PosturalPal (“we”, “us”) provides clinical postural-assessment software to health professionals in Australia. This policy explains what personal information we collect, why, and how we handle it. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), including the higher standard that applies to health information.
1. What we collect
Account information — when a clinic registers we collect the clinic name, the names and email addresses of clinician users, and password credentials (stored only as salted hashes).
Patient assessment data — clinicians using PosturalPal record patient names, dates of birth, conditions, clinical notes, postural photographs and derived measurements. This is health information and therefore sensitive information under the Privacy Act. It is entered and controlled by the treating clinic; we store and process it on the clinic’s behalf.
Technical data — sign-in events, device registrations and logs needed to run and secure the service. We do not use advertising trackers or analytics cookies on the clinical application.
2. Why we collect it
- To provide the service: storing assessments, computing measurements, generating reports, syncing between a clinic’s devices.
- To secure the service: authentication, session management, abuse prevention.
- To communicate: transactional email such as sign-in links, password resets and invitations (sent via our email provider). We do not send marketing email without consent.
3. Automated measurement
PosturalPal computes postural measurements, severity grades and the postural deviation index automatically from landmarks detected in photographs. These computed values are always presented to the treating clinician for review — no diagnosis or treatment decision is made solely by the software, and clinicians can adjust detected landmarks before relying on any measurement.
4. Patient consent
The treating clinic is responsible for obtaining the patient’s informed consent before capturing photographs and recording assessment data in PosturalPal, as part of the clinic’s own privacy obligations to its patients. Patients seeking access to or correction of their records should contact their treating clinic first; we support clinics in meeting those requests.
5. Where data lives
Clinical data is stored in Australia: our database is hosted in Sydney (AWS ap-southeast-2 via Supabase) and our application servers run in Sydney (Fly.io). Data is encrypted in transit (TLS) and at rest, and each clinic’s records are isolated by row-level security.
6. Who we share it with
We do not sell personal information and we do not share it except with the service providers required to run PosturalPal:
- Supabase (database hosting, Sydney)
- Fly.io (application hosting, Sydney)
- Resend (transactional email delivery)
Each processes data only on our instructions. If any transfer outside Australia becomes necessary we will take reasonable steps required by APP 8 before it occurs.
7. Retention & deletion
We retain data while a clinic’s account is active. When an account is closed, clinical records remain exportable for a 90-day grace period, with reminders to the clinic owner, before being deleted from production systems and then from backups on their rotation schedule. We delete sooner if the clinic confirms in writing that it has completed its export or does not require one. Practitioners are usually required to retain health records for at least seven years (longer for children) — that duty belongs to the treating clinic, and the export tools in Settings exist so closing an account never separates a clinic from records it must keep.
8. Security
See our Security page for details: encryption, access controls, per-clinic isolation, and Australian hosting. No system is perfectly secure; if a data breach occurs that is likely to result in serious harm, we will notify affected clinics and the OAIC in line with the Notifiable Data Breaches scheme.
9. Access, correction & complaints
You can request access to or correction of personal information we hold about you at privacy@posturalpal.com.au. We will respond within 30 days. If you are unsatisfied with our response you can complain to the Office of the Australian Information Commissioner (oaic.gov.au, 1300 363 992).
10. Cookies
The marketing site sets no cookies. The clinical application uses only essential cookies for sign-in sessions — no advertising or cross-site tracking.
11. Changes
We will post any changes to this policy on this page and update the date above. Material changes will be emailed to clinic owners.
Contact: privacy@posturalpal.com.au