Privacy Policy

Effective date: 6 July 2026 · Version 1.0

1. What We Collect

We collect information you provide directly:

Account information: name, email address, role, and organisation affiliation.
Assessment responses: answers to psychological instruments, demographics, and session metadata.
Clinical data: safety flag events and crisis screening results (CSSRS).
Usage data: IP address, browser type, and interaction logs for security and auditing.

2. How We Use It

Generate assessment reports and scoring results.
Maintain audit logs for clinical governance.
Improve the Service and ensure security.
Comply with legal obligations.

3. Where We Store It

All data is stored in Supabase infrastructure located in Sydney, Australia. Data is encrypted at rest and in transit (TLS 1.3). We do not transfer data outside Australia except as required by law.

4. Who We Share It With

We do not sell or share personal information with third parties, except:

With your explicit consent (e.g., sharing a report with a treating clinician).
To comply with a court order or lawful request.
To service providers who assist in operating the Service (under data processing agreements).

5. Your Rights

Under the Australian Privacy Act 1988 (Cth), you have the right to:

Access the personal information we hold about you.
Request correction of inaccurate information.
Request deletion of your data (right to erasure).
Complain to the Office of the Australian Information Commissioner.

6. Cookies

We use essential cookies to maintain your session. We do not use advertising or tracking cookies. See our Cookie Policy for details.

7. Children’s Privacy

Participants under 18 must have consent provided by a parent or legal guardian. We do not knowingly collect data from children without appropriate consent.

8. Data Retention

Assessment data is retained for 7 years in line with clinical record requirements. You may request deletion at any time; see our data retention policy for details.

9. Contact

Privacy enquiries: privacy@novadiem.org.