Privacy Policy

What we collect

The information collected includes your personal details such as name, address and contact phone numbers. As part of providing a psychological service, such as a psychological assessment or treatment, we will also need to collect and record other personal information that is relevant to your current situation. This includes keeping a record of what happens during sessions, any psychological tests you complete, and any information received from others, such as your referring doctor, other treating health practitioners, schools, or allied health professionals.

Where Neurotype provides services to a child, records of individual sessions with the child are kept distinct from records of family sessions and from records of any separate consultations with a parent. This allows access requests to be handled correctly under Australian privacy and health records law.

How your personal information is collected

There are a number of ways your personal information is collected, including when:

• You submit an enquiry through the contact form on our website.
• You provide information directly to Dr Vanessa Petersen in your session and in writing such as letters, email or text messages.
• Other health practitioners, such as your GP, provide personal information to Neurotype, through referrals, correspondence and medical reports.
• We receive personal information from non-clinical sources, such as schools, NDIS providers, or third parties involved in your care, through correspondence or reports.

If you have concerns that the information recorded is not correct, please discuss your concerns with Dr Vanessa Petersen.

Purpose of holding personal information

Your personal information is gathered and used for the purpose of providing a psychological service to you. Your personal information is retained in order to document what happens during sessions and enables Dr Vanessa Petersen to provide a relevant and informed psychological service to you. This information and record keeping is a necessary part of the services provided and guides treatment.

How we secure it

Neurotype stores client records using secure electronic systems with enterprise-grade security controls, including encryption in transit and at rest, multi-factor authentication, and role-based access restricted to Dr Vanessa Petersen and any authorised staff. Physical records, where they exist, are stored securely and destroyed by shredding when no longer required.

Online intake forms

When you complete the consent, history, or service agreement forms on this website, the information you enter is encrypted in your browser, on your device, before any of it is sent. A readable PDF copy downloads to your device for your records, and a separately encrypted copy is delivered to Neurotype's secure storage, so its contents are not legible to Cloudflare or its sub-processors in the ordinary course.

While you are completing a form, your in-progress answers are saved in your own browser so you can step away and return without losing your place. This draft stays on your device, is removed automatically when you submit, and expires after seven days. You can also clear it at any time using the Clear saved progress button on the form. If you are using a shared computer, please clear it before leaving.

The encrypted records are stored with Cloudflare in its Asia-Pacific region. The upload itself is handled by code that runs at the Cloudflare data centre nearest to you; for visitors in Australia, that is one of Cloudflare's Australian data centres. Cloudflare also encrypts the stored file at rest as a baseline storage measure, but because each record is already encrypted on your device before it leaves your browser, its contents are not legible to Cloudflare or its sub-processors in the ordinary course, regardless of where the file is stored. Standard server-side information that accompanies any web request, such as your IP address and browser identifier, is processed by Cloudflare for security and abuse prevention; Neurotype does not retain that information.

Disclosure outside of Australia

Some services used by Neurotype are hosted by third-party providers whose servers are located outside Australia. The encrypted intake form storage described in the previous section is held within Cloudflare's Asia-Pacific region, including Australian data centres. The platforms described in the sections that follow, standardised testing platforms, telehealth and video conferencing, and AI tools, are hosted primarily in the United States. Each of these providers receives only the information necessary for the specific task being performed, and identifying information is minimised, coded, or end-to-end encrypted where reasonably practicable. Neurotype takes reasonable steps consistent with Australian Privacy Principle 8 to ensure your information is handled to a standard consistent with the APPs.

Neurotype does not otherwise disclose your personal information to recipients outside of Australia.

Standardised testing platforms

Standardised neuropsychological and behavioural assessments are scored using vendor platforms hosted by their publishers. Depending on the test battery used for your assessment, this may include platforms such as Pearson Q-global and Q-interactive, PAR iConnect, and the WPS Online Evaluation System. These vendors are based primarily in the United States. Not every platform listed will be used in your assessment; the specific platforms that apply depend on the goals of the assessment.

For each assessment, only the information required to administer and score the specific test is entered into the platform. This includes age and any other demographic factors required for normative scoring, together with your responses to test items. You are identified to the platform by a coded client ID rather than your full name, so that your identifying information remains held within Neurotype's clinical record and is not held against your test data by the overseas vendor.

Each vendor encrypts data in transit and at rest, applies contractual privacy and security commitments to its professional customers, and does not use client data for marketing or to train AI or scoring models. Neurotype takes reasonable steps consistent with Australian Privacy Principle 8 to ensure these vendors handle your information to a standard consistent with the APPs.

Telehealth and video conferencing

Where a session is conducted via telehealth, Neurotype uses Google Meet, provided as part of Google Workspace by Google LLC. Audio and video are encrypted in transit, and Google does not store session content; Google Meet is used for the call only and is not used to record sessions. Google's video infrastructure processes data primarily on servers located in the United States, under Google's contractual privacy and security commitments to Google Workspace customers.

Session audio recording

Audio from sessions with Neurotype is recorded for clinical purposes, whether conducted in person or via telehealth. Recordings are captured directly onto a Neurotype-managed device protected by full-disk encryption, and remain within Neurotype's secure environment. Disposal of these recordings is described under "Retention and disposal" below.

Artificial intelligence (AI) tools

Neurotype uses AI tools in two specific ways:

• Session transcription, performed on the same Neurotype-managed device that captures the session audio. Audio does not leave the device.
• Report drafting assistance, performed by Anthropic (Claude), operating outside Australia. Only the minimum necessary information is provided, and identifying details are minimised or coded before transmission where reasonably practicable.

Neurotype only uses AI services that disable training on client data, whether by contractual commitment or account configuration. Dr Vanessa Petersen reviews, edits and remains professionally responsible for all clinical content produced with AI assistance. AI is not used to make clinical decisions, score standardised assessments, generate diagnoses, or to make recommendations that have not been independently formulated by Dr Petersen. Use of AI tools is documented in the Neurotype Service Agreement.

Retention and disposal

Neurotype is required to retain client records for a minimum period set by law and professional standards. For adult clients, records are retained for at least seven years from the date of the last entry. For clients who were under 18 at the time of the last entry, records are retained until the later of the client's 25th birthday or seven years from the last entry. When records are no longer required to be retained, Neurotype will take reasonable steps to securely destroy or de-identify your personal information. Electronic records are permanently deleted and physical records, where they exist, are destroyed by shredding.

Session audio recordings, and any raw transcripts derived from them, are securely deleted once the related report or session note is finalised. The clinical notes, scores and analysis derived from those sessions are retained as part of the clinical record under the retention periods set out above.

Confidentiality and disclosure

Personal information gathered by Dr Vanessa Petersen remains confidential except where consent is given to disclosure, or where disclosure is required or authorised by law.

For services provided to a child, Neurotype distinguishes information handling between the parent or guardian who has engaged the service (the accompanying parent), any other parent or guardian who shares parental responsibility (the non-accompanying parent), and third parties such as a GP, school, NDIS provider, insurer, or health practitioner. Each parent with parental responsibility is generally entitled to information about the service, subject to any applicable court, parenting or protection order and to the young person's own consent where Neurotype assesses they are mature enough to give it. Where parental responsibility is contested or court-ordered, the Service Agreement sets out how Neurotype handles consent and information sharing in those circumstances. Information is released to third parties only with written consent for each release.

There are times when Dr Vanessa Petersen may release information without consent, including:

• When a court requires information by issuing a subpoena, or disclosure is otherwise required or authorised by law.
• When Dr Vanessa Petersen is required to make a mandatory report. In Victoria, registered psychologists are mandatory reporters under the Children, Youth and Families Act 2005 (Vic) for suspected child physical or sexual abuse. Other reporting obligations may apply where there is risk of harm to a child or another person.
• When Dr Vanessa Petersen reasonably believes there is an immediate and specified risk of serious harm to you, your child, or another identifiable person, that can be reduced only by disclosure.
• When seeking professional consultation or supervision, where identifying details are concealed or disclosure is limited to what is necessary.

Further detail about how these exceptions apply in clinical practice is set out in your Neurotype Service Agreement.

Family arrangements and parental responsibility

Where parental responsibility is held by a step-parent, grandparent, kinship carer, or another person acting in loco parentis, Neurotype clarifies who holds legal responsibility for the child before sharing or releasing information. Indigenous and culturally diverse family and kinship arrangements are recognised and respected within this process. Where any applicable court, parenting or protection order is in place, that order takes precedence and Neurotype works within its terms.

Anonymity and pseudonymity

Where possible, Neurotype supports anonymous or pseudonymous interaction. Initial enquiries and intake conversations may be conducted without providing full identifying details. Once you proceed to assessment, identifying information is required to meet professional record-keeping obligations, along with the demographic information needed for normative test scoring.

Consequence of not providing personal information

Psychologists are required to keep clear and accurate client records as part of their professional obligations. If you do not wish for your personal information to be collected, we may not be able to provide the psychological service to you. Please discuss any concerns you have with Dr Vanessa Petersen.

Data breach policy

In the event of any unauthorised access, disclosure or loss of your personal information, Neurotype will activate its data breach response plan and take reasonable steps to contain the breach and minimise any consequential harm. Each suspected breach is assessed under the Notifiable Data Breaches scheme established under the Privacy Act 1988 (Cth). Where a breach is likely to result in serious harm, Neurotype will notify the Office of the Australian Information Commissioner and affected individuals as required by that scheme.

Direct marketing

Neurotype does not use your personal information for direct marketing purposes.

Accessing your personal information

At any stage you may request to see the personal information held about you, subject to the exceptions in the Privacy Act 1988 (Cth) and the Health Records Act 2001 (Vic). Requests should be made to Dr Vanessa Petersen, in person or by writing to [email protected]. Written requests will be responded to within a reasonable period, usually 30 days, and an appointment will be made if necessary for clarification purposes.

For records of a child or young person, access is governed by the Health Records Act 2001 (Vic) and related Australian privacy law. The assessment of whether a child is mature enough to make decisions about their own record is a clinical judgement made by Neurotype, in line with the Psychology Board of Australia's Code of Conduct. Where Neurotype assesses that the child is not mature enough to make the request themselves, a parent or other person with parental responsibility may access the record. Where Neurotype assesses that the child is mature enough to understand the nature of the request and the record, and the child chooses not to give consent for parental access, the record is not released to a parent.

Any applicable court, parenting or protection order may also affect how information is accessed, handled, or disclosed. If any such order applies, Neurotype will work within its terms. Where an access request is contested or unclear, Neurotype will discuss the position with the parties and seek further professional or legal advice as necessary.

Correcting your personal information

You may ask us to correct personal information we hold about you or your child. We will correct factual errors such as misspelled names, incorrect dates, contact details and other administrative information.

Some information cannot be altered through this process because changing it would compromise the integrity of the clinical record. This includes:

• clinical opinions, formulations and diagnoses, which represent the practitioner's professional judgement at the time of assessment;
• test results and their interpretation;
• information accurately recorded as having been reported by a third party (such as a teacher, school, treating clinician or family member), where our record correctly reflects what was reported and who reported it;
• the practitioner's clinical observations made during sessions.

Disagreement with a clinical opinion, a diagnosis, or with information provided by another person is not, on its own, a basis for changing the record. If we decline to make a requested change, we will tell you in writing and explain why. You may then request that a statement of your view be associated with the record under Australian Privacy Principle 13.4 and the equivalent provisions of the Health Records Act 2001 (Vic). We will take reasonable steps to ensure that statement is visible to anyone who later accesses the relevant part of the record.

Where you wish to challenge a clinical opinion, the appropriate avenue is a second opinion from another qualified practitioner, not amendment of our record.

Concerns

If you have a concern about the management of your personal information, please raise it with Dr Vanessa Petersen or contact us at [email protected]. We will acknowledge your concern promptly and work with you to investigate and resolve it. Upon request you can obtain a copy of the Australian Privacy Principles, which describe your rights and how your personal information should be handled.

If you wish to lodge a formal complaint about the use of, disclosure of, or access to, your personal information, you may do so with the Office of the Australian Information Commissioner:

• By phone on 1300 363 992
• Online at oaic.gov.au
• By post to: Office of the Australian Information Commissioner, GPO Box 5288, Sydney, NSW 2001

Availability

This policy is available free of charge on the Neurotype website and in alternative formats upon request.