Instinct Psychology

Privacy policy

How I collect, use, keep and share your information.

I am Steve Lanham, a psychologist. I run Instinct Psychology in Camberwell. To help you, I need to collect personal information, including health information. In short:

  • I collect only what I need to provide assessment, counselling or supervision and to run the practice.
  • Your records are kept in secure systems. The main one, Splose, keeps them in an Australian database. Some other systems I use keep information overseas. This policy says which countries.
  • I do not sell your information and I do not use it for marketing.
  • I share your information only with your consent, or when the law requires or allows it.
  • You can ask to see your information, ask me to correct it and complain if you think I have got something wrong.
  • If I use an AI tool with your information, I ask you first.

Who I am

Instinct Psychology is a sole trader practice run by me, Steve Lanham. I am a psychologist registered with the Psychology Board of Australia through AHPRA, with endorsements in clinical psychology and educational and developmental psychology. I am responsible for how your information is handled.

Address: 493 Riversdale Road, Camberwell VIC 3124
Email: admin@instinctpsychology.com.au

I handle information under the Privacy Act 1988 and the Australian Privacy Principles, the Health Records Act 2001 (Victoria) and the Psychology Board of Australia’s Code of conduct. This policy applies to clients and their families, people who enquire, referrers, psychologists I supervise and visitors to my website.

What I collect and why

Depending on why you are in contact with me, I collect:

  • Your contact details and date of birth, and for a child, the details of parents or guardians and their school
  • Medicare, health fund or NDIS details and referral letters
  • Health information: your history, current concerns, session notes, questionnaires, test results and the reports I write
  • For supervisees, registration details and a record of our sessions
  • For enquiries, what you tell me on the enquiry form.

Most of it comes from you. With your consent I may also collect information from your referrer, your child’s school and other professionals involved in your care. Psychological tests are scored in the publisher’s online platform, where I enter the person’s name and date of birth with their responses. Card details are handled by my payment providers and are not kept by me.

I use your information to respond to your enquiry, provide assessment, counselling and supervision, write the reports and letters you ask for, manage appointments and reminders, process payments and claims, communicate with your referrer and other professionals with your consent, and meet my legal and professional obligations. I do not sell your information, use it for marketing or send newsletters.

Who I share it with

Only when I need to, and in most cases only with your consent:

  • Your referring doctor. Medicare requires a short report during and after a course of treatment, and I tell you what I am sending
  • Your child’s school, other health professionals or an NDIS plan manager, when you agree
  • Medicare, your health fund or the National Disability Insurance Agency, to process claims
  • The companies that run the systems I use. They keep information for me and cannot use it for their own purposes.

My administrative support person handles bookings, invoices and Medicare claims. They can see appointment and billing details, but not session notes or reports, and they have signed a confidentiality agreement.

Without your consent I share information only when the law requires or allows it: a serious risk to your life, health or safety or to someone else’s, concerns about a child’s safety (psychologists are mandatory reporters in Victoria), a court order or subpoena, or a government audit. Where I can, I will talk with you first and share only what is needed.

Children and young people

For a child, a parent or guardian gives consent and receives information about the child’s care. As young people get older, I involve them more in decisions about their own information, and we talk together about what will be shared and what will stay private.

Where your information is kept

Your record lives in Splose, my practice management system, which keeps it in a database in Australia. Some other systems I use keep or process information overseas: my email, calendar and telehealth video calls, accounting, card payments and file storage in the United States, and the platforms that score psychological tests in Canada, with some processing in Ireland and the United States. Appointment reminders pass through message providers in the United States. Every system is protected by encryption and two-step sign-in, and only I and my administrative support person can sign in.

By using my services, you agree to your information being held with these providers. The law asks me to tell you two things about that. When you agree, I am not required to take extra steps to make sure each overseas provider follows the Australian Privacy Principles, and if something goes wrong overseas you may not be able to rely on Australian privacy law against that provider. If you do not want your information held overseas, talk to me before we start.

AI tools

My rules:

  • I ask for your consent before any AI tool handles your information.
  • I read and check everything an AI tool produces.
  • I never put your information into a public AI tool such as a free chatbot.
  • I use only AI tools whose providers state in writing that they do not use my information to train their models.

The tools I use or may use:

splose AI transcription
With your consent, Splose can transcribe a session and draft my session note. You can say no, or change your mind, at any session. Splose states data is not kept or used to train AI models.
Google writing assistance in Gmail
Google’s writing tool may help me draft emails. Google states that it does not use my Workspace content to train its models.
BastionGPT
A secure AI writing tool for health professionals that I may use to help draft reports, only with your written consent for this tool. Bastion states that it keeps information for Australian accounts in Australia and does not use content to train its models. Some processing may occur in the United States.

Keeping it safe

Session notes and reports are kept in Splose, not on my devices or in email. My devices are locked, encrypted and kept up to date. Email is not fully secure, so if you need to send me sensitive information, ask me for a secure form instead. In supervision and peer consultation about my own work, I do not use details that could identify you.

If I believe your information has been lost, stolen or seen by someone who should not have seen it, I will act quickly to contain it. If the breach is likely to cause you serious harm, I will tell you what happened and report it to the Office of the Australian Information Commissioner, as the law requires.

How long I keep it

As Victorian law requires, I keep your records for seven years after I last see you if you are an adult, or until the person turns 25 if they were under 18 when I last saw them. Supervision records are kept for seven years. If you enquire or join the waitlist but do not become a client, I delete your details within 12 months of our last contact. After that, records are destroyed securely.

Seeing and correcting your information

Email me to see your information or get a copy. I will respond within 30 days. There is no charge to ask, though I may charge the cost of copying within the limits set by Victorian law. In a few cases the law lets me refuse access, for example where it would put someone’s safety at risk. If I refuse, I will tell you why in writing and how you can complain.

If something in your record is wrong or out of date, tell me and I will correct it. If we disagree, I will add a note with your view. Test questions and record forms are protected by copyright and test security rules, so I can explain your results but cannot give copies of the test materials.

My website

My website does not collect personal information by itself. It has no cookies, trackers, analytics or embedded maps. The enquiry form is provided by Splose, so what you enter goes straight into Splose’s database in Australia. The website is hosted by Cloudflare, which keeps standard connection logs for security. Links to other sites, such as my booking page, are covered by their own privacy policies.

Questions and complaints

If you have a question or a concern about how I have handled your information, please tell me first at admin@instinctpsychology.com.au. I will acknowledge your complaint within 7 days and respond within 30 days.

If you are not satisfied with my response, you can complain to:

  • The Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992
  • The Health Complaints Commissioner (Victoria) at hcc.vic.gov.au or on 1300 582 113
  • AHPRA, for concerns about my professional conduct, at ahpra.gov.au or on 1300 419 495.

Changes to this policy

This is version 1, dated 12th October 2026. I review this policy by 12th October 2027, or sooner when I change a system I use.