Privacy Policy
Effective Date: 14 July 2024
1. Introduction
Welcome to TelepsychAI, a SAAS application designed for psychologists and their clients in Australia. We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy outlines how we collect, use, disclose, and safeguard your data.
2. Information We Collect
For Psychologists:
- Personal Information: Name, email address, AHPRA number, profile details (including address, fees, and cancellation policy), and photo profile.
- Professional Information: Practice details, appointment schedules, client notes, worksheets, and telehealth session details.
- Subscription Information: Payment details managed by Stripe.
For Clients:
- Personal Information: Name, email address, contact number, and address.
- Appointment Information: Location, date, time, and notes.
- Session Information: Notes and action items created during telehealth sessions.
- Emotional Recognition Data: Images captured during sessions. These images are not stored by us at all.
3. How We Use Your Information
- Account Creation and Management: To create and manage psychologist and client accounts.
- Service Delivery: To facilitate appointments, telehealth sessions, and worksheet management using AWS services.
- Subscription Management: To handle payments securely through Stripe.
- Improving Services: To enhance user experience and service functionality, including real-time emotion recognition.
Session Transcription and AI Review
For telehealth sessions where Session Review is available, the psychologist and client are asked separately for consent before transcription starts. Transcription starts only when both participants agree. If either participant declines, the video session can continue without transcription and no Session Review is generated.
For a consented session, Amazon Transcribe processes the session audio to create a timestamped transcript. TelepsychAI does not retain an audio recording for this feature. Amazon Bedrock processes the transcript to prepare an AI-generated review for the psychologist. These AWS services are configured to process Session Review data in the Sydney region, Australia (ap-southeast-2).
The transcript and review may contain sensitive health information. They are stored in AWS and encrypted at rest using AWS Key Management Service (KMS), and are transmitted through encrypted connections. Access is restricted to the authorised psychologist for that session; clients cannot access the psychologist's Session Review. The review is intended only as evidence-based material for the psychologist's reflection. It is not a diagnosis, treatment recommendation, psychologist score, or real-time coaching tool. Retention is covered by the Data Retention section of this policy.
4. Data Storage and Security
We employ industry-standard security measures to protect your personal information, ensuring its security both during transmission and while at rest. Our security practices include:
- Data Transmission: All data transmitted between the client and server is encrypted using HTTPS. We use secure authentication methods to protect user login and API requests.
- Client-Side Storage: We avoid storing sensitive information in localStorage or sessionStorage. Session tokens are stored using secure cookies with
HttpOnlyandSecureflags. - Server-Side Storage: Sensitive data is stored securely in our databases. We use environment variables to manage sensitive configuration data.
- Security Practices: We implement input validation and sanitization to prevent security vulnerabilities. Our dependencies are regularly updated to ensure the latest security patches are applied. We utilize Content Security Policy (CSP) to protect against injection attacks.
- Third-Party Services: We work with reputable third-party service providers, ensuring they comply with our strict data protection standards and industry best practices.
We are committed to continually assessing and improving our security measures to ensure the protection of your data.
5. Data Sharing and Disclosure
We do not sell or share your personal information with third parties except as necessary to provide our services, comply with legal obligations, or protect our rights. Information may be shared with:
- Service Providers: Such as AWS and Stripe, to facilitate the services we offer.
- Legal Authorities: If required by law or to protect our legal rights.
6. Data Retention
We retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy or as required by law. Psychologist and client information is stored securely and can be deleted upon request.
7. Your Rights
You have the right to:
- Access: Request access to your personal data.
- Correction: Request correction of any inaccuracies in your data.
- Deletion: Request deletion of your data.
- Objection: Object to the processing of your data under certain circumstances.
8. Data Security
We implement robust security measures to protect your personal information from unauthorized access, alteration, or disclosure. These measures include encryption, secure storage, and regular security assessments.
9. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. Any changes will be posted on this page, and we will notify you of significant changes via email or through the app.
10. Contact Us
If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at:
- Email: admin@telepsychai.com.au