Privacy policy
Counselling only works if you can speak freely. This page sets out exactly what Align Within records about you, where it is kept, who can ever see it, and the narrow situations in which the law requires me to act. It is written to be read, not skimmed past.
Align Within, Alexandria NSW 2015 Maryam Keri, counsellor and reiki practitioner
1. Who this policy covers
Align Within is a sole practice run by Maryam Keri, providing holistic counselling and reiki from rooms in Alexandria, New South Wales. In this policy, "I" and "me" mean Maryam Keri trading as Align Within.
This policy applies to everyone I hold information about. That includes current and former clients, parents and guardians who book on behalf of a child, anyone who fills in a form or sends an enquiry through this website, and anyone who contacts the practice by phone or email without going on to book.
It applies whether the information was given to me in a session, written on an intake form, left in a voicemail, or typed into a booking page.
2. The laws it follows
Two sets of rules apply to a counselling practice in New South Wales, and I am bound by both.
- The Privacy Act 1988 (Cth) and the thirteen Australian Privacy Principles, which govern how personal information is collected, used, disclosed and secured across Australia.
- The Health Records and Information Privacy Act 2002 (NSW) and its fifteen Health Privacy Principles, which set stricter rules again for health information specifically, and which apply to me as a private sector health service provider in NSW.
Most of what I hold about a client counts as health information, which the law treats as the most sensitive category of personal information there is. Where the two sets of rules differ, I follow whichever gives you more protection.
I am also bound by the code of ethics of the Australian Counselling Association, which carries its own confidentiality obligations on top of the legislation.
3. What is collected
I collect only what I need to work with you safely and to run the practice. Nothing is gathered speculatively.
Identity and contact details
- Your name, date of birth, postal address, phone number and email address.
- An emergency contact, and your relationship to them.
- Your GP's name and practice, where you choose to provide it.
- For a child or young person, the same details for the parent or guardian booking the sessions.
Health information
- What brought you to counselling, and what you want to be different.
- Relevant medical and mental health history, including current medications and any past or present treatment, where you choose to share it.
- Notes I make during or shortly after each session, recording themes discussed, the approach used, and anything agreed for between sessions.
- For reiki, any physical conditions relevant to whether hands-on contact is appropriate for you.
- Any risk-related information, including thoughts of self-harm or harm to others, where these come up.
Information about a child's circumstances
- School, year level, and who is in the household.
- Any parenting orders, court orders or family law arrangements that affect who may consent to treatment or receive information. I ask for copies where these exist.
- Any diagnoses, school reports or assessments a parent chooses to share.
Payment and administration
- A record of sessions attended, cancelled and paid for.
- Receipt and invoice records, which are kept for tax purposes.
- I do not store your card number. Card payments are handled entirely by Stripe, the payment processor behind Setmore, which holds those details under its own security obligations. I see only the last few digits and whether a payment succeeded.
Website and enquiry information
- Whatever you type into an enquiry or booking form, which is usually your name, contact details and a short description of what you are looking for.
- Basic, non-identifying information about how the site is used, covered in section 11.
You can always decline to answer something. If a piece of information is genuinely necessary for me to work with you safely, I will explain why rather than simply insisting on it. In some cases withholding it may mean I cannot take you on as a client, and I will say so plainly if that is the case.
Working anonymously
You are entitled to deal with me anonymously or under a pseudonym for a general enquiry, such as asking about fees or availability. Ongoing counselling is different: I need your real identity and contact details so that I can respond if there is a risk to your safety, and so that my records meet my legal and professional obligations.
4. How it is collected
Almost everything I hold comes directly from you, in one of four ways: in conversation during a session, on the intake form you complete before the first appointment, through the booking or enquiry form on this website, or in emails, texts and phone calls with the practice.
Occasionally information reaches me from someone else. That happens when a parent or guardian provides details about their child, when another practitioner such as a GP, paediatrician or psychologist sends a referral or report, or when a school shares an observation with a parent's written consent. Where I receive information about you from a third party and you would not reasonably expect it, I will tell you that I have it and where it came from.
I do not buy contact lists, and I do not collect information about you from social media or public records.
5. What it is used for
Your information is used to provide and manage your care, and for nothing else. In practice that means:
- Understanding your situation and planning the work we do together.
- Keeping an accurate record of sessions, so that I can pick up where we left off and so the work stays coherent over months rather than weeks.
- Contacting you about appointments, including confirmations, changes and reminders.
- Issuing invoices and receipts, and meeting my tax and record-keeping obligations.
- Reflecting on my own practice in clinical supervision, which is a professional requirement. Supervision discussions use de-identified information wherever possible, and my supervisor is bound by the same confidentiality obligations I am.
- Responding to a complaint, an insurance matter or a legal claim, if one ever arises.
I do not use your information for marketing. I will not add you to a mailing list, send you newsletters, or contact you about services you have not asked about. I do not sell, rent or trade personal information to anyone, in any circumstances.
7. Children and young people
Counselling a young person only works if they believe the room is theirs. At the same time, parents are entitled to know their child is safe and to be part of the work. This is how I hold both.
What a parent or guardian receives
After each session you receive a short summary of the themes we worked on and a suggestion for home. Over time you will have a clear picture of the direction of the work and whether it is helping.
What a parent or guardian does not receive
I do not pass on the detail of what your child tells me. If a young person believes their words will be repeated at the dinner table, they will not say the thing that matters. Withholding that detail is not me keeping secrets from you, it is the condition that makes the work possible.
What I tell the child
In the first session I explain to the child, in words appropriate to their age, that what they say stays in the room, with two exceptions: if I believe they or someone else is not safe, and if a court asks for the records. Children handle that honesty well. What they do not handle is discovering a limit after the fact.
Consent and who can access the record
A parent or guardian consents to treatment and books the sessions. As a young person matures, they may become capable of making their own decisions about their care and about who sees their information, and where that is the case I will take their views into account. Where parents are separated, both parents generally retain the right to information about their child unless a court order says otherwise, which is why I ask about orders at intake.
If a request to access a child's record would place that child at risk, I may refuse or limit it. That is a protection the law provides for the child, and I will use it if I need to.
8. Storage and security
Records are held electronically in Google Drive, inside the practice Google Workspace account, which is encrypted both in transit and at rest and kept separate from the online booking calendar. The account is protected by a strong, unique password and multi-factor authentication, and the folder holding client records is not shared with anyone.
Where paper exists, such as a signed consent form or a drawing made in a child's session, it is stored in a locked cabinet in a locked room and is not removed from the premises.
Devices used for practice work are password protected, encrypted, and set to lock automatically. I do not keep client information on unencrypted personal devices, on USB drives, or in personal cloud accounts, which means the practice account only and never a private email or storage account.
I am the only person with routine access to client records. No administrative staff, family members or contractors have access.
Information that is no longer needed and no longer required to be kept is destroyed securely: paper is shredded, and electronic records are permanently deleted rather than simply archived.
9. How long records are kept
NSW health records law sets minimum periods, and I keep to them rather than deciding case by case.
- For an adult client, the record is kept for at least seven years from the date of the last service provided.
- For a client who was under 18 at the time of the last service, the record is kept until they turn 25.
- Financial records, including invoices and receipts, are kept for at least five years to meet Australian Taxation Office requirements.
These are minimums. I do not keep records longer than I have a lawful reason to, and once the period passes and there is no ongoing legal reason to retain them, they are securely destroyed.
Because these periods are set by law, I cannot delete your record on request while the retention period is still running, even if you ask me to. What I can do is correct it or add your own statement to it, which is covered in the next section.
10. Seeing and correcting your record
It is your information, and you are entitled to see it.
Asking to see it
Put the request in writing to the email or postal address at the foot of this page. I may ask you to verify your identity. I will respond within 30 days, and there is no charge for making the request, though I may charge a reasonable amount for photocopying or for the time spent compiling a large file. I will tell you the cost before I incur it.
Rather than handing over raw session notes, I will often suggest going through the record together. Clinical notes are written in shorthand for my own use and can read coldly or confusingly out of context. That offer is a courtesy, not a condition, and you may simply take the copy if you prefer.
When access can be refused
Access can be limited or refused in a narrow set of circumstances set out in the legislation. The main ones are where providing access would pose a serious threat to the life or health of you or another person, where it would unreasonably reveal information about someone else, or where it relates to anticipated legal proceedings. If I refuse, I will tell you in writing, explain why, and tell you how to challenge that decision.
Correcting it
If something in your record is wrong, incomplete or out of date, tell me and I will correct it. Where we disagree about a clinical observation, I will not delete my note, but I will attach your statement to the record so that anyone who reads it in future reads your account alongside mine.
11. This website
This site is deliberately simple. It does not carry advertising trackers, social media pixels, or third-party profiling scripts.
Forms
Anything you type into an enquiry or booking form comes to me and is treated exactly like any other information you give me. If you send an enquiry and do not go on to become a client, I keep the correspondence for a reasonable period in case you come back, and then delete it.
Cookies and analytics
The site may set a small number of cookies necessary for it to function, and may record non-identifying aggregate information such as which pages are visited and roughly how many people visit. This is used to understand whether the site is doing its job. It is not linked to individual people, and it is not used to build profiles.
You can block or delete cookies through your browser settings. The site will continue to work.
Fonts and images
Some fonts and images may load from third-party services, which as a technical necessity receive your IP address in order to deliver the file. They do not receive any information about who you are or why you are visiting.
The booking calendar
Booking is handled by Setmore. When you choose a booking button, the Setmore calendar opens in a panel on this page rather than in a new tab, but it is still Setmore's page. What you type into it, such as your name, email address and the time you choose, goes to Setmore under its own privacy policy, and Setmore may set its own cookies in your browser. You can open the same calendar in a new tab instead, using the link at the foot of the panel.
Links to other sites
Where this site links elsewhere, such as to a booking page or a crisis support service, that organisation has its own privacy policy and I am not responsible for their handling of your information.
If you are reading this on a shared or monitored device and would rather not leave a trace, most browsers offer a private browsing mode, and you can clear your history afterwards. If it is safer to reach me another way, call the practice.
12. If something goes wrong
If there is unauthorised access to, or loss of, information I hold, and it is likely to result in serious harm to you, I am required under the Notifiable Data Breaches scheme to notify you and the Office of the Australian Information Commissioner as soon as practicable.
Notification will tell you what happened, what information was involved, what I am doing about it, and what you can do to protect yourself. I would tell you promptly and directly rather than burying it.
13. Making a complaint
If you believe your privacy has been mishandled, please raise it with me first. Write to the email or address below, set out what happened, and I will acknowledge it within seven days and give you a written response within 30 days.
If you are not satisfied with my response, or you would rather not come to me at all, you can go directly to any of the following. You do not need my permission and you do not need to tell me you are doing it.
- Office of the Australian Information Commissioner 1300 363 992, oaic.gov.au
- NSW Information and Privacy Commission 1800 472 679, ipc.nsw.gov.au
- Health Care Complaints Commission NSW 1800 043 159, hccc.nsw.gov.au
- Australian Counselling Association For complaints about professional conduct or ethics.
14. Contact
Any question about this policy, or about the information held about you, comes to me directly.
- Maryam KeriAlign Within
- Emailconnect@alignwithin.com.au
- PostAlign Within, Alexandria NSW 2015
This policy is reviewed at least once a year, and whenever the way the practice handles information changes. If it changes in a way that materially affects you, I will tell you rather than relying on you to notice. Last reviewed September 2026.