1. Who This Policy Applies To

This policy applies to all visitors to neurotherapyvictoria.com.au, prospective clients, current clients, and any other individuals who provide personal information to the clinic through any channel, including the website contact form, the online booking system, email, or phone.

2. What Information We Collect

The clinic may collect the following types of personal information:

• Contact details - name, email address, phone number, and any message you provide through the website contact form or when making an enquiry.
• Booking information - appointment details submitted through the Halaxy online booking system, including your name, contact details, and appointment preferences.
• Health and clinical information - information you provide about your health history, presenting concerns, and treatment goals, collected during or in preparation for clinical sessions. This may include sensitive health information as defined under Australian privacy law.
• Order and purchase information - when you purchase a product through the clinic's online shop, WooCommerce collects your name, billing address, shipping address, email address, phone number, and order details. Payment is processed via PayPal or direct bank transfer; card or payment account details are handled directly by PayPal and are not stored on this website.
• Website usage data - anonymous or pseudonymous data collected through website analytics tools (such as Google Analytics), including pages visited, time on site, device type, and approximate location. This data does not identify you personally.

The clinic collects only the information that is reasonably necessary for providing services, responding to enquiries, and meeting legal obligations.

3. How Your Information Is Used

Personal information collected by the clinic is used for the following purposes:

• Responding to your enquiries or booking requests
• Scheduling and managing appointments
• Delivering clinical services and maintaining appropriate clinical records
• Communicating with you about your care, including appointment reminders
• Processing and fulfilling product orders, including shipping and order confirmation communications
• Meeting legal, ethical, and professional obligations (including those set by AASW and BCIA)
• Meeting financial record-keeping obligations under Australian taxation law
• Improving the clinic's website and services through aggregated, anonymised analytics data

Your information will not be used for unsolicited marketing, and it will not be sold or shared with third parties for commercial purposes.

4. How Your Information Is Stored

Clinical records and client information are stored securely within Halaxy, a practice management platform that complies with Australian health information security standards. Halaxy stores data on Australian servers and operates under its own privacy and security framework. You can read Halaxy's privacy policy at halaxy.com/privacy-policy.

Information submitted through the website contact form is transmitted by email to James Reid and is not stored on the website's servers beyond the initial submission.

All electronic information is protected by appropriate access controls. Paper records, where used, are stored securely at the clinic's premises and are not left unattended or accessible to third parties.

5. Online Shop and Order Processing

The clinic's online shop is powered by WooCommerce, a plugin that operates within this WordPress website. When you place an order, WooCommerce stores your name, contact details, billing and shipping address, and order history in the website's database, which is hosted on the clinic's web server.

Payment processing: Payments can be made via PayPal or direct bank transfer. When you pay via PayPal, you are redirected to PayPal's secure platform to complete the transaction. The clinic does not receive or store your card number or full PayPal account details - PayPal handles all payment data under its own privacy and security framework. You can read PayPal's privacy policy at paypal.com/au/legalhub/privacy-full. For direct bank transfers, only your name and payment reference are received via the bank transaction.

Order fulfilment: Physical products are shipped via post. Your name and delivery address are used solely for the purpose of dispatching and tracking your order. Order confirmation and shipping notifications are sent to the email address you provide at checkout.

Financial records: Order records, including your contact details, items purchased, and transaction amounts, are retained for a minimum of 5 years in accordance with Australian Taxation Office (ATO) record-keeping requirements.

6. Disclosure of Your Information

The clinic will not disclose your personal information to third parties except in the following circumstances:

• With your consent - for example, to correspond with your GP or another treating professional at your request.
• When required by law - for example, in response to a court order, mandatory reporting obligation, or a lawful request from a government authority.
• To protect safety - where there is a serious and imminent risk to the safety of you or another person, as required under professional ethical guidelines.
• Service providers - trusted third-party platforms used in the delivery of services (such as Halaxy for bookings, WooCommerce for order management, and PayPal for payment processing), who are bound by their own privacy policies and relevant data protection requirements.
• Shipping and postal services - where a product is ordered, your name and shipping address will be used to fulfil and dispatch your order via Australia Post or a comparable carrier. Only the information necessary for delivery is shared.

7. Health Information and Sensitive Data

Health information is classified as sensitive information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). The clinic handles all health information with the additional care this classification requires, collecting it only where necessary, storing it securely, and disclosing it only in the circumstances outlined in Section 5 above.

As a social worker, James Reid is also bound by the Australian Association of Social Workers (AASW) Code of Ethics in relation to client confidentiality and the handling of sensitive information.

8. Website Analytics

This website uses Google Analytics to collect anonymised data about how visitors use the site. This data helps the clinic understand which pages are most useful and improve the overall experience. Google Analytics uses cookies and may collect data such as your approximate location, device type, and browsing behaviour on this site. This data is aggregated and does not identify you personally.

You can opt out of Google Analytics tracking by installing the Google Analytics opt-out browser add-on, or by adjusting your browser's cookie settings.

9. Your Rights

Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, you have the right to:

• Request access to the personal information the clinic holds about you
• Request that inaccurate or outdated information be corrected
• Make a complaint if you believe your privacy has been breached

To exercise any of these rights, please contact James Reid directly using the details below. Requests will be responded to within a reasonable timeframe, and no later than 30 days.

If you are not satisfied with the clinic's response to a privacy complaint, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or by calling 1300 363 992.

10. Retention of Records

Clinical records are retained in accordance with the legal and professional requirements applicable to health practitioners in Victoria. For adult clients, records are generally retained for a minimum of 7 years from the date of last contact. For clients who were minors at the time of treatment, records are retained until the client turns 25, or for 7 years from the date of last contact, whichever is longer.

Order and financial records related to shop purchases are retained for a minimum of 5 years in accordance with ATO record-keeping requirements.

Enquiry records (such as contact form submissions that did not lead to a clinical relationship) are retained only as long as necessary to respond to the enquiry and are then deleted.

11. Changes to This Policy

This policy may be updated from time to time to reflect changes in the clinic's practices or applicable law. The date at the top of this page indicates when the policy was last reviewed. Continued use of this website or the clinic's services after a policy update constitutes acceptance of the updated terms.