123Psych | Australia & International | Prepared: 25 October 2026
Part A - Australia: core provisions plus Australian legal requirements.
Part B - International (outside Australia): core provisions plus international legal requirements.
Common provisions are restated in each part so each can be read independently.
Applies to people receiving services in Australia.
Identify the actual 123Psych legal entity and distinguish whether it acts as health-service provider, booking intermediary, joint controller or processor in each workflow. This notice covers visitors, enquiries, account holders, clients, carers and practitioners only to the extent their information is actually handled.
Depending on services used, data may include names, contact details, age, location or time zone, identity verification, emergency contacts, referral details, booking history, invoices, payment tokens, device and log data, communications, accessibility preferences, and sensitive clinical information such as symptoms, assessments, diagnoses, treatment notes and correspondence. Do not collect categories that are unnecessary.
Information may come directly from forms and consultations; authorised parents or guardians; referrals; practitioners; payment, booking and security providers; and technical interactions with the site. Where collection from someone else is permitted, appropriate notice should explain the source and purpose.
Use information to respond to enquiries, assess suitability, provide or arrange care, verify eligibility, manage appointments, process payments, secure accounts, comply with clinical and legal duties, handle complaints and improve services. Optional marketing, non-essential analytics and advertising require their own appropriate legal basis or consent. Do not use therapy communications to target advertisements.
Health information receives heightened protection. Access should follow clinical need-to-know rules, professional confidentiality, informed consent and legally permitted exceptions. Disclosures may be required for immediate safety, child protection, lawful court orders or other legal obligations; such disclosures should be assessed and documented.
Where actually engaged, recipients may include treating practitioners, authorised clinical supervisors, booking and communications vendors, hosting and cybersecurity providers, payment processors, insurers or funders when authorised, and professional advisers or authorities where lawful. Name material categories, identify key providers where appropriate and use contracts that restrict access and onward use.
Remote hosting, international clinicians, support teams and vendor subprocessors may create overseas access or disclosure. Publish actual storage and recipient countries when known, assess applicable safeguards, limit access, and do not claim Australian-only storage or international certification without evidence.
Keep clinical records for the period required by applicable health-records legislation, professional standards, litigation holds and care continuity needs. Other account, transaction, enquiry and analytics data should have purpose-based retention schedules. Securely delete or de-identify information when no longer required; a deletion request may not override mandatory clinical record retention.
Provide a clear channel to request access to and correction of personal information, to raise a privacy complaint, and where applicable request erasure, restriction, portability or objection. Identity checks should be proportionate. Explain any lawful refusal, redactions, timeframes and review options.
Apply access controls, appropriate encryption in transit and at rest where supported, authentication, audit logging, backups, vendor diligence, staff confidentiality, retention controls and incident procedures. Do not claim a named certification, 24-hour monitoring or specific cryptographic strength without evidence. Assess notification duties after eligible data breaches.
Explain necessary cookies separately from optional analytics and advertising. Record consent where required, offer meaningful withdrawal and avoid placing tracking pixels in authenticated therapy or sensitive health workflows without a separately assessed lawful basis. Marketing preferences are separate from necessary appointment and safety communications.
Disclose any actual AI transcription, scribing, summarisation, chat, fraud detection or clinical decision support, including vendors, purposes, human oversight, retention and whether information trains models. Do not state that clinical information is or is not used for AI training until the relevant systems and contracts are verified. Obtain consent when required.
Apply age-appropriate consent and confidentiality standards. Verify guardian authority where necessary while recognising that mature minors may have independent privacy rights. Do not publish an arbitrary global minimum age unless it reflects service eligibility and local law.
Provide a verified privacy officer or designated contact, postal or online contact method and an accessible complaint procedure. Explain escalation to the relevant regulator after an appropriate opportunity for internal resolution.
For Australia, consider the Privacy Act 1988 and Australian Privacy Principles where applicable; state and territory health-records and health-complaints laws; Australian Consumer Law; Spam Act 2003; Disability Discrimination Act 1992; and applicable professional registration, advertising, telehealth and record-keeping obligations. Applicability varies by service and entity.
Australian registered practitioners must meet relevant Ahpra and National Board standards, including appropriate telehealth practice, informed consent and professional indemnity. Australian Consumer Law rights and remedies cannot be contracted away; fees and cancellation conditions must not be misleading or unfair.
Sensitive health information requires particular care. Assess collection notices, authorised uses, access/correction rights, retention and eligible breach notification. Before overseas disclosures, evaluate APP 8 duties where applicable. Commercial electronic marketing requires compliant consent, sender identification and unsubscribe mechanisms.
Clients may contact the relevant state or territory health complaints organisation and, for registered practitioners, Ahpra or the applicable National Board. Privacy complaints may be escalated to the OAIC where it has jurisdiction. Accessibility should be assessed against discrimination duties and reasonable adjustments.
Applies to people receiving services in countries outside Australia, only where 123Psych is legally able to provide the relevant service.
Identify the actual 123Psych legal entity and distinguish whether it acts as health-service provider, booking intermediary, joint controller or processor in each workflow. This notice covers visitors, enquiries, account holders, clients, carers and practitioners only to the extent their information is actually handled.
Depending on services used, data may include names, contact details, age, location or time zone, identity verification, emergency contacts, referral details, booking history, invoices, payment tokens, device and log data, communications, accessibility preferences, and sensitive clinical information such as symptoms, assessments, diagnoses, treatment notes and correspondence. Do not collect categories that are unnecessary.
Information may come directly from forms and consultations; authorised parents or guardians; referrals; practitioners; payment, booking and security providers; and technical interactions with the site. Where collection from someone else is permitted, appropriate notice should explain the source and purpose.
Use information to respond to enquiries, assess suitability, provide or arrange care, verify eligibility, manage appointments, process payments, secure accounts, comply with clinical and legal duties, handle complaints and improve services. Optional marketing, non-essential analytics and advertising require their own appropriate legal basis or consent. Do not use therapy communications to target advertisements.
Health information receives heightened protection. Access should follow clinical need-to-know rules, professional confidentiality, informed consent and legally permitted exceptions. Disclosures may be required for immediate safety, child protection, lawful court orders or other legal obligations; such disclosures should be assessed and documented.
Where actually engaged, recipients may include treating practitioners, authorised clinical supervisors, booking and communications vendors, hosting and cybersecurity providers, payment processors, insurers or funders when authorised, and professional advisers or authorities where lawful. Name material categories, identify key providers where appropriate and use contracts that restrict access and onward use.
Remote hosting, international clinicians, support teams and vendor subprocessors may create overseas access or disclosure. Publish actual storage and recipient countries when known, assess applicable safeguards, limit access, and do not claim Australian-only storage or international certification without evidence.
Keep clinical records for the period required by applicable health-records legislation, professional standards, litigation holds and care continuity needs. Other account, transaction, enquiry and analytics data should have purpose-based retention schedules. Securely delete or de-identify information when no longer required; a deletion request may not override mandatory clinical record retention.
Provide a clear channel to request access to and correction of personal information, to raise a privacy complaint, and where applicable request erasure, restriction, portability or objection. Identity checks should be proportionate. Explain any lawful refusal, redactions, timeframes and review options.
Apply access controls, appropriate encryption in transit and at rest where supported, authentication, audit logging, backups, vendor diligence, staff confidentiality, retention controls and incident procedures. Do not claim a named certification, 24-hour monitoring or specific cryptographic strength without evidence. Assess notification duties after eligible data breaches.
Explain necessary cookies separately from optional analytics and advertising. Record consent where required, offer meaningful withdrawal and avoid placing tracking pixels in authenticated therapy or sensitive health workflows without a separately assessed lawful basis. Marketing preferences are separate from necessary appointment and safety communications.
Disclose any actual AI transcription, scribing, summarisation, chat, fraud detection or clinical decision support, including vendors, purposes, human oversight, retention and whether information trains models. Do not state that clinical information is or is not used for AI training until the relevant systems and contracts are verified. Obtain consent when required.
Apply age-appropriate consent and confidentiality standards. Verify guardian authority where necessary while recognising that mature minors may have independent privacy rights. Do not publish an arbitrary global minimum age unless it reflects service eligibility and local law.
Provide a verified privacy officer or designated contact, postal or online contact method and an accessible complaint procedure. Explain escalation to the relevant regulator after an appropriate opportunity for internal resolution.
123Psych must assess whether a service may legally be offered to a client in each destination country, including professional licensing, permitted telehealth modalities, age and guardian consent, prescribing restrictions, safeguarding and professional indemnity. A website accessible worldwide is not proof that clinical services are available worldwide.
Where GDPR or UK GDPR applies, identify the controller and representative or DPO where required, specify lawful bases and Article 9 conditions for health data, provide transparent notices and rights procedures, and assess processors, security, data breaches and international transfer mechanisms. Do not assume consent is the lawful basis for all clinical processing.
Evaluate laws in the actual markets served, potentially including Canadian federal/provincial privacy laws, New Zealand Privacy Act, Singapore PDPA, and US federal/state health and consumer privacy rules where applicable. Do not assert HIPAA coverage, US state licensure or international certifications without verified facts.
For relevant European audiences, assess ePrivacy consent for non-essential tracking and GDPR requirements; for the UK consider PECR. Apply local direct-marketing opt-in and unsubscribe rules, consumer cancellation rights, accessibility duties and digital-service requirements where applicable.
Any governing-law or forum provision must preserve mandatory rights in the consumer’s country where applicable. Do not impose US-style arbitration or class-action waivers by default. Provide practical international complaint and regulatory escalation channels.
