Privacy Policy | Karuna Mental Health

Last updated: 12 October 2026

In short: we collect only the information we need to care for you, we keep it secure, we do not sell it, and we share it with other practitioners only with your consent or where the law requires. You can ask to see or correct it at any time.

1. Who we are

This policy explains how Karuna Mental Health ("Karuna", "we", "us") collects, uses, stores and discloses personal information, including health information. We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and, for health information in New South Wales, the Health Records and Information Privacy Act 2002 (NSW).

2. What we collect

We collect only what is reasonably necessary to provide and manage your care. This may include:

your name, date of birth, contact details and emergency contact;
health information, including your medical, psychiatric and psychological history, medications, assessments, treatment notes, outcome measures and correspondence with other practitioners;
referral letters and documents you or your referrer upload or send to us;
Medicare, private health insurance, NDIS, DVA, WorkCover or other funding details, and billing information;
information about people you ask us to involve in your care, such as family members or carers.

You can make a general enquiry without giving us your full name. To receive treatment, we will need to identify you.

3. How we collect it

Usually directly from you: through our online enquiry form, by phone or email, through intake forms and pre-screening questionnaires, and during your appointments. With your consent we may also collect information from your GP, referring or treating practitioners, family or carers, and funding bodies.

4. Why we use it

to respond to your enquiry and arrange your Karuna Anchoring Call;
to assess, plan, provide and review your care, including psychiatry, psychology, wellbeing and program services;
to communicate with you and, with your consent, with your other treating practitioners;
to process payments, rebates and claims;
to meet our legal, professional, clinical governance and quality-improvement obligations, including outcome measurement.

Where we use information to measure outcomes or improve services, we use it in de-identified form wherever we can. We will not use identifiable information for research without your separate consent and any required ethics approval.

5. When we disclose it

We disclose your information only:

with your consent, for example to your GP or other treating practitioners;
to service providers who help us run the practice (see section 6), under confidentiality obligations;
to Medicare, insurers, NDIS, DVA or other funders, as needed to process claims you have asked us to make;
where required or authorised by law, for example under a subpoena, mandatory reporting obligations, or to lessen or prevent a serious threat to the life, health or safety of you or another person.

We never sell your personal information or use it for third-party marketing.

6. Service providers and storage outside Australia

We use trusted service providers to operate our website, email and practice systems. These include:

Cloudflare, which hosts this website and processes enquiry-form submissions. Cloudflare operates a global network, so information you submit through the website, including any referral you upload, may pass through servers outside Australia while it is being delivered to us.
Microsoft 365, which provides our email and where enquiries are delivered and stored.
Our clinical and practice management software, video consultation platform and payment providers.

Enquiry-form submissions, including uploaded files, are sent to our secure Microsoft 365 mailbox and are not retained on the website host. Where information is handled outside Australia, we take reasonable steps under APP 8 to ensure the provider protects it to a standard consistent with the Australian Privacy Principles, including contractual and security commitments.

7. How we keep it secure

We protect information using encrypted connections (HTTPS), access controls and multi-factor authentication on our systems, role-based access for staff, and confidentiality obligations for everyone who works with us. Paper records, if any, are stored securely. No system is completely secure, so please avoid sending sensitive information by ordinary email if you would prefer another method; we can arrange one.

8. How long we keep it

We keep health records for as long as the law requires. In New South Wales this is generally at least seven years from your last contact with us, or, for a person under 18 at that time, until they turn 25. When records are no longer needed, we destroy or de-identify them securely.

9. Accessing and correcting your information

You can ask to see your information or to have it corrected by contacting us (section 12). We will respond within 30 days. In limited circumstances the law allows us to refuse access, for example where it would pose a serious threat to someone's life or health; if so, we will explain why and how you can complain. We do not charge for a request, though we may charge a reasonable fee for copying large records, which we will tell you about first.

10. Data breaches

If a data breach is likely to result in serious harm, we will contain it, assess it, and notify you and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.

11. This website and cookies

This website does not use advertising, tracking or analytics cookies, and we do not run third-party trackers such as Google Analytics or the Meta Pixel. Our hosting provider may use strictly necessary cookies or similar technology for security and performance (for example, to protect against malicious traffic). Your browser may also remember that you have closed our cookie notice. If we ever add analytics, we will update this policy and ask for your consent first.

Our website links to other sites, such as Anam Cara and crisis services. Their privacy practices are their own.

12. Questions and complaints

Please contact our Privacy Officer at hello@karunamentalhealth.com.au or through our contact page. We will acknowledge your complaint promptly and aim to resolve it within 30 days.

If you are not satisfied with our response, you can contact:

the Office of the Australian Information Commissioner: oaic.gov.au · 1300 363 992;
for health information in NSW, the Information and Privacy Commission NSW: ipc.nsw.gov.au · 1800 472 679.

13. Changes to this policy

We may update this policy from time to time. The current version, with its date, is always on this page.