Privacy Policy
Last updated: 12.09.2026
About this policy
Flourish with Francesca is committed to protecting your privacy. This policy explains how we collect, use, store, disclose and protect your personal information, including your health information.
We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). As a private sector health service provider, we are covered by the Privacy Act regardless of our size or turnover.
This policy covers both this website and our clinical practice.
What personal information we collect
Website visitors. Our website is hosted by Squarespace. When you visit, information is automatically collected including:
information about your browser, network and device
the web pages you viewed before arriving and while on our site
your IP address
details of your activity on the site, such as pages visited, clicks, searches, scrolling and timestamps
Enquiries and bookings. When you contact us or book an appointment through this website, we collect:
your name
your email address
your phone number
details relating to your appointment, including any information you provide in booking or intake fields (for example, how you were referred to us, or the reason you are seeking support)
Clients. If you become a client, we collect and hold health information about you in order to provide your care. This may include:
your contact details, date of birth and emergency contact
your presenting concerns, history, and relevant medical, family and social history
session notes, assessments, treatment plans and correspondence
referral information and reports from other health practitioners (for example, a GP mental health treatment plan)
payment records
Health information is "sensitive information" under the Privacy Act and attracts a higher level of protection.
How we collect it
We collect personal information directly from you wherever possible — through this website, by email or phone, in intake forms, and during sessions.
Sometimes we collect information about you from a third party, such as a referring GP or another health practitioner, or from a parent or guardian where the client is a child. Where we do, we will take reasonable steps to make you aware of it, unless you have already consented or it would be unreasonable or impracticable to do so.
We only collect health information about you with your consent, or where the law otherwise permits it.
You can deal with us anonymously or under a pseudonym for general enquiries. This is usually not practicable once you become a client, because we are required to keep accurate, identifiable clinical records.
Why we collect it and how we use it
We use your personal information to:
respond to your enquiry
schedule, confirm, reschedule and remind you about appointments
provide, plan and review your care
communicate with you about your care
process payments and, where relevant, Medicare or health fund claims
meet our legal, professional, insurance and record-keeping obligations
send you practice updates or newsletters, which you can unsubscribe from at any time
We do not sell your personal information, and we do not use it for direct marketing without your consent.
Who we disclose it to
Service providers who run this website and our booking system. We provide information to Squarespace, our website hosting and online scheduling provider, so they can provide those services to us.
Other third parties used by this website:
This site serves fonts from Google Fonts and Adobe Fonts, which may receive information about your browser, device, IP address and the page you are viewing.
In connection with your care, we may disclose your health information to:
other health practitioners involved in your care, such as your GP or psychiatrist, with your consent
your private health fund / Medicare / NDIS / insurer / employer's EAP provider where you have asked us to claim on your behalf
our clinical supervisor, as required by our professional obligations. Supervision is confidential and, where possible, identifying details are removed.
Without your consent, we will only disclose your information where the law requires or permits it, including:
where we believe it is necessary to lessen or prevent a serious threat to the life, health or safety of you or another person
where we are required to report under mandatory reporting laws, including suspected child abuse or neglect
where we are compelled by a subpoena, court order, or law enforcement or regulatory request we are legally obliged to answer
We will tell you if this happens, unless doing so would be unsafe or unlawful.
Overseas disclosure
Squarespace is based in the United States, and some of our other service providers store or process data outside Australia This means your personal information may be stored or handled overseas. We take reasonable steps to ensure overseas recipients handle your information consistently with the Australian Privacy Principles, but we cannot guarantee that overseas laws provide the same protection as Australian law.
Your clinical records are held in online securely and are not disclosed overseas.
Cookies
This website uses cookies and similar technologies — small files stored on your device.
Necessary cookies are always used. They allow Squarespace, our hosting platform, to serve this website to you securely.
Analytics and performance cookies are used only after you acknowledge our cookie banner These help us understand site traffic and activity.
You can block or delete cookies through your browser settings, though some parts of the site may not work properly if you do.
How we store and protect your information
We take reasonable steps to protect your information from misuse, interference, loss, and unauthorised access, modification or disclosure. These include password protection and multi-factor authentication on all accounts and devices, encrypted storage, locked physical storage for paper records, secure disposal, and limiting access to information to those who need it.
If a data breach occurs that is likely to result in serious harm, we will notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.
How long we keep it
We keep clinical records for at least 7 years from the date of your last appointment / for clients under 18, until they turn 25 —We are required to retain records for this period even if you stop seeing us.
Enquiry and website data is kept only as long as we need it, and then deleted or de-identified.
Accessing and correcting your information
You can request access to the personal information we hold about you, and ask us to correct anything that is inaccurate, out of date, incomplete or misleading. Contact us using the details below.
We will respond within 30 days. There are limited circumstances in which we may refuse access — for example, where giving access would pose a serious threat to someone's life, health or safety, or would unreasonably affect another person's privacy. If we refuse, we will tell you why in writing and explain how to complain.
Complaints
If you have a concern about how we have handled your personal information, please contact us first using the details below. We will acknowledge your complaint within 7 days and aim to resolve it within 30 days.
If you are not satisfied with our response, you can complain to:
Office of the Australian Information Commissioner — oaic.gov.au, or 1300 363 992
ACA
Changes to this policy
We may update this policy from time to time. The current version is always available on this page, with the date it was last updated.
Contact us
Flourish with Francesca
francesca@flourishwithfrancesca.com