Privacy Policy

Information We Collect

Account Information

When you create an account, we collect your name and email address, professional credentials and practice information, billing information (processed securely by our payment provider), and account preferences and settings.

Clinical Data (Health Information)

Through your use of our service, we process clinical data that you choose to enter or record, including session audio processed for transcription (not stored), transcriptions of sessions, clinical notes and documentation, client information that you input, and resources and materials you upload. This information constitutes "health information" under the Privacy Act 1988 and is afforded the highest level of protection.

Usage Information

We automatically collect certain information about your use of our service, including log data (IP address, browser type, access times), device information, feature usage patterns, and error logs and performance data.

Information About Minor Clients

When practitioners use InterSession for child, adolescent, or family therapy, we may process health information about minors (individuals under 18 years of age). This information is afforded the same protections as all health information processed through our platform.

Parental consent

Under Australian privacy law and OAIC guidance, children generally cannot consent to the collection of their health information on their own behalf. For clients under 15 years of age, parental or guardian consent is typically required. For clients aged 15-17, capacity to consent depends on their maturity and understanding. Practitioners are responsible for obtaining appropriate consent in accordance with their professional obligations.

Parent-facing features

InterSession includes features that generate summaries, growth tasks, and other materials intended to be shared with parents or guardians. Practitioners are responsible for determining when disclosure to parents is appropriate, taking into account the age and maturity of the child, the nature of the information, family dynamics and any safety concerns, mature minor considerations for older adolescents, and mandatory reporting obligations.

Data retention

Records relating to minor clients may be subject to longer retention requirements under state and territory health records legislation (typically until the child reaches 25 years of age). Practitioners are responsible for maintaining appropriate records to meet these obligations.

Mobile Application

InterSession offers a mobile application ("the App") on Android and iOS that gives clients direct access to information their practitioner has shared with them through the platform. Through the App, clients can view session and support summaries shared by their practitioner, growth tasks (with the ability to mark tasks complete), resources and materials, their daily mood check-in history and commentary, and personal reflections and diary entries. The App does not provide access to raw clinical notes; clients only see information their practitioner has explicitly published or shared.

Account and authentication

The App uses the same authentication infrastructure as the web platform. Clients sign in using a magic link or email one-time password (OTP). Authentication tokens are stored on the device using platform-native secure storage (Keychain on iOS, EncryptedSharedPreferences on Android). Onboarding state and non-sensitive preferences are stored in standard device storage. No passwords are stored on the device.

Voice reflections and microphone access

The App includes a voice reflection feature that allows clients to dictate diary entries using speech-to-text. Speech is processed on the device by the operating system’s built-in speech recognition (Apple Speech on iOS, Google Speech on Android); the App converts speech to text locally and displays it for the client to review and edit before submitting. Only the text transcript is sent to our servers - no audio recordings are created, stored, or transmitted from the App. The App will request microphone and speech recognition permissions before first use, and you can revoke these at any time in your device settings. The feature is optional.

Device permissions

The App requests microphone and speech recognition permissions (for voice reflections) and internet access (to communicate with our servers). The App does not request access to your camera, contacts, location, photos, or other device sensors.

Data stored on your device

The App stores a minimal amount of data on your device: authentication tokens in secure storage to keep you signed in, onboarding state and linked email in standard device storage, and a mood prompt timestamp. Clinical data is fetched from our servers each time you open the App and is not cached or stored offline on your device.

Analytics and tracking in the App

The App does not include any third-party analytics, tracking, or advertising SDKs. We do not collect device identifiers, advertising IDs, or usage analytics from the App.

Signing out and removing App data

When you sign out, your authentication tokens are removed from the device. Uninstalling the App removes all locally stored data. To delete your clinical data from our servers, follow the account closure process described in the Data Retention section.

Artificial Intelligence and Automated Processing

We use artificial intelligence to help generate clinical documentation, including transcripts, session notes, summaries, growth tasks and resources. This content is generated to assist the treating practitioner and is reviewed and approved by the practitioner before it is entered into a clinical record or shared with a client. A qualified health professional remains responsible for all clinical decisions. InterSession does not make clinical or treatment decisions, and does not use AI to make decisions that produce legal or similarly significant effects about an individual without human involvement.

We do not use your clinical data or health information to train our own or any third party's general artificial intelligence models. Our AI provider processes data through its API under terms that do not permit training on that data. If you would like more information about how AI is used in a particular feature, contact us at ops@intersession.io.

How We Use Your Information

We use the information we collect to provide, maintain and improve our services; process session recordings and generate clinical documentation; send you service-related communications; process payments and manage your subscription; respond to your inquiries and provide customer support; ensure the security and integrity of our platform; and comply with legal obligations.

What We Do NOT Do

We do not sell your data. We do not use clinical data to train AI models - your client data is processed only to provide services to you and is never used to improve our general AI capabilities. We do not share identifiable clinical data with third parties except as required to provide our services or as required by law.

Overseas Data Transfers

In accordance with APP 8 (Cross-border disclosure of personal information), we inform you that your personal information may be disclosed to service providers located in the following countries:

1. United States:
   1. Soniox (primary transcription),
   2. Deepgram (backup transcription),
   3. OpenAI (AI note generation)
2. Japan:
   • Resend (transactional email delivery)
3. Singapore:
   • Render (application hosting)

We take reasonable steps to ensure that overseas recipients handle your personal information in accordance with the Australian Privacy Principles, including by putting in place contractual obligations requiring APP-equivalent handling, security and purpose limitations. Under the Privacy Act, we generally remain accountable for how these overseas recipients handle your information. In relation to AI note generation, OpenAI processes data via its API under terms that do not permit training on your data; OpenAI may retain data for a limited period (up to approximately 30 days) for abuse-monitoring purposes before deletion.

Privacy and clinical documentation quality

Session transcription captures the content of the conversation as spoken, which may include personal identifiers mentioned during the session. This is necessary to produce accurate clinical documentation. We balance privacy protections with clinical utility: we do not seek to de-identify session transcripts in ways that would reduce the quality of your clinical records. Our privacy safeguards include:

1. storing primary records on servers in Australia;
2. not retaining audio after transcription;
3. obtaining explicit client consent;
4. limiting overseas processing to what is required to deliver the service;
5. and applying additional minimisation where it does not compromise documentation quality (for example, episode summaries exclude client names, and dates of birth are converted to age rather than transmitted directly).

When you use AI-assisted features, session content (including transcripts and clinical notes) may be sent to our AI provider in the United States to generate documentation. Audio sent for transcription may be processed by Soniox and, when required for availability or capacity, Deepgram as a backup provider; both process transcription data in the United States. Audio is processed transiently and is not stored by InterSession after transcription. Your primary data (clinical records, client information) is stored on servers located in Australia.

Data Security

We implement strong security measures to protect your information, including AES-256 encryption for all stored data, TLS 1.3 encryption for all data in transit, primary data hosted on servers in Sydney, Australia, row-level security policies to isolate clinician data, secure authentication, non-storage of session audio after transcription, and platform-native secure storage of mobile authentication tokens.

Our infrastructure is built on enterprise-grade platforms (Supabase for database, Render for application hosting) that maintain SOC 2 Type II certification and undergo regular independent security audits. While InterSession itself has not undergone independent security certification, we inherit the security controls and compliance of these certified infrastructure providers.

Data Breach Notification

In accordance with the Notifiable Data Breaches (NDB) scheme under the Privacy Act 1988, we will notify the Office of the Australian Information Commissioner (OAIC) and affected individuals of eligible data breaches as soon as practicable after becoming aware of the breach, and in any event as required by law. An eligible data breach occurs when there is unauthorised access to, or disclosure of, personal information held by us and the breach is likely to result in serious harm to any of the individuals to whom the information relates. Our breach notification will include the nature of the breach, the types of information involved, and recommendations for steps individuals can take to protect themselves. We maintain incident response procedures to ensure timely detection, containment, and notification of data breaches. Note: where a breach also involves health information covered by the Health Records Act 2001 (Vic) or another State or Territory scheme, we will also comply with any notification obligations under that legislation.

Data Retention

We retain personal and health information for as long as needed to provide the service and to meet legal and professional retention requirements. Health information is subject to minimum retention periods under health records legislation - generally at least 7 years from the last service for adults, and until the individual reaches 25 years of age for records relating to a person under 18 (HPP 4.2 (Vic) and equivalents). We do not delete health information before the end of any applicable minimum period, and we destroy or de-identify it once it is no longer needed and those periods have passed (APP 11.2).

We retain your data for as long as your account exists, regardless of subscription status. If your subscription lapses or you downgrade to a free plan, your data remains accessible; you do not lose your clinical records due to non-payment.

Account closure and deletion requests

If you close your account or request deletion of your data, all data is permanently and immediately deleted. This action cannot be undone. Please ensure you have exported any records you need before closing your account. Because you (as the treating practitioner) are responsible for meeting record-keeping obligations, deletion is carried out on your instruction. You must export or otherwise retain any records you are required to keep before requesting deletion. We will act on a deletion request in accordance with applicable law.

Important notice for practitioners

Mental health professionals in Australia are typically required to retain clinical records for 7 years or longer under professional registration requirements and state health records legislation. InterSession is a clinical tool, not an archive of record. You are responsible for maintaining your own record-keeping obligations, including exporting or archiving records before closing your account or requesting deletion. We recommend maintaining independent backups of clinical records to meet your professional and legal obligations.

Third-Party Services

We use the following third-party services to provide our platform:

1. Supabase.Database hosting (Sydney, Australia)
2. Render.Application hosting (Singapore)
3. Stripe.Payment processing (PCI DSS Level 1 certified)
4. Resend.Transactional email delivery (Japan)
5. Soniox.Primary audio-to-text transcription (United States)
6. Deepgram.Backup audio-to-text transcription, used when Soniox is unavailable or at capacity (United States)
7. OpenAI.AI-assisted clinical note generation (United States)

The mobile application also uses on-device speech recognition provided by Apple Speech (iOS) and Google Speech (Android) for the voice reflection feature. These run locally on the device; no audio is sent to our servers or to Apple or Google through our App, though these services may be subject to Apple’s and Google’s own privacy policies depending on your device settings.

We vet third-party providers for security and privacy before engaging them. They process data on our behalf under their standard terms of service. We will update this list if we add or change sub-processors.

Data Processing Agreements

For enterprise customers and larger practices that require a formal Data Processing Agreement (DPA), please contact us at ops@intersession.io.

Your Rights Under the Privacy Act

Under the Australian Privacy Act 1988 and applicable health records legislation, you have the right to access your personal information held by us (APP 12), request correction of inaccurate information (APP 13), know how your information is being used and disclosed, opt out of receiving marketing communications, request deletion of your data (subject to legal retention requirements), withdraw consent for optional processing, and lodge a complaint with us or the Office of the Australian Information Commissioner (OAIC). To exercise these rights, contact us at ops@intersession.io.

Complaints

If you believe we have breached the Australian Privacy Principles, a Health Privacy Principle or mishandled your personal information, you can lodge a complaint with us by contacting ops@intersession.io. We will investigate your complaint and respond within 30 days. If you are not satisfied with our response, you may escalate your complaint to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au, 1300 363 992, or enquiries@oaic.gov.au. If your complaint concerns health information in Victoria, you may also contact the Health Complaints Commissioner (Victoria); clients in other States or Territories may contact the relevant State or Territory privacy or health complaints body

Cookies and Tracking

We use essential cookies to maintain your session and authentication, remember your preferences, and ensure security.

Analytics

We use Google Analytics on our marketing website (intersession.io) to understand how visitors find and use our website. Google Analytics is not used within the clinical application (app.intersession.io) or the mobile application. No clinical data or application usage patterns are shared with Google. On our marketing website, Google Analytics collects information such as pages visited and time spent, device and browser information, geographic location (country/city level), and referral sources. This data is collected in aggregate, is not linked to individual clinical data, and is processed in the United States. You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on. We do not use third-party advertising cookies or sell data to advertisers.

Changes to This Policy

We may update this Privacy Policy from time to time. For any material changes, we will provide at least 30 days notice before the changes take effect by sending an email to the address associated with your account, posting a notice within the Service, and updating the "Last updated" date on this page. Your continued use of our services after the 30-day notice period constitutes acceptance of the updated policy.

Future: International Expansion

InterSession is currently available only in Australia. We plan to expand to other countries in future, including the United States. If you are located outside Australia and interested in InterSession, please contact us at ops@intersession.io to be notified when we launch in your region.

Contact Us

If you have questions about this Privacy Policy or our data practices, contact us:

1. Email: ops@intersession.io
2. Support: jake@intersession.io and luke@intersession.io
3. Contact form: intersession.io/contact

InterSession Group Pty Ltd

ABN 40 694 587 150 | ACN 694 587 150

Melbourne, Victoria, Australia