Privacy policy

This policy covers personal information and health information handled by Promise Igba ABN 22 659 184 064, trading as The Listening Room.

The practice is a private sector health service provider. The small business exemption in the Privacy Act 1988 (Cth) does not apply to health service providers, so this practice is bound by the Australian Privacy Principles regardless of its size or turnover.

Because the practice is in the Australian Capital Territory, the Health Records (Privacy and Access) Act 1997 (ACT) and its Health Records Privacy Principles also apply to health records held here.

Privacy contact: privacy@thelisteningroomau.com. Email is the formal contact channel. If you need this policy in another format, ask and one will be provided.

Version 2026-08-18.2, last updated 18 August 2026.

This website has no contact form, no account, no advertising trackers, no analytics, no pixels and no cookies set by the practice. Fonts are served from this site rather than fetched from a third party, so simply reading a page does not send a request to anyone else.

It is not accurate to say nothing at all is processed. The site is hosted on Vercel, and like any web host Vercel processes technical information in order to deliver and protect the site. That includes your IP address, the time of the request, the page requested, and browser and device information, held in server and security logs.

The practice does not use that technical information to identify you and does not combine it with your clinical record.

The intake form is hosted by Halaxy and opens on Halaxy’s own site. What you enter there goes to Halaxy, not through this website. A collection notice is shown before you provide information.

Contact and identity information: your name, email address, phone number and preferred contact method.

Health information: what you tell Promise about your circumstances, history and reasons for seeking support, and the clinical notes made during and after sessions. Health information is sensitive information and is treated accordingly.

The name and contact details of the emergency contact you nominate, used only as described in the terms of service.

Intake responses, referral information where someone has referred you with your consent, and appointment information including dates, attendance and cancellations.

Billing and transaction records: fees charged and paid.

Correspondence between you and the practice.

Where you attend couples sessions, information about you may appear in a record shared with your partner, and information about your partner may appear in yours.

Technical information processed by the website host, as described above.

If you contact the practice without becoming a client, only what you send is held.

Directly from you in almost every case: through the intake form, by email, or in session.

From a third party where you have been referred and have consented to that referral, for example by a GP or another service.

Sensitive information, including health information, is collected only with your consent and only where it is reasonably necessary for your care. You can decline to answer anything.

If you choose not to provide information that is genuinely needed, Promise may not be able to provide the service safely, and will tell you if that is the case rather than proceeding regardless.

If information about you arrives that was not asked for and is not needed, it is destroyed or de-identified where the law allows.

The practice does not buy contact lists and does not collect information about you from social media.

You can make a general enquiry without giving your name.

You cannot receive therapy anonymously. Clinical records must identify whose they are, and the professional and legal obligations attaching to those records make anonymous treatment impracticable.

To provide counselling, therapy and coaching to you, and to keep the clinical records that providing that care requires.

To arrange and confirm appointments and to contact you about your sessions.

To issue invoices and take payment.

To meet legal and professional obligations, including record keeping requirements, mandatory reporting where it applies, and the AASW Code of Ethics.

Your information is not used for marketing and is never sold. There is no marketing consent bundled into becoming a client, because there is no marketing.

Halaxy, an Australian practice management provider, holds clinical records, intake forms, your emergency contact and appointment information. Halaxy states that Australian practitioners’ data is stored in Australia.

Vercel hosts this website and processes the technical information described above.

Google Workspace holds practice email.

A third party telehealth provider processes the technical information needed to connect and run online sessions.

Where a payment provider is used, it processes the payment. Payment arrangements are confirmed with you directly, and this policy will name the provider once those arrangements are settled.

These providers handle information in order to provide their service to the practice. The practice has reviewed their published privacy and security terms and relies on those terms rather than on any private assurance.

The practice does not claim to control what each provider does internally beyond what their terms commit them to. Where a provider’s terms permit them to use information for their own purposes, that is a matter of their terms, not something this policy can override.

Clinical records held in Halaxy are stated by Halaxy to be stored in Australia.

Practice email is held in Google Workspace. The configured data region and the subprocessors involved have not been verified, so the practice cannot tell you that email is stored only in Australia, and cannot give you a complete list of the countries involved. Email may be stored or processed in one or more countries outside Australia, which may include the United States. If you would prefer not to send health information by email, say so and another method will be arranged.

The website host operates a global network, so technical request data may be processed outside Australia.

Where information is disclosed to an overseas recipient, the practice takes reasonable steps to satisfy itself that the recipient handles it consistently with the Australian Privacy Principles, principally by choosing providers whose published terms commit to comparable protections. Reasonable steps are not the same as absolute control, and this policy does not claim otherwise.

Your information is not sold or transferred to anyone for their own independent use, in any country.

Access to clinical records is limited to Promise. Records are held in password protected systems, and the providers used encrypt information in transit.

Devices used to access records are kept secured, and access is removed when it is no longer needed.

Providers are chosen with regard to their published security posture, and the practice maintains a documented procedure for responding to a suspected data breach.

No specific technical control is claimed here that has not been verified, and operational detail is deliberately kept general so that describing the practice’s security does not weaken it.

Health records about an adult are kept for at least seven years from the last occasion a service was provided.

Where information was collected while a person was under 18, it is kept until that person turns 25. The practice accepts clients aged 18 and over only, so this rule bears on any historical record rather than on new clients.

Records are kept longer where another law requires it, or where a complaint, investigation, legal proceeding or legal hold is on foot.

After that, records are securely destroyed or lawfully de-identified, and the destruction is recorded.

You can ask to see the information held about you, and ask for it to be corrected. Email privacy@thelisteningroomau.com. There is no fee for making a request.

You will be asked to verify your identity first, so that information about you is not given to someone else.

Requests are normally answered within 30 days. Where a request is complex you will be told, and given a timeframe.

Access is given except where the law permits it to be refused, for example where giving access would pose a serious threat to the life, health or safety of any person, where it would unreasonably affect another person’s privacy, or where it relates to anticipated legal proceedings. Where records contain information about another person, such as in couples work, access may be given in a form that does not disclose that other person’s information.

If access is refused, you will be given written reasons, told how to complain, and offered another way of meeting your request where one is available, such as access through a nominated health practitioner or a summary.

A reasonable charge may be made for the work of giving access, such as copying, but only where the law permits and only after the cost has been discussed with you.

If information is corrected, and it has previously been disclosed to someone else, you can ask that they be told of the correction, and that will be done where it is reasonable and practicable.

If a correction is refused, you can ask for a statement of your disagreement to be kept with the record, and it will be.

Where professional supervision or case consultation occurs, information is de-identified wherever it is reasonably practicable to do so.

Anyone involved is bound by professional confidentiality, only the minimum necessary information is used, and identifiable information is shared only with your consent or another documented lawful basis.

The practice does not use AI transcription, automated note summarisation, automated triage, or automated decision making about your care. None of those tools is authorised.

No such tool may be introduced without a privacy impact assessment, a review of the vendor, an update to this policy, and appropriate notice to you or your consent where required. That is a control the practice holds itself to, not an aspiration.

If there is a data breach that is likely to result in serious harm, the practice must notify affected people and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme.

You would be told what happened, what information was involved, and what you can do about it. Where an assessment concludes the legal threshold for notification is not met, the incident is still recorded and addressed.

If you think your privacy has been breached, you can raise it with Promise by emailing privacy@thelisteningroomau.com. It will be acknowledged, looked into, and answered in writing, normally within 30 days.

You do not have to raise it with the practice first. You can go directly to a regulator, and you should where the matter is serious.

Privacy Act complaints go to the Office of the Australian Information Commissioner at oaic.gov.au.

Complaints about ACT health records, under the Health Records (Privacy and Access) Act 1997 (ACT), go to the ACT Human Rights Commission at hrc.act.gov.au.

Complaints about the conduct of a social worker go to the Australian Association of Social Workers at aasw.asn.au.

This policy is reviewed whenever the practice changes how it handles information, and always before a materially different technology or provider is introduced.

The version and date at the top of this page show which version is current. Where a change materially affects current clients, they are told directly rather than left to notice.