Privacy Policy

Collection statement

Fossickpoint collects your personal information so I can provide counselling, coaching, masterclasses and related services to you, and run my business. Some of this is health information, which I handle with extra care.

I share your information only with the tools and people I need to deliver my services (such as my booking, video and payment systems), with your consent, or where the law requires or permits it. Some of those tools store information outside Australia.

If you don't give me the information I ask for, I may not be able to provide some services. The full policy below explains what I collect, how I use and protect it, how you can see or correct it, and how to make a complaint. Questions? Email info@fossickpoint.com.au.

Who I am and which laws apply

Fossickpoint is run by Zonia Mithzay Pomenta De La Espriella (known professionally as Mithzay Pomenta), a sole trader trading as Fossickpoint, ABN 73 910 458 405. In this policy, "I", "me" and "my" mean Fossickpoint.

Because I provide counselling, a health service, I am bound by the Privacy Act 1988 (Cth) and its Australian Privacy Principles (APPs). I also follow:

the Health Records Act 2001 (Vic) and its Health Privacy Principles (HPPs), for health information;
the Spam Act 2003 (Cth), for marketing emails and messages;
the Code of Ethics of the Australian Counselling Association (ACA).

I apply the same standards to my coaching, masterclasses and other services, whether or not the law strictly requires it.

This policy covers my website (fossickpoint.com.au), bookings made through it, and all services I provide in person, online, by phone or by email.

What I collect, how and why

I only collect what I need to work with you well and to run my business.

Name, phone and email. Collected when you enquire, book or join my mailing list, so I can respond, confirm bookings and keep in touch.
Fuller details (address, date of birth, emergency contact and the other details on your agreement and consent form). Collected when you start counselling or coaching, so I can provide a safe service and meet my duty of care.
Health and wellbeing information, and my session notes. Collected during counselling and coaching, so I can understand your situation and support you.
Payment and invoice details. Collected when you pay or I invoice you, to process payments and keep tax records.
Website usage information (pages visited, device and browser, approximate location). Collected when you visit my website, to keep the site working and understand how it is used.
Your feedback or testimonial. Only if you choose to give one, to improve my services and, with your written permission, share your words.

I collect information directly from you wherever I can. Sometimes it comes from someone else with your consent, such as a referring GP, your NDIS plan manager, or a program that funds your sessions.

Payments. Card payments are processed securely by Stripe. I never see or store your full card details.

Sensitive information. Health information, including mental health history, is sensitive information. I collect it only with your consent, and only what is relevant to the service you have asked for.

Using a first name or pseudonym. You can enquire, join my mailing list or attend a masterclass using just a first name or a pseudonym. For counselling and coaching sessions I need your full details, so I can provide a safe service and contact you or help if there is a safety concern.

No automated decisions. I do not use computer programs or artificial intelligence to make decisions about you, and I do not put client information into AI tools.

Notes for each service

Counselling. Your counselling agreement and consent form, which you sign through PandaDoc, sets out confidentiality and its limits in detail. Signed forms are downloaded and kept securely in your client file. Counselling and coaching are separate services, and I keep their records separate.

Coaching. My Coaching Terms and Conditions cover how I handle your information in coaching. I apply the same privacy and confidentiality standards as in counselling.

Masterclasses, workshops and trainings. I collect what I need to register you and send you the session details. Some masterclasses and trainings may be recorded. I'll tell you before the session starts, and you can keep your camera off or use a first name only.

Session recordings. Counselling and coaching sessions, including chats, are not recorded by me or by you unless we have both agreed to it beforehand.

Simple Steps program. Sessions in this program are funded by the Knox Rotary Club. I invoice the program using a unique client code, so your name and personal information do not appear on any invoices, correspondence or program files. I do not share session details or attendance with the program. If a client's place in the program ends, I may let the program know using the client code only.

NDIS funding. I am not a registered NDIS provider. If you use your NDIS plan, I send invoices to you or to your plan manager, with the details they need to pay them.

Clinical supervision. Like all counsellors, I discuss my work with a professional supervisor to ensure you receive the best care. These discussions never reveal your identity.

Who I share your information with

I never sell your information. I share it only when I need to, and only as much as is needed:

The tools I use to run my practice (listed below), which store or process information on my behalf.
Other health practitioners, such as your GP, when you have authorised a referral or report in writing.
Emergency contacts, emergency services or other health services, without your consent, only where there is a serious threat to your life, health or safety, or to someone else's.
People you nominate, such as a support person, with your consent.
Your NDIS plan manager or your insurer, only the invoice details needed to pay or claim for your sessions.
Contractors or assistants who help run the business. They see only what their role needs and sign a confidentiality agreement.
My lawyer, accountant or professional insurer, where needed to run my business or respond to a legal claim.
A collections agency, only your name and contact details, if fees remain unpaid.
Courts, police or government agencies, where the law requires or permits it, such as a subpoena or a mandatory report about a child at risk.

Tools I use and where they store data

Acuity Scheduling (Squarespace): bookings and booking forms. Data may be stored in the United States and other countries. Squarespace privacy policy
Google Workspace: email, calendar, files and mailing-list emails. Data may be stored in the United States and other countries where Google has data centres. Google privacy policy
Zoom: online sessions. Data may be stored in Australia and the United States. Zoom privacy statement
PandaDoc: agreements and consent forms. Data may be stored in the United States or the EU (Germany), depending on account region. PandaDoc data residency
Stripe: card payments. Data may be stored in the United States and other countries, including India. Stripe privacy centre
Xero: invoicing and accounts. Data may be stored in the United States, with some processing in New Zealand and Australia. Xero data and privacy
Wix: my website and its built-in analytics. Data may be stored in the United States and Ireland. Wix privacy policy
reMarkable: recent handwritten session notes, regularly transferred to long-term encrypted storage and removed. Data may be stored in Europe (Google Cloud). reMarkable cloud information

Because some of these providers store data outside Australia, I choose reputable providers with strong security and privacy commitments, and I take reasonable steps to make sure they protect your information. These companies update their policies from time to time, so the links above take you to their current versions.

Emails and marketing

I only send you newsletters, offers or event news if you have opted in, for example by ticking the box on my booking form. Every marketing email has an unsubscribe link, or you can email me to stop. I never use your health information for marketing, and I never share your details with other businesses for their marketing.

Messages about your bookings, sessions and invoices are not marketing, so you'll still receive those.

My website and cookies

My website runs on Wix. Wix uses cookies (small files on your device) to keep the site working and secure, and Wix's built-in analytics tells me how the site is used, such as which pages are visited. I do not use Google Analytics or Facebook (Meta) tracking. Booking pages may also use cookies from Acuity.

You can block or delete cookies in your browser settings, but some parts of the site may not work as well.

My website may link to other websites. I'm not responsible for their privacy practices, so please read their policies.

Keeping your information safe

I take reasonable steps to protect your information from misuse, loss and unauthorised access. These include accounts protected by strong passwords and two-step verification, encrypted storage for client files, and secure, locked storage for any physical records. No system is completely secure, though. For online sessions, please join from a private space.

How long I keep it

I keep client records securely for 7 years after our last session, as Victorian health records law requires, and then destroy them securely. I keep mailing-list details until you unsubscribe.

If there is a data breach

If your information is involved in a data breach that is likely to cause you serious harm, I will tell you and the Office of the Australian Information Commissioner (OAIC), as the Notifiable Data Breaches scheme requires.

Seeing or correcting your information

You can ask to see or correct the information I hold about you by emailing info@fossickpoint.com.au. I may need to confirm your identity first. I'll respond within a reasonable time and let you know if any costs apply. If I can't give you access to something, I'll explain why.

Questions and complaints

If you have a concern about how I've handled your information, please contact me first so I can put it right. I'll acknowledge your complaint and respond within 30 days.

If you're not satisfied with my response, you can contact:

the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au; or
for health information, the Victorian Health Complaints Commissioner at hcc.vic.gov.au.

Contact

Fossickpoint Email: info@fossickpoint.com.au Phone: 0417 003 505

Changes to this policy

I review this policy regularly. The current version is always on my website, and the date below shows when it last changed.

Version 2.0. Effective: 10/11/2026. Replaces Version 1.1 (11/01/2022).