De-identification

Professional health records are retained in accordance with applicable law and relevant professional obligations.

For private health service providers in Victoria, health information generally must be retained for at least seven years after the last health service, or until the individual reaches 25 years of age where the last health service was provided while the individual was under 18, subject to applicable legal qualifications and any longer retention requirements.

Different records may require different treatment, including:

• Professional session notes.

• Intake and consent forms.

• Assessment responses and reports.

• Relevant correspondence.

• Financial records.

• Temporary audio and AI-generated draft materials.

• Transcripts and final professional records.

An audio recording, a transcript and a final clinical note are not necessarily subject to identical technical storage or deletion arrangements.

Temporary processing data should be distinguished from information that has become part of a professional record.

Records are not automatically deleted when therapy or supervision ends.

Where information is no longer required and no legal or professional reason for retention remains, we take reasonable steps to securely destroy or de-identify it.

A request for immediate deletion may not be able to be fulfilled where statutory or other lawful retention obligations apply.

28. Access to Personal Information and Health Records

You may request access to personal information and health records held about you, subject to applicable legal requirements and exceptions.

Requests can be made through the contact details at the end of this policy.

We may ask for appropriate proof of identity and clarification of the requested records.

Information will be provided through an appropriate process and within applicable legal requirements.

Access may be limited, refused or provided in an alternative way where the law permits or requires this.

Where access cannot be granted as requested, we will explain the relevant decision and available review or complaint options as required.

Any applicable access or transfer charges must comply with relevant legislation and prescribed limits.

29. Correction and Accuracy of Records

We take reasonable steps to maintain information that is accurate, complete, up to date and relevant to its purpose.

You may request correction of information you believe is inaccurate, incomplete, out of date, irrelevant or misleading.

We will consider correction requests according to the applicable law.

Where it is not appropriate or lawful to overwrite the original professional record, the correction may be documented through an amendment, addendum or associated statement.

We will explain applicable options if a requested correction is not accepted.

30. Automated Decision-Making

Digital systems may support the organisation of information, appointment administration, screening, assessment or professional documentation.

We distinguish automated calculations or routine administration from the use of computer programs to make, or perform functions substantially and directly related to making, decisions that could significantly affect an individual’s rights or interests.

Professional judgement remains essential to the services we provide.

We will assess whether any enabled software features meet the relevant legal criteria for automated-decision disclosures.

From 10 December 2026, where the conditions in Australian Privacy Principle 1.7 apply, this policy must disclose the relevant kinds of personal information used and the kinds of significant decisions made or substantially supported by the computer programs concerned.

If such processing is introduced or identified, appropriate specific information will be provided in this policy in accordance with applicable law.

We do not treat the presence of automated questionnaire scoring or draft AI notes, by itself, as proof that every such function meets the legal threshold.

31. Your Choices and Informed Consent

We aim to support informed, voluntary and ongoing decisions about professional services and optional technologies.

You may ask:

• Why particular information is collected.

• What professional records are maintained.

• Which technology is proposed for an appointment.

• Whether AI listening or transcription will occur.

• Whether an audio or video recording will be retained.

• How transcripts and AI-generated notes are managed.

• Whether information is processed outside Australia.

• What alternatives may be available.

• How to withdraw consent for future optional processing.

• How to request access to or correction of information.

• How to make a privacy complaint.

Where appropriate, information may be explained in English or Vietnamese.

We aim to respect your choices while maintaining the professional documentation and legal obligations necessary for safe and responsible practice.

32. Complaints and Privacy Concerns

If you have a concern about how your information has been collected, used, disclosed, stored or protected, please contact the practice.

We welcome the opportunity to understand and respond to concerns respectfully.

We may request additional details to investigate the issue.

We aim to acknowledge privacy complaints and provide a substantive response within a reasonable period, ordinarily within 30 days.

Where a complaint remains unresolved, you may be able to contact an external authority depending on the issue.

Office of the Australian Information Commissioner (OAIC)
https://www.oaic.gov.au

Health Complaints Commissioner (Victoria)
https://hcc.vic.gov.au

Other professional complaint or regulatory pathways may be available depending on the circumstances.

33. Changes to This Policy

This policy may be reviewed and updated in response to changes in:

• Privacy and health records legislation.

• Professional ethical standards.

• Clinical or professional service arrangements.

• Technology providers and features.

• Artificial intelligence, recording and transcription practices.

• Data security, retention or regulatory requirements.

Where a material change requires further notice or consent, appropriate steps will be taken.

The current approved version will be available through our website.

34. Contact for Privacy Enquiries

For questions about privacy, confidentiality, professional records, consent, AI-assisted documentation, audio or video recording, smart devices, access, corrections or complaints, please contact:

Phuong (Teresa) Tran
Phuong Tran Psychotherapy & Counselling

232 Main Road East
St Albans VIC 3021
Australia

Phone: 0449 521 397
Email: contact@phuongtran.com.au
Website: https://phuongtran.com.au

35. Related Policies and Documents

This policy should be read alongside relevant documents, including:

• Professional Service Agreement and Informed Consent.

• Registration and Booking Forms.

• Recording, Transcription & AI-Assisted Clinical Documentation Consent Form.

• Clinical Supervision Agreements, where applicable.

• Social Media Policy.

• Fees, Payments, Cancellation and Refund Policy.

Important: Accepting this Privacy Policy or registering for an appointment does not, by itself, authorise optional AI listening, audio recording, video recording or session transcription.

Such activities are subject to the relevant information, agreement and consent procedures described above.

Phuong Tran Psychotherapy & Counselling — Privacy, Confidentiality & Digital Technology Policy.

Version 4.0 — Draft pending final operational and legal review.