Privacy policy

Information we collect

TMPlanner stores the information clinics and clinicians enter to run rehab programs: clinician account details, patient program content, and the activity patients record in the TMPlanner app (session completion, pain and symptom entries).

Where data lives

Patient records are stored in an Australian cloud region in Sydney. If a clinic turns on AI note structuring, the note text its clinicians submit is processed by our cloud provider, Google Cloud, and may be processed outside Australia; it is used only to produce a draft for the clinician to review, and Google may hold it briefly for abuse monitoring. Access is isolated per clinic: patients see only their own data, and clinicians see only their own clinic.

When a clinician sends a patient their plan by email or text, the message carries the patient's name, the plan link and a sign-in code, never the clinical record. It is delivered by Resend (email) and Twilio (SMS), which may process it outside Australia. Product feedback sent from the app or the console is emailed to the TMPlanner team via Resend, which may process it outside Australia.

Overseas disclosure

Patient records stay in Sydney. The services above that may process information outside Australia are: Google Cloud (AI note structuring and transcription, on Google's global endpoints, transient only), Resend (email delivery), Twilio (text message delivery) and YouTube (exercise demonstration playback). Where a clinic connects a consult scribe (Heidi or Lyrebird) or a practice-management system (Cliniko), information flows to and from that provider under the clinic's own agreement with it.

Voice notes and consult recording

If a clinician dictates notes or records a consult, the audio is transcribed by our cloud provider, Google Cloud, and may be processed outside Australia. TMPlanner does not store the audio; Google may hold it briefly for abuse monitoring. The transcript is kept only if the clinician saves it as notes. A consult is recorded only after the clinician has asked the patient for consent, and TMPlanner logs that consent with the time against the patient record.

Exercise demonstration videos

Some exercise demonstrations in the patient app are YouTube videos chosen by your clinician. When the patient opens their plan, the app loads a preview image for each of those videos from YouTube (a Google service), which discloses the device’s IP address and which videos were prescribed to Google, outside Australia. The video itself streams only when the patient taps Play, in YouTube’s privacy-enhanced mode. These videos cannot be saved for offline use. TMPlanner never sends a patient identifier to YouTube.

How data is used

Data is used to deliver the service: prescribing, reviewing and progressing rehab programs. We do not sell personal information, and we do not use patient data for advertising.

Security

Data is encrypted in transit and at rest. Clinician accounts are individual and password-protected, and access is scoped by role: patient credentials can never read another patient's data or change program content.

Clinician information

For clinicians we hold the account details a clinic enters (name, email, role), the programs, notes and messages they author, and an audit trail of changes made under their login. If a clinician dictates or records a consult, their own voice is transcribed as described above and the audio is not kept.

Retention, deletion and backups

Clinical records belong to the clinic, which sets its own retention under Australian health-records law; TMPlanner does not age them out from under a clinic. When a clinic leaves, its data is kept for 90 days so it can be exported, then deleted; deletion sooner is available on request. When data is deleted it is removed from our live systems immediately. Copies may persist in encrypted backup storage, used solely for recovery and disaster planning, for up to 14 weeks, after which they are destroyed.

Our website

The public pages of this site set no tracking cookies and load no advertising or analytics scripts. We count page views and button clicks ourselves, as daily totals with no identifier, plus a daily count of requests per connection, derived from a salted hash of the network address that cannot be reversed, to stop a script inflating them. The contact form is delivered to us by email (by Resend, as described above) and its contents are not stored by us; the same per-connection daily count applies to it. The wordmark font is served by Google Fonts, which receives the request from your browser.

Access and correction

Patients access their information through their treating clinic. If you want data corrected or removed, contact your clinic or contact us directly and we'll work through it with you. You can delete your TMPlanner account from the app's Settings; this removes your login and contact details. Your clinic keeps your clinical record as required by Australian health-records law.

Complaints

If you believe we have mishandled your information, contact us and we will respond within 30 days. If you are not satisfied with our response you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Contact

Questions about privacy? Contact us.