Privacy Policy

Hypfocus Therapies and Training www.hypfocus.com.au

Who we are

This privacy policy explains how Hypfocus Therapies and Training (Hypfocus) collects, uses, stores and shares your personal information, including health information.

Hypfocus is the practice of Georgina Mitchell, a clinical hypnotherapist and counsellor based in Mentone, Melbourne, Victoria. Sessions are available in person and online (telehealth).

You can contact us at:

We are covered by the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Health service providers are covered by this Act even if their annual turnover is under $3 million. Because we provide health services in Victoria, we are also covered by the Health Records Act 2001 (Vic) and the Health Privacy Principles.

What we collect

The information we collect depends on how you use the website and whether you become a client or buy something from the shop.

Contact details. This can include your name, email address, phone number, postal or street address, date of birth, and an emergency contact if you choose to give us one.

Health information. If you enquire about or receive therapy, we may hold information about why you are seeking support, your history, what we discuss in sessions, treatment plans, referrals, and anything else you or a referrer share with us so that we can provide care.

Payment details. This includes invoice and payment records and, where it is relevant, information needed for health fund, NDIS or referral billing. We do not store your full credit or debit card number. Card payments are handled by Stripe and, for shop purchases, Squarespace Commerce.

Website, shop and mailing list details. This includes messages you send through our contact forms, your newsletter sign-up details, and order details if you buy a hypnotherapy recording or another item from the online shop.

Website usage data. When you visit the site, Squarespace and its analytics tools may collect information such as your IP address, the pages you look at, the date and time of your visit, and the type of browser or device you use. If you click an affiliate link, the retailer (for example Amazon) may also collect information. That collection is covered by their own privacy policy.

We aim to collect only what we need for the purpose at hand.

How we collect it

We usually collect information directly from you. That happens when you book or attend a session (including through Cliniko), fill in a form, email us, contact us through the website, join the newsletter, buy something from the shop, or share information during a session.

We may also receive information from someone else, with your knowledge or consent. This might be your GP, another health professional, a family member you have asked us to speak with, or a referrer. Referrals sometimes come from ConnectPsych, or through the NDIS.

The main systems we use are:

  • Squarespace, which hosts the website, contact forms, the online shop, and the newsletter (Squarespace Email Campaigns)

  • Cliniko, for appointments, clinical notes and invoices

  • Stripe and Squarespace Commerce, for payments

  • Xero, for accounting

  • Google Workspace, for email and everyday practice administration

With your consent we may use a clinical note-taking tool (Heidi Health) to help prepare session notes. Those notes are then stored in your clinical record.

Why we use it

We use your information to provide, book and manage hypnotherapy and counselling, including telehealth sessions; to keep clinical records and support continuity of care; to send appointment information and reply to you; to process payments, issue invoices and keep accounts; to fulfil shop orders, including recordings you have purchased; to send the newsletter if you have asked to receive it; to operate, secure and improve the website; and to meet our legal, professional and insurance obligations.

We do not sell your personal information.

Consent

Where we need your consent, we will ask for it and explain what we are asking. You can withdraw your consent at any time by contacting us, unless we still need to keep or use the information for a legal reason. That includes keeping a health record for the period the law requires, or finishing a purchase you have already made.

Booking an appointment, attending a session, submitting a form, or buying from the shop also means we will handle the information needed for that purpose. For health services, we will talk with you about how we handle your information, including any clinical note-taking tool, before we use it in that way.

You can browse most of the website without giving us your name. We do need your details if you want to book therapy, buy from the shop, or join the mailing list.

Disclosure

We treat your information as confidential. We do not share your personal or health information with others unless:

  • you have given consent, for example so we can write to your GP or referrer, or speak with someone you have nominated

  • we are required or authorised by law, a court or a regulator to do so

  • it is necessary to prevent or lessen a serious threat to the life, health or safety of you or another person, and it is unreasonable or impracticable to get your consent

If your referral came from another provider, such as ConnectPsych, or is connected with the NDIS, we will only share information back with your consent, unless the law requires otherwise.

The service providers named in this policy may see information as needed to run their systems. For example, Cliniko holds appointment and clinical records, and Stripe processes payments. Their use of that information is covered by their own terms and privacy policies.

Overseas disclosure

Some of the services we use store or process information outside Australia. Squarespace, Stripe, Google and Amazon are based in the United States, and information may be held or processed there, or in other countries where those providers operate.

Where possible, health records are stored in Australia. Cliniko stores data for Australian practices in Australia.

When information is handled by an overseas provider, we take reasonable steps to make sure it is treated in a way that is consistent with Australian privacy law. Overseas providers are also subject to the laws of the country where the information is held.

Cookies and analytics

The website is built on Squarespace, which uses cookies and similar tools. Some of these are needed for the site to work, for example to keep a shop session active or to remember a form. Squarespace also provides analytics, which give us a general picture of how people use the site.

You can change cookie settings in your browser. If you block some cookies, parts of the site, such as the shop or forms, may not work as expected.

Affiliate links

Some pages on this website include affiliate links to products I recommend. These include links through Amazon Associates and, from time to time, other affiliate programs (for example Booktopia, which may be arranged through impact.com).

If you click an affiliate link and later buy something, I may earn a commission. This does not change the price you pay. As an Amazon Associate I earn from qualifying purchases.

Retailers and affiliate networks may set their own cookies when you click through, so they can attribute a purchase. Their use of your information is covered by their privacy policies, not this one.

Newsletter and unsubscribing

If you join the mailing list, we use your name and email address to send newsletters and occasional practice updates through Squarespace Email Campaigns. We will not add you to the list unless you have asked to join, or you have clearly agreed when filling in a form.

You can unsubscribe at any time using the link in the email, or by contacting us at admin@hypfocus.com.au.

Security and retention

We take reasonable steps to protect your information from misuse, interference and loss, and from unauthorised access, modification or disclosure. This includes using password-protected systems, limiting who can access clinical records, and using established payment providers. No online system is completely secure, so it helps to be careful about what you send by ordinary email.

Health records are kept in line with the Victorian Health Records Act 2001. We keep an adult's health information for at least 7 years after the last time we provided a health service to them. If the information was collected when the person was under 18, we keep it until they turn 25, or for 7 years after the last health service, whichever is later. We may keep records for longer if we need to, for example for legal or insurance reasons.

Other information, such as newsletter details, shop orders and general enquiries, is kept only for as long as we need it for the purpose we collected it, or as required by law (for example, tax and accounting records).

Access and correction

You can ask us for access to the personal information we hold about you, or ask us to correct it if it is wrong, out of date or incomplete. Please email admin@hypfocus.com.au. We may need to confirm it is you before we release or change anything.

For health information, Victorian law generally requires us to respond within 45 days. In some cases a fee may apply. If it does, we will tell you first. There are limited situations where we may not be able to give access, for example if doing so would be a serious threat to someone's life, health or safety. If we refuse a request, we will explain why, and you can use the complaint options below.

If we correct health information, we will take reasonable steps to tell any other health service provider we have already shared the original information with, unless you ask us not to.

Data breaches

If your personal information is involved in a data breach that is likely to result in serious harm, we will assess it and take steps to contain and address it. Where the Notifiable Data Breaches scheme under the Privacy Act 1988 requires it, we will notify you and the Office of the Australian Information Commissioner (OAIC) as soon as practicable.

Complaints

If you are concerned about how we have handled your personal or health information, please contact Georgina Mitchell first at admin@hypfocus.com.au so we can try to sort it out. Tell us what happened and how you would like it addressed. We will take your concern seriously and respond as soon as we reasonably can.

If you are not satisfied with our response, or you do not hear back within about 30 days, you can complain to the OAIC. Complaints to the OAIC need to be made in writing. Details are at oaic.gov.au. You can also write to GPO Box 5288, Sydney NSW 2001. For general enquiries, the OAIC can be contacted on 1300 363 992.

You can also complain to the Victorian Health Complaints Commissioner about how your health information has been handled, or about a health service provided in Victoria. Details are at hcc.vic.gov.au. You can call 1300 582 113, or write to GPO Box 4057, Melbourne VIC 3001.

Changes to this policy

We may update this policy from time to time, for example if our systems change or the law changes. The current version will always be the one published on this page, together with the date it was last updated.

Last updated: 12 November 2026