How we handle your information.

Who we are

Succoris Psychology is a network of eight psychology clinics across Australia, operated by Succoris Group. We are an APP entity as defined by the Privacy Act 1988 (Cth), and we comply with the Australian Privacy Principles (APPs).

If you have any questions about this policy or how we handle your information, please contact us at enquire@succoris.com.au or via our contact page.

What we collect

From website visitors

• Name, email address, phone number, and any message content you submit through our contact form.
• Anonymous usage analytics (page views, time on site, click patterns) only if you accept analytics cookies.
• Standard server logs (IP address, browser, timestamp) — used for security and abuse prevention only.

From clients of our clinical services

• Personal details (name, date of birth, address, contact details, emergency contact).
• Health information (presenting concerns, history, diagnoses, session notes, assessment results).
• Funding and rebate information (Medicare number, NDIS plan, private health details).
• Referral information (GP details, referrals, correspondence with other practitioners).

Clinical information is held by your treating clinician and the Succoris clinic you attend, governed by the same standards as any Australian psychology practice — including the AHPRA Code of Conduct.

How we use it

• Contact form submissions — sent to the relevant clinic to respond to your enquiry. Not stored in our website database; held only in the recipient's email inbox and our intake email.
• Clinical information — used to provide psychological services, manage your care, and meet our legal obligations (record-keeping, billing, regulatory reporting).
• Analytics data — used in aggregate to understand how the site is used and improve it. Never combined with personally identifying information.

Who has access

• Your treating clinician and admin staff at the clinic you attend.
• Third-party service providers we use to operate the practice, including Halaxy (practice management), Amazon SES (transactional email from our Sydney AWS region), Sanity (content management), and AWS (web hosting). All providers are bound by their own privacy obligations and process data on our behalf only.
• Other practitioners only with your specific consent (e.g. reports back to your GP).
• Regulatory bodies only where legally required (e.g. mandatory reporting under Australian law).

Where your data is stored

Where possible we use Australian-hosted services. Our website hosting (AWS Amplify) runs in the Sydney region (ap-southeast-2). Contact form email is sent via Amazon SES in the same Sydney region before delivery to our clinic inboxes. Sanity (content) is hosted globally with primary processing in the EU/US. Practice management (Halaxy) is Australian-hosted. Clinic email inboxes are hosted on Google Workspace — see your Google account settings or contact us if you need detail on inbox storage location.

If you'd prefer not to use the website form, please call your nearest clinic or email reception directly — see the contact page.

Cookies and analytics

Our website uses Google Tag Manager to load Google Analytics 4 (GA4) and understand aggregate usage patterns. Analytics tags are loaded in consent-denied mode by default — we don't track you until you explicitly accept analytics cookies via the consent banner. You can change your preference at any time via the link in the footer.

When consent is granted, GA4 sets cookies (`_ga`, `_ga_*`) which store an anonymous identifier and aggregate session data. No personally identifying information is sent to GA4. Data is retained for 14 months by default.

We don't use Facebook Pixel, Microsoft Clarity, or other tracking pixels at this time. If we add any, this policy will be updated.

Your rights

Under the APPs you have the right to:

• Access the personal information we hold about you.
• Correct any information that's inaccurate or out of date.
• Withdraw consent for marketing or analytics processing at any time.
• Request deletion of your information, subject to legal record-keeping requirements (clinical records must be retained for at least 7 years per AHPRA standards, longer for minors).
• Lodge a complaint with the Office of the Australian Information Commissioner (OAIC) if you believe we've mishandled your information.

To exercise any of these rights, email enquire@succoris.com.au. We aim to respond to all requests within 30 days.

Children's privacy

Children under 18 may attend therapy at Succoris with parental or guardian consent where appropriate. We collect and process information about minors with the same care and legal protection as adult clients. For website use, we don't knowingly collect personal information from children under 13 through online forms.

Security

We take reasonable steps to protect personal information against loss, unauthorised access, modification, and disclosure. This includes encrypted connections (HTTPS) on all website traffic, secure authentication for staff systems, and physical security at our clinics. Where we engage third-party providers, we ensure they offer comparable safeguards.

Changes to this policy

We may update this policy from time to time. The most current version will always be available at this URL with the date of last update shown at the top. For material changes, we'll notify clients directly where practical.

Contact

Questions, requests, or complaints about how we handle your information: enquire@succoris.com.au or via our contact page.

If you'd prefer to escalate, the Office of the Australian Information Commissioner handles privacy complaints — visit oaic.gov.au or call 1300 363 992.