Effective date: 11/08/2026

Last updated: 11/08/2026

Core to Canopy respects your privacy and is committed to handling your personal and health

information carefully, respectfully and lawfully.

This Privacy Policy explains how Core to Canopy collects, uses, stores, discloses and protects personal information when you contact us, visit our website, request or receive counselling services, subscribe to communications, or otherwise interact with us.

Core to Canopy aims to comply with the Privacy Act 1988 (Cth), the Australian Privacy Principles, the Health Records Act 2001 (Vic) and applicable professional and ethical obligations. The Australian Privacy Principles regulate the collection, use, disclosure, security, access and correction of personal information.

Who we are

In this policy, “Core to Canopy”, “we”, “us” and “our” means:

Business name: Core to Canopy

Business structure: Sole trader

ABN: 15365101442

Email: rand@coretocanopy.com.au

Postal address: 3029

For privacy questions, please contact the Privacy Officer using the details above.

Information we collect

Depending on how you interact with us, we may collect:

• Your name, pronouns, date of birth and contact details.

• Emergency contact and support-person details.

• Information about your presenting concerns, wellbeing, mental health, physical health,disability, trauma history, cultural identity, family circumstances and support needs.

• Session notes, treatment or support plans, assessments, correspondence and appointment history.

• Information provided by a parent, guardian, referrer, support person, school, employer, health professional, or other authorised person.

• Payment, billing and transaction information.

• Website enquiry information, including messages submitted through forms.

• Technical information such as IP address, browser type, device information and website usage data.

• Marketing preferences and records of communications with you.

Health information is sensitive information under Australian privacy law. We collect it only where reasonably necessary for providing, managing or improving services, or where otherwise permitted or required by law.

How we collect information

We may collect information:

• Directly from you during enquiries, intake, appointments, forms or correspondence.

• From a parent, guardian, authorised representative or support person.

• From a referrer or another health or community-service provider, where authorised.

• Through our website, email, telephone, video-conferencing or booking systems.

• From payment providers and service providers supporting our practice.

• From publicly available sources, where reasonably necessary and lawful.

Where practicable, we will collect information directly from you and explain why it is being collected, how it will be used and who it may be disclosed to.

You may choose not to provide some information. However, if information is necessary to assess your needs, provide safe services, communicate with you or meet legal obligations, we may be unable to provide some or all services without it.

Why we collect and use information

We may collect, hold, use and disclose personal information to:

• Respond to enquiries and communicate with you.

• Assess your needs and provide counselling or wellbeing services.

• Arrange appointments, cancellations, referrals and follow-up.

• Maintain accurate clinical and administrative records.

• Coordinate care with other providers where you have authorised this or where disclosure is legally permitted.

• Process payments, invoices, rebates and accounts.

• Manage safety, risk, emergencies and continuity of care.

• Meet legal, regulatory, insurance, professional and record-keeping obligations.

• Improve our services, policies, systems and client experience.

• Send service-related communications.

• Send newsletters or promotional material where permitted and where you have consented,or where applicable law allows it.

We will not use or disclose your information for an unrelated purpose unless you consent or the use or disclosure is otherwise authorised or required by law.

Consent

Where appropriate, we will seek your consent before collecting or disclosing sensitive information, communicating with another person about your care, contacting a third party, or using information for a purpose that is not reasonably expected.

You may withdraw consent at any time by contacting us. Withdrawal of consent will not affect information already collected or actions already taken lawfully before consent was withdrawn.It may affect our ability to provide particular services.

Consent may not be required where disclosure is necessary to lessen or prevent a serious threat to a person’s life, health or safety, or where disclosure is required or authorised by law.

Disclosure of information

We may disclose personal information to:

• Practitioners and staff involved in providing services.

• Other health professionals, support services or organisations involved in your care, with your consent where required.

• Parents, guardians, authorised representatives or support people, subject to consent, legal authority and the client’s circumstances.

• Referrers, insurers, employers, schools or funding bodies, where authorised and necessary.

• Payment processors, accountants, insurers, lawyers, information-technology providers,booking platforms and secure record-management providers.

• Government agencies, courts, tribunals, regulators or law-enforcement bodies where required or authorised by law.

• Emergency services or other appropriate persons where necessary to respond to a serious and imminent safety concern.

We aim to disclose only the information reasonably necessary for the relevant purpose.

Children and young people

Where services are provided to a child or young person, we will consider their maturity, capacity, best interests, legal requirements and the rights of parents or guardians.

We will explain confidentiality and its limits in an age-appropriate way. Information may be shared with a parent, guardian, referrer or another person where authorised, clinically appropriate or required to protect safety.

The specific arrangements for each child or young person will be discussed during intake.

Confidentiality and its limits

Counselling information is treated as confidential. However, confidentiality is not absolute.

Information may be disclosed without consent where:

• There is a serious and imminent risk to you or another person.

• We are concerned about the safety, abuse or neglect of a child or another vulnerable person.

• Disclosure is required by legislation, court order, subpoena or another lawful authority.

• Disclosure is necessary to obtain legal, professional, insurance or risk-management advice.

• Disclosure is otherwise permitted under applicable privacy law.

Where lawful and practicable, we will discuss the proposed disclosure with you beforehand.

Website and cookies

Our website may collect limited technical information, such as IP address, device type, browser information and pages visited. This information may be collected through cookies, analytics tools or website hosting services.

We may use this information to:

• Maintain website security and functionality.

• Understand general website usage.

• Improve website content and accessibility.

• Monitor website performance.

You can usually disable cookies through your browser settings, although some website functions may not work correctly.

If our website contains links to third-party websites, those websites have their own privacy practices. We are not responsible for their content or privacy handling.

Online and electronic communications

Email, SMS, telephone, online booking and video-conferencing may involve privacy or security risks. We will take reasonable steps to use reputable systems and protect information, but no electronic communication system is completely secure.

Please avoid sending highly sensitive information by ordinary email or SMS unless you accept the associated risks. We may use email or SMS for appointment reminders, administrative matters and other communications you have requested.

You are responsible for ensuring that contact details and devices you provide are secure and accessible only to appropriate people.

Overseas disclosure and storage

Some service providers used by Core to Canopy may store or process information outside Australia. These may include providers of:

• Website hosting.

• Email and cloud storage.

• Online booking.

• Video-conferencing.

• Payment processing.

• Practice-management or record-management systems.

Before using a provider, we will take reasonable steps to assess its privacy and security arrangements. Where required, we will obtain consent or otherwise comply with applicable privacy obligations.

Current overseas providers and locations:

“Core to Canopy does not currently disclose personal information overseas.”

Storage and security

We take reasonable steps to protect personal information from misuse, interference, loss,unauthorised access, modification or disclosure.

Security measures may include:

• Password protection and multi-factor authentication.

• Access controls and role-based permissions.

• Secure cloud systems and encrypted transmission where available.

• Secure paper-record storage.

• Device security and software updates.

• Staff confidentiality obligations.

• Regular review of providers and information-handling practices.

• Secure destruction or de-identification when information is no longer required.

No method of electronic storage or transmission can be guaranteed to be completely secure.

Data breaches

If we become aware of unauthorised access to, disclosure of or loss of personal information that is likely to cause serious harm, we will assess and respond in accordance with applicable law, including the Notifiable Data Breaches scheme where it applies.

We may notify affected individuals and the Office of the Australian Information Commissioner where required.

How long we keep information

We retain information only for as long as reasonably necessary for the purposes described in this policy, or as required by law, professional standards, insurance requirements or our record-keeping obligations.

When information is no longer required, we will take reasonable steps to securely destroy orde-identify it.

Record-retention period:

Adult client (18+ at time of service): 7 years from last contact/ session

Minor client (under 18 at time of service): Until the client turns 25, or 7 years from last contact- whichever is later.

Accessing your information:

You may request access to personal information we hold about you. Victorian law gives individuals a right to access health information held by private-sector organisations, subject to limited exceptions.

To request access, contact us using the details in this policy. We may ask you to verify your identity.

We will generally respond within a reasonable period. In some circumstances, access may be refused or limited, including where providing access would:

• Create a serious threat to someone’s life, health or safety.

• Unreasonably affect another person’s privacy.

• Prejudice legal proceedings, investigations or other lawful activities.

• Be unlawful or otherwise permitted to be withheld.

If access is refused, we will explain the reason where legally permitted and discuss available options.

Correcting your information

Please contact us if information we hold about you is inaccurate, incomplete, out of date or misleading.

We will take reasonable steps to correct information when appropriate. If we do not agree that correction is necessary, you may ask us to attach a statement to the record noting your concern.

Privacy complaints

If you believe we have mishandled your personal or health information, please contact us:

Privacy Officer: Rand Zaza

Email: rand@coretocanopy.com.au

Postal address: 3029

Please provide enough information for us to investigate your concern. We will acknowledge and handle complaints confidentially and aim to respond within a reasonable period.

If you are not satisfied with our response, you may contact:

Office of the Australian Information Commissioner

Website:

https://www.oaic.gov.au/privacy/privacy-complaints

Phone: 1300 363 992

You may also contact the Victorian Health Complaints Commissioner regarding health-service privacy concerns:

Health Complaints Commissioner Victoria

Website:

https://hcc.vic.gov.au

Phone: 1300 582 113

Changes to this policy

We may update this Privacy Policy when our services, systems, legal obligations or information-handling practices change.

The latest version will be published on our website and will show the date it was last updated.

Contact

For privacy questions, access requests, correction requests or complaints, contact:

Core to Canopy

Email: rand@coretocanopy.com.au