Privacy Policy

Last updated: 8 September 2026
This policy explains how MindLens Australia Psychology collects, uses, stores and protects your personal and health information.

1. About this policy

MindLens Australia Psychology (“MindLens”, “we”, “us”, “our”) provides psychology services by telehealth to clients across Australia. We are led by Susan Rudnick, Registered Psychologist.

We take your privacy seriously. As a health service provider we are bound by the Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs), regardless of our size. Because we are based in New South Wales we are also bound by the Health Records and Information Privacy Act 2002 (NSW). Where you are located in another state or territory, the equivalent health records legislation for that place may also apply.

As a Registered Psychologist, Susan Rudnick is additionally bound by the confidentiality obligations in the Psychology Board of Australia’s Code of Conduct and the Australian Psychological Society Code of Ethics.

This policy applies to our website at mindlenspsychology.com.au and to our psychology services.

2. Information we collect

Personal information

• Your name, date of birth, postal address, email address and phone number.
• Your emergency contact and, where relevant, your next of kin.
• Your Medicare number, private health fund details, DVA number or NDIS details where these apply to your care.
• Payment information. Card details are handled by our payment provider and are not stored by us.

Health information (sensitive information)

Health information is treated as sensitive information under the Privacy Act and is given a higher level of protection. We collect it only with your consent, or where the law otherwise allows it. This can include:

• Your reasons for seeking psychological support and what you would like to achieve from therapy.
• Your medical and mental health history, including current and past medications.
• Your GP referral, mental health treatment plan and any specialist reports.
• Clinical notes, assessment results and correspondence created during your care.

Information about other people

If you are a GP or other referrer submitting a referral through our website, you will be providing personal and health information about your patient. Please make sure you have your patient’s consent to do so before submitting the form.

Website and technical information

• Your IP address, approximate location, browser type, device type and operating system.
• The pages you visit, how long you spend on them, where you arrived from and where you go next.
• Anonymised recordings of on-page activity such as mouse movement, scrolling and clicks. See section 5.

3. How we collect it

Wherever it is reasonable and practicable, we collect personal information directly from you. We collect it when you:

• complete the appointment request, contact or referral forms on our website;
• book through our online booking provider, HealthEngine;
• call, email or message us;
• attend a telehealth session with us; or
• make a payment or claim a Medicare rebate.

We also collect information from other people where you have consented or where the law permits, for example from your GP or referring practitioner, another treating health practitioner, or a family member or carer involved in your care.

You may deal with us anonymously or under a pseudonym when making a general enquiry. This is not practicable once you become a client, because we are required to keep accurate, identified health records and because Medicare rebates cannot be claimed anonymously.

4. Why we collect and use it

We collect, hold, use and disclose your information to:

• provide psychological assessment, therapy and related care;
• keep accurate and current clinical records, as we are professionally and legally required to do;
• communicate with you about appointments, including reminders;
• correspond with your GP or referrer about your care, with your consent;
• process payments and Medicare, DVA, NDIS or health fund claims;
• manage and improve our services, including understanding how our website is used;
• meet our obligations under Australian law, including health records, privacy and taxation law.

We do not sell your personal information. We do not use your health information for advertising, and we do not upload client lists to advertising platforms.

5. Website, cookies and analytics

Our website uses cookies and similar technologies. Cookies are small files stored by your browser. Some are needed for the site to work, and others help us understand how the site is used so we can improve it.

The third party tools used on our website are:

These tools collect technical and behavioural information about your visit. They do not receive your clinical information, and we do not combine analytics data with your health record.

Your choices

• You can set your browser to refuse or delete cookies. Parts of the website may not work as intended if you do.
• You can opt out of Google Analytics using the Google Analytics Opt-out Browser Add-on.
• You can manage advertising preferences in your Meta ad settings and Google My Ad Center.
• Most browsers offer a Do Not Track or Global Privacy Control setting that you can turn on.

Our website contains links to other websites, including HealthEngine. We are not responsible for the privacy practices of those websites, and we encourage you to read their privacy policies.

6. Who we share information with

We treat your information as confidential. We disclose it only in the following circumstances:

• With your consent. Most commonly to your GP or referring practitioner, in the reports that Medicare requires us to provide, or to another treating practitioner.
• To claim your rebate. To Medicare, DVA, the NDIS or your private health fund, so that your session can be processed.
• To our service providers. Including our practice management, telehealth, email, payment and website providers, who are contractually required to protect your information and to use it only to provide their service to us.
• Where the law requires it. For example a court subpoena, a court order, or a mandatory reporting obligation.
• To lessen or prevent a serious threat. If we reasonably believe it is necessary to lessen or prevent a serious threat to your life, health or safety, or to the life, health or safety of another person, as permitted by the Privacy Act.

Where practicable, we will discuss any disclosure with you first.

7. Overseas recipients

Some of the technology providers we rely on, including the analytics and advertising providers listed in section 5 and some email and cloud services, store or process information on servers outside Australia, including in the United States. Where we disclose information to an overseas recipient we take reasonable steps to ensure it is handled in a way consistent with the Australian Privacy Principles.

Your clinical records are held in Australia.

8. Storage, security and retention

We hold your information in secure, access controlled electronic systems, and in secure physical storage where paper records exist. Our safeguards include password protection, multi factor authentication where available, encryption in transit, and limiting access to those who need it to provide your care.

No method of transmission over the internet is completely secure. Please keep in mind that email and web forms are not a secure way to send detailed sensitive information, and they should never be used in an emergency.

We are required to retain health records for a minimum period. For an adult client this is at least seven years from the date of last contact. Where a client was under 18 at the date of last contact, the record is kept until they turn 25. When information is no longer needed and we are no longer required to keep it, we destroy or de-identify it securely.

9. Accessing and correcting your information

You have the right to ask for access to the personal and health information we hold about you, and to ask us to correct it if it is inaccurate, out of date, incomplete or misleading.

To make a request, contact us using the details in section 12. We may ask you to verify your identity. We will respond within 30 days.

In limited circumstances we may decline a request, for example where giving access would pose a serious threat to the life, health or safety of any person, or where it would unreasonably affect the privacy of someone else. If we decline, we will tell you why in writing and explain how you can complain. Where appropriate, we may offer to provide the information through a mutually agreed intermediary such as your GP.

A reasonable administrative fee may apply for retrieving and copying records. We will tell you about any fee before we proceed.

10. Complaints

If you are concerned about how we have handled your information, please contact us first using the details in section 12. We take complaints seriously, we will acknowledge your complaint promptly, and we aim to resolve it within 30 days.

If you are not satisfied with our response, you can contact:

• Office of the Australian Information Commissioner (OAIC), 1300 363 992, oaic.gov.au
• Information and Privacy Commission NSW, 1800 472 679, ipc.nsw.gov.au
• Health Care Complaints Commission (NSW), 1800 043 159, hccc.nsw.gov.au, for complaints about clinical care
• AHPRA, 1300 419 495, ahpra.gov.au, for complaints about a registered practitioner

If you are outside New South Wales, the health complaints body and privacy regulator in your state or territory can also assist.

11. Changes to this policy

We review this policy from time to time and may update it to reflect changes in our services, technology or the law. The current version is always available on this page, and the date at the top shows when it was last updated. Where a change is significant, we will take reasonable steps to let current clients know.

12. Contact us

For any question about this policy, to request access to your information, or to make a complaint, contact: