TheraNotes privacy notice

Who we are

TheraNotes Pty Ltd (ABN 38 703 514 096) is based in Victoria, Australia (“TheraNotes”, “we”). TheraNotes is a workspace where allied health clinicians, such as occupational therapists, speech pathologists and psychologists, prepare clinical documents about their clients (assessments, reports, progress notes and other documents) with an AI assistant called ellie. For a privacy question or request, email hello@theranotes.com.au (opens in a new tab).

This notice covers clinicians and practice staff who use TheraNotes, people who ask for an invitation, and the clients whose information a practice enters. Your practice is responsible for the clinical services it provides, the information it chooses to enter and the authority of its users. TheraNotes is responsible for handling the information in its control as this notice describes and as privacy and health-records laws require. Please read this notice with your practice’s own privacy policy.

Information we handle

• About clients: name, preferred name, date of birth, NDIS number, contact details and address, health, disability, functional and support information, diagnoses as recorded, plan contacts, and the notes and messages a clinician adds.
• Documents: the text of typed PDF, Word and text documents a clinician attaches. The original file is not kept, so your practice keeps it in its own records.
• Work in TheraNotes: conversations with ellie, each document’s drafts and every revision, sign-off records, finalised documents, and each clinician’s preferences for how ellie writes for them.
• About clinicians and practices: name, work email, AHPRA registration number (or professional body membership number), practice name, ABN and contact email, roles, and who accepted the terms, which version and when.
• Sign-in: a Google account, or an email address and password (only a secure hash of the password is kept).
• If you ask for an invitation: your name, work email, practice name, whether you work alone or in a team, ABN, registration number and how you would use TheraNotes.
• Support and feedback: messages you send us and your ratings of ellie’s replies.
• Technical: what is needed to keep accounts secure and the service running: each sign-in with the browser and device used, and a record of who opened which client’s profile, document or report (kept 12 months, read by the practice’s Practice lead).
• How TheraNotes is used: to find where the product is slow, failing or hard to use, we record which screens a signed-in person opens, which named controls they use, how long requests take, and the errors they meet, together with the report they were working on at the time (by its internal reference, never its content). These records carry no client information, document text, conversation, file name, password or form entry. They stay in TheraNotes’ own database in Australia, are read only by TheraNotes staff (a practice’s leads see only when each of their people was last active), are never sent to an analytics provider, and are kept for 90 days (daily totals for 12 months).

How we collect it

Clinicians and practice staff enter client information or attach documents. You give us your own details when you ask for an invitation, set up a practice or join one. We check practice and registration details against the public ABN Lookup and AHPRA registers and professional bodies’ member registers.

How we use it

We use client information only to provide the service your practice uses: drafting and revising clinical documents, keeping client profiles, and keeping the history of every change, sign-off and finalised document. We use clinician and practice details to run accounts, check that practices are real and clinicians are registered, decide on invitation requests and contact you about your account. TheraNotes makes no clinical, eligibility or funding decisions.

Improving TheraNotes and support. We develop and test TheraNotes using invented cases. We do not routinely review client conversations, documents or revisions to improve TheraNotes. For each signed document we keep a few figures about how it was made, such as how much of ellie’s draft was kept, how many sources it cites and how soon after the session it was signed. These figures contain no client information or document text, and we use them to measure and improve TheraNotes. When you rate one of ellie’s replies or ask us for help, we look only at what is reasonably needed to deal with it. We may also look at information to investigate a security problem. Client information is never used to train AI models, by us or by OpenAI.

Support messages are read by us and arrive in our support inbox. Please don’t email client records unless we ask.

We don’t sell information or use it for marketing. We disclose it only to the providers listed below, to the practice it belongs to, or when the law requires.

Who can see information in your practice

• Clinicians see the clients assigned to them and their own documents.
• Clinical leads and Practice leads can read every client in the practice and colleagues’ documents; they change only their own work.

TheraNotes never makes one practice’s records available to another.

Who at TheraNotes can see it

Within TheraNotes, only the operator can reach client information, and only for the support and security reasons above. The providers listed below handle information to run the service.

Keeping it secure

Information is encrypted on its way to and from TheraNotes and where it is stored. Each practice’s information is kept apart by the database itself, and what each person can see is set by their role. No internet service can be guaranteed completely secure.

If information is accessed, disclosed or lost without authority, we tell the practice affected without undue delay and keep it informed as we respond. We also tell the people affected and the Office of the Australian Information Commissioner where the law requires.

ellie and dictation

ellie runs on OpenAI’s models. When a clinician sends a message, the model receives the conversation so far, the current document, the client’s name, date of birth and NDIS number, the clinician’s preferences for how ellie writes, and the text of anything ellie reads that the clinician can read: attached documents, profile details and the same client’s earlier documents. ellie may then change the current document or the client’s profile; earlier versions are kept, and the clinician checks all of ellie’s work. ellie cannot sign, issue or finalise anything: only the responsible clinician does. A finalised document is corrected by an amendment or a dated addendum, which keeps the original.

Dictation is for a clinician speaking their own notes, never for recording a client or a session. The recording is turned into text by OpenAI; TheraNotes does not keep the recording, and the text is kept only if the clinician sends it.

Where information is stored and who receives it

• Supabase (database, sign-in and stored files): Sydney, Australia.
• Vercel (runs the application): Sydney, Australia.
• OpenAI (ellie’s writing and dictation). What is sent to OpenAI is not used to train its models; OpenAI may hold it for up to 30 days to check for misuse, then deletes it.
• Anthropic (AI tools used across TheraNotes development).
• Resend (sends TheraNotes’ emails, which carry no client information): United States.
• Google (sign-in for people with a Google account, and our email, including the support inbox).

What stays in your browser

TheraNotes keeps you signed in with secure cookies, and your browser remembers display choices such as the width of the side panel. Words you have typed but not yet sent are kept in your browser so a refresh or a closed tab doesn’t lose them, and are cleared when you send them or sign out.

How long we keep information, and when a practice leaves

We keep a practice’s information while it uses TheraNotes. Archiving a client or document hides it; it doesn’t delete it. A clinician can remove an attached document, and if it is about the wrong person, erase its text; text already copied into a document or conversation, including a colleague’s report, stays there until the clinician who owns it changes it.

When a practice leaves, it can ask us for its finalised documents and for its information to be deleted, by emailing hello@theranotes.com.au (opens in a new tab). We keep the practice’s information until it asks.

Access, correction and complaints

To see or correct information about you, contact the practice that holds your record, or email hello@theranotes.com.au (opens in a new tab). We may need to confirm who you are first. A finalised document is corrected by an amendment or addendum, which keeps the original.

To complain, email hello@theranotes.com.au (opens in a new tab). We acknowledge your complaint, look into it, and reply with what we found and any action we will take, keeping you updated if it takes longer. If you are not satisfied, you can contact the Office of the Australian Information Commissioner (oaic.gov.au) or Victoria’s Health Complaints Commissioner (hcc.vic.gov.au).

Changes to this notice

A changed notice is published on this page with its date. A change to this notice does not by itself allow a new use of your clients’ information.