Privacy Statement and Privacy Policy

This Privacy Statement and Privacy Policy is applicable in Australia and sets out the privacy personal information policy of A.C.N. 677 123 134 Pty Ltd (ACN 677 123 134) t/as ClinicianX ABN 52 677 123 134 and its associated, subsidiary and parent companies, divisions, successors and assigns that conduct business in Australia (all of which are referred to in this document as “ClinicianX”).

Privacy Laws

ClinicianX is committed to complying with the Privacy Act 1988 (Cth) (“the Act”) and the Australian Privacy Principles (“the APPs”) as amended from time to time. In this document, these statutes and codes are collectively referred to as “the Privacy Laws”.

Our Privacy Statement – We respect your privacy

ClinicianX is committed to your privacy. Our policy on handling Personal Information (any information that identifies you or could reasonably identify you) is to comply with the Privacy Laws as amended from time to time for the fair handling of Personal Information. Our Privacy Policy is outlined in this document and you can obtain a copy of it on our website at www.clinicianx.com.au.

We may collect types of Personal Information from you during our relationship and we will advise you of this (and other matters about the collection of Personal Information) before, at or as soon as possible after the time of collection. We use the Personal Information collected for several purposes, including:

1. Providing you with our products and services and/or information about our products and services;
2. Assessing applications for access to products and services.
3. Administering our business activities;
4. Communicating with you by telephone, email, SMS or mail;
5. Managing, researching and developing our products and services;
6. Managing, servicing and reviewing accounts, including overdue accounts;
7. Managing records of past payments made to ClinicianX, if any (see Payment Information below);
8. Investigating any complaints; and
9. Insurance and debt collection purposes.

You have a right not to provide information that can identify you. However, if all or part of the Personal Information that we request from you is not provided, then we may not be able to do certain things (including supply you with our services).

In accordance with the Privacy Laws and ClinicianX’s Privacy Policy, you will be given access to your Personal Information on request. If you have any questions or concerns about our Privacy Policy, the types of Personal Information we may hold about you, or for corrections or complaints about a breach of your privacy, please direct your requests to our email [email protected].

Our Privacy Policy - Collection of your Personal Information

ClinicianX is committed to the protection of your Personal Information. Personal Information is any information or an opinion about an identified individual or an individual who is reasonably identifiable. We may collect types of Personal Information from you throughout our relationship and we will advise you of this (and other matters about the collection of Personal Information) before, at or as soon as possible after the time of collection.

We may collect the following types of information:

1. Personal Information: Information you provide when signing up, such as your name, email address, and professional credentials.
2. Profile Information: Details provided for your profile, including years of experience, specialties, service locations, capacity, availability, professional registration number, registered profession, verification status and verification dates.
3. Client and Referrer Enquiry Information: Information submitted through the Find an OT service, which may include a name, email address, telephone number, postcode, role, relationship to the person seeking support, preferred contact method, selected Occupational Therapist, and reason for the referral or support request.
4. Payment Information: No ClinicianX subscription or supervisor match fees. If you made a subscription payment to ClinicianX in the past, we keep the related billing details and transaction history. That payment processing was handled by Stripe, and we do not store your payment card or bank account details. Professional supervision fees are arranged directly with the independent supervisor.
5. Usage Data: Information about how you use the platform, such as the pages you visit, searches you make in our directories, profile updates you make, enquiries you receive, and when you sign in.
6. How you found us: When you create an account or submit a clinician network form, we record the website or link that brought you to ClinicianX (for example a search engine, a social media post or an email campaign), the campaign tags in that link, and the first ClinicianX page you visited. We also record the answer you give to “How did you hear about us?”.
7. Communication Data: Enquiries and messages exchanged between clients, referrers, Occupational Therapists, and supervisors through the platform, including connection and match status information.
8. Supervision Session Records: De-identified session details, clinical reasoning, learning, reflections, agreed actions, resources, competency areas, and CPD information saved by matched clinicians. Drafts remain visible only to their author. Shared records and shared comments are visible to both participants in the confirmed supervision match. Private participant notes are visible only to the participant who created them.

For supervisor profiles, ClinicianX may check registration details against the public AHPRA register. A registration number is displayed publicly only after ClinicianX has completed its manual check and the supervisor has consented to public display. Internal reviewer identities, verification notes, correction reasons and verification history are not displayed on public profiles.

The specific types of Personal Information that we collect from you and how we collect that information will depend on the services you require from us and how you interact with us. ClinicianX usually collects Personal Information directly from the individual concerned. Where this is not practical, ClinicianX will take reasonable steps to ensure that the individual is informed about the collection unless the individual has previously consented to the collection (either expressly or impliedly).

When you sign up to our website, we will ask you details about yourself. That information assists us in making decisions about our intended relationship with you, the terms of that relationship and how you use and interact with our platform. You have a right not to provide information that can identify you. However, if all or part of the Personal Information that we request from you is not provided, then we may not be able to do certain things (including supply you with our services).

At the time of collecting Personal Information about an individual, or as soon as practicable after that time, ClinicianX takes reasonable steps to ensure the individual is aware of:

1. The identity and contact details of ClinicianX and ClinicianX’s Privacy Officer;
2. The purposes for which the information is being collected;
3. Any organisations to which ClinicianX may disclose the information to;
4. The fact that an individual has a right to gain access to the personal information collected; and
5. The main consequences (if any) for the individual if all or part of the information is not provided.

A Find an OT enquiry may include health, disability, or other sensitive information if you choose to include it in the reason for referral or support request. Only provide information reasonably necessary for the selected Occupational Therapist to understand and respond to the enquiry. By intentionally providing sensitive information, you consent to ClinicianX collecting, storing, using, and disclosing it to the selected Occupational Therapist for that purpose.

If you submit information about another person, you must have authority and any consent required to do so. Do not include emergency information or unnecessary identifiers. ClinicianX is not an emergency service or a clinical record system.

Exceptions to this include:

1. Where you have given express consent to ClinicianX to do so.
2. Where there are reasonable grounds to believe that disclosure is necessary to prevent a threat to life or health;
3. The use is authorised by law or reasonably necessary to enforce the law; or when the information is necessary for the establishment, exercise or defence of a legal claim.

If we receive Personal Information which we did not solicit, we will determine as quickly as possible whether or not that Personal Information could have been lawfully collected by us in accordance with the Privacy Laws and ClinicianX’s Privacy Policy. If so, we will only use the unsolicited Personal Information as if that information had been solicited by ClinicianX (that is, lawfully and fairly in accordance with the Privacy Laws and our Privacy Policy). If not, we will take reasonable steps to de-identify or destroy the information.

When you use ClinicianX’s website at www.clinicianx.com.au, our hosting and network providers (Amazon Web Services and Cloudflare) keep technical records of each visit, such as your IP address, the date and time, the pages requested, the referring website and your browser type. We use these records to run and secure the website and to produce visitor statistics. Browsing before you create an account is not linked to you in these records. The details of how you found us are saved with your account when you sign up (see “How you found us” above), and our analytics can link your earlier visits in the same browser to your account once you sign in (see Analytics below). Activity while you are signed in is recorded against your account.

In the unlikely event of an investigation, a law enforcement agency or other government agency may exercise its legal authority to inspect our business records or ISP’s logs. It is also possible that your ISP is logging your activity while you visit our site. This is beyond the control of ClinicianX.

Our website uses cookies and similar browser storage to keep you signed in, remember your choices, keep the website secure, and, as described under Analytics below, measure how the website is used. We do not use advertising cookies or advertising tracking pixels, and we do not allow advertising networks to track you on our website.

In some circumstances, ClinicianX will provide you with an option of not identifying yourself, or of using a pseudonym, when dealing with us (unless ClinicianX is required or authorised by Australian law or a Court/Tribunal order to deal with individuals who have identified themselves, or where it is impracticable to do so).

Our Privacy Policy - How we use and disclose personal information

The Personal Information that you provide to us is used for several primary purposes. These purposes include:

1. To provide products and/or services to you and to send communications to you;
2. To answer enquiries and provide information or advice about existing and new products or services;
3. Facilitate and track enquiries and connections between clients, referrers, independent Occupational Therapists, and supervisors.
4. Send Find an OT enquiry information to the selected Occupational Therapist so they can respond, assess capacity, and decide whether to accept the referral.
5. Keep records of, and respond to questions about, past payments made to ClinicianX.
6. Improve the functionality and user experience of the platform.
7. Ensure compliance with our Terms and Conditions.
8. To advise you if we relocate;
9. To advise you if the Privacy Policy has been updated or amended;
10. To assess the performance of the Website and to improve the operation of the Website;
11. To assess our customer service and to improve our customer service to you;
12. To conduct business processing functions, including providing personal information to our related bodies corporate, contractors, service providers or other third parties;
13. Insurance and debt collection purposes.
14. For the administrative, marketing (including direct marketing and marketing research), planning, product or service development, quality control, human resources, educational and research purposes of ClinicianX, its related bodies corporate, contractors or service providers;
15. To update our records and keep your contact details up to date;
16. To process and respond to any complaint or enquiry made by you;
17. To comply with any law, rule, regulation, lawful and binding determination, decision or direction of a regulator, or in cooperation with any governmental authority of any country.
18. ClinicianX may contact you regarding anything set out in the above by e-mail, post or telephone.

ClinicianX will not sell, rent or trade your Personal Information.

When ClinicianX sends an enquiry to the selected independent Occupational Therapist, that clinician is independently responsible for how they handle the information they receive and must comply with their own professional, confidentiality, and privacy obligations.

Any Personal Information which you do supply will only be used internally at ClinicianX and will not be divulged to a third party unless that third party is associated or integral to the purpose for which you gave us the information or where required by law. We will only use and disclose Personal Information about you for the purpose for which you gave us that information. We may use and disclose Personal Information about you for a purpose other than the purpose for which you gave us the information where:

1. That other purpose is related to the purpose for which you gave us the Personal Information;
2. You have given us your consent for the Personal Information to be used or disclosed for the additional purpose;
3. Where there are reasonable grounds to believe that use or disclosure is necessary to prevent a threat to life or health;
4. Where we suspect that unlawful activity is or has been engaged in and we use or disclose the Personal Information to investigate the suspected unlawful activity;
5. The use or disclosure is authorised by law or reasonably necessary to enforce the law.

During the ordinary course of business, ClinicianX may disclose your Personal Information as required by law or to third parties related to your services, including:

1. Government departments such as courts, tribunals and regulatory authorities as permitted by law;
2. If necessary, our professional advisors including risk insurers, solicitors and financial advisors; and
3. Anyone else to whom you consent.

ClinicianX may also disclose your personal information to organisations involved in a transfer or sale of all or part of our business or its assets or one involved in managing our corporate risk and funding requirements.

Our Privacy Policy - Service providers and where your information is held

ClinicianX uses the following service providers to operate the platform. They handle Personal Information on our behalf only as needed to provide their service to us:

1. Amazon Web Services: hosting the platform and its database, keeping encrypted backups, sending account and service emails (Amazon Simple Email Service) and storing files you upload, such as profile photos (Amazon S3). This information is held in the AWS Sydney region in Australia.
2. Cloudflare: delivering the website securely and protecting it from attacks and misuse. Cloudflare processes your IP address, browser details and the pages you request, and operates a global network, including in the United States.
3. Brevo: sending ClinicianX follow-up and update emails to members and managing email preferences and unsubscribes. When we use Brevo for your account, we share, after you verify your email, your first name, email address, an internal account reference and account details such as your chosen pathways, profile status and whether you agreed to receive updates. Brevo tells us whether our emails were delivered, opened or clicked. We never share payment details, registration numbers, messages, enquiries or clinical information with Brevo. Brevo is based in the European Union and may store this information there.
4. PostHog: analytics, as described under “Analytics” below. PostHog stores this information in the European Union.
5. Stripe: processing of past subscription payments made to ClinicianX, if any. Stripe holds your billing details together with an internal account reference so payments can be matched to your account. No ClinicianX subscription or supervisor match fees. Stripe may store this information in the United States.
6. Google Fonts: delivering the fonts used on our website. Your browser requests fonts directly from Google, which receives your IP address and browser information as part of that request.
7. Google Search Console: reports from Google about how our website appears in Google search, such as search terms and clicks. These reports are totals and do not identify you.

Our Privacy Policy - Disclosure of personal information overseas

Our platform, database and backups are held in Australia. Some of the service providers listed above store or process Personal Information outside Australia: Stripe, Google and Cloudflare in the United States (Cloudflare also through its global network), and Brevo and PostHog in the European Union. Before disclosing Personal Information to an overseas recipient, ClinicianX takes reasonable steps, in accordance with Australian Privacy Principle 8, to ensure the recipient does not breach the Australian Privacy Principles in relation to that information, including by relying on each provider’s data processing terms.

Our Privacy Policy - Access by ClinicianX administrators

Authorised ClinicianX administrators can access messages, supervision records and related account information when this is needed for safety, support, moderation, or to meet legal obligations. Access is limited to authorised personnel and is used only for those purposes.

Our Privacy Policy - Analytics

We use analytics to understand how ClinicianX is used and to improve it: for example, to find where people have trouble signing up, which pages and searches lead to supervision connections, where in Australia more supervisors are needed, and which marketing activities work. We use this information only to run and improve ClinicianX. We don’t sell it, and we don’t use it to target advertising at you.

PostHog. We use PostHog, an analytics service, which stores this information in the European Union under a data processing agreement with us.

What PostHog receives from your browser.

1. The pages you view, as page types (such as “a supervisor profile”) rather than full web addresses.
2. The buttons and links you click and the forms you submit, but never what you type.
3. How quickly pages load, and errors.
4. Heatmaps of where people click and scroll.
5. The website or campaign that brought you here, and basic device details such as your browser and screen size.

On public pages, while you’re not signed in, PostHog also makes session recordings: a replay of the page, mouse movements, scrolling and clicks, with everything typed into forms hidden. We never record messages, supervision records, Find an OT pages or enquiries, account settings, admin pages, or sign-in and password pages.

What PostHog receives about your account. If you sign in, PostHog links this information to your internal ClinicianX account number and to basic account details: your account type, whether you seek or offer supervision or OT referrals, your state, how you found us, and, if you apply to be a supervisor, your application status and a range for your years of supervising experience. We also send key account events, such as signing up, verifying your email, completing onboarding, a first message, and a confirmed match. When you view a supervisor profile, we record which profile it was, so we can see which profiles help people find a supervisor. PostHog never receives your name, email address, phone number, postcode, registration numbers, or the content of messages, supervision records or enquiries.

Find an OT enquiries. An enquiry can reveal information about someone’s health or disability, so enquiry content is never used for analytics. We only count enquiries, by the Australian state they came from, without linking them to anyone.

What we don’t do. We don’t use advertising tracking pixels. We never use analytics to target advertising at you, or to make automated decisions about individuals.

How long we keep it. PostHog keeps session recordings for up to 30 days and other analytics information for up to 12 months. When you delete your account, we ask PostHog to delete the analytics information linked to it, which PostHog completes within about a week. Records from our previous in-app analytics are deleted after 90 days.

Your choices. You can turn analytics off, or back on, at any time with the button on this page or in the analytics notice. We also turn it off automatically if your browser sends a Global Privacy Control or Do Not Track signal. When analytics is off, nothing about your visits is sent to PostHog, apart from a few account events that happen on our side, such as your supervisor application being approved. You can also email [email protected] to ask what analytics information we hold about you, or to have your account excluded from analytics entirely. This doesn’t affect how the platform works for you.

Our Privacy Policy - Direct marketing

ClinicianX sends marketing emails, such as news about ClinicianX features and opportunities, only to people who have agreed to receive them, for example by ticking the updates option in your account. Every marketing email includes a way to unsubscribe, and we act on unsubscribe requests within 5 business days. You can also change your email preferences in your account or contact us. Service emails about your account, messages, matches or enquiries are sent whether or not you receive marketing emails.

Our Privacy Policy - Automated decisions

Some steps on the platform are automated. When you apply to be listed as a supervisor, the platform checks the answers you give about your registration, experience and supervision background against our published eligibility criteria, and you cannot submit an application until those criteria are met. Approval of supervisor applications and checks of registration details are made by a person at ClinicianX. Supervisor directory listings are ordered automatically using profile information: how many of your chosen filters a profile matches, how close it is to a location you search for, and how many matches the supervisor has made through ClinicianX. You can also choose to sort by fee or number of matches. Analytics information is not used to make automated decisions about individuals.

Our Privacy Policy - Security of your personal information

ClinicianX will take all reasonable steps to ensure that all Personal Information we collect, use or disclose is stored electronically in a secure environment accessed only by authorised persons. ClinicianX will take reasonable steps to protect any Personal Information that it holds from misuse, loss, unauthorised access, modification or disclosure, and to destroy or permanently de-identify Personal Information if it is no longer needed for any purpose. ClinicianX discloses Personal Information to comply with this Privacy Statement and Privacy Policy and to comply with the APPs.

ClinicianX has security measures designed to protect against the loss, misuse and/or alteration of the information under its control, including restricted access, firewalls and encryption.

You should be aware that there is a residual risk in transmitting any data electronically. This risk is inherent in any internet dealings.

Enquiry, connection, and supervision session records are retained only for as long as reasonably necessary to deliver and manage the service, maintain required business and legal records, resolve disputes, and protect platform integrity. When information is no longer required, ClinicianX will take reasonable steps to destroy or de-identify it.

Supervision session records are shared between the supervisor and the supervisee. If you delete your account, shared records you took part in are kept for the other person, because they may rely on them as evidence of supervision and continuing professional development. Your name, contact details and profile are removed from your account, and you are shown on those records as a former ClinicianX member. Your private reflections, preparation notes and questions are deleted. Your shared comments, your confirmations, and the text written in the shared record itself are kept as part of the agreed record.

Once your account is deleted, you can no longer access these records, and they cannot be restored to you, including if you create a new account. You can download a copy of your supervision records at any time from your supervision page, and you are asked to do so before deleting your account.

Our Privacy Policy - How to access, correct or update your information

We require accurate personal information about you to ensure you receive the best possible service from ClinicianX.

You will be able to access personal information that ClinicianX holds about you if it can be readily retrieved, subject to some exceptions allowed by law. Where we hold information that you are entitled to access, we will try to provide you with a suitable means of accessing it (for example, by mailing or emailing it to you).

To request access to your personal information, please contact ClinicianX in writing. There may be instances where we cannot grant you access to the personal information we hold. For example, we may need to refuse access if granting access would interfere with the privacy of others or if it would result in a breach of confidentiality. In these instances, we will provide written reasons for any refusal.

Our Privacy Policy - Complaints

ClinicianX takes your complaints seriously. If you believe that ClinicianX has not dealt with your Personal Information in a manner that complies with the Privacy Laws as amended from time to time, please contact us via email [email protected]. You must submit your complaint in writing. ClinicianX will use its best endeavours to provide a response in writing within a timely manner, and to correct any Personal Information and notify any other entity required with updated information.

ClinicianX has detailed procedures for dealing with Privacy Law breaches. If you are dissatisfied with the outcome of your complaint, or if ClinicianX refuses to provide access to, or correction of, your Personal Information, you may complain to the Office of the Australian Information Commissioner at www.oaic.gov.au.

Our Privacy Policy - Transparency

This Privacy Statement and Privacy Policy is available on ClinicianX’s website at www.clinicianx.com.au and will be made available free of charge to anyone who requests a copy. This Privacy Statement and Privacy Policy may be reviewed and amended from time to time, and any updated version will be made available on ClinicianX’s website or on request and will apply from the date the updated version is published or provided.

Our Privacy Policy - How to contact us

You can contact ClinicianX via email [email protected].