Privacy Policy

Smiling Hearts And Minds (SHM)
ABN: 52 661 240 097
Last updated: 22 October 2026

Our Commitment to Your Privacy

At Smiling Hearts And Minds (SHM), we believe that privacy, confidentiality, dignity and trust are essential to safe, respectful and compassionate care.

We recognise that seeking counselling, psychotherapy, EMDR therapy, spiritual care or clinical supervision may involve sharing deeply personal and sensitive information. We respect the trust placed in us and take our responsibility to protect that information seriously.

We are equally committed to protecting the privacy of people who visit our website, make enquiries, participate in professional learning or purchase digital resources from our online shop.

This Privacy Policy explains:

  • What personal and sensitive information we collect.

  • Why and how we collect, use and disclose information.

  • How we manage clinical records, assessments and AI-assisted documentation.

  • How we use external technology providers, including Stripe.

  • How website cookies and digital purchases are handled.

  • How information is stored, protected and retained.

  • Your rights to access, correct and raise concerns about your information.

We aim to collect and use only the information reasonably necessary for our services, operations and legal responsibilities.

Our approach is guided by applicable Australian privacy and health-record legislation, including the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), the Health Records Act 2001 (Vic) and the Health Privacy Principles (HPPs).

Where different laws or professional obligations apply, SHM will comply with the applicable requirements.

1. About Smiling Hearts And Minds

Business name: Smiling Hearts And Minds (SHM)
Australian Business Number: 52 661 240 097
Business address: 232 Main Road East, St Albans VIC 3021, Australia
Telephone: 0449 521 397
Email: info@theshm.com.au
Website: https://theshm.com.au

SHM is a Melbourne-based practice providing counselling, psychotherapy, EMDR therapy, spiritual and pastoral care, clinical supervision, reflective practice, professional development and wellbeing-related educational resources.

Our website also includes a digital resource shop offering therapy tools, printable worksheets, guides and other downloadable resources.

This Privacy Policy applies to personal information handled in connection with our:

  • Professional consultations and clinical services.

  • Enquiries, bookings and client administration.

  • Clinical supervision and educational activities.

  • Psychological and wellbeing assessments.

  • AI-assisted clinical documentation.

  • Website and electronic communications.

  • Online shop, digital downloads and payment processing.

  • Related professional and business operations.

Different services may involve different types of information and technology providers.

2. Personal Information, Sensitive Information and Health Information

Personal information means information or an opinion about an identified individual or someone who is reasonably identifiable, whether or not the information is true or recorded in a material form.

Examples include names, contact details, dates of birth, addresses, correspondence, appointment information and purchase records.

Sensitive information includes health information and certain protected information relating to matters such as racial or ethnic origin, religious or philosophical beliefs, sexual orientation and other personal characteristics recognised under Australian privacy law.

Health information may include information about an individual’s physical or mental health, health services sought or received, assessment results, treatment history, care plans and clinical notes.

We recognise that information about emotional wellbeing, trauma, family relationships, personal identity, culture and spirituality can be particularly sensitive.

SHM applies additional care when collecting, using, storing or disclosing such information.

3. Information We May Collect

The information we collect depends on your relationship with SHM and the services you access.

3.1 General enquiries and contact information

We may collect:

  • Your name, telephone number and email address.

  • Your preferred method of communication.

  • The nature of your enquiry.

  • Information you voluntarily include in forms, messages or correspondence.

  • Appointment requests and administrative information.

You do not need to disclose a detailed clinical history simply to make an initial general enquiry.

3.2 Counselling, psychotherapy, EMDR and spiritual care

Where reasonably necessary for professional care, we may collect:

  • Identifying and contact information, including date of birth and emergency contact details.

  • Presenting concerns, personal history and goals for support.

  • Relevant psychological, emotional and physical health information.

  • Previous treatment, medication, referrals or other care information.

  • Personal, family, social, relational and cultural circumstances.

  • Religious, spiritual or philosophical information, where relevant and appropriately provided.

  • Assessment results, care plans, session notes and progress records.

  • Information relevant to safety, continuity of care and professional responsibilities.

Sensitive information is collected with consent where required by law, unless a lawful exception applies.

3.3 Clinical supervision and professional education

We may collect information about professional roles, qualifications, registrations, memberships, employment circumstances, learning objectives, attendance and relevant correspondence.

When client situations are discussed in supervision or educational contexts, identifying information should be removed wherever reasonably practicable unless disclosure is otherwise appropriately authorised.

3.4 Psychometric and wellbeing assessments

Where NovoPsych or another appropriate assessment method is used, we may collect:

  • Assessment responses.

  • Scores, outcomes and progress measures.

  • Relevant demographic and clinical information.

  • Reports and interpretation-related information.

Assessment information is considered alongside professional judgement and the circumstances of the individual. Assessment scores are not treated as a substitute for a comprehensive clinical understanding.

3.5 Digital-resource purchases

When you purchase a resource through our online shop, we may collect:

  • Your name, email address and relevant billing information.

  • Products purchased, prices, currency and order history.

  • Payment status and transaction references.

  • Refund and customer-support information.

  • Customer account details, where applicable.

  • Download permissions and related technical information.

We recognise that the purchase of a resource about mental health or emotional wellbeing may reveal or suggest personal interests or circumstances.

We handle this information with appropriate care.

Purchasing a digital resource does not, by itself, create a counselling or psychotherapy relationship with SHM.

3.6 Website and technical information

When you use our website, technical systems may collect or generate:

  • Internet Protocol (IP) addresses.

  • Browser, device and operating-system information.

  • Login and session identifiers.

  • Security and access logs.

  • Shopping-cart and checkout information.

  • Essential cookie data.

  • Information needed for website operation and troubleshooting.

The extent of this collection depends on the website features you use.

4. How We Collect Information

Where reasonable and practicable, we collect personal information directly from you.

This may occur when you:

  • Contact us by telephone, email or website form.

  • Complete an intake, booking, consent or assessment form.

  • Attend an in-person or telehealth consultation.

  • Participate in clinical supervision or professional education.

  • Complete a psychological assessment.

  • Consent to AI-assisted documentation.

  • Create a customer account or purchase a digital resource.

  • Contact us about an order, payment, refund or technical concern.

We may also receive information from referring practitioners, healthcare professionals, authorised representatives or other relevant parties where collection is consented to or otherwise permitted by law.

Where required, we will inform you about the purpose of collecting information, relevant disclosures and any important consequences of not providing it.

If unsolicited information is received, we will assess whether it can lawfully be retained and handle it in accordance with applicable privacy requirements.

5. Why We Collect, Use and Disclose Information

We use personal information for legitimate purposes connected with providing professional services and operating SHM.

These purposes include:

Professional care: Assessing enquiries, determining service suitability, providing agreed care, maintaining clinical records, managing referrals and supporting continuity of care.

Appointments and administration: Scheduling consultations, confirming bookings, maintaining client details, preparing invoices and responding to service-related communications.

Clinical supervision and education: Providing supervision, reflective practice, professional development and educational activities.

Psychometric assessment: Administering appropriate measures, reviewing results and supporting informed clinical assessment and progress monitoring.

Clinical documentation: Maintaining accurate records, including consented AI-assisted preparation of draft notes where appropriate.

Digital purchases: Managing orders, processing payments, issuing receipts, delivering download links and providing customer support.

Legal and professional obligations: Maintaining required records, responding to lawful requests, addressing complaints and fulfilling relevant ethical and regulatory responsibilities.

Website operation and security: Protecting systems, maintaining functionality, preventing fraud and resolving technical problems.

Optional communications: Sending educational updates or promotional information where permitted by law and subject to any required consent.

We do not use confidential information disclosed during therapeutic care for unrelated advertising or commercial profiling without an appropriate lawful basis and any consent required by law.

Where information is used or disclosed for a secondary purpose, we will ensure that the use or disclosure is permitted under applicable privacy requirements.

6. Consent, Choice and Informed Participation

We recognise the importance of informed choice and respect for personal autonomy.

Where required, we seek consent before collecting sensitive information, disclosing information for a particular purpose or using optional technologies.

Consent should be voluntary, informed, current, specific to the circumstances and provided by a person with the relevant decision-making capacity.

You may ask questions before giving consent and may decline an optional activity.

You may also withdraw consent where legally and practically permitted. Withdrawal generally applies to future activities and does not automatically reverse lawful processing already completed or require deletion of records SHM must retain.

Where an activity requires separate consent, the publication of this Privacy Policy does not replace that consent.

7. Confidentiality and Its Limits

Confidentiality is fundamental to our professional relationships.

Information shared during counselling, psychotherapy, EMDR therapy, spiritual care or other professional services is not ordinarily disclosed to family members, employers, organisations or other third parties without valid consent or another lawful basis.

However, confidentiality is subject to legal and professional limits.

Disclosure may be required or permitted where:

  • You have provided valid consent.

  • Disclosure is required or authorised by legislation, a valid court order or other legally binding process.

  • Mandatory reporting obligations apply.

  • There is a serious threat to life, health or safety and the relevant legal conditions for disclosure are met.

  • Disclosure is otherwise permitted by applicable privacy or health-record laws for an appropriate purpose.

We consider the lawful basis, necessity and scope of any disclosure and aim to share only information reasonably necessary for the relevant purpose.

Where appropriate and legally permitted, we will explain the disclosure to you.

Further details about clinical confidentiality and informed consent may be provided through our client intake and service-consent processes.

8. Clinical Records and Zanda Health

SHM uses Zanda Health for practice management and clinical record administration.

Depending on the service, Zanda Health may be used for:

  • Client profiles and contact details.

  • Bookings, appointments and practice administration.

  • Intake and consent documents.

  • Clinical session notes and related records.

  • Client communications and relevant billing functions.

  • Other enabled practice-management features.

Zanda states that Australian practice accounts generally use Australian-hosted infrastructure for core practice data, while certain authorised support activities, AI processing or third-party integrations may involve access or processing outside Australia.

SHM remains responsible for its own privacy obligations, appropriate account configuration, professional confidentiality and the lawful handling of client information.

Provider privacy information:
https://zandahealth.com/privacy-policy/

9. Psychological Assessments and NovoPsych

SHM uses NovoPsych to support appropriate psychometric and wellbeing assessments.

Information handled through the platform may include questionnaire responses, assessment scores, reports, progress measures and related clinical details.

NovoPsych may be used to assist assessment, care planning, professional reflection and monitoring of changes over time.

The practitioner remains responsible for selecting appropriate measures, considering their limitations and interpreting results in the context of the individual.

NovoPsych states that patient information is generally stored in Australia unless different arrangements apply. Some non-patient account, service or technical information may be processed in other jurisdictions.

Where clinically appropriate and technically supported, assessment information may be linked with other clinical documentation systems used by SHM, subject to relevant privacy and consent requirements.

Provider privacy information:
https://novopsych.com/security/

10. AI-Assisted Clinical Documentation

SHM may use AI-assisted tools to help prepare clinical notes and related professional documentation.

Depending on the service and the tools in use, these may include:

  • AI documentation features within Zanda Health.

  • NovoNote, provided by NovoPsych.

  • Heidi Health.

These tools may assist with converting session audio into text, preparing summaries, organising information or drafting clinical notes.

10.1 We obtain consent before using AI-assisted session documentation

SHM uses AI-assisted transcription or session note-taking only with appropriate informed consent.

Before use, your practitioner will explain the purpose of the technology and relevant information-handling considerations, including the tool being used and whether session audio will be processed.

You will have an opportunity to ask questions and decide whether you agree.

Consent is documented through an appropriate consent process.

You may:

  • Agree to AI-assisted note-taking.

  • Decline its use.

  • Request clarification about the technology.

  • Withdraw consent to future AI-assisted session documentation.

Declining AI-assisted note-taking does not prevent you from receiving otherwise available professional care.

Where AI-assisted documentation is declined, the practitioner may use ordinary professional note-taking methods instead.

10.2 How audio, transcripts and notes may be handled

Depending on the technology and its configuration, AI-assisted documentation may involve:

  • Temporarily capturing or processing consultation audio.

  • Converting speech into a written transcript.

  • Generating a draft clinical summary.

  • Allowing the practitioner to review and correct the draft.

  • Saving an approved clinical note in the appropriate record system.

Temporary audio processing is still a privacy-relevant use of session information, even when the provider does not retain a permanent audio recording.

Different providers have different practices concerning audio, transcripts, draft notes and retention periods.

For example, a provider may temporarily process audio and delete it after transcription, while a transcript may remain available for a period determined by the product and its settings.

We aim to explain these arrangements when obtaining consent and to configure systems consistently with the purpose of the service, applicable law and our professional responsibilities.

We do not represent that every AI provider follows an identical deletion process.

10.3 Human review and professional responsibility

AI-generated documentation may contain errors, omissions or inaccuracies.

The practitioner remains responsible for reviewing, correcting and approving clinical notes before relying on them.

AI is used to support administrative documentation, not to replace professional clinical judgement or the therapeutic relationship.

10.4 AI model training and secondary use

SHM does not authorise the use of identifiable confidential client information for unrelated advertising or general-purpose AI model training.

The relevant AI providers publish their own commitments and arrangements concerning patient information, model training, data retention and security.

SHM seeks to use these services consistently with their applicable privacy and contractual arrangements and to review relevant changes.

We do not assume that removing direct identifiers automatically eliminates every privacy risk.

10.5 Withdrawal of consent

If you withdraw consent, SHM will stop the relevant optional AI-assisted processing for future sessions or uses covered by that withdrawal, subject to applicable requirements.

Withdrawal does not necessarily require the destruction of completed clinical records or historical notes that must lawfully be retained.

Where practicable and appropriate, you may ask us about the handling of temporary information created during earlier sessions.

10.6 AI service providers

Zanda Health:
https://zandahealth.com/privacy-policy/

NovoNote:
https://novopsych.com/novonote-privacy-policy-security/

Heidi Health:
https://www.heidihealth.com/legal/privacy-policy

11. Telehealth, Email and Electronic Communications

SHM may provide appropriate professional services through telehealth or other electronic communication methods.

Telehealth technologies may process information necessary to establish and maintain a consultation, such as connection details, device information and audio or video transmitted during a session.

We will identify relevant platforms and provide additional information where appropriate.

Telehealth sessions are not routinely recorded by SHM without appropriate notice and consent. Where consented AI documentation is used, the relevant audio-processing arrangements are explained separately as described above.

Gmail and Google

SHM uses Gmail, provided by Google, for business email correspondence.

When you email us, the information processed may include your name, email address, message contents, attachments and related technical information.

Google operates international infrastructure, and email information may be processed outside Australia.

Ordinary email is not guaranteed to provide the same confidentiality safeguards as a dedicated clinical record system.

We encourage you not to send detailed clinical histories, highly sensitive documents or urgent safety-related information through a general website enquiry or ordinary email unless an appropriate method has been agreed.

Google Privacy Policy:
https://policies.google.com/privacy

12. Website Hosting and GoDaddy

SHM uses GoDaddy for website hosting and related infrastructure.

Hosting and website operations may involve processing information such as:

  • IP addresses and connection data.

  • Website access, performance and security logs.

  • Information submitted through the website.

  • WordPress and WooCommerce operational information.

  • Technical data used for maintenance, security and troubleshooting.

GoDaddy operates internationally and may transfer certain information outside Australia.

SHM aims to avoid collecting detailed clinical information through general website infrastructure where dedicated professional systems are more appropriate.

GoDaddy Privacy Information:
https://www.godaddy.com/en-au/legal/agreements/privacy-policy

13. Online Shop, WooCommerce and Digital Downloads

Our digital resource shop operates through WooCommerce on WordPress.

When you purchase a product, information may be processed to:

  • Create and administer your order.

  • Identify the purchased products.

  • Confirm payment status.

  • Issue receipts and order notifications.

  • Provide digital download permissions and links.

  • Maintain necessary purchase records.

  • Respond to customer-support or refund enquiries.

  • Detect suspicious or unauthorised activity.

If customer accounts are enabled and you choose to register, relevant account information may be stored for account administration.

A request to close an account does not automatically require deletion of purchase or transaction records that SHM must retain under applicable law.

Digital-resource purchases and clinical records are handled for different purposes. A purchase is not automatically incorporated into a therapeutic health record simply because the resource relates to mental health.

However, purchasing a mental-health-related resource can reveal personal information or suggest sensitive interests. We therefore seek to limit unnecessary use or disclosure of purchase histories.

We do not sell customer lists or digital-product purchase histories to advertising networks or data brokers.

14. Payment Processing and Stripe

SHM uses Stripe for supported online payments, including purchases through our WooCommerce digital shop.

When you initiate or complete a payment, Stripe may collect and process information such as:

  • Your name and relevant billing or contact details.

  • Payment-card or selected payment-method information.

  • Transaction amount, currency, date and payment status.

  • Order and transaction identifiers.

  • IP address, device information and related security signals.

  • Information necessary to prevent fraud or manage payment disputes.

  • Certain merchant, product or order information, depending on the integration.

Stripe may share relevant information with payment networks, banks, financial institutions and other parties involved in processing or securing a transaction.

SHM does not intentionally collect or store full payment-card numbers or card security codes (CVC/CVV) in its WooCommerce database.

Sensitive card information is handled through the relevant Stripe payment infrastructure.

SHM may retain information such as the order value, payment status, transaction reference, receipt, refund history and related administrative records.

Stripe may also process information for its own lawful purposes, including fraud prevention, security, regulatory compliance and the provision of its services.

A transaction with SHM may indicate that a person has purchased a counselling-related service or wellbeing resource. We aim to minimise unnecessary sensitive information in payment descriptions and other payment-provider records.

Stripe Privacy Policy:
https://stripe.com/au/privacy

Other payment services used through separate appointment-booking arrangements may be governed by their own terms and privacy policies, which should be reviewed when using those services.

15. Cookies, Website Functionality and Tracking Technologies

SHM aims to minimise unnecessary tracking and protect visitors’ privacy.

Our website may use cookies and similar technologies that are necessary to maintain functionality, support secure transactions and protect systems against unauthorised access.

15.1 Essential and functional cookies

WordPress, WooCommerce, Stripe and relevant hosting or security services may use cookies or other technical identifiers to:

  • Maintain shopping-cart contents and checkout sessions.

  • Manage customer account logins.

  • Support website preferences and functionality.

  • Authenticate and secure payments.

  • Detect suspicious activity or fraudulent transactions.

  • Support the reliable operation of the website.

These technologies are primarily used for website functionality and transaction security.

15.2 Stripe payment-security technologies

Stripe may use cookies, device identifiers and similar technologies to authenticate payments, detect fraud and protect transactions.

These may operate when a payment form or payment-related service is used, even though SHM does not run advertising or remarketing campaigns.

15.3 Analytics and advertising

As at the date of this policy, SHM has not intentionally enabled Google Analytics, Google Ads tracking, Meta Pixel, remarketing pixels or dedicated behavioural advertising trackers on its website.

SHM does not currently use website browsing activity or digital-resource purchase histories to deliver targeted advertisements.

However, essential website services, embedded functionality, payment providers or other third parties may use their own technical identifiers in accordance with their applicable arrangements.

The absence of dedicated advertising or analytics tools does not mean the website is entirely free of cookies or other technical data processing.

15.4 Managing cookies

You can manage, restrict or delete cookies through your browser settings.

Disabling essential cookies may interfere with shopping-cart, checkout, payment, login or other website functions.

If SHM introduces additional non-essential analytics or advertising technologies, we will review the privacy implications and update relevant notices or consent arrangements where required.

16. When We Share Personal Information

SHM may disclose limited personal information to service providers or other recipients where reasonably necessary, consented to or otherwise permitted or required by law.

Depending on the circumstances, recipients may include:

  • Zanda Health for practice management and clinical administration.

  • NovoPsych for assessment-related functions.

  • NovoNote and Heidi Health for appropriately consented AI-assisted documentation.

  • Google for relevant email services.

  • GoDaddy for website hosting and technical infrastructure.

  • WooCommerce-related website and technical service providers.

  • Stripe, banks and payment networks for payment processing.

  • Referring practitioners or other healthcare professionals where authorised or permitted.

  • Appropriate professional advisers, including accountants, legal advisers and insurers.

  • Courts, regulators, emergency services or other authorities where legally required or authorised.

We seek to limit disclosures to the information reasonably necessary for the particular purpose.

SHM does not sell confidential clinical records or personal information to data brokers or advertisers.

Where third parties process information for SHM, we seek to use arrangements and safeguards appropriate to the information involved.

17. Overseas Storage, Access and Disclosure

SHM uses a combination of Australian-based clinical platforms and internationally operated technology services.

The location at which information is stored may differ from the location at which it is accessed, supported or temporarily processed.

For example:

  • Zanda Health states that core data for Australian practice accounts is generally stored in Australia, subject to specified circumstances involving support, AI processing and third-party integrations.

  • NovoPsych and NovoNote describe Australian storage arrangements for relevant patient information, while some account, service or technical information may be handled in other jurisdictions.

  • Heidi Health describes regional data-localisation arrangements, although some services may involve international subprocessors.

  • GoDaddy operates internationally and may transfer personal information to the United States and other jurisdictions.

  • Google operates infrastructure internationally and may process information outside Australia.

  • Stripe operates internationally and may share or process transaction information across relevant payment and service-provider networks.

Based on the published arrangements of relevant providers, overseas recipients may be located in the United States, United Kingdom and Ireland, and other countries may be involved depending on the service, provider arrangements and account configuration.

Not every category of information is disclosed to every provider or country. In particular, clinical records, payment information, website activity and business email are processed through different systems.

We take reasonable steps required by applicable Australian privacy law in relation to overseas disclosures, including APP 8 and relevant Victorian health privacy obligations.

The laws and privacy protections in overseas jurisdictions may differ from those in Australia.

If you would like further information about the overseas handling of information associated with a particular SHM service, please contact us.

18. How We Protect Your Information

SHM takes reasonable steps appropriate to the nature and sensitivity of personal information to protect it against misuse, interference, loss, unauthorised access, modification and disclosure.

Our information-management arrangements include the use of professional clinical systems such as Zanda Health and NovoPsych, together with relevant security controls provided by those systems.

Depending on the information and system involved, protective measures may include:

  • Restricting access to authorised users.

  • Authentication and appropriate account permissions.

  • Encryption and secure transmission provided by relevant platforms.

  • Appropriate management of clinical and administrative records.

  • Secure handling of communications and payment information.

  • Software, website and system maintenance.

  • Backups and recovery arrangements.

  • Review of technology providers and data-handling risks.

  • Appropriate response to suspected privacy and security incidents.

  • Secure destruction or de-identification where lawful and appropriate.

The implementation of particular technical safeguards may vary between systems and service providers.

We recognise that no electronic system or method of internet transmission can be guaranteed to be completely secure.

SHM remains responsible for taking reasonable steps in selecting, configuring and using external systems appropriately.

19. Data Breaches and Security Incidents

If SHM becomes aware of a suspected privacy or data-security incident, we will assess the circumstances and take appropriate steps to contain, investigate and address the issue.

This may involve:

  • Restricting unauthorised access.

  • Investigating the nature and extent of the incident.

  • Assessing the potential risk of harm.

  • Working with relevant technology providers.

  • Taking corrective or protective action.

  • Notifying individuals and regulators where required by law.

Where the Australian Notifiable Data Breaches scheme applies, SHM will assess suspected eligible breaches and comply with relevant notification requirements.

We will also consider any additional obligations arising under applicable Victorian health privacy legislation or professional responsibilities.

20. How Long We Retain Information

SHM retains personal information for as long as reasonably necessary for the purpose for which it was collected, or as required or authorised by law.

20.1 Clinical and health records

Applicable Victorian health-record requirements generally prevent a private health service provider from deleting health information until:

  • At least seven years have passed since the individual was last provided with a health service; or

  • Where the individual was last provided with a health service as a child, the individual has reached at least 25 years of age.

Other legal, professional or record-keeping obligations may require longer retention.

Accordingly, clinical records cannot necessarily be deleted on request or immediately after treatment concludes.

20.2 Assessments and AI-assisted documentation

Psychometric assessment results and approved clinical notes may form part of the relevant clinical record and are retained according to applicable obligations.

Temporary audio, transcripts and draft AI documentation may be subject to different provider-specific retention and deletion practices.

A temporary transcript or audio file being deleted does not necessarily result in deletion of a final clinical note lawfully retained by SHM.

20.3 Financial and digital purchase records

Invoices, orders, payment confirmations, refunds and relevant accounting records are retained for periods required by applicable taxation, accounting, consumer protection and other laws.

20.4 Enquiries and technical information

General enquiries, customer-account information, website logs and administrative records are retained according to their purpose and any relevant legal or operational requirements.

When information is no longer needed and no legal or otherwise permitted reason to retain it remains, SHM takes reasonable steps to securely destroy or de-identify it.

21. Accessing Your Personal and Health Information

You may request access to personal or health information SHM holds about you.

Requests can be sent to:

Email: info@theshm.com.au
Subject: Privacy – Access Request

We may ask you to verify your identity or legal authority before providing access, particularly where confidential clinical information is involved.

We will assess requests in accordance with the Australian Privacy Principles, Victorian health-record requirements and other applicable laws.

Access may be restricted or refused in circumstances permitted by law, including where disclosure would create a legally recognised safety risk or improperly reveal another person’s confidential information.

Where access is refused or limited, we will explain the reasons and available options where required.

We do not charge merely for submitting an access request.

Reasonable fees may apply to the provision of access to or copies of certain health records, subject to applicable statutory limits. We will explain relevant fees before proceeding.

22. Correcting Your Information

SHM takes reasonable steps to maintain accurate, complete, up-to-date and relevant personal information.

If you believe information we hold is incorrect, incomplete, outdated or misleading, you may request a correction.

Email: info@theshm.com.au
Subject: Privacy – Correction Request

We will consider the request in accordance with applicable law.

In some circumstances, a historical clinical record must be preserved to maintain an accurate record of professional care.

Where a correction is not made, you may be entitled to have a statement of your requested correction attached to the relevant record.

We do not charge a fee merely for requesting correction of health information.

23. Your Privacy Rights and Choices

Subject to applicable law, you may:

  • Ask what personal information SHM holds about you.

  • Request access to your information.

  • Request correction of inaccurate information.

  • Ask how and why information has been collected, used or disclosed.

  • Decline or withdraw consent to optional AI-assisted clinical documentation.

  • Withdraw other optional consent where legally permitted.

  • Opt out of promotional communications.

  • Request deletion or de-identification where lawful and appropriate.

  • Make a privacy enquiry or complaint.

  • Ask about relevant third-party or overseas information handling.

Where lawful and practicable, you may make a general enquiry anonymously or using a pseudonym.

However, sufficient identifying information may be necessary to provide professional care, verify records, manage secure appointments or complete online payments.

Withdrawal of consent or a deletion request does not override statutory record-retention requirements.

24. Children and Young People

SHM recognises the particular privacy needs of children and young people.

Where services involve minors, we consider relevant consent requirements, age, maturity, decision-making capacity, confidentiality and applicable law.

A parent, guardian or other authorised person may need to be involved depending on the circumstances.

However, parental status does not automatically provide unrestricted access to all confidential health information relating to a young person.

Requests for access or disclosure are considered in accordance with applicable laws and the circumstances of the individual.

We encourage appropriate adult support when children interact with online forms or digital purchasing functions.

25. Automated Processing and Decision-Making

Some of the technology services used by SHM involve automated processes.

Examples include:

  • Payment authorisation, transaction screening and fraud detection.

  • WooCommerce order confirmation and digital download permissions.

  • Website security and spam detection.

  • Routine booking or administrative notifications.

  • AI-assisted preparation of draft clinical documentation, where appropriate informed consent has been obtained.

Automated payment and security systems may use information such as transaction details, billing information, IP addresses, device identifiers and fraud-related signals.

These processes may contribute to a payment being approved, declined or referred for additional review, which may affect the immediate completion of an online purchase.

AI-assisted clinical documentation may process consultation information to prepare a draft, but the practitioner remains responsible for reviewing it and making professional decisions.

SHM does not use AI-generated session notes as a substitute for human clinical judgement.

From 10 December 2026, additional transparency obligations under APP 1 apply in prescribed circumstances where automated systems use personal information to make, or substantially and directly inform, decisions that could significantly affect an individual’s rights or interests.

SHM will review relevant systems against these requirements and provide information about applicable categories of decisions and personal information where legally required.

If you are concerned about an automated payment or administrative outcome, you may contact SHM for clarification or assistance.

26. Marketing and Service Communications

SHM may send communications necessary to respond to enquiries, administer professional services or complete purchases.

These may include:

  • Appointment confirmations and service information.

  • Responses to enquiries.

  • Invoices, payment receipts and relevant reminders.

  • Digital download links.

  • Important account, security or policy updates.

These communications are separate from optional marketing.

SHM does not currently use dedicated website advertising or remarketing trackers.

Where newsletters or promotional communications are offered, SHM will comply with applicable electronic-marketing requirements, including consent and unsubscribe obligations.

We do not treat a digital-resource purchase as unlimited permission to send unrelated promotional messages.

Confidential clinical information is not used for unrelated direct marketing without an appropriate lawful basis and any required consent.

27. Third-Party Websites and Services

Our website may contain links to external booking platforms, payment providers or other websites.

When you access an external service, that provider may collect and process information under its own privacy policy.

We encourage you to review relevant third-party privacy information before submitting personal or sensitive information.

SHM remains responsible for its own privacy obligations and for taking reasonable steps concerning providers engaged to deliver its services.

28. Privacy Enquiries and Complaints

We take privacy concerns seriously and aim to address them respectfully, fairly and promptly.

If you believe your information has been mishandled, or you have questions about this policy, please contact:

Privacy Contact
Smiling Hearts And Minds
232 Main Road East
St Albans VIC 3021
Australia

Email: info@theshm.com.au
Telephone: 0449 521 397

Please use the subject line:

Privacy Enquiry – Confidential

Describe your concern and, where possible, the outcome you are seeking.

SHM will consider the concern, investigate where appropriate and aim to provide a substantive response within 30 days.

If further time is reasonably necessary, we will explain the delay.

If you are dissatisfied with our response, or we do not respond within an appropriate period, you may be entitled to contact the relevant privacy or health complaints authority.

Office of the Australian Information Commissioner (OAIC)
https://www.oaic.gov.au/

Health Complaints Commissioner – Victoria
https://hcc.vic.gov.au/

These authorities have different jurisdictions and responsibilities. The appropriate complaint process depends on the nature of the matter.

29. Changes to This Privacy Policy

SHM may review or update this Privacy Policy to reflect changes in:

  • Australian privacy and health-record legislation.

  • Professional responsibilities.

  • Services provided by SHM.

  • Technology and AI systems.

  • Payment and website functionality.

  • Service-provider arrangements.

  • Information-handling and security practices.

The latest version will be published at:

https://theshm.com.au/privacy-policy/

The date at the beginning of this policy identifies its most recent update.

Where a change materially affects how information is handled, SHM will provide additional notice where appropriate or required by law.

30. Contact Smiling Hearts And Minds

If you have questions about your privacy, confidentiality, clinical records, AI-assisted documentation, online payments, digital-resource purchases or this policy, please contact us.

Smiling Hearts And Minds (SHM)
ABN: 52 661 240 097

232 Main Road East
St Albans VIC 3021
Australia

Phone: 0449 521 397
Email: info@theshm.com.au
Website: https://theshm.com.au

At Smiling Hearts And Minds, protecting personal information is part of respecting the person behind it.

We are committed to handling your information with care, transparency, professional integrity and accountability.