Personal Health Information (PHI) & Privacy Policy

Effective Date: 1 January 2026 | Governing Domain: ook.ac and l.ook.ac

1. Legislative & Regulatory Frameworks

Our operations comply with key health and data protection statutes, including:

• Australia: The Privacy Act 1988 (Cth), the 13 Australian Privacy Principles (APPs), and relevant South Australian Health Care Principles.
• United States: The Health Insurance Portability and Accountability Act (HIPAA) Security, Breach Notification, and Privacy Rules (45 CFR Parts 160 & 164) where applicable to international clients.
• European Union / UK: The General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679) regarding special category health data under Article 9.

2. Collection of Personal Health Information (PHI)

We only collect data strictly necessary to formulate treatment plans, ensure client safety, and deliver clinical counselling:

• Demographic Data: Full legal name, date of birth, emergency contact details, residential address, and billing information.
• Sensitive Clinical Data: Psychological intake notes, psychometric assessment scores, medical histories, medication summaries, and progress evaluations.
• Telehealth Metadata: Encrypted connection timestamps and IP addresses. Note: Telehealth audio and video streams are end-to-end encrypted and are never recorded.

3. Data Storage & Cryptographic Controls

All digital patient files, electronic notes, and transmission channels are protected using bank-grade security protocols:

• Data at rest is secured via AES-256 bit encryption within SOC-2 Type II and ISO 27001 certified medical cloud environments.
• Data in transit between your browser and our infrastructure uses strict TLS 1.3 encryption.
• Access is governed strictly by the Principle of Least Privilege (PoLP); administrative personnel have zero access to clinical consultation notes.

4. Retention, Patient Access & Correction Rights

Under the APPs and GDPR, patients maintain statutory rights regarding their health records:

• Retention Period: In accordance with Australian health records legislation, adult health records are retained for a minimum of 7 years following the final date of service.
• Access Requests: You may request an export of your health summary by writing to our Privacy Officer at privacy@ook.ac or records@ook.ac. Requests are fulfilled within 14 business days.
• Data Portability & Rectification: You may request corrections to factual errors within demographic records at any time.

5. Limits of Confidentiality & Mandatory Disclosures

Confidentiality between practitioner and client is strictly preserved, with exceptions limited exclusively to mandatory legal and clinical emergency conditions:

• Where there is reasonable belief that failure to disclose information would place the client or another individual at imminent risk of severe physical harm or suicide.
• Where subpoenaed by a court of competent jurisdiction.
• Mandatory notification under child protection or vulnerable persons legislation.

6. Privacy Officer Contact

If you have any questions or complaints regarding our data governance, contact our Privacy Officer:

Privacy Officer
Look Workplace Counselling & Recovery
Email: privacy@ook.ac
Address: 152 King William Road, Hyde Park, SA, 5061