PRIVACY POLICY

Michael Vaccaro – New Way of Being
Mindfulness-Based Counselling, Coaching & Relationship Work
PACFA Clinical Registrant No. 26952

Last updated: 3 October 2026

1. About this Privacy Policy

Your privacy is important to me.

This Privacy Policy explains how I collect, use, store, protect and disclose personal and health information in connection with my counselling, relationship, coaching, facilitation and related professional services.

It also explains your rights regarding the information I hold about you and how you can raise a privacy concern.

My practice handles personal and health information in accordance with applicable Australian and New South Wales privacy legislation, including the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs) and the Health Records and Information Privacy Act 2002 (NSW).

This Privacy Policy should be read alongside my Client Service Agreement & Informed Consent, which explains confidentiality, professional boundaries and the terms under which services are provided.

2. Who is responsible for your information?

The person responsible for privacy within the practice is:

Michael Vaccaro
Clinical Counsellor
PACFA Clinical Registrant No. 26952
Website: www.michaelvaccaro.com.au

Privacy enquiries may be made using the contact details provided on my website or through the email address you normally use to communicate with the practice.

3. What information may be collected?

The information collected depends on the nature of the services you receive.

It may include:

• your name, date of birth and contact information;

• address and emergency-contact information;

• appointment and booking information;

• health and wellbeing information;

• mental health and psychological information;

• relationship and family information;

• relevant personal history;

• information concerning medications, diagnoses, previous treatment or other healthcare providers;

• intake forms, questionnaires and assessments;

• clinical and session notes;

• correspondence between you and the practice;

• referrals and reports;

• information supplied by other professionals with your consent or where otherwise legally permitted;

• billing, invoicing and payment information;

• Medicare, health fund, NDIS, Victims Services or other funding information where applicable;

• information reasonably required to assess safety, suitability and the appropriate provision of services;

• information relating to complaints or feedback; and

• technical information generated when you use the practice website or online systems.

Some of this information is considered sensitive information or health information and receives additional protection under Australian privacy law.

I seek to collect only information that is reasonably necessary for providing or administering my services.

4. How information is collected

Information may be collected:

• directly from you during sessions;

• through intake, consent and assessment forms;

• through Halaxy or other secure practice-management systems;

• through appointment bookings;

• through email, telephone, SMS or other correspondence;

• through online or telehealth sessions;

• through Heidi when its use has been specifically consented to;

• from a partner participating in couples work;

• from a parent, guardian or authorised representative;

• from another healthcare professional, referrer or organisation where you have consented to the exchange of information;

• from a funding or referral body where relevant; or

• where collection is otherwise permitted or required by law.

Where practicable, health information will be collected directly from you.

5. Why information is collected and used

Personal and health information may be collected, held and used to:

• provide professional services to you;

• understand your circumstances and needs;

• assess suitability and safety;

• plan and review our work together;

• maintain appropriate clinical records;

• communicate with you;

• schedule and manage appointments;

• issue invoices and process payments;

• administer rebates, funding or third-party payment arrangements;

• communicate with other professionals where you have authorised this;

• meet professional supervision, insurance, ethical and legal obligations;

• respond to complaints or requests for information;

• manage risks to health or safety;

• maintain and improve practice administration and service quality; and

• comply with applicable laws, court orders or regulatory obligations.

Your health information will not be sold.

Your health information will not be used for advertising or direct marketing without your specific consent.

6. Confidentiality and disclosure

Information disclosed during professional services is treated as confidential.

Personal or health information will generally only be disclosed:

• with your consent;

• where disclosure is reasonably necessary for the purpose for which the information was collected and is permitted by law;

• to service providers assisting in the delivery or administration of my services;

• where required or authorised by law;

• where a valid court order, subpoena or other lawful requirement applies;

• where professional, ethical or legal obligations relating to serious risks to safety require disclosure; or

• in another circumstance permitted under applicable privacy legislation.

Where possible and appropriate, I will discuss significant disclosures with you before they occur.

7. Professional supervision

Professional supervision is an important component of ethical counselling practice.

I may discuss aspects of client work with an appropriately qualified clinical supervisor or professional consultant for the purpose of maintaining professional standards and supporting safe and effective practice.

Where practicable, identifying information is minimised.

Supervisors and professional consultants are themselves expected to maintain appropriate professional confidentiality.

8. Halaxy

I use Halaxy as a healthcare practice-management system.

Depending on the services you receive, Halaxy may be used to manage:

• client records;

• clinical notes;

• intake and consent forms;

• appointments;

• reminders;

• invoices and payments;

• correspondence; and

• other practice-administration functions.

This means some of your personal and health information may be stored and processed through Halaxy.

Halaxy maintains its own privacy and security arrangements. Halaxy currently advises that its core data is stored in Australia, although information may be processed or disclosed internationally where particular third-party services or integrations are used.

Only information reasonably required for the relevant purpose will be entered into or processed through these systems.

9. Heidi AI clinical documentation

I may use Heidi, an AI-assisted clinical documentation platform, to assist with preparing clinical notes and other documentation.

Where Heidi is used, information from a session may be securely processed to produce a transcript, summary or draft clinical note.

Heidi is a documentation aid only. AI-generated information can contain inaccuracies or omissions, and I remain responsible for reviewing clinical documentation and deciding what forms part of your clinical record.

Heidi is not used to independently diagnose you, determine treatment, make decisions about your access to services or replace my professional judgement.

Consent to Heidi

The use of Heidi during your sessions requires separate informed consent.

You may decline the use of Heidi without losing access to my services.

If you consent and subsequently change your mind, you may withdraw your consent at any time. Future sessions can then be documented manually.

Heidi maintains its own privacy, security and data-processing arrangements and may use approved technology service providers in delivering its platform.

10. Other digital service providers

In operating my practice I may use reputable third-party providers for functions such as:

• videoconferencing;

• website hosting;

• appointment scheduling;

• email and communication;

• electronic forms;

• cloud-based administration;

• payment processing;

• accounting;

• document storage; and

• professional practice administration.

These providers may process limited personal information where this is reasonably necessary to provide their services.

I take reasonable steps to select services that provide appropriate privacy and security protections for the nature of the information involved.

11. Overseas processing and disclosure

Some technology providers or their subcontractors may operate infrastructure or provide services outside Australia.

Where personal information may be disclosed or processed overseas, reasonable steps will be taken to use services with appropriate privacy and security protections and to comply with applicable Australian privacy obligations.

The countries involved may change depending upon the specific technology provider, infrastructure, integration or subcontractor being used.

Core clinical records are preferentially maintained using systems designed for healthcare information and appropriate Australian privacy requirements.

You are welcome to ask for further information about the systems currently being used to handle your information.

12. Website information and cookies

When you visit my website, certain technical information may be collected automatically.

This may include:

• IP address;

• device and browser information;

• pages viewed;

• date and time of access;

• referring website;

• general location information; and

• information stored through cookies or similar technologies.

This information may be used to operate the website, maintain security, understand how the website is being used and improve the website and services.

Third-party website, analytics, booking or embedded-content providers may also use cookies or similar technologies in accordance with their own privacy policies.

You can generally control or disable cookies through your browser settings, although doing so may affect some website functionality.

13. Email, SMS and electronic communications

Email, SMS and other electronic communication may be used for appointment reminders, administration, forms and communication concerning services.

While reasonable precautions are taken, ordinary electronic communication cannot be guaranteed to be completely secure.

You should avoid sending highly sensitive information by ordinary email or SMS where a more secure method is available.

Information contained in messages relevant to the professional service may be incorporated into your clinical record where appropriate.

14. Online and telehealth sessions

Where services are provided online, information may be transmitted using videoconferencing or other communications technology.

Reasonable steps are taken to use appropriate systems and protect confidentiality.

You are also encouraged to participate in online sessions from a private environment and to take reasonable precautions to prevent other people from overhearing or accessing your session.

15. Couples, families and information about other people

Couples and family work can involve information relating to more than one person.

Information supplied by one participant may therefore become relevant to the clinical record associated with the work.

Each participant's privacy will be respected as far as reasonably practicable, subject to the nature of conjoint work, the agreed confidentiality framework for the service, safety considerations and legal requirements.

You should avoid providing personal information about another person unless it is reasonably relevant to the work.

Where one person provides contact, health or personal information about another person, reasonable steps will be taken to handle that information appropriately.

Further confidentiality arrangements applying specifically to couples work are contained in the Client Service Agreement & Informed Consent.

16. Children and young people

Where services involve a child or young person, personal and health information may be obtained from the young person, parents, guardians, schools, healthcare professionals or other relevant people where appropriate and legally permitted.

Privacy, consent and access to records involving children and young people can depend upon factors including age, maturity, parental responsibility, the nature of the service and applicable law.

These issues will be considered on an individual basis with appropriate regard to the young person's privacy, wellbeing and legal rights.

17. Accessing your information

You generally have the right to request access to personal and health information I hold about you.

Requests should preferably be made in writing and should identify the information you are seeking.

Access may be provided by allowing you to inspect information, providing a copy, providing a summary or another appropriate method.

In some circumstances access may lawfully be refused or limited, including where providing access would unreasonably affect another person's privacy or where another legal exception applies.

If access cannot be provided, I will explain the reason where legally permitted.

Reasonable administrative costs may apply where substantial work is required to respond to a request, where permitted by law.

18. Correcting your information

I take reasonable steps to ensure personal and health information is accurate, current, complete, relevant and not misleading.

If you believe information I hold about you is inaccurate or incomplete, you may request that it be corrected.

Where appropriate, the record may be amended, supplemented or annotated rather than deleting an original clinical entry.

19. How information is protected

Reasonable physical, administrative and technological safeguards are used to protect personal and health information from:

• misuse;

• interference;

• loss;

• unauthorised access;

• unauthorised modification; and

• unauthorised disclosure.

Measures may include secure practice-management systems, access controls, passwords, encryption provided by relevant platforms, device security, appropriate backups and limiting access to information to those who reasonably require it.

No electronic system can be guaranteed to be completely free from security risks. If a privacy or security incident occurs, it will be assessed and responded to in accordance with applicable legal obligations.

20. Data breaches

If I become aware of a suspected loss, unauthorised access or unauthorised disclosure of personal information, I will take reasonable steps to contain and assess the incident.

Where a data breach meets the legal threshold requiring notification, affected individuals and the relevant privacy regulator will be notified in accordance with applicable law.

Appropriate remedial action will also be taken where possible to reduce the risk of harm.

21. How long records are kept

Health records are retained in accordance with applicable NSW law and relevant professional requirements.

For health information collected when a client is an adult, records will generally be retained for at least seven years from the last occasion on which a health service was provided.

Where health information was collected while a client was under 18 years of age, records will generally be retained until the client reaches 25 years of age.

Records may be retained for longer where required or permitted by law, professional obligations, insurance requirements, anticipated legal proceedings or another legitimate reason.

When information is no longer required and applicable retention obligations have expired, reasonable steps will be taken to securely destroy or de-identify it.

22. Anonymity and pseudonyms

Where practicable, you may make a general enquiry without identifying yourself.

However, providing professional health or counselling services ordinarily requires sufficient identifying information to safely provide the service, maintain appropriate records, manage emergencies, process payments or funding and meet legal and professional obligations.

For these reasons, it may not always be practicable to provide services anonymously or under a pseudonym.

23. Marketing communications

Receiving professional services does not automatically enrol you in marketing communications.

If you separately subscribe to newsletters, educational material or promotional communications, your contact information may be used for that purpose.

You may unsubscribe from marketing communications at any time.

Clinical or sensitive health information will not be used for direct marketing without your specific consent.

24. Links to other websites and services

My website may contain links to third-party websites, services or resources.

I am not responsible for the privacy practices of external organisations. You should review the privacy policies of those providers where relevant.

25. Privacy concerns and complaints

If you have a question, concern or complaint about how your personal or health information has been handled, please contact:

Michael Vaccaro
Privacy Contact – New Way of Being
www.michaelvaccaro.com.au

I will aim to acknowledge your concern promptly, investigate it appropriately and work with you toward a reasonable resolution.

If you are not satisfied with the response, you may also have the right to contact:

Office of the Australian Information Commissioner (OAIC)
For matters relating to the Privacy Act 1988 and Australian Privacy Principles.

Information and Privacy Commission NSW (IPC NSW)
For matters relating to NSW health privacy legislation.

Other complaint avenues may also be available depending on the nature of the concern.

26. Changes to this Privacy Policy

Privacy practices, technologies and legal requirements can change.

This Privacy Policy may therefore be reviewed and updated from time to time.

The current version will be published on my website and will state the date it was last updated.

Where a change materially affects the way existing client information is handled, reasonable steps will be taken to inform affected clients and, where required, obtain further consent.

Michael Vaccaro
Clinical Counsellor
PACFA Clinical Registrant No. 26952
New Way of Being
www.michaelvaccaro.com.au

Last updated: 3 October 2026