Privacy Policy

Effective date: 3 March 2026
Last updated: 3 March 2026

At Alloy Health, we are committed to protecting your privacy and handling personal information responsibly. This Privacy Policy explains how Alloy Health collects, holds, uses and discloses personal information, including sensitive information and health information, in connection with the services we provide. It also explains how you can access or correct your information, how you can make a privacy complaint, and how we will respond. This policy is intended to meet the requirements of the Australian Privacy Principles and Victorian health privacy laws.

1. Who we are

Alloy Health is a Melbourne-based child and adolescent psychology practice providing psychological assessments, therapy and related support services. We may also work collaboratively with other health professionals and support providers involved in a child or family’s care. For the purposes of this policy, “we”, “us” and “our” means Alloy Health.

2. What information we collect

Depending on the services you use, we may collect and hold personal information such as:

• name, date of birth, gender and contact details
• parent, guardian and emergency contact details
• Medicare, private health insurance, NDIS or other funding information
• referral details
• appointment and billing information
• correspondence with you
• information about schools, teachers or other professionals involved in care
• health information, including medical history, developmental history, psychological history, symptoms, diagnoses, treatment notes, reports, assessments, questionnaires and care plans
• information provided by parents, guardians, referrers, schools and other treating professionals
• website usage information, including IP address, browser type, pages visited and cookie/analytics data where you use our website.

Health information is sensitive information under Australian privacy law, and additional protections apply to how it is handled.

3. How we collect information

We collect personal information in a number of ways, including when:

• you contact us by phone, email, website form or online booking
• you complete intake, consent, background or assessment forms
• you attend appointments with us
• you make payments or claims
• a parent, guardian or authorised representative provides information to us
• a referrer, school, paediatrician, GP, allied health professional or other provider sends us information with your consent or as otherwise permitted by law
• you use our website
• you communicate with us through social media or other online channels.

Where reasonable and practicable, we collect information directly from the individual or their parent/guardian. In some cases, particularly when providing care to children, coordinating treatment, or processing referrals, we may collect information from other people or organisations. Australian privacy law generally requires health information to be collected lawfully and fairly, and usually directly from the individual unless that is unreasonable or impracticable.

4. Why we collect, hold, use and disclose information

We collect, hold, use and disclose personal information so that we can:

• provide psychological, assessment and allied-health related services
• assess suitability for services and respond to enquiries
• book and manage appointments
• communicate with patients, parents, guardians and referrers
• prepare reports, letters and recommendations
• coordinate care with schools, referrers and other treating professionals
• process billing, payments, Medicare, NDIS or other funding claims where applicable
• maintain clinical records
• improve our services, systems and website
• comply with legal, regulatory, professional and insurance obligations
• respond to complaints, incidents or data security issues.

As a general rule, we use and disclose health information for the primary purpose for which it was collected, for directly related purposes you would reasonably expect, with consent, or where otherwise required or permitted by law. You may withdraw your consent for us to use or disclose your personal information at any time by contacting us using the details in Section 16. Please note that withdrawing consent may affect our ability to provide certain services, and does not affect the lawfulness of any use or disclosure that occurred before the withdrawal.

5. Who we may disclose information to

We may disclose personal information to:

• the individual patient
• parents, guardians or authorised representatives
• referrers
• GPs, paediatricians, psychiatrists, speech pathologists, occupational therapists, schools and other health or education professionals involved in care
• Medicare, private health insurers, NDIS, or other funders/payers where relevant
• pathology, specialist or other service providers involved in care
• our professional advisers, insurers or legal representatives
• third-party service providers who help us operate our practice, such as IT providers, secure cloud storage providers, booking systems, payment processors, accounting providers and website/communications providers
• government bodies, regulators, courts, tribunals or law enforcement where required or authorised by law.

We will only disclose health information where it is appropriate for care and operations, where you have consented, or where the disclosure is otherwise required or permitted by law.

6. Children’s information

Because many of our services relate to children and adolescents, we often collect information from and communicate with parents or guardians. We may also collect information from schools and other professionals involved in a child’s care. Where appropriate, we will consider the child or young person’s maturity, capacity and privacy rights when deciding how information should be handled, accessed or disclosed.

7. Anonymity and pseudonyms

Where lawful and practicable, you may make a general enquiry without identifying yourself. However, in most cases we cannot provide clinical services anonymously or under a pseudonym because we need accurate identifying information to safely deliver healthcare, maintain records, communicate with relevant parties and meet legal obligations.

8. Direct marketing and service communications

We may send service-related communications such as appointment confirmations, reminders, administrative updates, invoicing information and information relevant to your care. We will not use health information for direct marketing unless you have consented or it is otherwise permitted by law. You may opt out of non-essential marketing communications at any time. Health information cannot generally be used for direct marketing without consent.

9. Website, cookies and analytics

When you visit our website, we or our service providers may collect technical information such as your IP address, browser type, pages viewed, time spent on pages and referring website details. We may use cookies and analytics tools to understand website traffic, improve functionality, measure performance and enhance user experience. You can usually adjust your browser settings to refuse cookies, although some website features may not function properly if you do so.

10. Overseas disclosure

We aim to use reputable providers and to manage personal information securely. Some of the third-party systems we use for website hosting, cloud storage, communications, booking, analytics, administration or business operations may store or process personal information outside Australia. We may disclose or store personal information with overseas service providers, including providers located in the United States and other countries. Where this occurs, we take reasonable steps to ensure those providers handle personal information in a manner consistent with Australian privacy obligations.

11. How we hold and protect information

We hold personal information in electronic and, at times, paper records. We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification or disclosure. These steps may include:

• secure practice management and record systems
• password protection and access controls
• staff confidentiality obligations
• secure cloud storage and backups
• device and network security measures
• limiting access to information to those who need it
• secure destruction or de-identification when information is no longer required, subject to legal retention obligations.

12. Access to and correction of your information

You may request access to personal information or health information we hold about you, and you may ask us to correct information that is inaccurate, incomplete, misleading or out of date. Requests should be made in writing using the contact details below. We may need to verify identity before granting access or making corrections. In some circumstances, the law allows us to refuse access or provide access in a limited form. If that happens, we will explain the reasons unless we are not permitted to do so. You may also request that we make your health information available to another health service provider where applicable. Victorian law gives individuals rights to access and correct health information, and to request transfer to another health service provider in certain circumstances.

13. Record retention

We keep health records for as long as required by law and professional obligations. In Victoria, health service providers generally must not delete health information earlier than 7 years after the last health service was provided, and if the information was collected while the individual was a child, generally not before the individual reaches 25 years of age, whichever is later.

14. Data breaches

If we suspect that personal information has been lost, accessed, used or disclosed without authorisation, we will investigate and respond in accordance with our obligations. Where required, we will notify affected individuals and the Office of the Australian Information Commissioner.

15. Complaints

If you have a question or complaint about how we have handled your personal information, please contact us first using the details below. We will review your concern and try to respond within a reasonable time. If you are not satisfied with our response, you may be able to complain to:

• the Office of the Australian Information Commissioner (OAIC) in relation to privacy matters under the Privacy Act
• the Health Complaints Commissioner (Victoria) in relation to health records handling or health services provided in Victoria.

16. Contact us

Alloy Health Melbourne, Victoria Phone: 0422 651 697 Email: systems@alloyhealth.com.au Please address privacy enquiries, access requests, correction requests and complaints to Alloy Health using the contact details above.

17. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal obligations or business practices. The latest version will be published on our website with the updated effective date.