Privacy Policy

Last updated: 13th of April, 2026

Introduction

This document describes the privacy policy of Narrative Health for the management of your personal information. The psychological service provided is bound by the legal requirements of the Australian Privacy Principles set out in the Privacy Act 1988 (Cth) and the Health Records and Information Privacy Act 2002 (NSW) (HRIPA). A copy of the Australian Privacy Principles may be obtained from the Office of the Australian Information Commissioner at www.oaic.gov.au

Sensitive Information

As a health practice, Narrative Health collects sensitive information as defined by the Privacy Act 1988 (Cth), including health information. Health information includes information about your physical or mental health, disability, or the health services provided to you. Sensitive information is afforded additional protections under the Australian Privacy Principles - in particular, it may only be collected with your consent and where it is reasonably necessary for the provision of psychological services.

Personal Information

Your clinical records are stored securely in Splose, our practice management software. Splose stores data on servers located in Australia and uses encryption compliant with Australian privacy law. Access to your records is restricted to your clinician and authorised practice staff, in accordance with our privacy policies and procedures. Any physical records are securely destroyed once a digital copy has been made.

The information we collect includes your personal details such as name, address, and contact phone numbers, as well as Medicare, health fund, DVA, or NDIS details where applicable. As part of providing a psychological service, we also collect and record information relevant to your current situation - including what happens during sessions, any psychological assessments you complete, and information received from others such as your GP or referring practitioner.

We also collect information submitted through our website, including online booking and contact forms, and website usage data (such as through cookies and analytics tools). Where lawful and practicable, you may request to interact with us anonymously or by pseudonym; however, this may limit our ability to provide services or process claims.

Third-Party Service Providers

Narrative Health uses the following third-party service providers to store, process, or transmit personal information:

Splose (Practice Management Software): Stores clinical records, client details, appointment history, and billing information. Data is stored on servers located in Australia. Splose's privacy policy is available at splose.com.

Splose AI (Clinical Note Assistance): Splose includes AI-powered features that may be used to assist with drafting or organising clinical notes. These AI features are powered by third-party technology providers, and personal information processed through AI features may be transmitted to servers located outside Australia. All AI-generated content is reviewed, edited, and approved by your psychologist before being finalised. Full details of how Splose handles personal information in connection with its AI features, including its use of third-party providers, are available in Splose's privacy policy at www.splose.com/privacy-policy

Google Workspace for Business (Email, Telehealth, File Storage): Narrative Health uses Gmail for email correspondence, Google Meet for telehealth sessions, and Google Drive for file storage. Google Workspace is provided by Google LLC. Google encrypts data in transit and at rest and processes data in accordance with its Data Processing Amendment. However, Google operates a global infrastructure and data may be processed or temporarily stored on servers located outside Australia, including in the United States. Google does not use your data for advertising or any purpose beyond providing the service. Google acts as a data processor under Narrative Health's instructions.

Narrative Health has taken reasonable steps to ensure that each of these providers handles personal information consistently with the Australian Privacy Principles, including through contractual arrangements (e.g. Google's Data Processing Amendment) and by selecting providers that maintain appropriate security certifications (e.g. ISO 27001, SOC 2).

Psychological Assessment Platforms: Where psychological assessments are part of your care, Narrative Health may use one or more specialist online assessment platforms to administer, score, and report on standardised measures. The platform used will depend on the specific assessments required. Platforms currently in use include Novopsych, WPS Online Evaluation System, PARiConnect, MHS Online Assessment Center+ (MAC+), and Pearson Clinical/Qinteractive.

Novopsych is an Australian platform and stores data on servers located in Australia. The remaining platforms are operated by companies based in the United States or Canada, and data processed through these platforms may be stored on servers located outside Australia. Narrative Health has taken reasonable steps to select providers that maintain appropriate data security standards. Relevant privacy policies are available on each provider's website. Not all platforms are used for every client.

Cross-Border Handling of Information

Some of the third-party services used by Narrative Health may process or store personal information on servers located outside Australia. In particular, Google Workspace operates on global infrastructure and data may be processed in countries including the United States.

In accordance with Australian Privacy Principle 8, Narrative Health has taken reasonable steps to ensure that overseas recipients of personal information handle that information consistently with the APPs. These steps include entering into data processing agreements with providers that include commitments to data security, access controls, and breach notification.

By engaging with Narrative Health, you acknowledge that certain personal information may be processed outside Australia as described in this policy. If you have concerns about this, please discuss them with your psychologist.

How Your Personal Information is Collected

There are a number of ways your personal information is collected, including when:

  • You provide information directly to your psychologist during sessions, or in writing such as letters, email, or text messages

  • You interact with Narrative Health staff such as our administration team

  • Other health practitioners, such as your GP, provide information through referrals, correspondence, and medical reports

  • We receive information from other sources, such as lawyers, employers, or insurance companies through correspondence or reports

  • You use our website, including through our online booking system and contact forms

If you have concerns that any information recorded is not correct, please discuss this with our administration staff or your psychologist.

Purpose of Holding Personal Information

Your personal information is gathered and used for the purpose of providing a psychological service to you. It is retained in order to document what happens during sessions and to enable your psychologist to provide a relevant and informed service. This information and record keeping is a necessary part of the service provided and guides treatment. If you do not wish for your personal information to be collected, we may not be able to provide the psychological service to you. Please discuss any concerns with your psychologist.

Disclosure of Personal Information

Personal information gathered by your psychologist will remain confidential except in certain circumstances. In most cases, any sharing of information will only occur with your consent.

Our practice will ask for your consent to share information when:

  • Sharing information with a family member, guardian, or carer

  • Discussing your care with others, such as your GP, employer, or any agencies which may be paying for your attendance

  • Providing a written report regarding your assessment or treatment to another professional or agency, such as your GP, lawyer, or insurance company

  • Disclosing the information in any other way not referenced in this document

Limits to Confidentiality

There are times when your psychologist may need to share your information without your consent. These include:

  • When a court requires information by issuing a subpoena, or providing information is otherwise required or authorised by law

  • When it is required because your psychologist must make a mandatory report - for example, where there is a concern about the safety of a child or young person

  • When your psychologist reasonably believes that you or someone else is at risk of serious harm

Psychologists are also required to engage in professional supervision as part of their ongoing professional obligations. Where your information is discussed in a supervision context, all care is taken to de-identify your information so that you remain anonymous.

You will be informed of these limits to confidentiality at the commencement of your engagement with Narrative Health.

Informed Consent

Consistent with the Psychology Board of Australia's Code of Conduct (2025), informed consent is an ongoing process. Before commencing services, we will explain what information we collect and why, the limits of confidentiality, fees and any third-party funding arrangements, and your right to withdraw consent at any time. Consent will also be revisited when there is a significant change to the service or your circumstances.

Use of Artificial Intelligence (AI) Tools

With your consent, Narrative Health uses AI-powered features within Splose - our practice management software - to assist with limited administrative tasks such as drafting or organising clinical notes. These features are powered by third-party technology providers, and personal information processed through AI features may be transmitted to servers located outside Australia. Full details of how Splose handles personal information in connection with its AI features are available in Splose's privacy policy at splose.com/privacy-policy. All AI-generated content is reviewed, edited, and approved by your psychologist before being finalised. We retain full professional responsibility for the accuracy and clinical appropriateness of all records. If additional AI tools are introduced in the future, this policy will be updated accordingly.

Storage, Security, and Data Breaches

Your information is stored securely in Splose, which uses encryption compliant with Australian privacy law. Access is restricted to your psychologist and authorised practice staff. Records are retained for a minimum of seven (7) years from the date of last entry, or until age 25 for minors, whichever is longer, after which they are securely destroyed.

Narrative Health takes the security of your personal information seriously and has implemented technical and organisational measures to protect against unauthorised access, disclosure, or loss. These include access controls, encryption, regular password management, and staff training.

In the event of a data breach that is likely to result in serious harm to any individual, Narrative Health will comply with the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988 (Cth). This includes assessing the breach within 30 days of becoming aware of it, notifying the Office of the Australian Information Commissioner (OAIC) if the breach is assessed as likely to result in serious harm, and notifying affected individuals as soon as practicable. Narrative Health maintains a Data Breach Response Plan that details these procedures.

Practice Continuity

In the event that your psychologist becomes unable to continue providing services due to illness, incapacity, or other unforeseen circumstances, your psychologist has appointed a nominated psychologist to manage client records, facilitate appropriate referrals, and ensure continuity of care. Details of this arrangement are available on request. This ensures your records remain secure and accessible in accordance with the Privacy Act and HRIPA.

Requests for Access and Correction to Client Information

At any stage you may request to see and correct the personal information about you kept on file. Your psychologist may discuss the contents with you and/or give you a copy, subject to the exceptions in the Privacy Act 1988 (Cth) and the HRIPA. A reasonable administration fee may apply for the preparation and provision of copies of your records, which will be communicated to you before the request is processed. If your psychologist is satisfied that your personal information is inaccurate, out of date, or incomplete, reasonable steps will be taken to ensure that this information is corrected. All requests for access to or correction of personal information should be lodged with your psychologist or our administration staff. Written requests will be responded to in writing within 45 days, and an appointment will be made if necessary for clarification.

Concerns

If you have a concern about the management of your personal information, please inform your psychologist or our administration staff. Upon request you can obtain a copy of the Australian Privacy Principles, which describe your rights and how your personal information should be handled.

If you wish to lodge a formal complaint about the use of, disclosure of, or access to your personal information, you may do so with:

  • The Office of the Australian Information Commissioner (OAIC): phone 1300 363 992 | online at www.oaic.gov.au/privacy/privacy-complaints | post to GPO Box 5288, Sydney NSW 2001

  • The Australian Health Practitioner Regulation Agency (AHPRA): phone 1300 419 495 | online at www.ahpra.gov.au

  • The NSW Information and Privacy Commission (IPC) — for complaints specifically under the Health Records and Information Privacy Act 2002 (NSW): phone 1800 472 679 | online at www.ipc.nsw.gov.au | post to GPO Box 7011, Sydney NSW 2001

Changes to This Policy

This policy may be updated from time to time to reflect changes in legislation or our practice. The current version will always be available on our website and at our practice.