How TMPlanner handles patient information

Where data lives

Patient records are stored in an Australian cloud region in Sydney. If your clinic connects AI note structuring, the note text is processed outside Australia. Backups run on a schedule, and a retention schedule is available on request.

Who can see what

Each clinic's data is isolated. Isolation is enforced in the API and again in the datastore, so a clinician sees only their own clinic's patients and a patient sees only their own program. TMPlanner staff can access data only to run and support the service, and that access is recorded.

How people sign in

Clinician accounts are provisioned per clinic by TMPlanner. There is no public signup. Patients sign in with a single-use code issued by their clinic plus one identity check. Codes are stored hashed and cannot be reused.

Encryption

Data is encrypted in transit and at rest.

Clinical decisions stay with the clinician

• A patient's credentials cannot progress a phase, approve anything or edit program content. A progression request raises a flag for the clinician and changes nothing.
• Regression is off by default. If a clinician turns it on, it is limited to steps they pre-approved, they are notified, and it can be undone.
• Patients never see a computed outcome score. Scoring is server side and for the clinician.
• Messaging is only available once the clinic has enabled a messaging policy.
• The safety note and any escalation pathway shown to a patient are written by the clinician. TMPlanner never generates them from a score.

Records you can rely on

• What a patient records is append-only, so a reported symptom or completed session cannot be silently overwritten.
• Entries logged offline replay once, so a session cannot be double counted.
• Consent records cannot be edited, and a report cannot go to a referrer or funder without recorded consent.
• Reports, regressions and administrative actions are written to an audit trail.

No personal information in the plumbing

IDs, URLs, logs and analytics carry no names and no health information.

AI note structuring

AI note structuring is off unless your clinic connects it. Note text your clinicians submit is processed by our cloud provider, Google Cloud, and may be processed outside Australia; Google may hold it briefly for abuse monitoring. It produces a draft program only. No program, phase or exercise reaches a patient until a clinician reviews the fields and approves. We don't write the raw note into our application logs. Our provider's own handling is governed by our agreement with them.

Privacy law

TMPlanner handles health information and is subject to the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and to state health records legislation where it applies. Our privacy policy is a draft pending legal review.

Report a security issue

Email hello@tmplanner.app with the details. Please don't include patient information.