Privacy | Body Belonging

Because you’re entitled to know.

Not buried in fine print, and not only after you’ve handed it over.

Body Belonging Clinic is bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles. We’re a health service provider, which means the small-business exemption doesn’t apply to us. The rules apply, and we’re glad they do.

This policy covers everyone — clients, people who fill in a form, and anyone who simply visits this website.

Body Belonging Clinic · Lauren Lynch, Accredited Mental Health Social Worker · ABN 76 208 028 254 · 3A Megalong Street, Nedlands WA 6009 · admin@bodybelongingclinic.com.au · 0493 117 185

What we collect

If you become a client, or enquire about becoming one: your name, contact details and date of birth; your emergency contact; your Medicare, DVA or private health fund details; your referral and referring practitioner; health information — what you tell us in sessions, our clinical notes, assessments and questionnaires, and correspondence about your care; and payment records.

Health information is sensitive information under the Privacy Act. It gets the highest level of protection, and we only collect it with your consent.

If you just visit this website: pages you looked at, roughly where you are, what device you used, and how you found us — only if you accept cookies. If you decline, we don’t collect this.

If you message, comment or subscribe: your name, contact details, and whatever you chose to tell us.

Where we get it

Almost always from you, directly. Sometimes we receive information about you from someone else — most often a referral from your GP, psychiatrist or paediatrician, and occasionally from a parent, carer, school or another treating practitioner where that’s part of your care and consent allows. If we ever collect information about you from someone other than you, we’ll tell you we’ve done so.

Why we collect it

To provide safe, effective and lawful care. To keep accurate clinical records — we are legally required to. To bill you and claim rebates from Medicare, DVA or your health fund. To communicate with you about appointments. To send you things you’ve actively asked for, and nothing you haven’t. And to understand how people find this website, so we can make it better.

If you’d rather not give us something, you can say so. But be aware: without your Medicare details we can’t claim a rebate for you, and without health information we can’t provide safe care. We’ll always tell you the consequence before you decide.

Who we share it with

With your consent — and only with your consent, except in the situations below — we may share information with your GP, psychiatrist, paediatrician, dietitian or psychologist; your school, NDIS supports or other treating practitioners; and your family, kin or carers where that’s part of your care and you’ve agreed.

Without needing separate consent, because it’s inherent to the service you’ve asked for: Medicare, DVA or your private health fund, to process a claim you’ve asked us to make; and our payment processor and accountant, for billing.

One thing that isn’t optional, and you should know it up front. If you’re using a Medicare Mental Health Treatment Plan or Eating Disorder Plan, we are required to send a written report to your referring practitioner at the end of a course of treatment. That’s a condition of the Medicare item, not a choice we make. You’re welcome to see what we send.

We never sell your information. We never trade it. We never use your health information for marketing. Ever.

When we may share without your consent

Only where the law requires or permits it:

There is a serious and imminent risk to your life or safety, or someone else’s. Wherever possible we’ll tell you first and involve you in what happens next.
There is a concern that a child or young person is at risk of harm.
A court subpoenas your records. We cannot refuse a court order.
Medicare or a health fund audits a claim made on your behalf.

And one that’s a safeguard, not a leak. Lauren attends regular professional supervision — a senior clinician who helps her practise well. Your care may be discussed there, de-identified. This is how you get a therapist who keeps getting better.

Where your information is stored

Your clinical records are held in Halaxy, a secure practice-management system with data stored in Australia. Access is restricted to Lauren, protected by encryption and two-factor authentication. Correspondence with your GP goes through HealthLink, a secure clinical messaging service — not ordinary email.

Is any of it sent overseas?

Your health information: no. Your clinical records stay in Australia.

But we have to be straight with you about the rest. Like most small businesses, we use third-party tools to run this website, our mailing list and our books — and several of them store data outside Australia:

Google Analytics — website usage, cookie-consent only — United States
Meta (Instagram) Pixel — website usage, cookie-consent only — United States
Microsoft Clarity — website usage, cookie-consent only — United States
Flodesk — our email list, if you subscribe — United States
ManyChat — Instagram message replies, if you message us — United States
Netlify — website hosting and enquiry forms — United States
Xero — accounting and invoicing records — Australia, New Zealand and the United States

None of these ever touch your clinical records. They see website visits and — if you chose to subscribe, message us, or receive an invoice — your name and contact details.

If you decline cookies, the analytics tools collect nothing. If you’d rather not be on the mailing list, don’t subscribe, or unsubscribe in one click at any time.

We say this plainly because a privacy policy that quietly omits it isn’t a privacy policy.

How long we keep it

The law is specific, and it may be longer than you’d expect. Adults: at least 7 years from your last appointment. Children and young people: until they turn 25. So if we see a ten-year-old, that record is held for fifteen years. After the retention period, records are securely destroyed.

Your rights

You can ask to see the personal information we hold about you. Just ask. We’ll respond within a reasonable time, and normally free of charge.

You can ask us to correct anything that’s wrong. If we disagree, we’ll tell you why, and you can ask us to note your disagreement on the file.

In rare cases we may need to limit access — for example, where release could pose a serious risk to someone’s life or health. If that ever happens we’ll explain why, and look for another way to give you what you need.

Email admin@bodybelongingclinic.com.au.

Email, referrals and what to send

Email is not monitored as a crisis service. For urgent risk, medical instability or immediate safety concerns, please use emergency or acute services — or call 000.

If you’re a referrer, please make sure the person has consented, and send only what’s needed for triage. Where you have secure referral channels, please use them. A brief summary is usually enough to start the conversation.

If something goes wrong

We’re covered by the Notifiable Data Breaches scheme. If a breach ever occurred that was likely to cause you serious harm, we would notify you and the Office of the Australian Information Commissioner.

If you have a complaint

Please tell us first — admin@bodybelongingclinic.com.au. Most things are fixable in a conversation, and we’d rather hear it than not. We’ll acknowledge you within 7 days and aim to resolve it within 30.

If you’d rather go elsewhere, or you’ve raised it and you’re not satisfied:

Office of the Australian Information Commissioner (OAIC) — 1300 363 992 — oaic.gov.au
Health and Disability Services Complaints Office (WA) — 1800 813 583 — hadsco.wa.gov.au
AASW (ethics complaints) — 1800 630 124 — aasw.asn.au

Raising a concern will never affect the care you receive here.

Changes to this policy

If we change this policy we’ll update the date below. If a change is significant, we’ll tell you rather than expecting you to notice.

Last updated: 13 July 2026.

Privacy and information handling.