Privacy policy

Effective date: 11 October 2026. Version 2.2. This policy applies to innerhelp.com.au (and innerhelp.com, which redirects to it), the Inner Help platform and video rooms, and the services provided through them. It replaces the policy dated 10 October 2026.

1. Who we are and who holds your record

Inner Help Pty Ltd is the operator of the platform. We provide matching, booking, payment, records storage, the video room and a clinical governance framework. The platform software is licensed from our related company Healable International Limited (Hong Kong) and runs on Inner Help's own servers in Sydney, Australia. Healable has no access to your information; Inner Help is responsible for it under Australian law. Your care is provided by an independent practitioner. Two organisations therefore hold information about you:

• Inner Help holds your account, intake and safety answers, bookings, payments, messages sent through the platform, and the clinical notes your practitioner writes on the platform.
• Your practitioner is responsible for your clinical record and is bound by their own professional and privacy obligations. Where they keep notes outside the platform, they hold those notes.

You can make an access or correction request to either of us; we will coordinate so you only have to ask once.

2. What we collect

• Identity and contact details: name, date of birth, email, phone, address, state, emergency contact.
• Account details: sign-in email, password (stored only as a hash), two-step verification settings, sign-in times.
• Health information (sensitive information): your answers to intake, safety and matching questions; what you want help with; clinical notes, session records and any letters or reports your practitioner writes; where you consent, a referral or Mental Health Treatment Plan from your GP, and letters to or from your GP or another clinician.
• Medicare and NDIS details: your referral and Mental Health Treatment Plan details where your practitioner needs them for a Medicare receipt (Inner Help does not lodge Medicare claims, so we do not ask for your Medicare card number); your NDIS number and plan manager details only if you use NDIS funding.
• Payment information: the card you save at booking is held by Stripe; we see only the card type, last four digits, expiry and the amounts charged or refunded. Practitioners' bank details are held for paying them.
• Session information: when you attend, how long for, and whether you consented to AI note-taking. Video sessions are never recorded unless both you and your practitioner have agreed to AI note-taking for that session (section 7).
• Correspondence: messages you send through the platform, by email, form, SMS or phone. We keep emails you exchange with us and link them to your record, so we can help you consistently.
• Website information: pages visited, device and browser type, IP address, and, only if you accept advertising measurement, the identifiers described in section 9.

3. How we collect it

Most information comes from you, through the website, your account, the video room and messages. With your consent we also collect information from your GP, an informant you nominate, or a previous treating clinician. Your practitioner adds clinical notes. Stripe tells us the outcome of payments. Services Australia and NDIS plan managers tell us the outcome of claims and invoices.

4. Why we collect it

• To match you with a practitioner, including by using your answers in the matching process described in section 8.
• To book, hold and support your sessions, and to let your practitioner assess, treat and support you.
• To keep you and others safe, including acting on safety answers and contacting emergency services or your emergency contact if there is a risk of harm.
• To take payment, pay your practitioner, issue receipts you can use to claim a Medicare rebate yourself, and issue NDIS invoices where you ask us to.
• To communicate with your GP or other clinicians, only with your consent or where the law requires it.
• To run and improve the service, using de-identified information wherever possible.
• To meet legal obligations, including record keeping, mandatory reporting, responding to lawful requests, and tax and Medicare compliance.
• To tell you about Inner Help services, only where you have agreed to receive that, and never using your health information.

5. Consent

When you complete intake you consent to Inner Help and your practitioner collecting and using your health information for the purposes in section 4. You can withdraw that consent at any time by contacting us. If you do, we may not be able to continue providing the service, and we will keep the records the law requires us to keep (section 10) but stop using them for any other purpose.

We ask for separate, specific consent before we: write to your GP or another clinician; contact an informant; record a session for AI note-taking; share information with your NDIS plan manager; or send advertising measurement data to Google or Meta.

6. Where your information is stored, and who else processes it

Your clinical records, intake and safety answers, session records and account are stored on Google Cloud in Sydney, Australia, encrypted in transit and at rest, with access limited to the people involved in your care and the staff who support them, and with audit logs of every access. Staff and practitioners are bound by confidentiality obligations.

Some services we use to run the platform process limited personal information outside Australia. We use them because they are the most secure option available for that task, and we give each one only what it needs. We do not send your clinical notes, safety answers or health information to any overseas service. The table lists every outside service that handles personal information.

We also disclose information to: your practitioner; your GP, pharmacy or another clinician where you have consented; your NDIS plan manager and the NDIA for NDIS invoices with your agreement; your professional indemnity insurer or ours if a claim arises; and regulators, courts or authorities where the law requires it. We will update this table when a service changes, and the current version is always at this address.

7. AI note-taking

Your practitioner may ask to use AI to help draft their notes. This only happens if both you and your practitioner say yes before the session, and you can say no or stop at any time without any effect on your care. If you agree: the audio of the session (never the video) is recorded and transcribed by Amazon Web Services in Sydney; the audio is deleted as soon as it is transcribed, and in any case within one day; the transcript is used to draft a note that your practitioner reviews and signs, and is deleted when the note is signed, and in any case within 30 days; the signed note becomes part of your clinical record, which you can ask to see; and your information is never used to train AI models. We record your yes or no with the session. You can withdraw consent per practitioner in your account under "Summaries and AI notes".

8. Automated matching

When you ask to be matched, a computer program compares your answers (what you want help with, your preferences, your availability and safety answers) with practitioners' focus areas, approach, availability and capacity, and suggests practitioners to our matching team. A person on that team reviews every suggestion before an introduction is made, and no introduction is refused by the program alone. The kinds of personal information used are those in section 2 under identity, health information and session information. You may ask us how a particular match was made.

9. Cookies, analytics and advertising measurement

The website works without any tracking. When you first visit, a banner asks whether you will allow analytics and advertising measurement. Nothing from Google Analytics, Meta or Attributable loads until you choose "Yes". If you choose "No" or close the banner, we use only the cookies the site needs to work (your sign-in, your cookie choice, security checks) and our own server logs, which record pages requested and IP addresses and are kept for 90 days.

If you say yes, Google Analytics and Attributable receive a pseudonymous visitor identifier, the pages you view, your device and browser type and approximate location, so that we can understand how the site is used and which enquiries came from which campaigns. Meta receives a pseudonymous identifier and the pages you view so that we can measure and pay for advertising on Facebook and Instagram. Because this is a mental-health website, visiting it can say something about your health, which is why we ask first.

What we never do, whatever you choose: the self-test pages never load analytics or advertising tags; no event sent to Google, Meta or Attributable contains your self-test answers or score, which condition you are reading about, anything you type into a form, or your name or email; and we do not use your health information or your platform account to target advertising at you. For practitioners who enquire about joining Inner Help and have accepted the banner, we send Meta a hashed version of the email address and the fact that an enquiry was made, so that recruitment advertising can be measured.

You can change your choice at any time using "Cookie preferences" in the footer; withdrawing consent stops the tags from that point. Your choice is stored in a cookie in your browser for 12 months. Visitors from the European Union, United Kingdom, EEA or Switzerland see the same banner and the same rules apply.

10. How long we keep information

Clinical records are kept for at least seven years from the date of your last contact with Inner Help, or until you turn 25 if you were under 18 when the record was made, as the Health Records Act 2001 (Vic) and equivalent state laws require. Your practitioner keeps their records for the period their profession requires. Medicare referral records are kept for two years from the service. Payment records are kept for seven years for tax purposes. Website enquiries that do not become accounts are deleted after 12 months. Other information is kept only as long as needed for the purpose it was collected, then securely deleted or de-identified.

11. Access and correction

You can ask to see the personal information Inner Help holds about you, and ask us to correct it if it is wrong or out of date. Email info@innerhelp.com.au or call 1800 841 890. We will respond within 30 days and may need to verify your identity first. If a request concerns your practitioner's clinical notes we will involve them. In limited cases the law allows us to refuse access, for example where it would pose a serious threat to someone's health or safety; if so, we will tell you why and how to complain.

12. Data breaches

If a data breach is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires, and tell you what happened and what you can do. Inner Help and each practitioner have agreed to tell each other within two business days of becoming aware of a breach affecting a client.

13. Complaints

If you think we have mishandled your information, tell us first at info@innerhelp.com.au. We will acknowledge your complaint within five business days and aim to resolve it within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au, 1300 363 992) or, for health information, to the Victorian Health Complaints Commissioner (hcc.vic.gov.au, 1300 582 113). Complaints about a practitioner's conduct can also be made to Ahpra (for registered practitioners), the practitioner's professional association, or the NDIS Quality and Safeguards Commission (1800 035 544) for NDIS-funded supports.

14. Practitioner directory listings (collection notice)

The Inner Help finder includes unclaimed listings of practitioners who state publicly that they work with ADHD or autism. This notice is given under Australian Privacy Principle 5. We collected publicly published professional details only: name, profession and credentials as published, practice name, suburb, state and postcode, whether telehealth is offered, and business phone and website where published. We collected them from practitioners' own practice websites and professional association directories whose terms permit it; we do not copy information from the Ahpra register, and we link to a practitioner's Ahpra register entry rather than restating it. Each listing shows the date it was last checked. A professional email address, where published, is held only to invite the practitioner to claim, correct or remove the listing, and is never displayed. An unclaimed listing does not mean the practitioner is affiliated with, verified by, or available through Inner Help, and the listing says so. A practitioner can claim, correct or remove a listing at any time at no cost from the listing page or by emailing info@innerhelp.com.au; removal takes effect immediately and we confirm it within two business days. Listing details are displayed on this website and processed by the hosting and email services in section 6. They are not sold or shared for marketing.

15. Changes to this policy

We may update this policy from time to time. The current version, with its effective date and version number, is always published at this address. We will email current clients and practitioners at least 14 days before a material change takes effect, and will ask again for your consent if a change would use your information for a new purpose.

16. Contact

Privacy Officer, Inner Help Pty Ltd, Level 7/222 Exhibition St, Melbourne VIC 3000. Phone 1800 841 890. Email info@innerhelp.com.au. See also our terms of service and refund policy.