Privacy Policy

Effective Date: 13 October 2026

12 Points Pty Ltd respects the privacy of the people who use our clinical, training, business-support and digital services. This policy explains what information we collect, why we collect it, how we use and protect it, when we may share it, and how you can access, correct or raise a concern about your information.

In this policy, 12 Points, we, us and our mean 12 Points Pty Ltd, ABN 83 622 983 742, including the services and brands known as 12 Points Psychology, 12 Points Training and SPARKSFIRE.

1.  Scope of This Policy

This policy applies when you interact with us as a therapy or psychology client, parent, guardian, carer, referrer, trainee, supervisee, workshop participant, member, purchaser, Systems Snapshot client, website visitor, contractor, job applicant or other contact. It also applies to personal information collected through our websites, forms, emails, telephone calls, appointments, events, online platforms and business systems.

Additional collection notices, consent forms, service agreements or professional obligations may apply to a particular service. Those documents should be read with this policy.

2.  Privacy Laws and Professional Duties

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles where they apply. For health information handled in Victoria, we also comply with the Health Records Act 2001 (Vic) and the Health Privacy Principles. Our clinicians and other regulated professionals may also have confidentiality, record-keeping, notification and professional-conduct obligations.

If a law or professional obligation provides a stronger protection or requires a particular use, disclosure or retention period, that requirement applies.

3.  What We Mean by Personal and Sensitive Information

Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether or not the information is true or recorded in material form.

Sensitive information is given additional protection. It includes health information and information about matters such as racial or ethnic origin, religious or philosophical beliefs, sexual orientation, criminal record and membership of certain associations.

Health information includes information or an opinion about a person’s physical, mental or psychological health, disability, wishes about future health services, or a health service provided or to be provided.

4  Information We Collect and Hold

Depending on your relationship with us, we may collect and hold:

  • identity and contact information, including name, date of birth, address, email, telephone number and emergency contacts

  • demographic information and communication, accessibility or cultural preferences

  • health and sensitive information needed for psychology, supervision, training or another service, including relevant history, assessments, treatment information, referrals, progress notes and correspondence

  • Medicare, private health insurance, funding, billing and payment information

  • appointment, attendance, service, purchase, membership and transaction records

  • professional information, including role, qualifications, registration, practice details, supervision or training needs

  • Systems Snapshot information about a practice, services, workflows, client journey, technology, communications, workload, business pressures and implementation preferences

  • information you choose to provide about your own wellbeing, disability, health or personal circumstances where relevant and lawfully collected

  • communications, enquiries, feedback, complaints, testimonials and survey responses

  • website and technical information such as IP address, device, browser, pages viewed, referral source and cookie or analytics identifiers

  • employment, contractor or applicant information, including work history, qualifications, references and right-to-work information

We may also hold information about another person that you provide, such as a family member, referrer, employee, contractor, patient or client. You should only provide another person’s information where you are authorised to do so and it is reasonably necessary. Systems Snapshot materials must not contain identifiable patient or client information.

5.  How We Collect Information

We usually collect information:

  • directly from you through forms, conversations, appointments, questionnaires, email, telephone, websites, portals, purchases, events and service delivery

  • from a parent, guardian, authorised representative, family member or carer

  • from a referrer, treating practitioner, employer, school, insurer, funder, Medicare or another organisation where authorised or permitted by law

  • from publicly available sources where relevant to a service, such as a business website reviewed for a Systems Snapshot

  • automatically through websites and digital services using cookies, logs and analytics technologies

  • from service providers that support bookings, payments, communications, forms, telehealth, learning, storage, administration or security

Where required, we provide a collection notice at or before collection. If it is not practicable to do so, we provide notice as soon as practicable.

6.  Why We Collect, Use and Disclose Information

We collect, use and disclose information where reasonably necessary to:

  • assess enquiries, suitability, accessibility and service needs

  • provide psychology, therapy, supervision, training, membership, digital, SPARKSFIRE and Systems Snapshot services

  • manage appointments, referrals, communications, accounts, payments, rebates, records and customer support

  • prepare, quality-check and deliver reports, resources, certificates and other service outputs

  • coordinate care or services with authorised people and providers

  • maintain professional standards, clinical governance, supervision, safety, service quality and continuity

  • operate, secure, evaluate and improve our services, websites, systems and client experience

  • respond to feedback, complaints, incidents, disputes and legal claims

  • meet legal, regulatory, professional, insurance, taxation, record-keeping and reporting obligations

  • send service communications and, where permitted, information about relevant services or events

We only use or disclose sensitive and health information for the purpose for which it was collected, a directly related purpose you would reasonably expect, with consent, or as otherwise permitted or required by law.

7.  Clinical and Health Information

Clinical information is collected and used to provide safe and appropriate care, maintain health records, communicate with you, coordinate authorised care and meet professional and legal duties. We generally collect health information with consent, subject to limited circumstances where collection, use or disclosure is authorised or required by law.

We may disclose relevant health information to people involved in your care or administration, such as treating practitioners, authorised representatives, referrers, Medicare, insurers or funders, where you would reasonably expect this, you have authorised it, or the law permits or requires it. We may also disclose information where reasonably necessary to lessen or prevent a serious threat to life, health or safety, or to comply with a court order, subpoena, mandatory reporting duty or other legal requirement.

Clinical information is not used for general direct marketing unless the required consent has been obtained. Clinical records are not submitted to the SPARKSFIRE Systems Snapshot AI workflow.

8. AI Assisted Processing Across Our Services

We may use approved AI-assisted tools for limited purposes in our clinical, training, administration and business-support services. The information used, the consent required and the safeguards applied depend on the service. AI output may be incomplete or inaccurate, so an appropriately authorised person reviews material used in service delivery. We do not rely on AI alone to make a clinical, legal or similarly significant decision about a person.

Clinical Services

With your consent, a clinician may use PatientNotes.app or NovaNotes as an audio-to-text clinical documentation tool during a session. The tool assists the clinician to prepare a draft clinical note; it does not replace the clinician's professional judgement or responsibility for the record. Under our current workflow, session audio is not retained by the documentation tool after it has been converted to text. The clinician reviews the resulting documentation, and the final clinical note is stored in our practice management system, Halaxy, as part of the clinical record.

Our clinical consent process explains this potential use. We seek your verbal consent at the start of each session before using PatientNotes.app or NovaNotes. You may decline or withdraw consent, and doing so will not affect the care available to you. If you have concerns about AI use in your care, please speak with your clinician so that a non-AI approach can be used where reasonably available.

We may also use approved AI tools to assist with administrative work or the creation of general resources. Only deidentified information may be used for those purposes; identifiable or sensitive client information must not be entered into those tools. We do not authorise clinical information supplied to an AI documentation tool to be used to train a general-purpose AI model.

Training and Professional Education

We may use AI-assisted tools to help prepare, organise, format or quality-check training materials and to support routine training administration. A member of the 12 Points team remains responsible for the final content, participant communication, assessment or service decision.

We minimise the personal information used for these purposes. Identifiable clinical client information must not be included in training prompts, materials or case examples. Participant or trainee information is deidentified before use wherever practicable. If an AI-assisted activity requires identifiable participant information, or sensitive information that is not already covered by the purpose of collection, we will provide an appropriate collection notice and seek consent where required before use.

Participants should not enter another person's confidential, identifiable or clinical information into an AI tool used as part of a training activity. Where we make an AI-enabled learning tool available, we will explain its intended purpose, any relevant privacy instructions and the extent of human review.

SPARKSFIRE Systems Snapshot

The Systems Snapshot is a practice-systems and client-journey review. We collect the information supplied through the Snapshot form, supporting documents, public links, follow-up communications and any agreed review materials to analyse workflows and prepare the report. This may include personal information about the purchaser or practice team and information about workload, wellbeing or professional context that the purchaser chooses to provide.

Do not submit patient or client names, contact details, dates of birth, Medicare details, case notes, recordings or any other information that could identify a patient, client or third party. If identifiable information is submitted accidentally, contact sparksfire@12points.com.au promptly. We may stop reviewing it, request a deidentified replacement and take reasonable steps to isolate or delete the material, subject to legal and technical retention requirements.

The only AI system given access to information submitted for the Systems Snapshot is our custom agent operating within a ChatGPT Business workspace. The agent may help organise, summarise, compare or quality-check the submitted information. It does not make autonomous clinical decisions. A person reviews the evidence, selects the findings and is responsible for the final report.

12 Points does not opt in to the use of its ChatGPT Business inputs or outputs to train or improve OpenAI models. Under OpenAI’s current business-data commitments, ChatGPT Business content is excluded from model training by default. We apply the same internal privacy and confidentiality standards to Snapshot information that we apply across the 12 Points practice.

If the Snapshot form specifically asks for sensitive information about you, we will seek express consent where required.

9.  Who We May Share Information With

Depending on the service and legal basis, we may disclose information to:

  • our directors, employees, clinicians, contractors, supervisors and authorised personnel who need it for their role

  • health practitioners, referrers, authorised representatives, insurers, funders, Medicare and others involved in an authorised service or care pathway

  • technology and administration providers supporting practice management, forms, telehealth, communications, payments, accounting, cloud storage, cybersecurity, training platforms, websites and analytics

  • OpenAI as the external provider of the ChatGPT Business workspace used for the Systems Snapshot

  • professional advisers, insurers, auditors, accreditation or regulatory bodies

  • courts, tribunals, law-enforcement agencies, government bodies or other recipients where required or authorised by law

  • a purchaser or successor if the business or a service is restructured, transferred or sold, subject to appropriate privacy protections

We do not sell personal information. We take reasonable steps to select and manage service providers with privacy, confidentiality and security protections appropriate to the information and service involved.

10.  Overseas Processing and Disclosure

Some technology providers and their subprocessors may store or process information outside Australia. Depending on the provider and account configuration, likely locations may include the United States and other countries identified in the provider’s current service or subprocessor documentation.

For ChatGPT Business, OpenAI may process content outside Australia. OpenAI states that safety and abuse-monitoring data is stored in the United States and that limited copies may also be retained there even where another storage region is selected. Data residency does not necessarily mean that all processing occurs in that region.

Before disclosing personal information overseas, we take reasonable steps required by applicable privacy law and consider the provider’s contractual, privacy and security protections. Because provider locations can change, contact us if you require current information about a particular service before submitting information.

11.  Websites, Cookies and Analytics

Our websites and digital platforms may use cookies, server logs, analytics tools, embedded content and similar technologies to operate the site, remember preferences, understand use, improve performance and protect security. These technologies may collect device, browser, IP address, page-view and interaction information.

You can control some cookies through your browser or available cookie settings. Blocking cookies may affect website functionality. External links and embedded services are governed by the privacy practices of the relevant third party.

12.  Direct Marketing and Service Communications

We may send administrative and service messages needed to manage appointments, purchases, programs or other services. Where permitted, we may also send information about relevant services, resources or events. You can opt out of marketing at any time by using the unsubscribe function or contacting us.

We do not use or disclose sensitive information, including health information, for direct marketing unless the required consent has been obtained. Opting out of marketing does not stop necessary service or legal communications.

13.  Security

We take reasonable steps appropriate to the sensitivity of the information to protect it from misuse, interference, loss, unauthorised access, modification and disclosure. Measures may include access controls, two-factor authentication, encryption offered by our service providers, secure systems, confidentiality obligations, staff training, backups, monitoring and incident-response procedures.

No method of storage or transmission is completely secure. Please avoid sending highly sensitive information through ordinary email unless this has been agreed and is appropriate. Tell us promptly if you believe information has been sent to the wrong person, accessed without authority or otherwise compromised.

14.  Retention and Disposal

We retain personal and health information for as long as reasonably needed for the purpose collected and to meet applicable clinical, professional, health-record, insurance, taxation, employment, dispute and legal requirements. Different record types have different minimum retention periods.

When information is no longer required and we are not legally required to retain it, we take reasonable steps to securely destroy it or deidentify it. Backup, audit, security and service-provider systems may retain limited copies for a further period before deletion through ordinary system cycles.

15.  Access and Correction

You may ask to access personal information we hold about you or request correction if you believe it is inaccurate, out of date, incomplete, irrelevant or misleading. Contact us using the details in section 19 and describe the information or service involved. We may need to verify your identity and authority before responding.

We will respond within the period required by law or, where no specific period applies, within a reasonable time. Access may be provided in an appropriate form. We may charge a reasonable fee where permitted and disclosed in advance. We may refuse or limit access where the law allows, including where access would unreasonably affect another person’s privacy or create a serious threat to health or safety. If we refuse a request, we will generally provide written reasons and available complaint options, unless the law permits otherwise.

16.  Data Breaches

If we become aware of a suspected data breach, we take reasonable steps to contain it, assess what happened, reduce potential harm and prevent recurrence. We work with relevant service providers where more than one organisation is involved.

Where the Notifiable Data Breaches scheme or another applicable law requires notification, we will notify affected individuals and the Office of the Australian Information Commissioner or another relevant regulator as soon as practicable. A notification may describe the incident, the kinds of information involved and recommended protective steps.

17.  Privacy Questions and Complaints

You can raise a privacy question or complaint using the contact details in section 19. Please explain what happened, the service involved and the outcome you are seeking. We will acknowledge a complaint within 5 business days and aim to provide a substantive response within 30 calendar days. We will let you know if we reasonably need more time.

If you are not satisfied with our response, you may be able to complain to the Office of the Australian Information Commissioner. Complaints about health information handled in Victoria may also be made to the Victorian Health Complaints Commissioner. We encourage you to contact us first so we have an opportunity to address the concern.

18.  Changes to This Policy

We may update this policy when our services, technology, providers or legal obligations change. The current version will be published on our website with its effective date. If a change materially affects how we handle information already collected, we will take reasonable steps to notify affected people and obtain consent where required.

19.  Contact Us

12 Points Pty Ltd
ABN 83 622 983 742
Registered business address ASV Wadeson, 37 Sunhill Road, Mount Waverley VIC 3149
General and clinical privacy enquiries hello@12pointspsychology.com
SPARKSFIRE and Systems Snapshot enquiries sparksfire@12points.com.au