Privacy Policy

1. Introduction

Harper Mind is committed to protecting the privacy of the people we work with. As a health service provider, we are bound by the Privacy Act 1988 (Cth), including the 13 Australian Privacy Principles (APPs), and by Victoria's Health Records Act 2001, regardless of our size or annual turnover.

This policy explains what personal and health information we collect, why, how we use and disclose it, how we keep it secure, and how you can access, correct, or raise concerns about your information. It applies regardless of which specific software or platforms Harper Mind uses to deliver services at any given time.

This policy applies to every client, regardless of how their care is funded — including Medicare, DVA, NDIS, or private billing. Your funding pathway may mean certain information is shared with the relevant funding body as described in Section 5, but the underlying privacy protections in this policy apply equally to all clients.

2. What Information We Collect

Personal information

Name, date of birth, contact details, emergency contact and next of kin details, your GP's details where provided, Medicare/DVA/NDIS numbers where relevant, payment and billing details.

Health information

Information about your mental and physical health, diagnoses, and treatment history; clinical notes, risk assessments, safety plans, and treatment plans; results from psychometric measures and standardised assessments; information shared by you during sessions where clinically relevant; correspondence with other treating practitioners.

Telehealth-specific information

The physical address you confirm at the start of each session (a mandatory safety step so emergency services can be sent to you if needed); technical information necessary to conduct a telehealth session, not retained beyond what is needed to deliver the session.

Sessions are not recorded by Harper Mind unless you have given specific, separate written consent for a particular purpose, and any such consent can be withdrawn at any time.

Website information

If you visit the Harper Mind website, we (or our analytics provider) may collect your IP address, browser type, pages visited, and visit duration via cookies or similar technologies. This is not linked to your clinical record unless you separately identify yourself (e.g. submitting a contact or intake form). You can block cookies through your browser settings.

3. How We Collect Information

Directly from you; from a referring practitioner with your consent or as permitted by law; from a funding body (Medicare, DVA, or the NDIS) where relevant to your claim or referral; from a support person or family member you have authorised.

4. Why We Collect and Use Your Information

To provide psychological assessment, treatment, and care; to assess and respond to risk to your safety or others'; to process billing and claims relevant to your funding pathway; to meet legal, professional, and regulatory obligations including AHPRA registration standards and mandatory reporting; to communicate with other treating practitioners with your consent or as permitted by law; for clinical supervision and quality assurance, in de-identified or limited form wherever possible.

We do not use your information for marketing purposes, and we do not sell your information to any third party.

5. Who We Share Information With

We only disclose your information where necessary for the purposes above, where you have consented, or where required or authorised by law, including:

• your GP or referring practitioner (continuity of care);
• Medicare/Services Australia (processing rebates or claims);
• Department of Veterans' Affairs (processing DVA-funded claims);
• NDIS Quality and Safeguards Commission / your plan manager (NDIS-funded supports);
• emergency services or crisis services (where necessary to prevent serious threat to life, health, or safety);
• courts, tribunals, or statutory authorities (where legally required);
• professional indemnity insurer (managing an actual or potential claim);
• IT, software, and telehealth service providers engaged by Harper Mind.

We do not disclose your information to any party outside Australia except where a service provider engaged by Harper Mind stores or processes data using infrastructure located overseas; where this occurs, we take reasonable steps to ensure that provider is bound by privacy protections consistent with the Australian Privacy Principles.

6. How We Store and Protect Your Information

Your clinical records are held electronically in secure, access-controlled practice management systems. Telehealth sessions are conducted through platforms that use encrypted connections. Harper Mind does not store payment card details. Access to client records is restricted to those who need it to provide or support your care. Any paper records are kept in locked storage with restricted physical access.

No system is completely secure. If Harper Mind experiences a data breach likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches scheme, and take reasonable steps to contain and remediate the breach.

7. AI-Assisted Note Taking

Where you consent, your clinician may use an AI-assisted note-taking tool to support session documentation. Session content and the summaries or clinical notes generated from it form part of your clinical record. This information is used solely to support accurate documentation and continuity of care. Your information is not used to train AI models. Your clinician will seek your informed consent before using an AI note-taking tool in any session, and you may decline or withdraw consent at any time without affecting your care.

8. How Long We Keep Your Information

For adult clients: at least 7 years from the date of the last service provided. For clients who were minors at the time of treatment: until the client turns 25. Once the relevant retention period has passed, records are securely destroyed or permanently de-identified.

9. Accessing, Correcting, or Deleting Your Information

You have the right to request access to the personal and health information Harper Mind holds about you, and to request correction of information you believe is inaccurate. Submit a request in writing to admin@harpermind.com.au. We will respond within a reasonable period, generally within 30 days. A reasonable administrative fee may apply to cover the cost of retrieving and providing copies of records, but not for lodging the request itself.

10. Complaints and Concerns

If you have a concern about how Harper Mind has handled your personal or health information, contact us at admin@harpermind.com.au — we will acknowledge your complaint and aim to resolve it within a reasonable timeframe, generally 30 days. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au, or the Health Complaints Commissioner (Victoria) at hcc.vic.gov.au. You may also contact AHPRA regarding concerns about a registered practitioner's conduct.

11. Contact Us

Privacy Officer: Jarrod Weir
Email: admin@harpermind.com.au

12. Changes to This Policy

Harper Mind may update this policy from time to time to reflect changes in law, our services, or the technology we use. The current version will always be available on request, and material changes will be communicated to current clients.