GDPR and privacy standards

We adhere to the EU General Data Protection Regulation and the UK GDPR. Personal information is limited to what the between-session workflow needs: account details, assigned tasks, client responses, and device tokens for reminders. We do not sell personal information, run ads, track location, or use AI to analyse responses.

Task titles, guidance, templates, and response text are encrypted in the database (AES-256-GCM). Your practitioner decides the clinical content and obtains any consent their practice requires. You can delete your account from Settings in the app. Other privacy requests — access, correction, or restriction — can be sent to support@clientbridge.app.

We adhere to the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth), overseen by the Office of the Australian Information Commissioner. The same limits apply: collect only what the workflow needs, use it for that purpose, keep it secure, and delete it when you close your account.

Client and practice data is stored in Australia (Google Cloud, Melbourne). Practitioners remain responsible for any extra duties under state or territory health-records laws.

New Zealand’s equivalent is the Privacy Act 2020, overseen by the Office of the Privacy Commissioner. It sets 13 Information Privacy Principles covering collection, use, storage, access, and correction. We adhere to those principles in the same way as the GDPR and the Australian Privacy Principles.

The European Commission treats New Zealand’s privacy law as adequate, so EU personal data can be sent to New Zealand under that decision. ClientBridge itself stores data in Australia.

This is how ClientBridge is designed and operated. It is not a government certification, and it does not replace a practitioner’s own privacy duties to their clients.