CS Clinical PsychServices Pty Ltd

Privacy policy

Dr Carol Snellgrove — Clinical Psychologist

Effective: [date to be set on publication]

About this policy

This Privacy Policy explains how CS Clinical PsychServices Pty Ltd (ACN 644 617 550), the practice of Dr Carol Snellgrove ("I", "me", "my"), collects, uses, stores and discloses your personal information, in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). I am a clinical psychologist registered with the Australian Health Practitioner Regulation Agency (AHPRA) and a member of the Australian Psychological Society. Protecting your privacy and the confidentiality of your information is fundamental to my professional and ethical obligations.

This Policy should be read together with my Terms and Conditions (the Terms) and with the consent form you complete before your first appointment. The Terms are the agreement between you and me; this Policy explains how your personal information is handled under that agreement.

My practice and OneBodyMind

I practise independently from premises operated by One Body Mind Pty Ltd (ACN 682 839 372) ("OneBodyMind") at Unit 12, 154 Fullarton Road, Rose Park SA 5067, a collective of independent mental health professionals. Under my agreement with OneBodyMind, it provides me with:

  • reception services, including receiving and managing bookings and enquiries (08 7228 2319);
  • the practice management system in which my appointment book, client records and accounts are kept (currently PracSuite);
  • invoicing under my practice's name, collection of fees, and follow-up of outstanding payments; and
  • processing of payments and the submission and management of Medicare claims on my behalf (currently through the Tyro platform).

To provide those services, OneBodyMind and its staff handle your personal information on my behalf and at my direction, as my agent. The information involved includes your name, date of birth and contact details, your appointment times, referral details, Medicare and payment details, invoices and account history, and the clinical records held in the practice management system.

The limits on OneBodyMind's role are as follows:

  • OneBodyMind acts only on my behalf and only for the purpose of providing those administrative services to me. It must not use your information for its own purposes.
  • OneBodyMind does not provide health services to you, has no role in your assessment or treatment, and does not direct or influence my clinical judgement.
  • OneBodyMind and its staff are bound by confidentiality obligations to me under our agreement, and must handle your information in accordance with the Privacy Act 1988 (Cth) and the APPs.
  • OneBodyMind's staff access your information only to the extent needed for reception, billing and claiming. They will see your referral and Mental Health Treatment Plan, because these are required to process Medicare claims. They are never asked to read, and do not read, my clinical notes.
  • Your clinical records remain owned and controlled by me and under my professional responsibility. OneBodyMind stores copies electronically in the practice management system solely so that it can provide those services to me.

I remain responsible for your personal information under Australian privacy law even when OneBodyMind handles it on my behalf. If I change practice services provider, or the software or payment platforms used, I will update this Policy and the Terms.

Bookings and your consent to OneBodyMind handling your information

When you book an appointment — online through my booking page, or by phone or email through OneBodyMind's reception — the details you provide are entered directly into the practice management system operated by OneBodyMind, and OneBodyMind's reception staff receive and manage your booking on my behalf.

Before completing an online booking you will be asked to confirm that you have read this Privacy Policy and the Terms and that you consent to your information being handled as they describe. By completing an online booking, you specifically consent to:

  • me collecting the personal information you provide, including your name, date of birth, contact details, and any referral or appointment details;
  • that information being received, stored and handled by OneBodyMind on my behalf for the purposes of managing your booking, contacting you about your appointment, invoicing and collecting fees, and processing payments and Medicare claims;
  • OneBodyMind contacting you by phone, SMS or email about your appointments (for example, confirmations, reminders and account matters); and
  • your information being held in the practice management system (PracSuite) and processed through the payment and claiming platforms (Tyro) described in this Policy.

The same applies if you book by phone or email: by giving your details to OneBodyMind's reception, you consent to them being handled in this way.

This consent is limited to the administrative handling described above. It is not consent to Medicare claiming on your behalf, to the sharing of your information with other health providers, or to AI-assisted note-taking. Those consents are sought separately, in writing, on the consent form you complete before your first appointment, and you may give or withhold each of them independently. Nor does booking an appointment authorise any physical contact during a session, which requires separate written consent at the time.

Because my reception, records and billing are all run through OneBodyMind, I am not able to provide services without your information being handled in this way. If you have any concerns about this, please contact me before booking so that we can discuss them. You may withdraw your consent at any time by writing to me; withdrawal does not affect anything done before I receive it, but it may mean I cannot continue to provide services to you.

Information I collect

I collect only the personal information reasonably necessary to provide psychological services and to meet my legal and ethical obligations. This may include:

  • name, date of birth, gender, address, email and phone number;
  • Medicare, DVA, private health insurance, NDIS plan-management and payment details, and claim details for WorkCover or CTP matters;
  • referral details and Mental Health Treatment Plans (for example, from your GP, psychiatrist or paediatrician);
  • emergency contact information and, for clients under 18, the details of parents or guardians;
  • medical and mental health history;
  • session notes, assessments, test results, treatment plans and reports;
  • communications with you (such as emails, SMS and phone calls); and
  • booking and attendance records, invoices and account history.

Health information is "sensitive information" under the Privacy Act. I collect it only with your consent and only where it is reasonably necessary for the services I provide.

How I collect it

I usually collect information directly from you — when you book (online or through reception), on intake and consent forms, in sessions, through the enquiry form on this website, and by phone, email or online contact. I also collect information from your referring doctor when you are referred to me, and, with your consent or where required or authorised by law, from other healthcare providers and services involved in your care. OneBodyMind's reception collects booking and enquiry details on my behalf.

Assessments arranged by someone else. Where an assessment or report is requested by a third party — for example an insurer, a lawyer, an employer or a case manager in a WorkCover, CTP or other medico-legal matter — I also receive information from that party, and the report I prepare goes to them as agreed before the assessment begins. I explain this to you at the start, including who will receive the report.

AI-assisted note-taking. Where you have given separate written consent (clause 11 of my Terms), I may use an AI-assisted note-taking tool during sessions so that I can give you my full attention rather than writing notes. Session audio is processed in real time to produce a written summary; only that summary, which I review and correct where necessary, is kept in your record, and the audio and transcript are not retained. I take reasonable steps to ensure the tool meets Australian privacy requirements, encrypts your data, stores it in Australia, and does not use it to train AI models. You may withdraw this consent at any time without affecting your care. No decision about your care is made by an automated system.

How I use and disclose it

I use your personal information to:

  • provide, assess, plan and review your care;
  • communicate with you about appointments and treatment;
  • administer billing, Medicare, DVA, NDIS and insurance claims;
  • provide reports to your referring doctor where you are referred under a Mental Health Treatment Plan, as Medicare requires;
  • prepare reports that you, or a third party with your knowledge, have requested;
  • meet legal and professional obligations, such as record-keeping and mandatory reporting; and
  • participate in professional supervision and peer consultation, using de-identified information.

I may disclose your personal information to:

  • OneBodyMind, as my agent, for the administrative purposes described in this Policy;
  • PracSuite (practice management software) and Tyro (payments and Medicare claiming), which handle your information under their own privacy and security obligations;
  • your referring doctor, for the reports required under your Mental Health Treatment Plan;
  • other healthcare providers, hospitals, diagnostic services and health insurers, with your consent;
  • Medicare, DVA, your NDIS plan manager, and insurers or other funders where they pay for your services;
  • the party who requested an assessment or report, as agreed with you beforehand;
  • my clinical supervisor and peer consultants, using de-identified information, who are bound by confidentiality obligations equivalent to mine;
  • legal authorities, where required or authorised by law — including where I believe there is a serious risk of harm to you or others, where child abuse or neglect is suspected, or under a subpoena or court order; and
  • a debt collection agency, only where fees remain unpaid and only the information necessary to recover them.

Sensitive information, including health information, is handled with extra care and is not used or disclosed for any other purpose without your explicit consent or as required by law. I do not use or disclose your information for direct marketing, and I do not sell it.

Clients under 18

Where the client is under 18, a parent or guardian provides consent unless the young person is able to consent for themselves under South Australian law, and the information collected includes that person's details. I owe a young person confidentiality in their own right. What I share with a parent about sessions, and a parent's access to records, may be limited where the young person is able to make their own decisions, where I consider limitation to be in their best interests, or where disclosure would create risk.

Storage and security

I take reasonable steps to protect your information from misuse, interference and loss, and from unauthorised access, modification or disclosure. Information may be held in:

  • secure electronic systems, including the PracSuite practice management system operated by OneBodyMind, the Tyro payment and claiming platform, and secure email; and
  • secured paper files (in locked storage), where paper records are used.

Only I, and OneBodyMind's authorised staff bound by confidentiality obligations, can access your records. Telehealth sessions are provided through secure, encrypted platforms. I rely on OneBodyMind, PracSuite and Tyro to maintain appropriate security measures, but I remain responsible for ensuring your information is protected under Australian privacy law. If a data breach occurs that is likely to result in serious harm to you, I will notify you and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.

Overseas disclosure. I do not ordinarily disclose your personal information to overseas recipients. The practice management, payment and note-taking systems described in this Policy store data in Australia. Some services I use are provided by international companies and may store or process data outside Australia — including my practice email (Microsoft Outlook) and the enquiry form on this website, which runs on Google's infrastructure — for example in the United States. Where that happens, I take reasonable steps to ensure your information is protected in a way consistent with the APPs.

Third-party providers

For more information on how these providers handle personal information, see their privacy policies:

Retention of records

Clinical records are retained for at least 7 years from your last appointment, or until a client who was a minor turns 25 — whichever is longer — in line with professional standards and legal requirements. After this period, records are securely destroyed or de-identified. Records held in the practice management system operated by OneBodyMind remain mine and are retained or destroyed on my instructions, including if I cease practising from OneBodyMind.

Access, correction and complaints

You have the right to access and correct the personal information I hold about you, and to complain if you believe your privacy has been breached. Please make requests in writing using the contact details below. I will respond within 30 days and may need to verify your identity first. Requests about information handled by OneBodyMind on my behalf should also be made to me; I will coordinate the response.

In limited circumstances, access may be declined (for example, where it would pose a serious threat to the life, health or safety of any person), in accordance with the law. If so, I will explain why and, where appropriate, offer another way of providing the information, such as through your GP.

If you are not satisfied with my response, you may contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or 1300 363 992. You may also raise concerns about my professional conduct with AHPRA (www.ahpra.gov.au) or with the South Australian Health and Community Services Complaints Commissioner (www.hcscc.sa.gov.au).

Website and online services

  • Online booking. The online booking page linked from this website is provided by PracSuite. Information you enter into it is transmitted securely to the practice management system operated by OneBodyMind and is handled as described in this Policy. The booking page may use cookies that are necessary for it to function.
  • Enquiry form. The enquiry form on this website is processed by a script running on Google's infrastructure (Google Apps Script) and delivered to my practice email. It is for making contact only — please don't include clinical details you would not send by ordinary email. The form is not monitored for urgent messages.
  • No cookies or tracking. This website does not use cookies, advertising trackers or similar technologies to collect personal information. It may use privacy-friendly, cookie-free analytics that count page visits without identifying you. Its fonts and images are served from the website itself.

Changes to this policy

I may update this Policy from time to time to reflect changes in legal, professional or operational requirements, including any change to the practice services provider or platforms I use. The current version is always on this page and available on request.

Contact

If you have any questions about this Policy or my privacy practices, please contact:

Dr Carol Snellgrove, CS Clinical PsychServices Pty Ltd
OneBodyMind, First Floor, Unit 12, 154 Fullarton Road, Rose Park SA 5067
Email: csclinicalpsychservices@outlook.com · Phone: 08 7228 2319