Privacy Policy

About this policy

This policy explains how Ink & Intuition Psychotherapy collects, uses, stores and shares your personal and health information. The practice is run by Jess Matotek, an ANZACATA-registered art psychotherapist and family therapist. Jess sees people in person in Western Sydney and the Blue Mountains, and online across Australia.

We follow the Privacy Act 1988 (Cth), including the Australian Privacy Principles, and the Health Records and Information Privacy Act 2002 (NSW). “We” means the practice. “You” means a client, a parent or carer, or anyone who contacts us.

What we collect

We collect only what we need to work with you and to bill for it.

• Contact details: your name, email address and phone number.
• Intake details: your date of birth, an emergency contact, and your GP’s details.
• Billing details: who pays (you, a parent or carer, a plan manager or another payer), their email address, and the date, type and fee of each session.
• NDIS details, if you are an NDIS participant: your NDIS number and how your plan is managed.
• Health information: what brings you to therapy, relevant history, and notes from sessions. The law treats this as sensitive information, and we take extra care with it.
• Artwork made in sessions, which we keep securely as part of your therapy record.
• Travel, if we come to you: our invoicing system records only the distance or time travelled, never your address.

You can make a general enquiry without giving your name. For therapy and billing we need your real name.

How we collect it

Most information comes from you directly: in conversation, on intake forms, and through the enquiry form on this website. We may also receive information from:

• a parent, carer or guardian, when we work with a child or young person;
• a referrer such as a GP, school or support coordinator, with your consent;
• your plan manager or support coordinator, if you are an NDIS participant.

If we receive information about you that we didn’t ask for and don’t need, we destroy it.

How we use it

We use your information to:

• provide therapy and plan your sessions;
• arrange appointments;
• prepare invoices and receipts, and claim from the NDIS or your plan manager;
• keep clinical records, and meet our other legal, professional and insurance obligations;
• take part in clinical supervision, where we discuss our work without identifying you.

We never sell your information or use it for marketing.

Who we share it with

We share your information only with your consent, or when the law requires or allows it.

With your consent, for example with your GP or other practitioners, your school, or your NDIS plan manager, support coordinator or the NDIA (for invoices, claims and progress reports).

Without your consent, only when:

• there is a serious threat to someone’s life, health or safety;
• we must report that a child or young person is at risk of significant harm;
• a court order, subpoena or other law requires it.

Where we can, we’ll talk with you before sharing anything in these situations.

Services that help us run the practice: Google stores our email and calendar on our behalf, and online sessions run on Microsoft Teams (see below).

How we store and protect it

• Clinical records (session notes and intake forms) are kept on paper in a locked cabinet, and digitally on Jess’s own password-protected computer.
• Invoicing is done by a system that runs on Jess’s own computer, not in the cloud. It holds names, billing contacts, NDIS numbers and session dates and fees. It holds no clinical notes and no addresses, and it uses no artificial intelligence, analytics or tracking.
• Appointments are kept in Google Calendar under a short client code (such as “AB01”), never a name or any health information. The invoicing system reads only each appointment’s code, time and colour, and cannot change the calendar.
• Email, including invoices, is sent from our Gmail account, so copies stay in that account. The invoicing system can send email through it but cannot read any.

Our devices are password-protected. We take reasonable steps to protect your information from misuse, loss and unauthorised access, and destroy it securely once we no longer need to keep it.

Information held overseas

Google may store our email and calendar on servers outside Australia, including in the United States. Online sessions run on Microsoft Teams, and Microsoft may also store or process information about those sessions outside Australia. We don’t otherwise send your information overseas.

How long we keep records

NSW law requires us to keep health records for at least 7 years after your last session. If we collected them while you were under 18, we keep them until you turn 25. Invoices and other financial records are kept for 5 years, as tax law requires. After that, we destroy records securely.

Seeing and correcting your information

You can ask to see the information we hold about you, or ask us to correct it, by contacting us (below). We’ll respond within 30 days. Asking and correcting are free; we may charge a reasonable fee for copies.

In rare cases the law lets us refuse access, for example if it would put someone’s safety at risk. If that happens, we’ll explain why in writing.

This website

The enquiry form asks for your name, your email address and, if you choose, your phone number and a short note. It goes straight to Jess’s email inbox. Please don’t include clinical details; we’ll talk about those once we’ve spoken.

This site does not use analytics, advertising or tracking, and it sets no cookies. It is hosted by Cloudflare, which handles the technical details of each visit, such as your IP address, to deliver the site and protect it from abuse, and its fonts load from Google Fonts. Links to Instagram, TikTok and LinkedIn take you to those services, which have their own privacy policies.

If something goes wrong

If a data breach is likely to cause you serious harm, we’ll tell you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

If you have a concern or complaint about your privacy, please contact Jess first (below). We’ll acknowledge it within 7 days and aim to resolve it within 30 days. If you’re not satisfied, you can contact:

• the Office of the Australian Information Commissioner;
• the NSW Information and Privacy Commission, for health information (within 6 months of becoming aware of the problem);
• the Health Care Complaints Commission, for concerns about a health service in NSW;
• the NDIS Quality and Safeguards Commission, if you are an NDIS participant.

Contact us

Jess Matotek, Ink & Intuition Psychotherapy
Email: inkandintuition.psychotherapy@gmail.com

We review this policy from time to time and publish the current version on this page. Last updated: 18 October 2026.