Deb Smith Naturopathy ("we", "us", "our") is a sole trader practice operated by Deb Smith, ABN 30 750 092 036, based in Kialla West, Victoria, Australia, providing naturopathy, clinical hypnotherapy, counselling and psychotherapy services by telehealth across Australia.
We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and by the Health Records Act 2001 (Vic) and its Health Privacy Principles (HPPs).
This policy explains what personal and health information we collect, why we collect it, how we store and protect it, who we share it with, and how you can access or correct it.
Personal information
Name, date of birth, email address, postal address, telephone number, emergency contact details, and payment information.
Health information (sensitive information)
Health information is treated as sensitive information under the Privacy Act and attracts additional protections. This includes:
Website information
If you submit an enquiry form, we collect the information you provide in that form.
If you request a free guide or other download, we collect your first name and email address, together with a record of whether you agreed to receive occasional emails from us. Requesting a guide is not the same as joining our mailing list: we will only send you marketing emails if you ticked that box, and every such email includes a one-click unsubscribe link that removes you immediately and automatically. You may also ask to be removed at any time by replying to any email or contacting us using the details below. Unsubscribing from marketing emails does not affect appointment confirmations, intake forms, or any other message we need to send you about your own care.
Cookies, analytics and advertising
Our website uses cookies and similar technologies to understand how the site is used and to measure the effectiveness of our advertising. These may include:
This information is collected about your use of the website. It is not combined with your health records, and these technologies are not used on the client intake form, which carries health information.
You can control or clear cookies through your browser settings, and most browsers allow you to block them entirely, though parts of the site may not work as intended if you do. If your browser sends a "Do Not Track" signal, we do not load analytics or advertising technologies at all. You can also opt out of Google Analytics using Google's browser add-on, and adjust your advertising preferences in your Google and Meta account settings.
We collect information:
We collect health information only where it is reasonably necessary for your care, and only with your consent. You may decline to provide information, but this may limit our ability to treat you safely.
We collect and use your information to:
We do not use your information for marketing without your separate, express consent, and we do not sell or trade your information under any circumstances.
We disclose your information only where necessary, and (except where required by law) only with your consent:
| Who | What is shared | Why |
|---|---|---|
| Our dispensary partner vital.ly | Prescription details, relevant clinical information | To dispense your prescribed remedies |
| NutriPATH or other pathology providers | Referral and identifying details | To conduct testing you have consented to |
| Your GP or other treating practitioners | Relevant clinical information | Continuity of care, only with your consent |
| Stripe | Payment details | Payment processing. Card details are handled by Stripe and are not stored by us. |
| Google (Google Workspace) | Records stored in Gmail and Google Drive | Secure record storage and communication |
| Google (Analytics & Ads) | Website usage data only, never health information | Understanding how the site is used and measuring advertising |
| Meta (Facebook & Instagram) | Website usage data only, never health information | Measuring advertising and showing relevant ads |
Overseas disclosure. Some of these providers, including Google, Meta and Stripe, store or process data on servers located outside Australia, including in the United States. By providing your information you consent to this disclosure. These providers are bound by their own privacy and security obligations, and we take reasonable steps to ensure they handle your information appropriately.
Disclosure required by law. We may disclose information without your consent where we are required or authorised by law to do so, or where there is a serious and imminent threat to your life, health or safety, or to the life, health or safety of another person.
Your records are stored electronically within Google Workspace (Google Drive and Gmail), which is protected by:
Telehealth recordings. Telehealth consultations conducted via Google Meet are recorded with your consent. Recordings are stored within the same secured Google Workspace environment, form part of your health record, and are subject to the same access, correction, retention and destruction provisions set out in this policy. You may withdraw consent to recording at any time before an appointment begins.
Only Deb Smith has access to your health records. We do not share account access with any third party.
Backups. Our client database is copied automatically each week so that your records can be restored if they are ever lost or damaged. Backups are held inside the same secured Google Workspace environment as the original, are never shared or moved elsewhere, and are subject to the same access, retention and destruction provisions as the records they copy.
In the event of a data breach. If a breach occurs that is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner as required under the Notifiable Data Breaches scheme.
Under the Health Records Act 2001 (Vic), we are required to retain health records for a minimum of seven years from the date of your last consultation.
We provide services to adults aged 18 and over only.
After the applicable retention period, records are securely and permanently destroyed.
You have the right to request access to the personal and health information we hold about you, and to request correction of anything inaccurate, out of date or incomplete.
To make a request, email deb@debsmithnaturopathy.com.au.
We will respond within 30 days. In limited circumstances we may decline a request, for example, where providing access would pose a serious threat to someone's life, health or safety, or would unreasonably affect another person's privacy. If we decline, we will explain why in writing and tell you how to seek review.
A reasonable administrative fee may apply for providing copies of records. We will tell you the amount before proceeding.
If you are concerned about how we have handled your information, please contact us first at deb@debsmithnaturopathy.com.au. We take complaints seriously and will acknowledge your complaint within 7 business days and respond substantively within 30 days.
If you are not satisfied with our response, you may contact:
Office of the Australian Information Commissioner (OAIC)
Phone: 1300 363 992 · Web: oaic.gov.au
Health Complaints Commissioner (Victoria)
Phone: 1300 582 113 · Web: hcc.vic.gov.au
Where it is lawful and practicable, you may deal with us anonymously or by pseudonym, for example, when making a general enquiry. However, we cannot provide clinical care anonymously, as we require accurate health information to treat you safely.
We may update this policy from time to time. The current version will always be available on our website, with the "last updated" date shown at the top. Material changes affecting how we handle your health information will be communicated to current clients directly.