Privacy notice
How Practice Bridge handles information for the practices that use it, their staff and their patients.
Version 0.1
Who we are and our role
Practice Bridge is run by Braden Pty Ltd (ABN 21 662 181 740), in Western Australia. It is software that a practice uses to prepare assessment reports, send appointment reminders and keep its records organised.
If you are a patient, your practice is responsible for your health record and for this information. Practice Bridge processes it on the practice’s instructions, and holds the items listed below for the purposes below. Ask your practice first about anything to do with your record.
Information about your health is sensitive information. Your practice is responsible for having your consent to collect it in the course of your care.
What we collect and hold
About practice staff:
- your name, email address and sign-in identity (including a Google or Microsoft account, if you sign in with one), and your role in the practice;
- invitations: the invited person’s email address, kept with the invitation record;
- records of actions taken in the practice (who did what, and when), for security and accountability;
- voice samples of practice terms, if staff record them to help transcription.
About the practice: its name, timezone and contact details, its plan, and a billing contact. You enter card details on Stripe’s pages. We never receive or hold card numbers; we hold the billing contact, plan and Stripe identifiers.
About patients, as the practice uses the service:
- appointment times, types and status, linked to the patient’s Cliniko record by ID;
- assessment findings, reports and their versions, clinical notes, transcripts, and documents and images the practice adds (such as care plans and PostureScreen exports);
- consultation recordings, only when made with the consent of everyone present;
- records of consent given for a recording, and of reports sent (when, and to which email domain).
We do not store patients’ names, email addresses or phone numbers as data fields: they are read from Cliniko when a page shows them or a message needs them. We do store a keyed one-way hash of a patient’s email address, which we cannot read back, so that a request not to be emailed is honoured. The clinical content we hold (transcripts, recordings and documents a practice attaches) may itself contain a name or other details. Documents such as care plans may carry government identifiers, such as a Medicare number; we do not read or use them.
Our hosting provider keeps standard technical logs of requests for a short time. When a browser reports a blocked script, we keep the report, which includes the browser type and the page address.
Where it comes from
Most patient information comes from the practice, not from you directly: from its Cliniko account, from its staff, and from services the practice chooses to connect (its email and calendar, PostureScreen exports, and the storage where it keeps reports). Staff may also import transcript files exported from a recording service such as Otter.
If information is not provided, the practice cannot use the features that need it. For example, without an appointment Practice Bridge cannot send a reminder for it.
How it is used
- to prepare and issue assessment reports that a clinician reviews;
- to run the automations the practice sets up, such as appointment reminders sent from the practice’s own email address;
- to file issued reports in the storage the practice chooses;
- to support, secure and improve the service, and to bill the practice.
We do not sell information, and we do not use it for advertising. We do not send marketing to patients; staff receive service messages about the practice’s account.
Service providers, and where information goes
We use these providers. Some are outside Australia, so information is disclosed overseas as shown.
Supabase
- What for
- The database and stored files
- Where
- United States
Vercel
- What for
- The server functions that run the service, and the queue that schedules background jobs such as reminders
- Where
- United States: the server functions and the job queue run in US East (iad1). The queue holds record IDs, timings and error codes; an unexpected fault in our own code can record its own message instead. Patient names and contact details are not passed between jobs. Page files that hold no personal information are served from Vercel’s worldwide network
Stripe
- What for
- Billing the practice
- Where
- See the open items above
The practice’s Cliniko account
- What for
- Appointments and patient details, read when needed; draft treatment notes, only where enabled for the practice (a clinician reviews and signs them in Cliniko)
- Where
- The region of the practice’s own Cliniko account
The practice’s Google or Microsoft account
- What for
- Sending emails from the practice’s own address, calendar events, and report storage, each only if the practice connects it
- Where
- Per the practice’s own account
A speech-to-text provider
- What for
- Transcribing a consultation recording, only when one is made
- Where
- Shown before recording (see below)
| Provider | What for | Where |
|---|---|---|
| Supabase | The database and stored files | United States |
| Vercel | The server functions that run the service, and the queue that schedules background jobs such as reminders | United States: the server functions and the job queue run in US East (iad1). The queue holds record IDs, timings and error codes; an unexpected fault in our own code can record its own message instead. Patient names and contact details are not passed between jobs. Page files that hold no personal information are served from Vercel’s worldwide network |
| Stripe | Billing the practice | See the open items above |
| The practice’s Cliniko account | Appointments and patient details, read when needed; draft treatment notes, only where enabled for the practice (a clinician reviews and signs them in Cliniko) | The region of the practice’s own Cliniko account |
| The practice’s Google or Microsoft account | Sending emails from the practice’s own address, calendar events, and report storage, each only if the practice connects it | Per the practice’s own account |
| A speech-to-text provider | Transcribing a consultation recording, only when one is made | Shown before recording (see below) |
Signing in with Google or Microsoft only confirms who you are. Email, calendar and file access are asked for separately, by the practice, and only for what it turns on.
Speech-to-text: the providers the service can use are Microsoft Azure (Australia East), Google (australia-southeast1), OpenAI (United States, unless a regional data-residency agreement applies), ElevenLabs (United States or Europe), and Grok STT through Vercel AI Gateway (processing location not confirmed as Australian). Grok STT is enabled only for synthetic Demo testing and its Gateway requests require zero-data-retention routing and exclude prompt training. Before each recording, the provider, where it processes audio, how long it keeps it and whether it may use it for training are shown and acknowledged. Those details are each provider’s own terms: for example, OpenAI’s terms say it keeps API inputs for up to 30 days to monitor abuse, unless zero retention is agreed, and does not use them for training by default.
Google and Microsoft account data
Each kind of access is asked for separately, only when an owner or admin turns on the feature that needs it, and only from the person who connects it.
Sign in with Google or Microsoft (openid, email, profile)
- What Practice Bridge does with it
- Confirms who you are. Nothing else.
- What it keeps
- Your sign-in identity and email address.
Google calendar list (calendar.calendarlist.readonly)
- What Practice Bridge does with it
- Lists the practice’s calendars, so one can be chosen for appointments.
- What it keeps
- Which calendar was chosen.
Google calendar events (calendar.events)
- What Practice Bridge does with it
- Creates, updates and removes the appointment events Practice Bridge made in the chosen calendar. It does not change other events. Events carry the appointment type, and a Practice Bridge reference, not the patient’s name.
- What it keeps
- The IDs of the events it made.
Gmail sending (gmail.send)
- What Practice Bridge does with it
- Sends the reminders and report emails the practice set up, from the practice’s own address. It cannot read the mailbox.
- What it keeps
- When each email was sent and to which email domain; the message stays in the practice’s Sent folder.
Google Drive files it creates (drive.file), under its own grant
- What Practice Bridge does with it
- Adds issued reports to the folder the practice picked, and reads back the files it added to check them. It cannot see other files. While choosing a folder, Google’s picker uses a short-lived token for this grant only.
- What it keeps
- The IDs of the folder and files, and a checksum of each file.
Microsoft 365 (Calendars.ReadWrite, Mail.Send, User.Read)
- What Practice Bridge does with it
- The same calendar and email uses as for Google, through Microsoft Graph. It cannot read the mailbox.
- What it keeps
- As for Google.
Microsoft files (Files.ReadWrite.AppFolder, Sites.Selected, Files.ReadWrite)
- What Practice Bridge does with it
- Only if the practice turns them on: exam forms in Practice Bridge’s own OneDrive folder; issued reports in the one SharePoint site an administrator granted, or in the connecting person’s OneDrive.
- What it keeps
- The IDs of the folders and files, and a checksum of each file.
| Access | What Practice Bridge does with it | What it keeps |
|---|---|---|
| Sign in with Google or Microsoft (openid, email, profile) | Confirms who you are. Nothing else. | Your sign-in identity and email address. |
| Google calendar list (calendar.calendarlist.readonly) | Lists the practice’s calendars, so one can be chosen for appointments. | Which calendar was chosen. |
| Google calendar events (calendar.events) | Creates, updates and removes the appointment events Practice Bridge made in the chosen calendar. It does not change other events. Events carry the appointment type, and a Practice Bridge reference, not the patient’s name. | The IDs of the events it made. |
| Gmail sending (gmail.send) | Sends the reminders and report emails the practice set up, from the practice’s own address. It cannot read the mailbox. | When each email was sent and to which email domain; the message stays in the practice’s Sent folder. |
| Google Drive files it creates (drive.file), under its own grant | Adds issued reports to the folder the practice picked, and reads back the files it added to check them. It cannot see other files. While choosing a folder, Google’s picker uses a short-lived token for this grant only. | The IDs of the folder and files, and a checksum of each file. |
| Microsoft 365 (Calendars.ReadWrite, Mail.Send, User.Read) | The same calendar and email uses as for Google, through Microsoft Graph. It cannot read the mailbox. | As for Google. |
| Microsoft files (Files.ReadWrite.AppFolder, Sites.Selected, Files.ReadWrite) | Only if the practice turns them on: exam forms in Practice Bridge’s own OneDrive folder; issued reports in the one SharePoint site an administrator granted, or in the connecting person’s OneDrive. | The IDs of the folders and files, and a checksum of each file. |
The access tokens are held by our connection service (Vercel Connect) and used only on our servers. They are never stored in your browser, apart from the picker’s short-lived token above.
Information from these accounts is used only to provide the features above. It is not sold, not used for advertising, and not used to train AI models.
Practice Bridge’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Disconnecting an account in Practice Bridge revokes its access, unless another practice still uses the same person’s connection. Events already created stay in the calendar, sent emails stay in the mailbox, and filed reports stay in the practice’s storage. Stopping report storage in Google Drive revokes that grant, unless another practice still keeps reports there under the same person’s connection. You can also remove Practice Bridge’s access from your Google or Microsoft account settings at any time.
How long it is kept
As the service works today:
Private photo drafts and their photos
- How long
- Draft access expires 30 days after creation or the last successful save; expired private photos are queued for deletion. Reviewed versions are retained separately.
Consultation recordings
- How long
- at most 7 days, and deleted as soon as the note is accepted
Recording parts on the device
- How long
- until uploaded; removed after 24 hours and when you sign out
An email address a clinician types for a report send
- How long
- until the report is sent, or 30 days after a send that stopped
Legacy automatically delivered Otter transcripts not used
- How long
- 7 days (a record that one arrived is kept 30 days)
Platform support context
- How long
- two hours; entry, exit and accessed targets are audited. This session lifetime is not clinical-record retention.
| What | How long |
|---|---|
| Private photo drafts and their photos | Draft access expires 30 days after creation or the last successful save; expired private photos are queued for deletion. Reviewed versions are retained separately. |
| Consultation recordings | at most 7 days, and deleted as soon as the note is accepted |
| Recording parts on the device | until uploaded; removed after 24 hours and when you sign out |
| An email address a clinician types for a report send | until the report is sent, or 30 days after a send that stopped |
| Legacy automatically delivered Otter transcripts not used | 7 days (a record that one arrived is kept 30 days) |
| Platform support context | two hours; entry, exit and accessed targets are audited. This session lifetime is not clinical-record retention. |
Clinical content (findings, reports, notes, transcripts and documents) is held until it is deleted. No automatic deletion applies to it today. A retention schedule is being set, and this notice will change when it is.
Reports the practice files in its own storage (such as SharePoint or Google Drive) stay there under the practice’s own rules. Emails sent from the practice’s own address stay in its mailbox. Backups made by our database provider age out on that provider’s schedule.
Keeping it secure
- Information is sent over HTTPS only.
- Access is limited by practice and by role: members of a practice do not see patients, visits or reports.
- Stored files are private and read only by the server, after its own checks. A practice’s Cliniko key, and any speech-to-text key it provides, are kept in Supabase Vault.
- Sensitive actions are recorded. Authorised platform developers can enter a practice for read-only support, including its patient information. Access is tied to their sign-in session, records their reason, expires after two hours and does not grant clinical sign-off or patient sending.
- A nightly audit counts, for each practice, any patient names or addresses stored where they should not be, and records it for us to act on.
If a breach is likely to cause serious harm, we tell the practice promptly so it can meet its own obligations, and notify the Office of the Australian Information Commissioner where the law requires.
Access, correction and complaints
Patients: ask your practice to see or correct your information. The practice holds your record in Cliniko and can act on it; we help the practice where we need to.
Practice staff: ask us, or your practice’s owner, to see or correct your details.
Complaints: tell us first, and we will look into it and reply. If you are not satisfied with our answer, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).
For practices: a paragraph for your own privacy policy
Your practice tells patients how it handles their information. You may adapt this:
We use Practice Bridge, a service run by Braden Pty Ltd, to prepare assessment reports, run appointment reminders and keep practice records organised. Practice Bridge works on our instructions. It reads the details it needs from our practice management system (Cliniko) when it needs them, and stores assessment findings, reports, notes and related documents in the United States (Supabase) so that our clinicians can review and issue them. Recordings of consultations, if we make them with your consent, are transcribed by the provider named when we ask for your consent, and deleted within 7 days.
Changes to this notice
Each version is dated, and the current one is always the one shown here.
See also the Terms of service.