Security & Privacy

This page is our privacy policy. No hidden data collection, no surprises. If anything changes, we'll update this page and let you know.

Forms capture what clinicians need for assessment. Patients aren't required to provide full legal names — initials or preferred names work fine for clinical purposes.

Forms ask only for information needed to complete the assessment. No unnecessary fields, no data harvesting.

If someone sends us information we didn't ask for, we assess whether we're allowed to keep it. If not, we delete it securely.

Each form clearly shows what information is being collected and for what purpose. Consent is captured before submission.

Assessment data goes to the clinician who requested it. We don't sell it, share it with marketers, or use it for anything other than delivering your service.

Patient information is never used for marketing. Clinicians may receive product updates, with a clear unsubscribe option in every email.

All clinical data is stored on servers in Sydney, Australia. Where ancillary data is processed overseas (authentication, payments), we ensure comparable privacy protections are in place.

We generate our own internal identifiers. Medicare numbers, driver's licences, and other government IDs are never adopted as account or patient identifiers.

Form responses are timestamped and stored exactly as submitted. This maintains clinical integrity and supports audit requirements.

Bank-level encryption, strict access controls, and continuous monitoring. Healthcare record retention follows jurisdictional requirements — Australia: adult records kept 7 years, children's until age 25. New Zealand: health records kept 10 years from last entry.

Want to see what we hold? Need something removed? Just ask. We honour requests promptly, subject to healthcare retention requirements.

Clinicians can edit patient contact details directly in the dashboard.

We only collect health information for a lawful purpose connected to clinical assessment — directly related to the practitioner-client relationship.

Health information is collected directly from the individual (or their parent/guardian for children), through assessment forms they complete themselves.

Each form clearly explains who is collecting the information, why it's needed, and that it will be shared with their practitioner. Consent is captured before submission.

Our neurodivergent-friendly forms are designed to reduce anxiety. No deceptive practices, no hidden tracking — just straightforward clinical assessment.

All data is protected with AES-256 encryption, strict access controls, and continuous monitoring. Health records are retained for a minimum of 10 years as required by HIPC Rule 5.

Individuals have the right to request access to their health information held by us. We respond to access requests promptly.

Practitioners can correct patient contact details directly in the dashboard. Individuals may request corrections to their personal information at any time.

Form responses are timestamped and stored exactly as submitted. We take reasonable steps to ensure information is accurate before it is used.

Health information is retained for 10 years from the last entry (HIPC requirement). After that, it is securely destroyed unless ongoing retention is required by law.

Health information is used only for the clinical purpose for which it was collected. We never sell data, use it for marketing, or repurpose it without consent.

Assessment data is shared only with the requesting practitioner and authorised clinicians within the same practice. No third-party disclosure without consent.

Clinical data is stored in Australia (Sydney). Under Section 11 of the Privacy Act 2020, we ensure comparable protections are in place for any ancillary data processed overseas.

We generate our own internal identifiers. NHI numbers and other government identifiers are never adopted as account or patient identifiers.