Privacy policy | Pathway Art Therapy

Pathway Art Therapy is run by me, Lou Lou Rodrigues (ABN 612 650 93394). This policy explains what personal information I collect, why I collect it, and how I keep it safe. It covers this website, enquiries, bookings, payments and sessions.

Because I provide health services in Australia, I follow the Australian Privacy Principles in the Privacy Act 1988. Where the General Data Protection Regulation (GDPR) applies to my work, such as when I work with people living in the European Union, I follow it too.

The short version

I only collect what I need to support you and run my practice.
I never sell your information or use it for advertising.
Anything you share in sessions is treated as confidential.
This website doesn’t use cookies, analytics or tracking.
You can ask to see, correct or delete your information at any time.

What I collect

When you contact me

Your name, email address, where you live, what you’re interested in, and anything you write in your message. Please keep health details in the contact form brief. We can talk about them properly once we connect.

When you book and pay

Your name, contact details and booking times. Payments are processed securely by Stripe, so I never see or store your full card details.

When we work together

To provide safe, ethical sessions, I keep records. These may include:

your contact details, and for young people, a parent or guardian’s details
background, goals and wellbeing information you choose to share
session notes
photos of artwork made in sessions, only with your permission
for NDIS participants, your NDIS number, plan management details and invoices

Some of this is sensitive health information. I only collect it with your consent, and only when it’s needed for our work together.

When you visit this website

This website doesn’t use cookies, analytics or tracking tools. Like most websites, the hosting service, GitHub Pages, may keep basic technical logs, such as IP addresses, for security.

How I use your information

To reply to your enquiry
To book, deliver and follow up on sessions
To keep accurate, professional records
To issue invoices and take payments, including NDIS claims
To meet my legal, insurance and professional obligations

I’ll only send you news or offers by email if you’ve signed up for them, and you can unsubscribe at any time.

If the GDPR applies to you, I rely on your consent, including your explicit consent for health information, on the need to provide the service you’ve asked for, and on my legal obligations.

Who I share it with

I only share information when it’s needed, with:

services that help me run my practice, such as my email, booking calendar (Google), payments (Stripe), contact form (Web3Forms), sign-up forms (Google Forms), and video and record-keeping tools, which may only use it to provide their service to me
your NDIS plan manager, if you’re plan-managed, for invoicing
other people involved in your care or support, such as a GP or school, only with your consent
anyone I’m required to share it with by law, or where there’s a serious risk to someone’s safety

I never sell or rent personal information.

Information stored overseas

I live overseas, and the services I use store information in several countries, including Australia, the United States and the European Union. This means your information may be stored or accessed outside the country where you live. I choose services with strong security and privacy protections.

How I keep it secure

Records are kept in secure, password-protected systems with two-step sign-in.
My work computer is encrypted and used only for my practice.
I keep session details out of everyday email and messaging.
Only I can access your records.

How long I keep it

Health records are kept for at least 7 years after our last session. For young people, they’re kept until the young person turns 25, if that’s later. After that, they’re securely deleted.

Enquiries that don’t lead to sessions are deleted once they’re no longer needed.

Your rights

You can ask me to:

show you the information I hold about you
correct anything that’s wrong or out of date
delete your information, unless I’m legally required to keep it
stop using it for a particular purpose, or withdraw your consent

If the GDPR applies to you, you can also ask for a copy in a portable format, and object to or limit how your information is used.

To make a request, email me at loulou@pathwayarttherapy.com. I’ll reply within 30 days.

Young people

For children and teens, I usually collect information from a parent or guardian. Young people can ask about their own information too, and I’ll take their age and maturity into account when I respond.

Concerns or complaints

If you’re unhappy with how I’ve handled your information, please tell me first so I can put it right. If you’re still not satisfied, you can contact:

the Office of the Australian Information Commissioner, at oaic.gov.au
if you live in the European Union, the data protection authority in your country

Changes to this policy

I may update this policy from time to time. The latest version will always be on this page.

Last updated 11 September 2026.