Last updated: 5 June 2026
This policy is provided in English, which is the controlling version.
Potentialz Unlimited Pty Ltd (ABN 34 629 683 432) · Last updated: 5 June 2026
Potentialz Unlimited Pty Ltd (ABN 34 629 683 432) ("we", "our", "us") operates the Potentialz Unlimited mobile application (the "App") and the website www.potentialz.com.au (the "Website"), together the "Services".
We are committed to protecting your privacy and the confidentiality of your personal and health information. This Privacy Policy explains how we collect, use, store, disclose, and protect your information across both the App and the Website, in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth), applicable State health-records legislation (including the Health Records and Information Privacy Act 2002 (NSW)), and the Notifiable Data Breaches (NDB) scheme.
As AHPRA-registered psychologists, we are also bound by professional codes of ethics, including the Psychology Board of Australia / Australian Psychological Society (APS) Code of Ethics and AHPRA regulations on client confidentiality. The same confidentiality protections that apply to in-person care apply to your use of the App and Website.
The App only requests device permissions necessary for the features you use. We do not access your mobile device's contacts, camera, microphone, or location without your explicit permission. You can review and revoke these permissions at any time in your device settings.
Certain App content — such as journal entries and personal notes — is stored locally on your device and is not transmitted to our servers unless you choose to sync or back it up. Local data is removed when you delete the App, subject to your device's own backup settings.
All information disclosed during psychological services is confidential and will not be shared without your consent, except in specific circumstances:
If a data breach likely to result in serious harm occurs, we will respond in accordance with the Notifiable Data Breaches scheme.
We use the following third-party service providers and SDKs to operate the Services. Each handles your data under its own privacy policy:
| Provider | Purpose | Privacy Policy |
|---|---|---|
| Supabase | Database and storage (App & Web data) | supabase.com/privacy |
| Firebase (Google) | Authentication and push notifications | firebase.google.com/support/privacy |
| Expo | App delivery and over-the-air updates | expo.dev/privacy |
| Amazon SES (AWS, USA) | Sends Website contact-form and notification emails | aws.amazon.com/privacy |
| Mautic (self-hosted, Australia) | Stores Website enquiry contact details | mautic.org/privacy-policy |
| SendFox (USA) | Email marketing list (name and email only) | sendfox.com/legal/privacy |
| Cloudflare (USA / global) | Website delivery, security, request logging | cloudflare.com/privacypolicy |
Under Australian Privacy Principle 8, we disclose that some Website and App data is processed by overseas service providers, including in the United States (Amazon SES, SendFox, Cloudflare, Firebase/Google, Expo) and globally (Supabase, Cloudflare). Mautic is hosted in Australia. By using the Services you consent to your information being transferred to and processed in these jurisdictions. We take reasonable steps to ensure these providers handle your information consistently with the Australian Privacy Principles.
You may request access to your clinical records by written request. Reasonable fees may apply for copying, and limited exceptions apply where access would pose a serious risk or affect another person's privacy.
For data held in the App and Website, you may request to:
To exercise these rights, contact [email protected].
You can request deletion of your account and associated personal data at any time:
We will process verified deletion requests within 30 days. Please note: clinical and health records that we are legally required to retain (see Section 9) cannot be deleted before the end of the mandatory retention period; in that case we will restrict access to those records and delete them securely once the retention period expires.
Records are securely destroyed (shredding or secure digital deletion) after the applicable retention period.
Telehealth sessions are conducted via a secure, encrypted video platform. Sessions are not recorded unless you provide explicit consent. Standard confidentiality and privacy protections apply to telehealth services.
The App and Website are not directed to children under 16 for independent account creation. For clients under 18 receiving clinical services, parents/guardians are provided with general information about treatment progress, while specific session content remains confidential unless the young person consents to disclosure, or there are safety concerns requiring parental notification.
We handle your information in accordance with the Australian Privacy Principles, the Privacy Act 1988 (Cth), applicable State health-records legislation, and the Psychology Board of Australia / APS Code of Ethics. The confidentiality and privacy protections that apply to in-person psychological services apply equally to your use of the App and Website.
We may update this Privacy Policy to reflect changes in legal requirements, the App, or our practices. Updated policies will be posted within the App and on our Website with a revised "Last updated" date.
Potentialz Unlimited Pty Ltd (ABN 34 629 683 432)
Unit 608, 8 Elizabeth Macarthur Drive, Bella Vista NSW 2153
Phone: 0410 261 838
Fax: 02 8458 5127
Email: [email protected]
Website: www.potentialz.com.au