Last updated: 29 September 2026
About this policy
This policy explains how Joanne Leidreiter Pty Ltd (ABN 40 626 220 228) collects, uses, stores and discloses personal information. Jo Leidreiter is a psychologist registered with the Australian Health Practitioner Regulation Agency (AHPRA).
It covers both this website and the psychology services provided at our practice.
We are bound by:
- the Privacy Act 1988 (Cth) and the Australian Privacy Principles
- the Health Records and Information Privacy Act 2002 (NSW) and the Health Privacy Principles, which apply to health information in New South Wales
- the professional obligations that apply to registered psychologists, including the APS Code of Ethics
Where these impose different standards, we apply the higher one.
The information we collect
Ordinary personal information
Name, contact details, date of birth, emergency contact, billing and payment details, Medicare and private health fund details, and technical information such as IP address and browser type when you use this website.
Health information
If you are a client, we collect and hold health information. This includes the reason for your visit, your history, assessment and session notes, diagnoses, treatment plans, referrals and correspondence with other practitioners, and any information you provide about your health.
Health information is “sensitive information” under the Privacy Act. It carries stronger protections than ordinary personal information, and we treat it accordingly.
Consent, and when we collect without it
We collect sensitive information with your consent, and only where it is reasonably necessary for providing your care.
Consent may be express, such as signing an intake form, or implied, such as telling us about your symptoms during a session.
We may collect or use health information without consent only in the narrow circumstances the law permits, including where there is a serious and imminent threat to someone’s life, health or safety, or where we are required by law.
We do not collect sensitive information through this website. Website enquiry forms ask only for contact details and a general message. Please do not send clinical details through a web form or by email, as neither is a secure channel.
How we collect
Directly from you, in person, by phone, by email, through our booking systems, or through forms on this website.
Sometimes from others, with your consent or where the law allows: your GP or referring practitioner, other treating practitioners, Medicare, or your private health fund.
If we receive information about you from someone else and you have not consented, we will tell you unless doing so would be unreasonable or unlawful.
Why we collect it, and how we use it
For clinical purposes: providing psychological services, planning and reviewing treatment, and communicating with other members of your care team where you have consented.
For administration: scheduling, billing, processing Medicare and health fund claims, and maintaining our records.
For legal and professional obligations: meeting record-keeping requirements, responding to lawful requests, and professional indemnity purposes.
For the website: responding to enquiries, and improving how the site works.
We do not use your health information for marketing. If you subscribe to our mailing list, we use only the details you provided for that purpose, and you can unsubscribe at any time.
We never sell your personal information.
Who we disclose it to
With your consent: your GP, psychiatrist, or other treating practitioners, and anyone else you nominate.
Where required or authorised by law: including subpoenas, court orders, mandatory reporting obligations, and requests from AHPRA in the course of a regulatory matter.
Where there is a serious and imminent risk to your life, health or safety, or to someone else’s. In practice this means we may contact emergency services or a nominated person. We will tell you where it is safe and appropriate to do so.
Our service providers, who are bound by confidentiality obligations and may only use the information to provide their service to us:
- Halaxy, our practice management system, which holds clinical records, appointment bookings and billing
- HotDoc, which we also use for appointment bookings
- Stripe, which processes card payments through Halaxy
- Flodesk, which we use for mailing list communications. Flodesk receives only the contact details of people who subscribe, and never health information
- Our website host and analytics providers
Overseas disclosure
Some of the service providers listed above store or process data outside Australia.
Where that happens, we take reasonable steps to ensure the overseas recipient handles your information in a way consistent with the Australian Privacy Principles, as APP 8 requires. We remain accountable for what happens to your information after it leaves us.
We do not send health information overseas except where you have given express consent, or where the law requires it. Our mailing list platform receives contact details only.
If you would like to know which providers we use and where they store data, ask us and we will tell you.
How long we keep it
Health records. The law requires us to keep them, and we cannot delete them on request while that obligation runs.
- Where the information was collected while you were an adult: seven years from the last occasion we provided you with a service
- Where it was collected while you were under 18: until you turn 25
These periods come from section 25 of the Health Records and Information Privacy Act 2002 (NSW).
Other information. Financial records are kept as tax law requires. Website enquiry records and mailing list data are kept only as long as needed, and deleted or de-identified after that.
When a retention period ends, we destroy records securely or de-identify them.
How we protect it
Clinical records are held in secure, access-controlled systems. Paper records, where they exist, are stored in locked facilities. Data transmitted through this website is encrypted in transit. Access is limited to those who need it to do their work, and everyone with access is bound by confidentiality obligations.
No system is completely secure. We keep our arrangements under review and update them as needed.
Data breaches
If a data breach occurs that is likely to result in serious harm, we will notify you and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.
Health information is treated as high risk in that assessment, because a breach involving it will almost always be capable of causing serious harm.
Accessing and correcting your information
You may ask for access to the personal and health information we hold about you, and ask us to correct anything inaccurate or out of date.
Write to us at support@joleidreiter.com.au. We may ask you to verify your identity.
We will usually respond within 30 days.
On access to clinical records specifically. You have a right of access. In limited circumstances the law allows a provider to give access in an alternative form, for example through a summary or a supervised discussion, where direct release would pose a serious threat to someone’s life, health or safety. If that applies we will explain why in writing, and you can have that decision reviewed.
If we refuse access or decline to make a correction, we will tell you why in writing and explain how to complain.
Complaints
If you think we have mishandled your information, tell us first. Write to support@joleidreiter.com.au with the details. We will acknowledge within 5 business days and aim to resolve it within 30 days.
If you are not satisfied with our response, you can contact:
Office of the Australian Information Commissioner 1300 363 992 · oaic.gov.au
Information and Privacy Commission NSW, which handles health information complaints in New South Wales 1800 472 679 · ipc.nsw.gov.au
You can also raise concerns about a registered practitioner with AHPRA on 1300 419 495.
Cookies and website analytics
This website uses cookies and analytics tools to understand how the site is used and improve it. This collects technical information such as IP address, browser type and pages visited. It is not linked to your clinical records.
You can disable cookies in your browser settings. Some parts of the site may not work as well if you do.
Purchases and digital products
Where you buy a product or service through this website, we collect the information needed to process your order. Payment card details are handled by Stripe and are not stored by us.
Purchase records are kept as tax law requires.
Anonymity
You can ask us general questions about our services without identifying yourself. We cannot provide psychological services anonymously, because we are required to keep identified clinical records.
Changes to this policy
We may update this policy. The current version is always on this page, with the date at the top. If we make a change that materially affects how we handle your information, we will take reasonable steps to tell you.
Contact us
Joanne Leidreiter Pty Ltd Suite 1, Level 7, 26 College St, Darlinghurst NSW 2010 support@joleidreiter.com.au