Privacy Policy

A Beautiful Mess Counselling & Psychotherapy (ABM) respects your privacy and recognises that the information you share in counselling is personal and sensitive.

This Privacy Policy explains how I collect, use, store, protect and disclose personal and health information when providing counselling and psychotherapy services.

Last updated: October, 2026

1. About this policy

A Beautiful Mess Counselling & Psychotherapy (ABM) handles personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This policy should be read alongside the information provided to you about confidentiality and informed consent for counselling.

2. Information I may collect

To provide counselling and related services, I may collect personal and sensitive information including:

  • your name, date of birth and contact details;

  • emergency contact and, where relevant, parent or guardian details;

  • demographic and identifying information you choose or need to provide;

  • health, mental health and wellbeing information;

  • information about relationships, family, personal history and circumstances relevant to counselling;

  • intake, assessment and referral information;

  • counselling goals, session records and clinical notes;

  • correspondence and information relating to appointments;

  • billing, payment and funding information;

  • NDIS information where relevant to the services you receive; and

  • information provided by another health professional, support provider, parent, guardian or other person where you have consented to this, or where collection is otherwise permitted or required by law.

  • With separate consent, session audio, transcripts and AI-generated draft notes

I aim to collect only information that is reasonably necessary for providing and administering the services you receive.

3. How I collect information

Most information is collected directly from you, including through enquiries, intake and consent forms, conversations during counselling, correspondence and information you provide through Halaxy.

Before you become a client, information may also be provided through an enquiry made via the ABM website or email.

Information may sometimes be obtained from a parent or guardian, referrer, health professional or other person involved in your care, with your consent or where otherwise permitted or required by law.

Where you expressly consent, information may also be collected through NovoNote as described in section 5A

4. Why I collect and use your information

Your information may be collected and used to:

  • provide safe and appropriate counselling and psychotherapy services;

  • understand your circumstances, needs and therapeutic goals;

  • plan, document and review your counselling;

  • communicate with you about your appointments and services;

  • manage bookings, billing and payments;

  • coordinate with other professionals or services where you have consented to this;

  • meet professional, ethical, insurance, administrative and legal obligations; and

  • respond appropriately where there are concerns about safety or where disclosure is permitted or required by law.

Your health information will not be used for direct marketing without your specific consent.

5. Clinical records and storage

Halaxy is ABM's primary clinical record system. Identifiable client information, including intake information, clinical records, appointments, documents and relevant communications, is maintained through Halaxy.

Once you are established as a client in Halaxy, ongoing client communication will ordinarily occur through Halaxy.

Halaxy states that Australian client data is stored in Australia and protected using security and encryption measures. Halaxy uses third-party providers to deliver some functions, including communications and payment processing. Some of these providers are located outside Australia.

Where you choose to pay by card through Halaxy, payment information is handled through Halaxy's payment-processing providers. ABM does not have access to your complete stored card details.

ABM also maintains de-identified session notes in Microsoft OneDrive. These notes do not contain information intended to identify you and are maintained separately from your identifiable clinical record.

5A. Optional AI-assisted session documentation

With your informed consent, I may use NovoNote, an AI-assisted documentation service provided by NovoPsych Pty Ltd, to help prepare draft counselling notes.

NovoNote captures session audio and converts it into a transcript and draft notes. Session content may include sensitive personal and health information. I review and correct generated notes before adding them to your clinical record in Halaxy. After reviewing and correcting the draft, I transfer the final counselling note to Halaxy and delete the session transcript and draft note from my NovoNote account. The final note in Halaxy is retained in accordance with the record-retention provisions of this policy. I remain responsible for the final notes and clinical decisions.

Use is optional. I will explain the process, answer your questions and obtain your express consent before using it. You may decline, ask me to pause or stop, or withdraw consent for future use without affecting your access to counselling. I will document your preference and confirm consent before recording each session.

For relationship sessions, consent will be sought from each participant. For young people, consent arrangements will take account of their capacity and any relevant parent or guardian involvement.

Withdrawing consent does not automatically remove clinical records already created. Requests concerning existing information will be considered under the access, correction and retention provisions of this policy.

6. Confidentiality and disclosure

Information shared in counselling is treated confidentially.

I will not ordinarily disclose your personal or health information to another person or organisation without your consent.

There are circumstances, however, where information may be used or disclosed without consent where permitted or required by law. These can include circumstances where:

  • disclosure is required or authorised by law or a court or tribunal order;

  • disclosure is necessary to lessen or prevent a serious threat to someone's life, health or safety and the requirements for such disclosure are met;

  • another exception under applicable privacy law applies; or

  • disclosure is otherwise permitted in connection with providing or administering your health service.

Where appropriate and lawful, I will aim to discuss a proposed disclosure with you before it occurs.

7. Professional supervision and consultation

Professional supervision is an important part of safe, ethical counselling practice.

Information about clinical work may be discussed with an appropriately qualified professional supervisor or consultant for the purposes of professional supervision, reflection and maintaining the quality and safety of services.

Wherever reasonably practicable, identifying information is removed or minimised when discussing client material in supervision or professional consultation.

Supervisors and relevant professional consultants are also expected to maintain confidentiality.

8. Children and young people

When counselling children and young people, information may be collected from the young person as well as from their parent, guardian or other relevant person.

Privacy and confidentiality are important to the therapeutic relationship with a young person. How information is shared with a parent or guardian will depend on factors including the young person's age, maturity and capacity, the circumstances of the counselling, consent arrangements, safety considerations and applicable legal requirements.

These matters will be discussed as part of the consent and counselling process.

9. Third-party services and overseas handling

ABM uses trusted third-party technology providers to assist in delivering and administering services.

Halaxy is used for practice management and identifiable clinical records. Halaxy states that Australian data is stored in Australia. However, some services integrated into or used by Halaxy may involve providers located overseas, including providers in the United States and other jurisdictions, particularly for payment processing, communications and technical services.

Halaxy maintains its own privacy policy explaining how it manages information and its third-party providers.

Microsoft OneDrive is used by ABM for de-identified session notes. These notes are not intended to contain information that identifies individual clients.

Where you consent to AI-assisted session documentation, ABM uses NovoNote, provided by NovoPsych Pty Ltd.

NovoNote states that patient data is stored in Australia and protected by encryption. Audio is temporarily cached and deleted after successful transcription. Transcript retention depends on the account’s deletion settings.

NovoNote uses third-party AI processors, with identifying information redacted by default. It states that client data is not used to train AI models. Its privacy policy separately permits de-identified patient information to be used for service improvement.

Further information is available in NovoNote’s Privacy Policy and Security information. Before use, I will explain ABM’s retention arrangements and any relevant overseas processing.

10. Keeping information secure

I take reasonable administrative and technical measures to protect the personal information ABM holds.

This includes limiting access to client information, using password-protected systems and reputable service providers, maintaining identifiable clinical records within the designated practice-management system, and separating de-identified working notes from identifiable client records.

No electronic system can be guaranteed to be completely secure. If ABM becomes aware of a data breach, it will be assessed and managed in accordance with applicable privacy and data-breach obligations.

11. Retention of records

Clinical and administrative records are retained for the period required by applicable legal, professional, ethical and insurance obligations.

When personal information is no longer required to be retained, reasonable steps will be taken to securely destroy it or permanently de-identify it where appropriate and lawful.

12. Accessing or correcting your information

You may request access to personal information ABM holds about you and may ask for information you believe is inaccurate, incomplete, out of date, irrelevant or misleading to be corrected.

In some circumstances, access may be limited or refused where permitted by law. If this occurs, I will generally explain the reason for the decision and the options available to you, unless doing so would itself be inappropriate or unlawful.

Requests for access or correction can be made using ABM's usual contact details.

13. Privacy concerns and complaints

If you have a question or concern about how your personal information has been handled, please contact A Beautiful Mess Counselling & Psychotherapy using ABM's usual email/contact details.

I will take reasonable steps to consider and respond to your concern.

If you are not satisfied with the response, you may be able to make a complaint to the Office of the Australian Information Commissioner (OAIC)

14. Changes to this policy

This Privacy Policy may be updated from time to time to reflect changes in ABM's practices, technology or legal obligations.

The current version will be made available to clients and through the ABM website.

Policy version: September 2026