Legal
Security
PsychRooms holds sensitive health information. This page describes the controls protecting it, and what your practice is responsible for.
Data residency
All clinical and practice data is stored in the Sydney region on Supabase infrastructure. Clinical AI processing runs in Australia — currently AWS Bedrock in ap-southeast-2 (Sydney), with voice transcription on Deepgram's Australian endpoint — and the region is enforced in code. Clinical records are not transferred to overseas processors. Transactional email (Postmark, United States) and card-on-file processing (Stripe, United States) are the only overseas sub-processors; neither holds clinical records. The full list is in the Privacy Policy.
The single exception is telehealth video, where your practice enables Google Meet: the video stream is carried by Google's global infrastructure. PsychRooms does not record or store it. See the Privacy Policy for detail.
Encryption
- All traffic is encrypted in transit using TLS
- Data is encrypted at rest
- HTTP Strict Transport Security is enforced across our domains
Access control
PsychRooms enforces row-level security at the database layer, not only in the application. Every clinical and financial query is scoped to the authenticated user's organisation and role, so an application-layer flaw cannot by itself expose another practice's records.
Role-based access control covers owner, admin, practice manager, clinical director, finance, reception, psychologist and provisional psychologist, each with access appropriate to the role.
Authentication
- Accounts authenticate with email and password over an encrypted connection
- Sessions expire after a period of inactivity
- Multi-factor authentication is in active development and is not yet available. The design enforces TOTP for elevated roles (owner, admin, clinical director) and offers it to all accounts
Clinical record integrity
Signed session notes are immutable — they cannot be edited or deleted after signing. Corrections are made by timestamped addendum, preserving the original record. Actions across the platform are recorded in an audit trail attributable to an identified user.
AI safeguards
- AI processing is confined to Australian regions (Sydney), enforced in code and checked in our build pipeline
- Identifying details are stripped from clinical text in code before it reaches any AI model
- Clinical text is never used to train AI models. Our clinical AI providers (AWS Bedrock, Deepgram) are used under terms that exclude customer data from model training
- AI output is a draft; it enters the clinical record only when a practitioner reviews, edits and signs it
- PsychRooms never auto-commits AI content to a client record
Backups and continuity
Databases are backed up daily. Backups are held in the same Australian region as the primary data.
Reporting a vulnerability
If you believe you have found a security vulnerability in PsychRooms, email brett@cymp.com.au with the detail needed to reproduce it. Please give us a reasonable opportunity to investigate and remediate before public disclosure. We will acknowledge your report and keep you informed of progress. We will not pursue action against researchers who report in good faith, act only against their own account or test data, and avoid privacy violations, service degradation and data destruction.
Incident response
Where an incident is likely to result in serious harm, we notify affected practices and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.
Your responsibilities
Security is shared. Your practice should enable MFA for every user once it is released, review role assignments when staff join or leave, use unique passwords, keep devices patched and locked, and export records periodically to hold an independent copy.
Contact
Change Your Mind Psychology Pty Ltd
Altona Meadows, Victoria, Australia
brett@cymp.com.au