Who this is about
Paul King, trading as Paul King Counselling (ABN 85 802 729 431), a sole practitioner providing online counselling from New South Wales. Registered Counsellor with the Australian Counselling Association, membership R83348.
Contact: paul@paulkingcounselling.com.au
As a health service provider I'm bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and by the Health Records and Information Privacy Act 2002 (NSW). These apply to me regardless of the size of my practice.
What I collect
| Type | Examples |
|---|---|
| Contact details | Name, email, phone, address |
| Safety details | Emergency contact, your GP, the address you attend sessions from |
| Health information | What brings you to counselling, relevant history, session notes, any risk information |
| Payment details | Invoices and payment records. Card numbers are handled by the payment provider and are never seen or stored by me |
Health information is treated as sensitive information under the Privacy Act. I collect it only with your consent and only where it's reasonably necessary for me to provide counselling.
Why I ask for your address and emergency contact
Because we meet online, I can't physically reach you. If you were ever at serious risk during a session, I'd need to be able to direct emergency services to you or contact someone who can help. That's the only reason I hold this information.
How I collect it
Directly from you — through the intake form, in our sessions, and by email or phone. If I ever need to collect information about you from someone else (for example a GP), I'll ask your permission first, unless there's a serious risk to safety that makes that impossible.
What I use it for
- Providing counselling to you
- Keeping accurate clinical records, as I'm professionally and legally required to do
- Arranging appointments and sending reminders
- Invoicing and payment
- Responding to your enquiries
I don't use your information for marketing. I don't sell it. I don't share it with anyone for any commercial purpose.
When I might share it
What you tell me stays between us, with a small number of exceptions you're entitled to know about upfront:
- Serious and imminent risk. If there's a serious risk to your life or safety, or someone else's, I may contact emergency services or your emergency contact.
- A child at risk of significant harm. I have legal obligations to report this.
- Where the law requires it — for example, if my records are subpoenaed by a court.
- Clinical supervision. I discuss my work with a supervisor using no identifying details. My supervisor is bound by the same confidentiality.
- With your consent — for example, if you ask me to write to your GP.
Wherever it's possible and safe, I'll talk with you first and tell you what I'm doing and why.
The services I use
Running a practice means using software, and those providers handle some of your information on my behalf. I choose them with your privacy in mind.
| Service | What it handles |
|---|---|
| Halaxy | Appointments, your client record, clinical notes, invoicing |
| Halaxy Telehealth | The video session itself. Sessions are never recorded. |
| Google Workspace | Email correspondence with you |
| Braintree | Card processing, through Halaxy. I never see or store your card number. |
Your clinical records are stored in Australia. Halaxy holds Australian practice data on Australian servers, encrypted at rest and in transit, and card details are held by the payment provider rather than alongside your health records.
The exception is email. Google Workspace may store or process correspondence outside Australia — one of the reasons I ask that email be kept to practical matters like arranging appointments rather than anything personal.
AI-assisted notes
With your explicit consent, I may use a secure transcription tool built into Halaxy that listens to our session and drafts my notes, so I can give you my full attention rather than writing while you talk.
- The audio is processed to produce the note and is not kept afterwards.
- Only the written note is stored, in my secure practice records.
- I read and correct every note. I remain fully responsible for what's recorded.
- I'll tell you each time before I turn it on.
This is entirely optional. You can decline now or at any point later, including part-way through a session, without giving a reason. If you decline, I write my notes by hand. Your choice makes no difference to your session or to how I work with you.
No session recordings
I don't record sessions — not video, not audio — and I'd ask that you don't either. If there were ever a specific reason to, it would only happen with your written consent and for a clearly agreed purpose.
How I keep it safe
- Records are held in Halaxy — encrypted, access-controlled, on Australian servers — not on my own computer.
- Devices are password protected with multi-factor authentication enabled.
- I'm the only person with access to your records.
- I don't discuss personal health information over ordinary email or text. Please keep email to practical matters like arranging appointments — it isn't a secure channel.
- I take sessions from a private room where I can't be overheard.
How long I keep it
I'm required to keep clinical records for seven years from the date of our last session. For anyone who was under 18 at the time, records are kept until their 25th birthday. After that they're securely destroyed.
Seeing and correcting your records
You have the right to ask for a copy of the information I hold about you, and to ask me to correct anything that's wrong. Just email me. I'll respond within 30 days.
There are narrow circumstances where I might not be able to release everything — for example if doing so would pose a serious risk to someone's life or health, or reveal information about another person. If that ever applied, I'd explain why in writing and look for another way to give you what you need, such as talking it through together.
I don't charge for a request to correct your records. If a request for access involves substantial work, I may charge a reasonable cost, and I'd tell you before doing anything.
If something goes wrong
If your information were ever lost or accessed without authorisation, and it were likely to cause you serious harm, I'm required to tell you and to notify the Office of the Australian Information Commissioner.
This website
My website doesn't use tracking cookies or analytics, and doesn't collect information about you when you visit. If you email me from the site, I hold that message the same way as any other correspondence.
Complaints
If you're unhappy with how I've handled your information, please tell me first — email me and I'll respond within 30 days. I'd genuinely rather hear it and put it right.
If you're not satisfied with my response, you can take it further:
- Office of the Australian Information Commissioner — 1300 363 992, oaic.gov.au
- NSW Information and Privacy Commission — 1800 472 679, ipc.nsw.gov.au
- Health Care Complaints Commission (NSW) — 1800 043 159, hccc.nsw.gov.au
Changes
I'll update this policy when my practice or the services I use change. The date at the top shows when it was last revised.