This Privacy Policy describes how David Manks Psychology manages your personal information. The practice is bound by the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth) and, as a health service provider in Victoria, by the Health Privacy Principles (HPPs) in the Health Records Act 2001 (Vic).

We collect personal information and sensitive health information that is necessary to provide your psychological care. This includes your name, address, contact details, date of birth, Medicare and referral details, and the health information relevant to your assessment and treatment, including session and case notes, correspondence and any reports.

We collect information in several ways: directly from you, including through Intake and Consent Forms completed in our practice management system (Halaxy); through correspondence such as email and SMS texts; when you interact with our Practice Manager; and from other health practitioners through referrals, correspondence and medical reports. If you choose not to provide information we reasonably need, we may be unable to provide the psychological service.

Your information is held and processed using the following systems. Each stores data in Australia, and applies strong security:

We hold the privacy and processing terms of these providers and review them as part of our annual privacy review.

Clinical records, including case notes, are accessible only to David Manks. Our Practice Manager has access to non-clinical information only, such as calendar entries and the administrative details on intake forms, and is bound by a written confidentiality agreement. Hard-copy records are held in a locked, secure-grade filing cabinet in a locked room.

Your information is used to provide psychological services, including assessing, diagnosing and treating your presenting concerns, to document your care, and to enable safe and informed continuity of care.

Your information is kept confidential and is disclosed only where one of the following applies:

We do not sell, rent or use your information for marketing. Your information is not disclosed to recipients outside Australia unless you consent or the disclosure is required by law (Australian Privacy Principle 8).

We take reasonable steps to protect your information from misuse, loss and unauthorised access, including encryption, access controls and secure storage. In the event of unauthorised access to, disclosure of, or loss of your information, we will activate our Data Breach Response Plan. Where a breach is likely to result in serious harm, we will notify you and the Office of the Australian Information Commissioner in accordance with the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth).

We retain health records for at least the period required by Health Privacy Principle 4.2: a minimum of seven years from your last appointment, or, for information collected while you were under 18, until you turn 25. We may retain records longer where there is a clinical or legal reason to do so. When records are no longer required, they are securely destroyed or de-identified.

You may request access to, and correction of, your personal information. Requests should be made in writing to David Manks and are handled under Health Privacy Principle 6 and Australian Privacy Principle 12, subject to the limited exceptions those laws allow. We will respond within 30 days and may arrange an appointment where needed for clarification.

If you have a concern about how your information is handled, please raise it with David Manks in the first instance. If your concern is not resolved, you may contact:

Dated: 10 July 2026