Privacy Policy
Hypnotic Impact — Barbara Saba
Last updated: 31 July 2026
Why this policy exists
I am a counsellor and clinical hypnotherapist. That makes me a health service provider under the Privacy Act 1988 (Cth), and the Act applies to my practice regardless of its size. This policy explains what information I collect about you, why I have it, where it is kept, and what you can do about it.
I am not a registered psychologist or a medical practitioner.
What I collect
When you enquire or book a session: your name, email address, phone number, and whatever you choose to tell me about why you are getting in touch.
When you become a client: health information. That includes what you tell me about your symptoms, your history, your circumstances, and how you respond to sessions, along with my own notes about our work together. Health information is treated as sensitive information under the Act, which means I can only collect it with your consent and I must protect it more carefully than ordinary contact details.
When you join my email list: your email address, and the language you selected.
When you visit the website: anonymous usage data through Google Analytics — pages viewed, approximate location by country or city, device type, and how you arrived at the site. This does not identify you by name.
I do not collect information about you from anyone else without telling you.
Why I collect it
- To provide counselling and hypnotherapy services to you
- To arrange, confirm and reschedule appointments
- To keep clinical records, which I am obliged to keep accurately
- To send you the free audio or emails you asked for
- To understand how people find and use the website
I do not sell your information. Ever. To anyone.
How it is held, and where
Your information is held in the following systems. Several are based overseas, and this is the part most people do not think to ask about, so it is set out plainly:
| What | Service | Where it is held |
|---|---|---|
| Bookings and appointment details | Acuity Scheduling (Squarespace) | United States |
| Card payments for sessions | Stripe, through the Acuity booking page | United States |
| Payments for audio products | Payhip (Payhip Ltd) | United Kingdom |
| Email list | Mailchimp (Intuit) | United States |
| Website hosting | Netlify | United States |
| Website analytics | Google Analytics | United States and elsewhere |
| Email correspondence | Gmail (Google) | United States |
| Clinical notes | Google Drive | United States |
| Paper client files | Held by me, in a secured filing cabinet | My office, Fremantle, Western Australia |
I never see or store your full card number. Card details are entered directly into Stripe's payment fields and handled by Stripe, or by Payhip for audio purchases. What reaches me is confirmation that a payment succeeded.
By using this site, booking a session, or emailing me, you consent to your information being handled in those countries. I take reasonable steps to use established providers with their own security obligations, but information held overseas is subject to the laws of those countries.
Sessions are held over Google Meet. I do not record sessions unless you ask me to and agree in writing.
Who I share it with
I do not disclose your information to anyone else except:
- With your express consent — for example, a support letter to your employer, or a letter to your GP. You decide, in each case, what it says and who receives it.
- Where the law requires it. This includes a court order or subpoena, and it includes my obligations where there is a serious and imminent risk to someone's life, health or safety, or where a child is at risk of harm.
Nothing goes to your employer, your recruiter, or a testing clinic unless you have asked me to send it.
How long I keep it
Clinical records are kept for seven years from the last date of interaction or service delivery. After that they are securely destroyed.
You can unsubscribe from my email list at any time using the link at the bottom of any email, and your address is removed.
Keeping it secure
I use password-protected accounts with two-factor authentication where the service offers it, and a password manager rather than reused passwords. Paper records are held in a secured filing cabinet. The website is served over HTTPS.
No system is completely secure. If a data breach happens that is likely to cause you serious harm, I am required to notify you and the Office of the Australian Information Commissioner, and I will.
Seeing your information, and correcting it
You have the right to ask for a copy of the personal information I hold about you, and to ask me to correct anything that is wrong.
Email me at b.hypnoticimpact@gmail.com. I will respond within 30 days. There is no charge for making the request.
There are limited circumstances where the Act allows me to refuse access — for example, where giving it to you would pose a serious threat to someone's life or health, or would unreasonably affect another person's privacy. If I refuse, I will tell you why in writing and explain how to complain.
Cookies and analytics
The website uses Google Analytics, which sets cookies to measure visits. You can block or delete cookies in your browser settings, or install Google's opt-out browser add-on. The site works without them.
The website does not run advertising trackers.
If you are unhappy with how I have handled your information
Tell me first. Email b.hypnoticimpact@gmail.com with what happened. I will acknowledge within 7 days and give you a written response within 30 days.
If you are not satisfied with my response, you can complain to the Office of the Australian Information Commissioner:
- oaic.gov.au
- 1300 363 992
- GPO Box 5218, Sydney NSW 2001
You do not need my permission to do that, and it costs nothing.
Changes to this policy
If this policy changes, the updated version is published on this page with a new date at the top.