Introduction
Hummingbird Psychotherapy ("we," "us," or "our") is committed to protecting the privacy of personal information, including health information that we collect and hold. This Privacy Policy outlines how we collect, use, disclose, and protect your personal information in accordance with the Australian Privacy Principles (APPs) contained in the Privacy Act 1988 (Cth).
We understand the importance of privacy in therapeutic relationships and education settings. This policy has been developed to ensure that your personal information is handled with the highest standards of confidentiality, integrity, and respect.
Scope
This Privacy Policy applies to all personal and health information collected by Hummingbird Psychotherapy through our website, in consultations, during supervision sessions, in educational programs, and through other service delivery channels.
Types of Information We Collect
Personal Information
We may collect the following types of personal information:
- Name, address, email, phone number, and other contact details
- Date of birth and demographic information
- Emergency contact details
- Financial information related to payment for services
- Professional information (for supervision and education clients)
- Referral details and information from other healthcare providers
Sensitive and Health Information
As a mental health service provider, we may collect sensitive and health information including:
- Medical history and current health status
- Mental health information and psychological assessments
- Information about substance use and psychedelic experiences
- Information related to treatment planning and progress
- Session transcripts, where you have consented to session transcription
- Other information relevant to providing our services
How We Collect Information
We collect personal and health information directly from you through:
- Intake forms and questionnaires
- Consultations and therapy sessions
- Session transcription, where you have consented (see AI-Assisted Records below)
- Supervision sessions
- Educational programs and workshops
- Written or electronic correspondence
- Our website and online booking forms
In some circumstances, we may collect information about you from third parties such as:
- Referring healthcare providers
- Other healthcare professionals involved in your care (with your consent)
- Family members or carers (with your consent)
Purpose of Collection
We collect personal and health information primarily to:
- Provide appropriate and effective therapeutic services
- Facilitate supervision and educational services
- Manage your care and maintain appropriate records
- Process payments and manage our accounts
- Communicate with you about our services
- Comply with legal and regulatory obligations
- Improve our services through quality assurance activities
- For research purposes (only with explicit consent and in de-identified form)
How We Use and Disclose Information
Hummingbird Psychotherapy uses and discloses personal information only for the primary purpose for which it was collected or for related secondary purposes that would reasonably be expected, or to which you have consented.
We may use or disclose your information for the following purposes:
- To provide therapy, supervision, or educational services
- To collaborate with other healthcare providers involved in your care (with your consent)
- To process payments and maintain our accounts
- To comply with legal obligations including mandatory reporting requirements
- For quality improvement, reflective practice, teaching, and research purposes (in de-identified form, and for research only with your explicit consent)
We will not use or disclose your personal information for direct marketing purposes.
AI-Assisted Records
With your consent, sessions may be transcribed using a secure transcription service. No audio recording is retained — only a written transcript is generated. Transcripts are processed within our secure records system to produce session summaries, and AI-assisted tools within the same system may be used to prepare summaries of your care to date. All AI-generated material is reviewed by your practitioner before it forms part of your clinical record.
AI features within our records system operate under zero-data-retention arrangements, meaning your information is not retained by, or used to train, the underlying AI providers.
Transcripts are deleted once the session summary has been completed and reviewed by your practitioner; only the summary is retained as part of your clinical record.
Session transcription is entirely optional. If you prefer not to have sessions transcribed, notes will be taken manually, and this will not affect the services you receive.
Data Security and Retention
Hummingbird Psychotherapy takes reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification, or disclosure. These measures include:
- Encryption of electronic records in transit and at rest
- Access controls limiting access to information on a need-to-know basis, protected by multi-factor authentication
- Audit logging of access to our records system
- A formal agreement with our records platform provider governing the security and handling of health information
- Physical security measures for any paper-based records
- Secure disposal of information when no longer needed
We maintain records for the periods required by law (typically 7 years after the last client contact, or until 25 years of age for clients who were minors).
Overseas Storage of Information
Hummingbird Psychotherapy's primary records system is Notion, an enterprise platform whose data is hosted in the United States on Amazon Web Services infrastructure. Client information held in this system — including intake information, clinical records, session transcripts, and session summaries — is therefore stored outside Australia. This arrangement is governed by a formal agreement with the platform provider covering the security and handling of health information, including encryption, access controls, and zero-data-retention arrangements for AI processing.
In addition, appointment and communication information may be processed overseas by our calendar and email service providers [Google, Microsoft].
We take reasonable steps to ensure that all overseas recipients handle personal information in a manner consistent with the Australian Privacy Principles, and we remain accountable for your information under Australian law.
Access and Correction
You have the right to access the personal information we hold about you and to request corrections if you believe the information is inaccurate, out of date, incomplete, irrelevant, or misleading. Requests for access or correction should be made in writing to the contact details provided below.
We will respond to requests for access or correction within 30 days. If we refuse access or correction, we will provide written reasons and information about complaint mechanisms.
We may charge a reasonable fee for providing access to records, but this fee will not be excessive and will not apply to the making of the request.
Privacy Concerns and Complaints
If you have concerns about how we handle your personal information or wish to make a complaint about a breach of the APPs, please contact us using the details below. We will acknowledge your complaint within 7 days and provide a response within 30 days.
If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or 1300 363 992.
Privacy in Special Circumstances
Psychedelic Integration Support
We understand the sensitive nature of psychedelic integration support. Information shared in these sessions is subject to the same strict confidentiality standards as all health information. We do not encourage, facilitate, or assist in obtaining illegal substances.
Clinical Supervision, Reflective Practice, and Teaching
For therapists receiving supervision, case material discussed is treated confidentially. As part of ongoing professional development, your practitioner maintains de-identified reflective practice records concerning their own experience and development as a therapist; these records do not contain identifying information. Any case material used for supervision, teaching, or training purposes is thoroughly de-identified.
Research and Education
If information is collected for research purposes, this will only occur with explicit informed consent. Data used for educational purposes will be de-identified.
Changes to This Policy
Hummingbird Psychotherapy may update this Privacy Policy from time to time to reflect changes in our information practices or regulatory requirements. Updates will be published on our website, and significant changes will be communicated directly to clients where practical.
Contact Us
If you have questions or concerns about this Privacy Policy or how we handle your personal information, please contact:
Effective Date
This Privacy Policy is effective as of 18th July 2026.