Policies
Malu Health Group Privacy Policy
Last updated 14 September 2026
Malu Health Group (ABN 15 682 104 089) and its related companies, (Malu, we, us or our) are committed to protecting the privacy of Personal Information that we handle in accordance with applicable Privacy Laws. This policy applies to all clinics and services operated by Malu, regardless of the trading name under which they operate.
This Privacy Policy applies to Personal Information handled by Malu in connection with our clinics, Website, digital platforms, telehealth services and related business operations and sets out how we collect, use and share your Personal Information.
This Privacy Policy also sets out your rights in relation to your Personal Information.
What kinds of Personal Information we collect and hold
When you engage with us in person, online on the Website or otherwise, or over the phone, we may collect Personal Information from and about you, that may include:
your name, date of birth and contact details;
Medicare, health fund and billing information;
referral details and appointment records;
health and mental health information relevant to your care;
clinical notes, assessments and treatment records;
information from other health professionals or third parties involved in your care (with consent or as permitted by law);
NDIS participant information, including participant number, plan details, funding and plan management arrangements, nominated representatives, and information required to meet NDIS funding, reporting and compliance obligations;
information about family members, carers, guardians, support people, teachers, employers or other third parties where relevant to a service we provide or where you ask us to involve them;
billing and payment information, including invoices, payment history, private health insurance details or funding information;
other Personal Information shared in communications with us, including in sessions, emails, SMS, forms, online enquiries, call records and feedback or complaints;
job application and recruitment information if you apply to work with us; and
other information you choose to provide to us;
Sensitive Information is a subset of Personal Information and includes information about your health (including your physical and mental health), religious or philosophical beliefs, sexual orientation or practices, criminal record and other information. Because of the nature of the services we provide, much of the Personal Information we collect is Sensitive Information. We collect Sensitive Information only where it is reasonably necessary to provide our services, and we do so in accordance with applicable Privacy Laws.
In addition to the information described above, we may also collect the following, where relevant to your care or attendance at our clinics:
Session recordings — audio or video recordings of consultations, made for the purposes of maintaining your clinical record and for clinical supervision of the treating practitioner. These recordings are not used for research purposes.
Guardian or authorised representative identity documents — where a parent, guardian, or authorised representative acts on behalf of a client, we may collect identifying information about that person.
School or workplace information — where relevant to a referral, report, or treatment plan (for example, information provided by or shared with a school or employer in connection with your care).
How we collect Personal Information
We usually collect Personal Information directly from you. For example, we may collect information when you:
make an enquiry or book an appointment;
complete intake forms or other forms;
attend a clinic appointment or participate in telehealth services;
communicate with us by phone, email, SMS, Website, online portal or other digital channel;
complete assessments, questionnaires or outcome measures;
make a payment or seek Medicare, NDIS, insurance or other funding support; or
make a complaint, provide feedback, or engage with us through our Website or social media.
We may sometimes also collect Personal Information from third parties which may include:
other psychology practices that we acquire;
parents, carers, guardians, nominees or support persons;
general practitioners, psychiatrists, paediatricians and other treating healthcare practitioners;
hospitals, schools, early childhood services, allied health providers and community organisations;
the NDIA, plan managers, support coordinators or approved quality auditors in connection with NDIS funding;
referrers, insurers, Medicare, private health funds or compensation schemes; and
publicly available sources or other lawful sources where appropriate.
Where required under Privacy Laws, we will provide a collection notice to you and obtain your consent before we collect your Personal Information.
Why we collect, hold, use and disclose Personal Information
We collect, hold, use and disclose your Personal Information for purposes that may include to:
provide our services to you;
assess your needs, provide treatment or support, monitor progress and coordinate care;
communicate with you and, where appropriate, your carer, guardian, nominee, support person or other treating practitioners;
arrange appointments, manage administration, maintain records and support quality assurance activities;
prepare invoices, process payments and administer Medicare, NDIS, private health insurance or other funding arrangements;
manage complaints, incidents, legal requests and regulatory reporting obligations;
train and supervise staff, and improve our services, systems and clinical governance practices;
undertake research, service evaluation or quality improvement activities, usually using de-identified information where practicable or otherwise with consent or as permitted by law;
protect the safety of patients, staff and the public, including by responding to serious risks to life, health or safety;
comply with legal, regulatory, professional, accreditation and contractual obligations;
make and manage claims with our insurer; and
otherwise carry out our functions and activities.
If you do not provide us with the Personal Information that we request or require from you, we may not be able to provide you with our services, or otherwise engage with you.
How we may disclose Personal Information
We may disclose Personal Information to:
our contractors and consultants who need the information to perform their role and who will ordinarily be subject to contractual obligations to keep that information confidential;
our related businesses and partners where disclosure is necessary for service delivery, administration, quality assurance;
other treating practitioners or service providers involved in your care, such as your general practitioner, psychiatrist, paediatrician, allied health providers, hospitals, schools or community organisations;
parents, carers, guardians, nominees, support persons or other persons you authorise us to communicate with;
the NDIA, approved quality auditors, plan managers, support coordinators, auditors that assess our operations for NDIS purposes, and other NDIS related entities where consent has been given or disclosure is otherwise required or authorised;
Medicare, private health insurers, compensators, funding bodies and payment processors;
technology, clinical and business service providers who help us operate our practice, such as electronic health record providers, artificial intelligence (AI) platforms, telehealth platforms, psychometric assessment platforms, IT support providers, cloud hosting providers, transcription or note-assistance providers, document management providers, billing providers and legal, accounting or audit advisers;
our insurers, professional advisers and external complaint bodies;
law enforcement agencies, courts, tribunals, regulators, child protection authorities or other government agencies where disclosure is required or authorised by law; and
a purchaser, successor or adviser in connection with a sale, acquisition, restructure or financing of all or part of our business, subject to appropriate confidentiality arrangements and legal requirements.
We do not sell Personal Information.
Overseas disclosures of Personal Information
We do not disclose your Personal Information overseas. However, some of our technology, clinical and business service providers may disclose Personal Information overseas in providing their services to us.
Use of AI
Malu may use digital systems, software tools and, where appropriate, AI features to support clinical and business operations. This may include tools that assist with transcription, note drafting, document or correspondence preparation, intake processing, psychometric assessment workflows, administrative efficiency, data analysis, clinical governance and service improvement. We may input Personal Information into such tools for any of the purposes described in this Privacy Policy.
We do not intend for AI-enabled tools to replace clinician judgement, professional responsibility or human oversight in the delivery of care. Clinical decisions will remain subject to oversight by staff.
We do not use any publicly available generative AI tools to input Personal Information because they can present significant privacy risks.
Your practitioner will explain to you how they plan to use AI and seek your consent to this, where required under Privacy Laws.
How we hold and protect Personal Information
We hold Personal Information in electronic and paper records, including clinical files, communications records and practice management systems. We take reasonable steps to protect Personal Information from misuse, interference and loss, and from unauthorised access, modification or disclosure including through role-based access, password protections and encryption and physical security measures for paper records and clinic premises.
While we implement reasonable safeguards designed to protect your Personal Information from unauthorised access, disclosure or misuse, we cannot guarantee the security of information transmitted to or from us, as the transmission of information over the internet is not completely secure. Any electronic communication with us, including through our Website or email, is carried out at your own risk.
We are also not responsible for the privacy practices or content of any other websites that may be linked to or from our Website. Once you leave our Website and visit another site, we do not have control over how your information is collected, used, or handled.
How we retain Personal Information
We retain Personal Information only for as long as is necessary to fulfil the purposes for which it was collected. This includes retaining records in connection with providing psychology services, billing and payment processing, taxation record keeping, Medicare claims management and compliance, maintaining professional indemnity insurance, and our obligations to government bodies in respect of NDIS participants.
Once we no longer need Personal Information for any of the purposes set out in this Policy, and we are otherwise not required by law or by a professional, regulatory or funding obligation to retain it, we will take ensure the information is deleted or de-identified.
Direct marketing
We may use your Personal Information to send you service offers and updates, clinic information, newsletters or other communications about our services. You may opt out of marketing communications by emailing our Privacy Officer using the below email with your full name and the words ‘OPT OUT MARKETING’
Access to and correction of Personal Information, and complaints
You have rights under the Privacy Laws in relation to your Personal Information.
These include the right to:
Access: request access to the personal and health information we hold about you (subject to limited exceptions permitted by law);
Correct: request that we correct information that is inaccurate, incomplete or out of date; and
Make a complaint: raise a concern if you believe your privacy has been handled in a way that does not comply with the Privacy Laws.
If you make a complaint, we will take reasonable steps to investigate and respond to you within a reasonable timeframe. If you are not satisfied with our response, you may refer your complaint to the Office of the Australian Information Commissioner (OAIC) via www.oaic.gov.au or telephone to 1300 363 992.
Further information about how to exercise these rights can be obtained by contacting our Privacy Officer.
Contact details
For privacy questions, access requests, correction requests or complaints, please contact:
Privacy Officer
Email: privacy@malu.health
Post: 6 Middlemiss St, Milsons Point NSW 2061
Definitions
NDIA means National Disability Insurance Authority.
NDIS means National Disability Insurance Scheme.
Personal Information means information or an opinion about an identified person, or a person who is able to be reasonably identified from the information. Information does not have to be true or recorded in a material form to be considered Personal Information.
Privacy Act means the Privacy Act 1988 (Cth), as amended from time to time.
Privacy Laws means the Privacy Act and APPs, and State and Territory Legislation.
Sensitive Information means Personal Information that is afforded a higher level of protection under the Privacy Act and includes health information, information about a person’s ethnicity, race, political opinions, religious beliefs, political association memberships, philosophical beliefs, professional or trade association membership, sexual orientation or practices, or criminal record.
State and Territory Legislation means the Health Records and Information Privacy Act 2002 (NSW), Health Records Act 2001 (VIC) and Health Records (Privacy and Access) Act 1997 (ACT).
Website means any website, online portal, digital platform or other online service operated by or on behalf of Malu or any of its related companies or businesses, including websites operated under any of our clinic or trading names.
Latest News & Articles
Stay informed with our latest news and articles, offering valuable insights and updates on what is happening here at the clinic.
