Privacy Policy

Keir Mathews Mental Health & Wellbeing (ABN 80617201533)

Last updated: 6 October 2026

I am committed to protecting your privacy and handling your personal information with care. I handle your information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs) and applicable Victorian privacy legislation, including the Health Records Act 2001 (Vic).

This Privacy Policy explains what information I collect and keep, why I collect it, how I protect it, when it may be shared, and how you can access or correct information I hold about you.

What is personal information
Personal information is information that identifies you or could reasonably be used to identify you.

Some personal information is considered sensitive information under privacy law. This includes health information, as well as information about matters such as disability, racial or ethnic background, sexual orientation, religious or philosophical beliefs and criminal history. Sensitive information has additional privacy protections.

What information do I collect and keep?
The information I collect depends on your circumstances and the services I provide. It may include:

  • your name, date of birth, address, telephone number and email address

  • Medicare, private health insurance and payment information

  • referral and appointment information

  • information about your physical and mental health and wellbeing

  • information about your relationships, family, work and personal circumstances

  • information about previous treatment, support or services

  • information you provide through forms, questionnaires, emails, text messages or other correspondence

  • clinical notes and records of appointments

  • relevant information provided by other people or organisations involved in your care, where authorised or otherwise permitted or required by law.

Your clinical record may include information you provide during appointments, my clinical notes and observations, information relevant to your care, and relevant information provided by other health professionals or people involved in your care.

I keep records to help me provide safe and appropriate care, understand your circumstances over time, communicate effectively with you and, where appropriate, coordinate your care with other services.

How do I collect your information?

I generally collect information directly from you when you:

  • make an enquiry or appointment

  • complete an online form or questionnaire

  • attend an appointment in person or by telehealth

  • communicate with me by telephone, email, text message or other correspondence

  • provide information as part of your ongoing care.

Where appropriate and authorised, I may also collect relevant information from your GP, psychiatrist, paediatrician, another health professional or another person or organisation involved in your care or support.

Why do I collect and use your information?

I collect, hold and use your personal information to:

  • provide counselling, psychotherapy and mental health services

  • understand your circumstances and provide appropriate care

  • communicate with you about appointments and your care

  • coordinate your care with other health professionals or services, where appropriate

  • process payments, Medicare and private health insurance claims

  • meet legal, professional and regulatory obligations

  • manage my practice.

I do not use your personal information for marketing and I do not send newsletters or promotional material.

Professional standards

I am an Accredited Mental Health Social Worker and a member of the Australian Association of Social Workers (AASW). My practice follows the AASW Code of Ethics, including its requirements for confidentiality, informed consent and record keeping.

Confidentiality and disclosure

Information you share during counselling or psychotherapy is treated as confidential.

In most circumstances, I will only share your personal information with another person or organisation with your consent. This may include your GP, psychiatrist, another health professional, family member or carer, insurer, compensation agency or another organisation involved in your care or support.

There are limited circumstances in which information may need to be disclosed without your consent. These may include:

  • where disclosure is required or authorised by law

  • in response to a court order, subpoena or other legal requirement

  • where a mandatory reporting obligation applies

  • where disclosure is necessary to address a serious threat to the life, health or safety of you or another person.

I may also need to disclose information to service providers that help me operate my practice, such as providers of practice management, telehealth, email, website hosting, payment processing and other technology services.

Where appropriate and safe to do so, I will discuss a proposed disclosure with you beforehand.

Professional supervision and consultation

From time to time, I may discuss aspects of my professional practice with a supervisor or professional colleague for professional supervision, consultation or quality improvement.

Where client information is discussed, I take reasonable steps to protect your privacy and de-identify information where appropriate.

Third-party services and information stored overseas

I use trusted third-party services to help operate my practice and provide services to you. These include:

  • Halaxy for practice management, clinical records, appointment scheduling, telehealth and some payment and claiming services

  • Google Workspace for email and other business services

  • Squarespace for my website

  • Airwallex for payments made through Halaxy Auto Payments

  • HICAPS for eligible health insurance claims and payments.

Some of these providers, or their technology partners, may handle personal information outside Australia. This may include providers in the United States and other countries where their services or technology partners operate.

Halaxy’s published information states that Australian practitioner data is stored in Australia, although some Halaxy services use overseas third-party providers. Google Workspace and Squarespace may also process or transfer information outside Australia.

I take reasonable steps to ensure that personal information handled by third-party providers is appropriately protected.

Website and online services

When you use my website, you may provide personal information through online forms, such as your name, contact details and any information you include in an enquiry.

My website may also collect limited technical information, such as your IP address and information about how the website is used, through cookies and similar technologies.

My website is hosted by Squarespace, which may process or transfer information outside Australia.

External websites linked from my website have their own privacy practices and privacy policies.

How is your information stored and protected?

Your personal information may be held in physical records, on my computer systems, in cloud storage and through the third-party systems I use to operate my practice.

While I take reasonable steps to protect your information, no electronic storage or transmission system can be guaranteed to be completely secure.

How long is your information kept?

I retain health records for the periods required under applicable legislation and professional requirements.

I also retain information for as long as reasonably necessary to provide services and meet my legal, professional and business obligations.

When information is no longer required, I take reasonable steps to securely destroy it or permanently de-identify it.

Accessing and correcting your information

You can request access to personal information I hold about you and ask me to correct it if you believe it is inaccurate, incomplete, out of date, irrelevant or misleading.

You can contact me at hello@keirmathews.au. I may ask you to provide reasonable identification to protect your privacy. If someone is requesting records on your behalf, or on behalf of a deceased client, I will ask for evidence of their authority.

I will generally respond to an access or correction request within 30 days, in accordance with applicable privacy laws.

In some circumstances, I may be permitted or required to refuse access to some or all of the information requested. If this occurs, I will provide you with written reasons where required by law.

Data breaches

I take reasonable steps to protect your personal information from unauthorised access, loss, misuse or disclosure.

If a data breach occurs that is required to be notified under applicable privacy laws, I will take the required steps to respond to the breach and notify affected individuals and the relevant regulator where required.

Privacy concerns and complaints

If you have a question, concern or complaint about how I have handled your personal information, please contact me:

Keir Mathews
Email: hello@keirmathews.au
Phone: 0405 050 320

I will consider your concern and take reasonable steps to resolve it.

If you are not satisfied with my response, you can contact the Office of the Australian Information Commissioner (OAIC):

Phone: 1300 363 992
Email: enquiries@oaic.gov.au
Post: GPO Box 5288, Sydney NSW 2001

Review of this policy

This Privacy Policy is available on my website.

I review this policy periodically and update it when necessary to reflect changes in legislation, technology or the way I handle personal information.