Privacy Policy

Last updated: 18 August 2026

This policy outlines the ways in which North Star Child Therapy ("North Star", "we", "us" or "our") handles the personal and health information of our clients and their parents or guardians. We take privacy seriously and are committed to protecting the personal and health information entrusted to us. We handle information in accordance with applicable privacy legislation, including the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and the Health Records Act 2001 (Vic) and Health Privacy Principles (HPPs).

Personal information is information or an opinion about an identified individual, or an individual who can reasonably be identified. This may include information such as a person’s name, address, phone number, email address and date of birth.

Sensitive information is a type of personal information and includes information about matters such as a person’s racial or ethnic origin, religious or philosophical beliefs, sexual orientation, criminal record and health information.

As a child and family therapy service, North Star may also collect relevant information about a child or young person’s physical and mental health, development, family relationships, education, behaviour, emotional wellbeing, previous treatment and other circumstances relevant to the provision of therapy. Where relevant to the child or young person’s care, we may also hold information relating to parenting arrangements, court orders, child protection involvement or other legal or family circumstances.

The sharing of personal and health information assists North Star to understand a client’s circumstances, assess their needs and suitability for services, plan and provide appropriate therapeutic support, monitor progress and meet our professional and legal obligations.

We may also collect and use personal information to:

• communicate with clients, parents and guardians;
• manage appointments and enquiries;
• maintain clinical and administrative records;
• process invoices and payments;
• communicate with other professionals involved in a client’s care where appropriate;
• manage safety, risk and duty of care; and
• comply with legal, ethical and professional requirements.

Where lawful and practicable, a person may make a general enquiry without identifying themselves or may ask to use a pseudonym. However, in some circumstances it may not be practicable for North Star to provide clinical services without sufficient identifying information, particularly where this information is required for consent, clinical records, safety, billing or legal purposes.

North Star primarily provides services to children, young people and their families. Personal and health information may therefore be collected from both the child or young person and their parent or guardian.

A child or young person’s capacity to make decisions about their personal information is considered on an individual basis, taking into account their age, maturity, understanding, circumstances and the nature of the information involved.

Where a child or young person has sufficient capacity to make decisions about their information, their privacy rights and views will be respected in accordance with applicable law. Where they do not have sufficient capacity, a parent or legal guardian may make relevant decisions on their behalf.

The way information may be shared with parents or guardians will depend on factors including the child or young person’s age and capacity, consent arrangements, clinical needs, safety considerations and legal obligations. Confidentiality and parent or guardian involvement will be discussed as part of the consent and intake process.

We collect personal and health information through a variety of means, including:

• information shared verbally by a client, parent or guardian;
• written communication received by email, SMS or letter;
• our website and online booking system;
• our practice management system, Cliniko;
• intake, consent and assessment forms;
• questionnaires or outcome measures completed as part of therapy;
• a parent or guardian of a child or young person;
• referrals from a GP, treating practitioner or other service;
• schools, allied health professionals or other people involved in a client’s care, where consent has been provided or collection is otherwise permitted by law; and
• documents or information relevant to a client’s care, such as reports or court orders, where appropriate.

Where possible, we collect personal and health information directly from the person concerned or, in the case of children and young people, from them and/or their parent or guardian.

North Star maintains social media accounts, including Instagram, for general information, education and community engagement and to provide links to our website and booking services.

We do not use social media to collect clinical information, provide therapy or manage appointments. Clients and families are encouraged not to send sensitive, personal or clinical information through social media messages or comments.

If a person chooses to contact North Star through social media, we may receive limited information associated with their account or message. Where appropriate, they will be directed to contact North Star through our usual email, telephone or booking channels.

Interaction with social media platforms is also subject to the privacy practices and policies of the relevant social media provider.

We take reasonable steps to protect the personal and health information we hold from misuse, interference, loss and unauthorised access, modification or disclosure.

North Star uses Cliniko, a third-party practice management system designed for healthcare providers, to securely manage information such as client contact details, appointments, forms, clinical records, correspondence, invoices and other practice information.

North Star’s Cliniko account data is hosted in Australia. Cliniko also uses approved third-party service providers and subprocessors to provide functions such as infrastructure, technical support, email, SMS, payment processing, monitoring and other services.

Access to North Star’s records and systems is limited to authorised persons who require access for legitimate clinical or administrative purposes.

Information may be held electronically and, where hard-copy records are required, in physical form. Reasonable administrative, technical and physical safeguards are used to protect this information.

Payment and billing information may be processed through Cliniko and third-party payment providers. North Star does not intentionally record full credit or debit card details within a client’s clinical record.

North Star retains health information in accordance with its legal and professional obligations.

Under Victorian health privacy requirements, health records will generally not be destroyed until at least seven years after the last occasion on which a health service was provided. For health information collected while an individual was under 18 years of age, records will generally be retained until the individual has reached at least 25 years of age, or longer where another applicable legal or professional requirement requires this.

When information may lawfully be destroyed and is no longer required, reasonable steps will be taken to securely destroy or permanently de-identify it.

If North Star becomes aware of a suspected privacy or security breach, we will investigate the matter and take appropriate steps to contain and respond to it.

Where a data breach is required to be notified under applicable privacy legislation, North Star will notify the relevant regulatory authority and affected individuals as required by law.

North Star will only use or disclose personal and health information for the purpose for which it was collected, for a directly related purpose that would reasonably be expected, with consent, or where the use or disclosure is otherwise permitted or required by law.

With appropriate consent, information may be shared with people involved in a client’s care, such as:

• parents or guardians;
• GPs;
• psychologists, psychiatrists or other health practitioners;
• schools or educational professionals; and
• other services or professionals involved in supporting the child or young person.

North Star may also use appropriately limited information as part of professional supervision or clinical consultation. Identifying information will be minimised where practicable, and professional supervisors and consultants are expected to maintain confidentiality.

Personal or health information may be disclosed without consent where this is required or authorised by law. This may include circumstances involving legal or court requirements, mandatory reporting obligations or serious concerns regarding the life, health or safety of a person, where disclosure is permitted or required by law.

North Star may also provide limited personal information to service providers that assist us in operating the practice, such as practice management, communications, information technology and payment providers, where this is reasonably necessary for them to provide those services.

Although North Star’s Cliniko account data is hosted in Australia, some of the third-party services used by Cliniko are located outside Australia.

As a result, limited personal information may be processed by or disclosed to service providers located overseas where this is necessary to provide services such as email, SMS, technical infrastructure, payment processing, system monitoring and support.

Cliniko currently uses subprocessors located in Australia, the United States and the United Kingdom. These providers and locations may change from time to time.

North Star takes reasonable steps to use reputable service providers and to ensure that personal information is handled in accordance with applicable privacy requirements.

You may request access to personal or health information North Star holds about you.

We may ask for information necessary to verify your identity and to identify the records you are requesting.

Requests relating to the records of a child or young person will be considered having regard to the young person’s age, maturity and capacity, the consent arrangements in place, their privacy rights and North Star’s legal obligations.

In some circumstances, access may be limited or refused where permitted or required by law. If access is refused, we will provide reasons where required.

A fee may apply to providing access to health records where permitted by law. Any fee will be in accordance with applicable Victorian requirements.

Requests for access can be made by contacting: support@northstarchildtherapy.com.au

We take reasonable steps to ensure that the personal and health information we collect, use and hold is accurate, complete, up to date and relevant.

You may request that North Star correct or update personal or health information that you believe is inaccurate, incomplete or out of date.

We will deal with requests for correction in accordance with applicable privacy legislation.

Requests for correction can be made by contacting: support@northstarchildtherapy.com.au

If you believe your personal or health information has not been handled appropriately or in accordance with applicable privacy legislation, please contact North Star in the first instance. Privacy complaints can be directed to:

North Star Child Therapy
Email: support@northstarchildtherapy.com.au

We will take your concerns seriously, investigate the matter and endeavour to respond and resolve the complaint within a reasonable timeframe. If you are not satisfied with the outcome, you may be able to make a complaint to the:

• Office of the Australian Information Commissioner (OAIC) in relation to the Privacy Act and Australian Privacy Principles; and/or
• Health Complaints Commissioner (Victoria) in relation to the handling of health information under the Health Records Act 2001 (Vic).

North Star may update this privacy policy from time to time to reflect changes to our services, information-handling practices, technology or legal requirements. The most current version of the privacy policy will be published on the North Star Child Therapy website. Where appropriate, significant changes may also be communicated directly to current clients.

If you have any questions about this privacy policy, wish to access or correct personal information, or have a privacy-related concern or complaint, please contact:

North Star Child Therapy
Email: support@northstarchildtherapy.com.au