Privacy Policy

Introduction

Circa Sleep Pty Ltd (ABN 94 678 977 574), trading as Circa Sleep Psychology, is committed to protecting your privacy and complying with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy outlines what type of information is collected and how we collect, use, disclose, and safeguard your personal information.

This policy covers both parts of our service:

• our clinic, where Dr Amelia Scott provides individual psychological services; and
• our online programs and courses, including The Insomnia Program, which you buy and work through on our program platform.

Most of this policy applies to both. Where something applies only to online programs, it is set out in the section headed Online programs and courses. Because we are a health service provider, the Privacy Act applies to us regardless of our size, and almost everything we collect in the course of providing our services — including your name and email address — is treated as health information, which is a kind of sensitive information under the Act.

Last updated: 25 August 2026.

Types of information collected

We collect various types of information.

Client Service Record Information:

• Name, date of birth, addresses, contact numbers, emergency contacts, email address and other contact details;
• Health information contained in your digital health record including medicare number, healthcare identified and health fund details where relevant (if you participate and only with your consent);
• Financial payment details (such as your credit card number);
• Other information disclosed by you, if relevant when providing our services directly to you (such as your relationships with other persons, employment information and qualifications, gender, race, sexuality or religion); and

Confidential Client Record Information:

• Details of other health service providers involved in your care and copies of any referral letters and/or reports/results from those parties;
• Medical information including medical history, medications, allergies, adverse events, immunisations, social history, family history and risk factors;

In addition, in the provision of psychological services Circa Sleep Psychology will likely collect the following personal information:

• Treatment plans, psychological assessments, referral sources.
• Responses and results from psychological tests and questionnaires.
• Responses and results reasonably obtained as part of a neuropsychological assessment.
• Information pertaining to your session notes; treatment plan and your response to treatment.

If you enrol in an online program, we collect much less than this. See Online programs and courses below for the full list.

Collection methods

We are committed to using lawful and fair means to collect personal information and collecting it from others only when it is unreasonable or impracticable to obtain certain information from our clients directly.

A client's personal information is collected in a number of ways:

• During psychological therapy with Circa Sleep Psychology, including when the client provides information directly to a clinician using hardcopy or electronic forms, correspondence including via email and when the client interacts directly with CIRCA Sleep Psychology employees; and
• From a client's responsible person, such as parents and guardians; and
• From other health service providers who provide personal information to Circa Sleep Psychology, via referrals, correspondence and medical reports; and
• Directly from you, when you sign up to our mailing list, join a waitlist, submit a form on our website, buy an online program, or answer a questionnaire inside a program.

We will always endeavour to keep you reliably informed of the information collected and the source of that information, and will seek and obtain written informed consent to contact and retrieve that information.

Use and disclosure of information

It is necessary for Circa Sleep Psychology to collect, hold, and use information to provide our service, including for the following purposes to:

• Communicate with clients;
• Conduct psychological services including assessment and diagnosis;
• Deliver an online program you have purchased, give you feedback on your progress within it, and provide customer support;
• Process your payment and administer refunds;
• Communicate with other relevant healthcare providers (with the client's written consent);
• Communicate with other parties such as schoolteachers to obtain clinical information (with the client's written consent);
• Liaise with Medicare, your health fund or government department;
• When it is necessary to lessen or prevent a serious threat to your life, health, or safety or public health or safety;
• To handle a complaint or respond to anticipated or existing legal action; and
• As required by the Commonwealth Privacy Act 1988

Our privacy practices are in keeping with the Commonwealth Privacy Act 1988, and in our practice of confidentiality we also strive to conform to the ethical principles of the APS Code of Ethics.

We will seek your written consent to communicate with third parties. We may share confidential information in the following circumstances:

• with the consent of the relevant client or a person with legal authority to act on behalf of the client;
• where there is a legal obligation to do so (e.g., a subpoena is issued, or when a mandatory report must be made about a child at risk of harm);
• if there is an immediate and specified risk of harm to an identifiable person or persons that can be averted only by disclosing information; or
• when consulting colleagues, or in the course of supervision or professional training, provided the psychologist conceals the identity of clients and associated parties involved; or obtains the client's consent, and gives prior notice to the recipients of the information that they are required to preserve the client's privacy, and obtains an undertaking from the recipients of the information that they will preserve the client's privacy.

We do not sell your personal information. We do not disclose it to third parties for their own marketing purposes, and we do not upload our contact list to advertising platforms to build custom or lookalike audiences.

In line with the Privacy Act and APS Code of Ethics, client information is retained for a minimum of 7 years after the client's last contact with our service, or if the client is under 18, until they turn 25.

Online programs and courses

This section applies if you buy, or sign up for information about, one of our online programs, including The Insomnia Program.

What we collect before you buy. If you join a mailing list or waitlist, we collect your name and email address. If you buy a program, we collect your name, email address and the details needed to process your payment. We do not collect any health information before you purchase. There is no health screening step, and nothing you tell us is reviewed or approved by us before you enrol.

What we collect inside a program. Our programs contain questionnaires that ask about your sleep and about practical safety matters — for example, how long you take to fall asleep, whether you have fallen asleep unintentionally during the day, whether your work involves driving or machinery, and whether you currently take anything to help you sleep. Some questions invite you to write about what matters to you in your own words. This is health information, and it is sensitive information under the Privacy Act. We collect it only with your consent, which we ask for at the questionnaire itself. Answering is voluntary: you can skip any question or leave the questionnaire blank, and doing so does not affect your access to the program.

What we use it for. To give you a starting point, to measure your progress, and to give you brief written feedback at set points in the program. We may also use de-identified information — information that can no longer identify you — to evaluate and improve our programs. We do not use your program answers to target advertising to you.

What we do not collect. We deliberately do not ask online program participants for a residential address, phone number, emergency contact, GP details or Medicare number. Our programs are self-guided and we do not monitor participants, so we have no use for that information and we do not want to hold it.

Where it is stored, and who can see it. Our programs run on Kajabi, a third-party online course platform. Your account details and your questionnaire answers are stored on Kajabi's servers, which are located outside Australia, including in the United States. See Overseas storage and disclosure below. Within Circa Sleep, your responses can be seen by staff who hold administrative access to the platform. The platform does not allow us to restrict access to individual fields, so we keep the number of administrator accounts to a minimum and require two-factor authentication on each of them.

Our record of your care. Where you have enrolled and we have given you written feedback, we save your responses together with that feedback into our own records system. That record, not the platform, is our lasting record, and it is kept for at least 7 years from your last contact with us.

What we do not connect it to. We do not sync program questionnaire data or health-related custom fields to email marketing tools, automation tools, advertising platforms or any other third-party service.

Overseas storage and disclosure

Some of the service providers we rely on store data outside Australia. In particular:

• Kajabi, the platform that hosts our website and delivers our online programs, stores account information, form and questionnaire responses, and email records on servers located overseas, including in the United States.
• Our email, document storage and practice systems may store information on servers located overseas, including in the United States, where those providers operate global infrastructure.
• Our payment provider processes card payments and may store transaction records overseas. We do not store your full card details ourselves.

This means that if you enrol in an online program, your health information will be stored overseas. Before disclosing personal information to an overseas recipient we take the steps that are reasonable in the circumstances to ensure that the recipient handles it consistently with the Australian Privacy Principles, including by putting appropriate contractual terms in place with our providers. You should be aware that once information is held overseas, Australian privacy law may be harder to enforce, and the recipient may be subject to laws that compel disclosure in that country.

By enrolling in an online program and answering its questionnaires, you consent to your information being stored overseas as described in this section. If you would prefer that your health information is not stored overseas, please do not answer the questionnaires, and contact us to discuss seeing us through the clinic instead.

Anonymity and pseudonymity

You may deal with us anonymously or under a pseudonym where it is lawful and practicable to do so. For our online programs, we do not verify your identity: a working email address is enough, and you may use a name that is not your legal name. We will not ask you to prove who you are unless you ask us to access, correct or delete information we hold, in which case we need to be reasonably satisfied that the request is really yours.

For clinical services, and where a Medicare or health fund claim is involved, we generally cannot provide the service anonymously.

Direct marketing

We will only send you marketing emails — sleep insights, new articles, program news — if you have opted in to receive them. The opt-in box at checkout and on our forms is never pre-ticked, and buying a program does not by itself opt you in.

Every marketing email contains an unsubscribe link, and we act on unsubscribe requests promptly. Opting out of marketing does not affect service emails about a program you have bought, such as your welcome email, module notifications or receipts.

We never use health information you have given us inside a program to decide what marketing to send you.

Cookies, analytics and advertising technology

Our website uses cookies and similar technologies to keep the site working, to remember you when you log in, and to help us understand how the site is used. Our website platform applies these across the whole site; we are not able to switch them off for individual pages.

Where we run advertising, our advertising partners may set cookies on your device to measure whether an ad led to a visit. You can control cookies through your browser settings, though some parts of the site may not work properly if you block them.

Our questionnaires are delivered inside the program platform and their contents are not passed to analytics or advertising providers.

Storage and Security

Circa Sleep Psychology collects and stores your personal information electronically. We securely store this information on servers and computer systems. In some cases, personal information may be collected on paper, which is then converted to an electronic format, and the original paper documents are securely destroyed.

All Circa Sleep Psychology clinicians will take reasonable steps to protect the personal information of clients from misuse, interference, or loss, and from unauthorized modification, access, or disclosure. This will be done in accordance with the APS Code of Ethics (2007) and other relevant ethical guidelines, legal obligations, and privacy laws, including the Privacy Act 1988 and the Australian Privacy Principles. These steps include limiting the number of staff with administrative access to our systems, requiring two-factor authentication on those accounts, and removing access when it is no longer needed.

Data breaches

If a data breach occurs involving personal information and the breach is likely to result in serious harm, we will contain and assess it, notify affected individuals as soon as practicable, and notify the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

Retention and deletion

How long we keep your information depends on what it is:

• Clinical records — at least 7 years after your last contact with our service, or if you were under 18, until you turn 25.
• Online program records where you enrolled and received feedback — treated as health records and kept for at least 7 years from your last contact with us.
• Mailing list and waitlist details where you never purchased — deleted within 12 months of your last interaction with us, or sooner if you ask.

Access and Correction

You have the right to:

Access: Clients can request details of personal information we hold about them, as permitted by the Privacy Act 1988 (Cth) (the Act). In some cases, we may refuse to provide access, as allowed under the Act. Otherwise, we will provide access if it is reasonable and practicable to do so. We generally provide this information free of charge, but if your request requires significant effort or expense, we may ask for a reasonable fee.

Correction: If you believe that any information we hold about you is inaccurate, outdated, incomplete, irrelevant, or misleading, please contact us using the details below. We rely on clients to inform us when their personal information changes. We will correct any inaccurate or outdated information and notify relevant third parties of the correction, unless doing so is impracticable or unlawful.

Deletion: If you wish for us to delete personal information we hold about you, or stop collecting information for a specific purpose, please contact us. However, please note that we may be required by law to retain certain information (such as healthcare records) for a prescribed period. Even if we agree to delete your information, some residual data may remain in backups or deletion logs.

We will respond to requests for access, correction, or deletion of information within a reasonable timeframe.

Requests can be made in writing to [email protected], and we will respond as soon as practicable.

Complaints

Clients have a right to make a complaint about the handling of their personal information.

Complaints can be made to Circa Sleep Psychology by email ([email protected]). We will endeavour to respond appropriately to reasonable complaints within 30 days of the receipt of the email.

Ultimately, if you wish to make a complaint about the use of, disclosure of, or access to your personal information, you may do so with the Office of the Australian Information Commissioner by phone on 1300 363 992 or online, or by post to: Office of the Australian Information Commissioner, GPO Box 5218, SYDNEY NSW 2001.

Other agencies to which clients may bring complaints are as follows:

• Australian Health Practitioner Regulation Agency (ahpra.gov.au)
• Australian Psychological Society (psychology.org.au)

Changes to the policy

We may update or modify this Privacy Policy at any time and at our discretion. Any changes will be effective immediately upon posting the updated Privacy Policy on our website. We encourage you to check back periodically to stay informed of the current version.

Contact

Queries, complaints, requests for access or correction should be made in writing and sent to: [email protected]