Legal
Privacy Policy
This policy explains how we handle personal information, including the health information your practice records in PsychRooms. It applies to the PsychRooms platform and this website.
1. Who we are
PsychRooms is operated by Change Your Mind Psychology Pty Ltd ("we", "us", "PsychRooms"), of Altona Meadows, Victoria, Australia. We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
PsychRooms is practice management software used by registered and provisional psychologists. In most cases we act as a service provider to your practice: your practice is the entity that holds the clinical relationship with its clients, and we process client information on your practice's behalf and under your practice's instructions.
2. Information we collect
2.1 Practitioner and practice information
- Name, email address, phone number and postal address
- AHPRA registration number, registration type and endorsements
- Medicare provider number and banking details used for claiming
- Supervision relationships, logbook entries and professional development records
- Billing and subscription records
- Account security data, including authentication settings
2.2 Client information entered by your practice
Your practice enters information about its clients, which is sensitive information and health information under the Privacy Act. This may include name and contact details, date of birth, Medicare and health fund details, referral information, appointment records, clinical notes, psychometric assessment responses and scores, treatment plans, and correspondence.
2.3 Technical information
We collect IP address, browser and device type, pages visited and timestamps, and audit records of actions taken in the system. We use Vercel Analytics on this marketing website, which does not use cookies to track individuals across sites.
3. How we use information
- To provide, maintain and secure the PsychRooms platform
- To process Medicare and patient claims you submit
- To generate AI-assisted drafts at your request (see section 5)
- To maintain audit trails required for clinical and medicolegal record-keeping
- To bill you and administer your subscription
- To provide support and communicate about the service
- To meet our legal obligations
We do not sell personal information. We do not use client clinical information for advertising.
4. Where your data is stored
All clinical and practice data is stored on Australian infrastructure in the Sydney region, hosted on Supabase. Data is encrypted in transit (TLS) and at rest.
5. Artificial intelligence
PsychRooms offers AI-assisted drafting of clinical notes, letters, treatment plans and psychometric interpretation narratives. This processing runs in Sydney, Australia — currently on AWS Bedrock (ap-southeast-2), with voice transcription on Deepgram's Australian endpoint.
- Identifying details are stripped from clinical text in code before it is sent to an AI model
- Client data processed for AI drafting is not transferred outside Australia
- Clinical text is never used to train AI models; our clinical AI providers are used under terms that exclude customer data from model training
- AI output is presented as a draft only. It does not enter the clinical record until the treating practitioner reviews, edits and signs it
- The treating practitioner remains professionally responsible for the accuracy and clinical appropriateness of every record
6. Disclosure
We disclose personal information only:
- To Services Australia, where you submit a Medicare or patient claim
- To sub-processors that operate the platform, under contractual confidentiality and security obligations
- Where required or authorised by Australian law, including a court order or subpoena
- Where there is a serious and imminent threat to the life, health or safety of any individual
- With your consent
6.1 Sub-processors
| Provider | Purpose | Data location |
|---|---|---|
| Supabase | Database, authentication, file storage | Sydney, Australia |
| Amazon Web Services (Bedrock) | AI-assisted clinical drafting | Sydney, Australia (ap-southeast-2) |
| Google Cloud (Vertex AI) | Administrative AI features only — no clinical text | australia-southeast1 (Sydney) |
| Vercel | Application and website hosting | Global edge network |
| Google Workspace (Meet) | Telehealth video, where enabled by your practice | Google global infrastructure |
| Deepgram | Voice transcription for session notes, where enabled by the practitioner | Australian endpoint |
| GoFax | SMS reminders and confirmations | Australia |
| Postmark | Transactional email — reminders, receipts and secure-message notifications | United States (no clinical records) |
| Stripe | Card-on-file capture and charging, where enabled by your practice | United States (card details only) |
| Tyro Health | Medicare and funder claim lodgement, once live | Australia |
Telehealth video. Where your practice enables Google Meet telehealth, the video stream is carried by Google's infrastructure, which may include servers outside Australia. PsychRooms does not record or store the video stream. Notes and records created after the session are stored in Australia as normal. If your practice requires fully Australian-hosted video, use a dedicated compliant telehealth platform alongside PsychRooms.
7. Retention and deletion
- On cancellation, we will provide an export of your records on request within 30 days; logbook and supervision records can be exported as PDF at any time
- Clinical records are then retained in line with AHPRA requirements and the health records legislation applying to your practice
- We do not charge for access to your own records during the applicable retention period
- After the applicable retention period expires, data is securely destroyed
Retention periods for health records vary between States and Territories and by client age at the time of the record. Your practice remains responsible for meeting the retention obligations that apply to it.
8. Accessing and correcting your information
You may request access to, or correction of, personal information we hold about you by contacting us. We will respond within a reasonable period, ordinarily 30 days. Where a request concerns a client of your practice, we will direct it to your practice, which holds the clinical relationship.
9. Data breaches
Where a breach is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.
10. Complaints
If you believe we have mishandled your personal information, contact us first at brett@cymp.com.au. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.
11. Changes to this policy
We may update this policy from time to time. Material changes will be notified in-app or by email before they take effect. The "last updated" date above always reflects the current version.
12. Contact
Privacy Officer, Change Your Mind Psychology Pty Ltd
Altona Meadows, Victoria, Australia
brett@cymp.com.au