Privacy Policy

Last updated: 2 October 2026

Grief Connect® supports people through grief and loss. What you share with us is often deeply personal, and we treat it with the care it deserves. This policy explains what personal information we collect, why we collect it, how we look after it, and what you can do if you have a question or a concern.

Grief Connect is operated by the Moriarty Trading Trust, ABN 42 252 405 258, PO Box 213, Brunswick WA 6224. In this policy, “we”, “us” and “our” mean Grief Connect.

We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles. As a provider of counselling and social work services, we also follow the Australian Association of Social Workers Code of Ethics and the Western Australian Code of Conduct for unregistered health care workers.

The information we collect

Depending on how you work with us, we may collect:

• Contact and identity details, such as your name, date of birth, email address, phone number and postal address, and where relevant your Medicare number or the details of your GP or an emergency contact.
• Information about your grief, health and wellbeing, including what you share when you enquire, book or attend a session. The law treats this as sensitive information and gives it extra protection.
• Counselling and case records, which Michelle keeps as a practising social worker.
• NDIS details, if you are an NDIS participant, such as your plan, your plan manager and information about your disability and support needs.
• Employer details, if you come to us through an Employee Assistance Program (EAP).
• Booking and payment information. Card payments are processed by our payment providers. Your full card number is not stored on our website.
• Order and delivery details when you buy from our shop.
• Community information if you join the Grief Connect® Community, including your profile and anything you post.
• Training and event details, such as the names and email addresses of attendees, and recordings where you have agreed to be recorded.
• Website usage information, such as the pages you visit and the device you use. See “Our website and analytics” below.

How we collect it

Most information comes straight from you: through the forms on our website, when you book through our booking system, when you email or call us, during sessions, and when you buy something or join the community.

Sometimes it comes from someone else, with your knowledge. For example, an employer may refer you through an EAP, or a plan manager or support coordinator may contact us about NDIS support. If we receive information about you from someone else, we will let you know.

You can make a general enquiry without giving your real name. We cannot provide counselling, NDIS or EAP services anonymously, because we need to know who we are working with and keep proper records.

Why we collect it

We collect, use and share personal information to:

• respond to your enquiry
• provide counselling, supervision, NDIS and EAP services, and keep the records a social worker must keep
• manage bookings, payments and invoices
• claim or invoice NDIS supports through your plan manager, where that applies
• deliver shop orders
• run the Grief Connect® Community
• deliver workplace training, keynotes and webinars
• send our newsletter, but only if you have asked for it
• improve our website and services
• meet our legal and professional obligations

We only use your information for the reason you gave it to us, for a closely related purpose you would reasonably expect, or with your consent. We never sell your personal information.

Sensitive information

We only collect information about your health and grief with your consent, and only where we need it to support you. Sharing that information with us, for example in an enquiry or a session, is how you give that consent. We will never use it to market to you unless you have clearly agreed.

Who we share it with

We share personal information only as far as we need to, with:

• Services that run our practice, including our booking and clinical records system (Halaxy), our website host, our email provider (Microsoft), our payment processor (Stripe), our online community platform (Circle), our video platforms (Halaxy telehealth and Zoom), our newsletter platforms (Mailchimp and MailerLite) and our event ticketing platform (Humanitix).
• People who help us run the business, such as our website and marketing contractor and our bookkeeper or accountant, who may be able to see some information in the course of their work and who are bound by confidentiality.
• Your plan manager or support coordinator, if you receive NDIS-funded support and it is needed for your plan.
• Your employer, for EAP services, but only the administrative details needed to arrange and invoice the sessions, such as confirming that a session took place. We do not share what you discuss without your written consent.
• Delivery services, to send your order.

Members of the Grief Connect® Community can see what you post there. Please think about what you share in a group space.

When we may share information without your consent

Confidentiality is at the heart of what we do. There are rare situations where the law allows or requires us to share information without your consent, for example:

• where we reasonably believe it is necessary to lessen or prevent a serious threat to someone’s life, health or safety
• where the law requires it, such as a court order or subpoena
• to a professional supervisor, to support safe practice, in a way that protects your identity wherever possible

If this ever happens, we share only what is necessary. Where it is safe and appropriate, we will talk with you about it first.

Information stored overseas

Some of the services we use store or process information outside Australia. Our clinical records system (Halaxy) and our website are hosted in Australia. The following services may hold information overseas:

• Circle, our community platform, in the United States
• Stripe, our payment processor, in the United States, India and other countries
• Zoom, for webinars and any sessions held on it, in the United States
• Google, for website analytics, in the United States and other countries
• Mailchimp, in the United States and other countries
• MailerLite, in the European Union
• Meta, for our Facebook support groups, in the United States, Ireland, Denmark and Sweden

Halaxy may also use service providers located overseas. We choose established providers with published privacy and security commitments.

Our website and analytics

Our website uses Google Analytics and Google Tag Manager to understand how visitors use the site: which pages are viewed, how people arrive, and whether forms and links work. This uses cookies and similar technology. We set it up so that it does not collect your name, email address, phone number or anything you type into our forms, and we do not use it for advertising.

You can block or delete cookies in your browser settings, or install Google’s opt-out add-on at tools.google.com/dlpage/gaoptout.

Our online shop records how you found us, such as a search engine or a link in a newsletter, with each order.

Our Facebook support groups are run on Facebook and are covered by Meta’s own privacy policy as well as this one.

Our newsletter

We only add you to our newsletter if you tick the box to sign up. Every newsletter has an unsubscribe link, and you can also ask us to remove you at any time. We act on unsubscribe requests within five business days.

Keeping your information secure

We take reasonable steps to protect your information from misuse, loss, and unauthorised access, change or disclosure. These include secure, access-controlled systems, limiting who can see client records, and using established providers for bookings, payments and email.

If a data breach is likely to cause you serious harm, we will tell you and the Office of the Australian Information Commissioner, as the law requires.

How long we keep it

We keep counselling and case records for as long as our professional and legal obligations require. We keep business and financial records for the period tax law requires. When we no longer need information, we securely delete or de-identify it.

Seeing and correcting your information

You can ask to see the personal information we hold about you, and ask us to correct it if it is wrong, out of date or incomplete. Email us at michelle@griefconnect.com.au and we will respond within 30 days. We will need to confirm your identity first. We do not charge for making a request.

In a small number of cases the law allows us to decline, for example where giving access would pose a serious threat to someone’s safety. If we decline, we will tell you why in writing and how you can complain.

Questions and complaints

If you have a question about privacy, or you think we have mishandled your information, please contact us first:

• Email: michelle@griefconnect.com.au
• Post: PO Box 213, Brunswick WA 6224

We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days.

If you are not satisfied with our response, you can contact:

• The Office of the Australian Information Commissioner (OAIC), for privacy complaints: oaic.gov.au, 1300 363 992.
• The Health and Disability Services Complaints Office (HaDSCO), Western Australia, for complaints about a health service: hadsco.wa.gov.au, 1800 813 583.
• The NDIS Quality and Safeguards Commission, if you are an NDIS participant: ndiscommission.gov.au, 1800 035 544.

Children and young people

Our services are designed for adults. Our community and support groups are for people aged 18 and over.

Changes to this policy

We may update this policy from time to time. The current version is always on this page, with the date it was last updated.