Privacy Policy

Privacy & Information Storage Policy

1. Introduction to Our Privacy Policy

The Family Room is committed to protecting the privacy and personal information of its employees, clients, and stakeholders.

This Privacy and Information Storage Policy ensures that personal information is collected, stored, and used in accordance with the Privacy Act 1988 (Australia) and the Australian Privacy Principles.

We take our commitment to privacy seriously and have systems and processes in place to maintain privacy at all times.

To provide high-quality healthcare services, we must maintain and store personal information. Personal information is obtained so that we can:

  • Best tailor services to your needs

  • Evaluate and monitor program outcomes

  • Facilitate resolution of complaints with stakeholders

2. What This Privacy Policy Covers

This policy applies to all employees and contractors of The Family Room who have access to personal information as part of their work.

It covers all personal information The Family Room collects, stores, or uses while delivering healthcare and support services.

3. Purpose of Collecting Personal Information

This policy reaffirms our commitment to providing safe, secure, and private healthcare services that comply with legal and ethical requirements.

The purpose of this policy is to:

  • Ensure personal information is collected, stored, and used lawfully and ethically

  • Protect the privacy of individuals

  • Comply with the Privacy Act 1988 and Australian Privacy Principles

  • Promote a culture of privacy and data security

4. Roles and Responsibilities for Data Privacy

The Directors are responsible for ensuring this policy is implemented effectively.

Employees and contractors must:

  • Comply with this policy and relevant privacy laws

  • Report any privacy breaches or incidents

  • Participate in privacy and data security training

5. Collection, Use and Disclosure of Personal Information

5.1 How We Collect Personal Information

The Family Room collects personal information only for purposes relevant to our healthcare services and with your consent.

Consent may be provided verbally or in writing. However, we require written consent before sharing information with third parties (unless required by law).
We limit collection to necessary information and ensure it is accurate, complete, and up to date.

5.2 Why We Use Your Information

We use personal information to:

  • Inform treatment and care decisions

  • Identify and protect the individual

  • Deliver safe and effective healthcare services

5.3 When We Share Personal Information

Personal information may be disclosed to:

  • Other treating healthcare professionals

  • Family or authorised representatives

  • Persons at direct or immediate risk

  • Law enforcement authorities

  • Referring organisations

  • Legal practitioners

  • Community service providers

Unless required by law, we disclose information only with written consent. The Family Room does not sell, trade, or rent personal information.

6. Information Storage, Security and Data Protection

The Family Room securely stores personal information to prevent unauthorised access, use, or disclosure.

We use a secure case management system where:

  • Only authorised personnel can access information

  • All activity and communication are managed within the system

We store personal information from assessments and appointments electronically and securely destroy hard copies.

We use physical, technical, and administrative safeguards and regularly review our systems to maintain security.

7. Accessing and Correcting Your Personal Information

The Family Room recognises your right to access and correct your personal information.

You may:

  • Request access to your personal records

  • Request corrections to inaccurate or incomplete information

What if I attend sessions with my partner, child or family?

  • You can ask your clinician how information from joint and individual conversations will be recorded and handled. If you request a record that also contains another person’s information, we will consider their privacy when responding.

8. Data Access Controls and Confidentiality

Access to personal information is granted on a strict need-to-know basis.

Employees and contractors must not share or disclose information without authorisation.

All staff are required to:

  • Use strong passwords

  • Use two-factor authentication

  • Follow secure data handling practices

We store clinical and administrative records using our practice management software, Zanda Health. Zanda reports ISO 27001 certification for its information security management system and an externally audited privacy program. Zanda encrypts data when stored and in transit.

Our Zanda account privacy settings mean that only your clinician can access and edit your clinical notes. Our reception and admin staff can access your administrative information (e.g. name, contact details, Medicare, referral and appointment details).

In line with the Psychology Board of Australia’s Code of Conduct, our clinicians retain adult clients’ clinical records for at least seven years after the last entry in the record. Our clinicians must retain child and adolescent records until the client’s 25th birthday.

9. Telehealth & AI tools

We use Zanda Health to manage telehealth appointments and provide your personal appointment link. Your consultation takes place through Zoom, which encrypts audio and video during transmission. Please keep your appointment link private and join from a place where you feel comfortable speaking confidentially. We also use Zoom Waiting Room so your clinician can check who is present before admitting anyone.

Our clinicians use Zanda AI scribe or Heidi AI to transcribe sessions and edit clinical notes. Before your first appointment, you will receive an AI consent form. If you do not complete the AI consent form, your clinician will not use AI transcription services during your appointments.

9. Privacy Complaints and Enquiries

The Family Room takes privacy concerns seriously and has procedures to respond promptly.

To raise a concern:

10. Monitoring and Continuous Improvement

We regularly monitor and evaluate this policy using:

  • Feedback from clients and staff

  • Privacy incident reporting

Management tracks implementation and performance.

Employees and contractors are encouraged to provide feedback for improvement.

11. Policy Review and Updates

This policy is reviewed annually to ensure it remains compliant, effective, and up to date.

All updates are recorded in the Policy and Procedure Register.