Privacy policy
1. Introduction and purpose
Carmody Psychiatric Services Pty Ltd ("the practice") is committed to protecting the privacy of personal and health information and to handling that information responsibly, in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and the Health Records Act 2001 (Vic) and the Health Privacy Principles (HPPs).
This policy explains what information the practice collects, how it is used and disclosed, how you may access and correct it, and how you may make a complaint if you consider your privacy has been interfered with.
The practice provides two distinct types of service, and different privacy considerations apply to each:
Treating services — psychiatric assessment, treatment and therapy provided to patients, delivered by telehealth or in person at the practice's consulting rooms.
Medicolegal services — independent psychiatric assessments and reports prepared at the request of a third party, such as a legal practitioner, insurer, employer, court or tribunal.
Section 6 sets out the arrangements that apply to medicolegal assessments. Section 7 sets out the arrangements that apply to children and young people.
Scope. This policy applies only to personal and health information held by Carmody Psychiatric Services Pty Ltd. Dr Carmody also undertakes clinical, governance and consulting work for other organisations. Where information is collected and held by one of those organisations in the course of that work, that organisation is the custodian of the information and its own privacy policy applies. This policy does not govern that information.
This policy is updated from time to time to reflect changes to the practice's systems, processes and legal obligations. The current version is available on request and on the practice website.
2. Consent
All health information is sensitive information. The practice collects sensitive information with your consent, unless an exception under privacy legislation applies.
For treating patients, consent to the collection and use of your information for the purpose of providing your care is confirmed at the time of your first appointment, including through the intake or registration process. Your information is accessed only for the purpose of providing that care.
Express consent is sought before your information is used for any purpose that is not directly related to your healthcare.
3. Information the practice collects
The practice collects personal and health information necessary to provide its services. This may include:
name, date of birth, address and contact details
Medicare details, private health insurance details, and other billing information
psychiatric and medical history, clinical notes, correspondence, investigation results, medication history and treatment plans
information contained in referrals and reports from other treating practitioners, hospitals and diagnostic services
for medicolegal matters, documentary material provided by the referring party, which may include medical records, employment records, statements, surveillance material and other litigation material
information generated or processed through artificial intelligence tools used in clinical or administrative work, as set out in section 8.
Information is primarily collected directly from you. With appropriate authority, information may also be obtained from other treating practitioners, hospitals, diagnostic services, or a referring party. In limited circumstances, information may be collected from a family member, carer or other person involved in your care.
The practice conducts consultations both by telehealth and in person at its consulting rooms. Closed-circuit television is not used at the consulting rooms.
Clinical images. Photographs or images are taken only where clinically indicated and with your consent obtained at the time.
Website use. When you visit the practice website, information is collected through cookies and website analytics tools, which may include your IP address, device and browser type, pages visited and referring website. This information is used to understand how the website is used and to maintain and improve it. Some of this information may make you reasonably identifiable, in which case it is treated as personal information under the Privacy Act 1988 (Cth).
The website includes a contact form. If you use it, the practice collects the details you enter, which may include your name, email address, telephone number and the content of your message. This information is used only to respond to your enquiry, and is retained as part of the practice's records where it relates to a patient or a matter. Please do not use the contact form to send detailed health information or urgent clinical information. If your enquiry is urgent, contact your general practitioner, present to your nearest emergency department, or telephone 000.
4. How information is used and disclosed
Your personal and health information is used and disclosed for the purpose for which it was collected, and for directly related purposes that you would reasonably expect. This includes:
providing psychiatric assessment, treatment and care
communicating with your general practitioner, referring practitioner and other health practitioners involved in your care
preparing reports and correspondence you have requested or consented to
administrative functions, including appointment scheduling, billing and Medicare claiming
meeting the practice's legal and professional obligations, including mandatory reporting and responding to a subpoena, court order or other lawful requirement.
Communication with or about you may occur by telephone, email, secure messaging or SMS, and may include personal and health information. Email is used routinely for correspondence with referring parties in medicolegal matters, including transmission of reports and accompanying material. Reasonable steps are taken to protect information sent by email, including verification of recipient addresses and use of encryption or password protection for attachments where appropriate.
Disclosure without consent. Information may be disclosed without your consent only where permitted or required by law. This includes:
where it is unreasonable or impracticable to obtain your consent, and the practice reasonably believes the disclosure is necessary to lessen or prevent a serious threat to the life, health or safety of any individual, or to public health or safety
where you lack capacity to consent and the disclosure is made to a person responsible for you, for the purposes of providing you with appropriate care or treatment, or for compassionate reasons
where the disclosure is required or authorised by law.
Service providers. The practice uses external providers for functions such as practice management software, telehealth delivery, secure messaging, transcription, data storage and accounting. These providers are engaged on terms requiring them to protect your information and to use it only for the purpose for which it was provided to them.
Information held or processed outside Australia. Some of the practice's software and service providers process or store information outside Victoria and outside Australia. The practice's artificial intelligence transcription and dictation tools are used under commercial terms which prohibit use of practice data for model training, and which incorporate a data processing agreement. Processing under those terms may occur in the United States, Europe, Asia and Australia, and storage is in the United States. Details of other providers, and the countries in which they hold information, are available on request. Where information is held or processed outside Australia or outside Victoria, the practice takes reasonable steps to ensure the provider handles your information consistently with the APPs and the HPPs, including by contract, and remains accountable for that handling.
The practice does not sell or trade your information.
5. Research, quality improvement, teaching and marketing
The practice does not participate in research and does not contribute your information to research databases or registries.
De-identified information may be used for the practice's own clinical audit, quality improvement, professional development, peer review, teaching and continuing professional development presentations. No individual is identifiable in this material. Where case material could not be adequately de-identified, it is not used, unless your express written consent has been obtained.
The practice does not use your personal information to market goods or services to you, and does not disclose your information for marketing purposes.
6. Medicolegal assessments
Where you attend an assessment arranged by a third party, the following applies. It is set out in the information and consent form provided to you before the assessment, and is explained again at the commencement of the assessment.
The assessment is conducted at the request of the referring party. The purpose is to provide an independent opinion to that party. A treating relationship is not established, and treatment is not provided.
Information you provide during the assessment, together with the documentary material supplied by the referring party, is used to prepare a report for the referring party.
The report and any accompanying material are provided to the referring party. Once provided, the referring party determines how the report is used, including whether it is disclosed to other parties, filed in proceedings, or produced to a court or tribunal. The practice does not control that further use.
Confidentiality is therefore limited in a way that differs from treating care. What you say during the assessment may be recorded in the report.
Consent to participate in the assessment is confirmed at the outset. You may decline to answer any question or to continue with the assessment, and the fact that you have done so may be recorded in the report.
Where a matter raises a risk to your safety or the safety of another person, that information may be disclosed to your general practitioner or treating team, a family member, carer or support person, emergency or crisis services, or the referring party, as necessary.
Correspondence with the referring party, including transmission of the report and any accompanying material, is ordinarily conducted by email. Where the referring party requires a particular method of transmission or file handling, that requirement is followed.
Information collected for a medicolegal assessment is not used for any other purpose.
Requests for a copy of a report. As the report is prepared for and provided to the referring party, requests for a copy are in the first instance referred to that party. Where a request is instead made to the practice, it is dealt with as a request for access under section 11, and is considered on its merits under HPP 6 and the APPs.
7. Children and young people
Where a patient is under 18 years of age, information is collected from the young person and, where appropriate, from a parent, carer or guardian.
A young person who has sufficient maturity and understanding to consent to their own treatment may exercise rights under privacy legislation in their own right, including consent to the collection, use and disclosure of their information, and requests for access and correction.
Where a young person has that capacity, their information is not disclosed to a parent, carer or guardian without the young person's consent, unless the disclosure is permitted or required by law, including where it is necessary to lessen or prevent a serious threat to the life, health or safety of any person.
Where a young person does not have that capacity, a parent, guardian or other authorised representative may exercise those rights on the young person's behalf.
Capacity is assessed on each occasion, having regard to the young person's maturity and understanding and to the nature of the information in question.
What will, and will not, be shared with a parent, carer or guardian is discussed with the young person and the family at the outset of care.
Retention of the records of a person who was under 18 years of age at the time of the last service is dealt with in section 10.
8. Use of artificial intelligence
The practice uses artificial intelligence tools for three purposes:
transcription — producing a written transcript of a consultation or assessment
dictation — converting Dr Carmody's spoken dictation into text
document organisation — indexing, ordering and summarising documentary material to assist review.
The first two functions convert speech into text. The third assists with navigating and reviewing documentary material. These tools are not used to generate clinical content. The history, mental state examination, diagnosis, formulation, opinion and recommendations recorded in any note, letter or report are Dr Carmody's own work, and he remains responsible for the content of the record.
Your express consent is obtained before a transcription tool is used in your consultation or assessment. This is raised with you at the start of the appointment. You may decline, and your care or assessment will proceed without it.
Dictation is used after the consultation to prepare the written record. Where a dictation tool is used and the dictation contains information that identifies you, that information is handled in accordance with this policy, including the arrangements in section 4 for information held or processed outside Australia. You may ask that dictation tools not be used in relation to your record.
Where documentary material is processed to assist review, the tool is used to index, order and summarise that material. Dr Carmody reviews the source material himself, and any output of the tool is checked against the source documents. The content of any report or record is drawn from the source material and from his own assessment, not from the output of the tool.
Audio recordings are not stored. Any recording is deleted once the text has been produced. The resulting text forms part of your record and is handled in accordance with this policy.
Your information is not used to train or develop artificial intelligence models. The tools are used under commercial terms which prohibit that use, and which are distinct from the consumer terms applying to the same products.
No decision affecting you is made solely, or substantially, by an automated system. No automated decision-making tool is used in the practice.
The tools used may change over time. Any tool is assessed for its privacy, security and data handling arrangements before adoption, including where information is held or processed outside Australia, and is subject to the requirements set out in this section.
9. Anonymity and pseudonymity
Privacy legislation provides for individuals to deal with an organisation anonymously or under a pseudonym, except where this is impracticable or where the law requires identification. You may make a general enquiry of the practice without identifying yourself. Once a clinical or medicolegal service is to be provided, the practice requires you to be identifiable, given obligations relating to medical records, prescribing, Medicare claiming and medicolegal reporting.
10. Data security and retention
Reasonable steps are taken to ensure your information is accurate, complete, current and relevant, and to protect it from misuse, interference, loss, and unauthorised access, modification or disclosure. Measures include:
electronic clinical record systems with access controls and encryption
secure telehealth and secure messaging platforms
regular software updates, backups and review of security arrangements
physical security of the practice's consulting rooms, and secure storage of any paper records held.
Data breaches. The practice maintains a data breach response process. A suspected data breach is assessed within 30 days of the practice becoming aware of it. Where a data breach is likely to result in serious harm, you and the Office of the Australian Information Commissioner will be notified in accordance with the Notifiable Data Breaches scheme.
Retention. Health records are retained in accordance with the Health Records Act 2001 (Vic). Records are held for at least seven years from the date of the last service provided. Where the individual was under 18 years of age at the time of the last service, the record is held until that person reaches 25 years of age. Medicolegal records may be held for longer where required in connection with legal proceedings. Records no longer required, and past the applicable retention period, are destroyed securely.
Transfer or closure. If the practice, or a location of the practice, is transferred or closed, health information is dealt with in accordance with the Health Records Act 2001 (Vic) and the Statutory Guidelines on Transfer or Closure of the Practice or Business of a Health Service Provider. You will be notified of the arrangements for your records and of how you may obtain access to them.
11. Access to and correction of your information
You have the right to request access to the personal and health information the practice holds about you, and to request correction of information that is inaccurate, out of date, incomplete, irrelevant or misleading.
Requests should be made in writing to the contact below. You may be asked to verify your identity, and a person making a request on behalf of another person will be asked for evidence of their authority to do so.
Timeframes. A request for access is responded to as soon as practicable and no later than 45 days after it is received. A request for correction is responded to no later than 30 days after it is received. Where a fee is charged for access, you will be given written notice of the fee, and access will be provided within seven days after payment of the fee or 45 days after the request, whichever is the later.
Form of access. Access may be provided in a form appropriate to the circumstances, including by inspection, by provision of a copy, by way of a summary or explanation, or through your general practitioner or another nominated health service provider.
Fees. A fee may be charged to cover the cost of retrieving and providing the information, capped at the maximum prescribed by the Health Records Regulations 2023 (Vic). No fee is charged for making the request itself, or for requesting a correction.
Refusal. Access may be refused in the limited circumstances permitted by privacy legislation, including where providing access would pose a serious threat to the life, health or safety of any person, or would unreasonably affect the privacy of another person. If access is refused, you will be given written reasons and told how to complain. Where access is refused on the ground that it would pose a serious threat to your life or health, you may nominate a health service provider to be given the information on your behalf, and to assess whether that ground applies, under Part 5 Division 3 of the Health Records Act 2001 (Vic).
Section 6 sets out the position for medicolegal reports.
12. Privacy enquiries and complaints
Enquiries, requests for access or correction, and privacy complaints should be directed to:
Privacy Officer: Dr Dave Carmody
Practice: Carmody Psychiatric Services Pty Ltd
Email: admin@drdavecarmody.com.au
Postal address: 704 Burwood Rd, Hawthorn East VIC 3123
Complaints should be made in writing. You will receive acknowledgement within seven days and a substantive response within 30 days.
If you are not satisfied with the response, you may contact:
Health Complaints Commissioner (Victoria) — for complaints about the handling of health information in Victoria
Telephone: 1300 582 113
Website: hcc.vic.gov.au
Office of the Australian Information Commissioner — for complaints under the Privacy Act 1988 (Cth)
Telephone: 1300 363 992
Website: oaic.gov.au
13. Review of this policy
This policy was last updated on 6/8/2026.
This policy is reviewed at least annually, and sooner if there is a change to the practice's operations, the technology it uses, or the law. A review is scheduled before 10 December 2026, when new Australian Privacy Principles 1.7, 1.8 and 1.9 commence and impose additional privacy policy requirements on entities that use computer programs to make, or substantially assist in making, decisions affecting an individual's rights or interests. Material changes are published on the practice website.