Privacy policy

1. About this policy

This privacy policy explains how Jake J Ciminelli (ABN 50 779 562 383), trading as Greylight Psychology, collects, holds, uses and discloses your personal information, including health information. In this policy, "I", "me" and "my" refer to me and my practice.

I handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), the Health Records Act 2001 (Vic) and its Health Privacy Principles, and my professional obligations of confidentiality as a registered psychologist.

2. Information I collect

The kinds of personal information I may collect and hold include:

• your name, date of birth, address, phone number and email address
• emergency contact details
• Medicare number, Mental Health Treatment Plan and referral details, and private health insurance details
• WorkSafe Victoria (WorkCover) or TAC claim numbers and case manager details, where relevant
• medical, psychological and family history, and other health information you share with me
• session notes, assessments, outcome measures, treatment plans and correspondence
• reports and referrals from other health professionals
• billing and payment records
• session audio, transcripts and draft notes, where you consent to a session being recorded (see section 6)
• reflections, completed tasks and questionnaire responses (such as the K10, DASS-21, PHQ-9 or GAD-7) that you submit through the client app or secure assessment links
• information you submit through this website's contact or referral forms

Health information is sensitive information under the Privacy Act. I only collect it with your consent, or where otherwise permitted or required by law, and only where it is reasonably necessary to provide my services.

3. Anonymity and pseudonyms

You can make a general enquiry without identifying yourself, or using a pseudonym. To provide psychological treatment, process Medicare rebates or bill an insurer or scheme, I need to know who you are, so it isn't practical to receive ongoing care anonymously.

4. How information is collected

Where possible, I collect information directly from you, for example when you:

• contact me by phone, email or through this website
• complete intake, consent or assessment forms
• attend sessions in person or by telehealth
• use the InterSession client app or complete an assessment through a secure link

I may also receive information from others, such as your GP, psychiatrist or other treating practitioners (including through the health professional referral form on this website), your WorkSafe or TAC case manager, or a parent or guardian. I only do this with your consent or where it is otherwise permitted by law.

5. Why I collect it

I collect, hold and use your information to:

• assess your needs and provide psychological services
• keep accurate and complete clinical records
• communicate with you about appointments, fees and your care
• process Medicare rebates and invoices, and manage WorkSafe, TAC or insurer claims
• communicate with your referrer and other treating practitioners, with your consent
• meet my legal, regulatory and professional obligations
• respond to enquiries made through this website

6. Practice software, session recordings and AI

I use InterSession (InterSession Group Pty Ltd), an Australian practice platform built for mental health professionals, to keep clinical records, draft session notes and documents, send questionnaires, and share between-session materials with you through its client app.

Session recordings

• I only record a session with your consent. You can say no, or change your mind at any time, and it won't affect your care.
• Audio is used only to create a transcript. It is processed briefly by InterSession's transcription providers and is not stored once the transcript is made.
• The transcript and the notes I finalise form part of your clinical record.

AI-assisted notes and materials

• InterSession uses artificial intelligence to draft transcripts, session notes, summaries, letters and between-session materials from the record.
• I review, edit and approve everything before it becomes part of your record or is shared with you. AI does not make clinical decisions; I do.
• Your information is never used to train AI models.

The client app

If you use the InterSession client app, you sign in with a secure link or one-time code sent to your email. I only see what you choose to submit. The app has no third-party analytics, tracking or advertising, and any voice-to-text reflections are converted on your own device, so no audio is sent.

Using recordings, AI-assisted notes or the client app is optional. Let me know if you'd prefer I don't use them, and I'll keep notes the traditional way.

7. Use and disclosure

Everything discussed in therapy is confidential. I only use or disclose your information for the purpose it was collected, for a directly related purpose you would reasonably expect, or with your consent. I may disclose information without your consent only where permitted or required by law, for example:

• where there is a serious threat to your life, health or safety, or that of another person
• under mandatory reporting obligations, such as child protection
• in response to a subpoena, court order or other legal requirement
• to Medicare, WorkSafe Victoria, the TAC or your insurer, to the extent needed to process a claim you have made
• to regulators such as the Psychology Board of Australia and AHPRA where required

I also use trusted service providers to run my practice, such as practice management, telehealth, email and website hosting services. They handle information only to provide those services to me, under confidentiality and security obligations. I do not sell, rent or trade personal information, and I do not use it for direct marketing.

8. Overseas disclosure

Your clinical records are stored in Australia, on InterSession's servers in Sydney. Some of my service providers process information outside Australia, mainly in the United States:

• Session transcription: recorded audio is transcribed by Soniox (with Deepgram as a backup) in the United States. Audio is processed transiently and not stored.
• AI-assisted notes: transcripts and notes may be sent to OpenAI in the United States to generate draft documentation. OpenAI does not train on this data, but may keep it for up to approximately 30 days for abuse monitoring before deleting it.
• This website: the site is hosted by Vercel, and messages and attachments sent through its contact and referral forms are delivered to my practice inbox by Resend. Both may process this information in the United States and other countries where they operate.

Before using an overseas provider, I take reasonable steps to make sure it handles personal information in a way that is consistent with the APPs. If you would prefer not to send information through the website, you can email me directly instead.

9. Storage and security

I take reasonable steps to protect your information from misuse, interference, loss, and unauthorised access, modification or disclosure, including:

• storing electronic records in InterSession, on Australian servers, encrypted at rest (AES-256) and in transit (TLS 1.3)
• not keeping session audio once it has been transcribed
• using an encrypted telehealth platform
• keeping any paper records in a locked filing cabinet
• sending website form submissions over an encrypted (SSL/TLS) connection
• limiting access to your clinical records to me, and to service providers only as needed to operate their systems

10. Data breaches

If a data breach occurs that is likely to result in serious harm, I will notify you and the Office of the Australian Information Commissioner (OAIC) in line with the Notifiable Data Breaches scheme, and take steps to contain the breach and reduce any harm.

11. How long records are kept

As required by the Health Records Act 2001 (Vic), I keep health records for at least 7 years after my last contact with you or, if you were under 18 when I last provided a service, until you turn 25, whichever is later. After that, records are securely destroyed or de-identified.

Website enquiries from people who don't go on to become clients are deleted once they're no longer needed.

12. Access and correction

You can ask to access the personal information I hold about you, or ask me to correct information you believe is inaccurate, out of date, incomplete or misleading. Please email enquiries@greylightpsychology.com.au. There is no charge to make a request, and I will respond within 30 days.

In limited circumstances the law allows me to refuse access, for example where giving access would pose a serious threat to someone's life, health or safety. If I refuse, I will explain why in writing and let you know how to complain.

13. This website, cookies and analytics

This website does not use analytics, advertising or tracking cookies. Like most websites, the host automatically records basic technical information (such as your IP address and browser type) to keep the site secure and running. Fonts are loaded from Google Fonts, which means your browser shares your IP address with Google.

Please don't include urgent safety concerns in website forms. They are not monitored for urgent situations. If you or someone else is in immediate danger, call 000.

14. Automated decision-making

I use AI to help draft documentation (see section 6), but I do not use computer programs, including artificial intelligence, to make decisions, or to substantially and directly assist in making decisions, that could reasonably be expected to significantly affect your rights or interests. Every draft is reviewed by me, and all clinical decisions about your care are made by me.

15. Complaints

If you have a concern about how your information has been handled, please contact me first so I can try to resolve it. I will acknowledge your complaint promptly and respond within 30 days.

If you're not satisfied with my response, you can contact:

• the Office of the Australian Information Commissioner: oaic.gov.au, 1300 363 992
• the Health Complaints Commissioner (Victoria), for health information handled under the Health Records Act 2001 (Vic): hcc.vic.gov.au, 1300 582 113

16. Changes to this policy

I review this policy regularly and may update it to reflect changes in the law or my practice. The current version is always available on this page, and the date at the top shows when it was last updated.

17. Contact