Supriva holds information about people’s professional lives, and some of it is sensitive. This policy says plainly what we collect, why, who sees it and how long we keep it. It is written to be read, not filed. If something in it is unclear, the Privacy Officer at privacy@supriva.com.au will answer.
Who we are
Supriva is run by Supriva Pty Ltd (ACN 701 292 088, ABN 85 701 292 088), an Australian company based in New South Wales. We are bound by the Privacy Act 1988 and the Australian Privacy Principles.
Our Privacy Officer is responsible for how we handle personal information and for answering requests and complaints. Reach them at privacy@supriva.com.au.
Who this policy is about
Several groups of people, and the policy says which parts apply to each.
- Supervisors and practitioners who hold a Supriva account. Most of this policy is about you.
- People you supervise, or who supervise you, who are also members and see some of your information because you work together.
- Practitioners’ own clients, who are never on Supriva, but who may be discussed in a supervision session. The section headed If you are a practitioner’s client is for them.
- People on the public supervisor registers of ACA and PACFA, whether or not they have heard of us. The section headed If you are on a public register is for them.
- Visitors to our public pages, about whom we hold very little.
What we collect, and why
We collect information at the moment it is needed, and we tell you why at that moment. This is the whole of it.
When you create an account
Your name and email address, and a password, which we never store in a readable form. If you sign in with Google, Google tells us your name and email address and confirms you control that address. If you sign in with Apple, Apple tells us the email address you chose to share, which may be one of Apple’s private relay addresses forwarding to your own, and your name only the first time you authorise. Every sign-in after that carries neither, and we recognise you by an identifier Apple issues for Supriva alone. We use these to run your account and to reach you.
Your registration
Which registering body you are registered with: ACA, PACFA, or both. Your registration number, your registration level, your renewal date, and how long you have been registered. A supervisor recognised some other way, by an employer’s supervision panel, by another association, or on a qualification held overseas, answers that instead: in place of a number we hold a passage in your own words saying who recognises you as a supervisor and how, kept as you typed it. There is no register to check a recognition against, so a person at Supriva reads it. This is sensitive information under the Privacy Act, and we ask for your consent before collecting it, as its own step. We use it to check your registration against your body’s public register, to work out which supervision rules apply to you, and, if you are a supervisor, to show your credentials on your profile.
Your details
A phone number, so a supervisor can reach you about a session. Your date of birth, which only a supervisor you book can see. Your pronouns, if you choose to give them, so people address you correctly.
Your practice
Your career stage and a band describing your client-contact hours, because your registering body’s supervision requirement depends on both. Where you practise, as a suburb, state and locality, and whether you meet online, in person or both. If you offer in-person sessions, the address. To check it we send a request naming it to Google’s address validation service, so a practitioner arrives at the right door. Your practice is a real place Google already maps, so Google learns nothing new about you from the check; the request is still sent, and what it carries is the address.
Who you would feel at ease with
If you choose to tell us, a preference about the gender of your supervisor, and about their background or lived experience: First Nations-informed practice, culturally and linguistically diverse, migrant or refugee experience, LGBTQIA+ affirming, or faith-informed. This is optional, and the screen says so. A preference like this can say something about you, so we treat it as sensitive: it is used only to shape who we show you, it is never displayed to anyone, and it is never combined with anything else.
If you are a supervisor
Your certificate of currency for professional indemnity insurance. A model we run ourselves reads it once, at upload, to take the cover dates and type of cover, and a person at Supriva checks anything it cannot read. It runs in Australia, and the certificate is not sent anywhere else. The certificate itself is stored apart from the rest of your record, and the only people who can open it are the team who review supervisor applications. Every time one of them does, we record who opened it and when.
Your profile photo and, if you add one, a short video. Your answers about how you work, the kinds of supervision you offer and who you work with. If you give us your practice’s website address, we read the site to get a sense of how you write and keep a short note of that, not a copy of the site. From your answers, the same model, running in the same place, drafts two paragraphs for your profile, which you read and approve before anyone sees them. The fees you set.
Your calendar, if you connect one
With Google, we ask only to see when you are busy. With Microsoft, the permission Microsoft offers lets us read your calendar, but we keep only the busy intervals. Either way, what we store is that a time is taken, never what is in it. If you also ask us to add your Supriva sessions, we ask for one more permission. We then keep a calendar called Supriva in your account, or add the sessions to one of your own calendars that you choose. To show you your calendars, we read their names, and we keep only the name of the one you choose. We put only the sessions’ times and links in your calendar, and we change nothing else in it. The credential you give us is encrypted with a key that is not kept with your data, and you can disconnect at any time, which deletes it.
Your practice management system, if you connect one
Halaxy, Cliniko, Splose, Zanda or Acuity. We hold the credential you give us, encrypted the same way, and use it to read when you are busy. If you ask us to, we also add your Supriva sessions to it as time that is taken, with a link to the session and nobody’s name. In Halaxy and Zanda that means one patient or client record named for Supriva, which is nobody, for the sessions to be booked against. Disconnecting deletes the credential, and takes the sessions still to come back out.
People you already supervise
A supervisor can invite the practitioners they already work with by giving us their names and email addresses. We email each person once, on the supervisor’s behalf, saying who invited them and where their details came from. If they do not join within 30 days, we delete what we were given.
Bookings and payments
Which sessions you book, whether they went ahead, and the record of hours that produces. Payment is handled by Stripe. Your card details go to Stripe and never pass through us; what we hold is a reference to your Stripe record. If you are a supervisor, Stripe also holds your payout details and whatever identity information Stripe needs to pay you. We issue the supervisor’s invoice to the practitioner on the supervisor’s behalf. A supervisor can choose to pay all or half of our platform fee for their supervisees. We send our own invoice for the platform fee to each person who pays a share of the fee.
Video sessions
Sessions happen over video inside Supriva. We record who joined and when, so that a session counts. We do not record audio or video, and we do not transcribe sessions.
A supervision note on your confirmation
When a session went ahead, a social worker, their supervisor or a group’s host can add a note to their confirmation. The note says how the session met the AASW’s supervision requirements. A note is optional, and holds up to 1,000 characters. Your supervisor or practitioner sees the note. In a peer group, the peers who were there see each note. In a paid group, the host sees each member’s note, and the members see the host’s. The note appears on the supervision record and on the record’s PDF. We ask you not to name or describe a client in a note. We keep each note with the signed confirmation, for as long as we keep the supervision record.
Messages
You can send messages to a supervisor who supervises you, or to a person you supervise. Booking an emergency session also starts a conversation with that supervisor. The conversation shows the booking, and you can write to the supervisor before the session. A supervisor can also ask questions before somebody joins one of their groups or books a first session with them. We call those questions a pre-screen. A pre-screen can include a video call of up to 10 minutes.
Each conversation is encrypted with a key of its own, held apart from the messages. Our team does not read your messages. When you report a message, our team sees that one message and your reason. We record who on our team opened the report, and when. We delete a report with its conversation, or 12 months after our team closes it, whichever comes first.
We note when you last read a conversation, and when you were last on its page. The other person sees whether you are there. Nothing is stored while you type. When a message waits unread, we send you one email. The email names who wrote, and never what they wrote.
A supervisor sees the phone number on your account as soon as you start their pre-screen. You see the supervisor’s phone number once you have sent them a message in the pre-screen. A supervisor also sees the phone number of each person they supervise, in their conversations and on that person’s record. Nobody sees the phone number of an account that has closed. A pre-screen call runs in Australia, and nothing in the call is recorded. We keep when the call opened, when each person joined, and when the call ended.
We ask you not to name or describe a client in a message.
When we delete your account, the messages you sent stay with the other person, as part of their conversation. Your name on them is replaced with “A former member”. A report you made stays under the same name. We delete a conversation 30 days after everyone in it has closed their account.
Support
When you write to support@supriva.com.au, send a message from our contact page, or send an enquiry from our page for organisations, the message becomes a support ticket in our own system. Our support system runs in Australia, with everything else we hold. An enquiry for an organisation also gives us the organisation’s name, and, if you give them, its sector, its size and the timing you have in mind. Your message, any files or pictures in it, and our replies are kept on the ticket, and only our team can see it. If you wrote from the address on your Supriva account, the ticket is linked to your account so we can help with it. Our replies come from support@ and are signed by the person on our team who wrote them. Mail to support@ passes through our Google Workspace email on its way to that system, and is not kept there.
When you chat with us from Help in your dashboard, the conversation is a support ticket too, linked to your account and kept the same way. While you have it open we note that you are there, so the person answering knows whether you will see their reply; if you have left before reading it, we send it to you by email from support@.
If a call would help, someone on our team can open the phone number on your account to ring you. Each time they do, we record who opened it and when.
When you write to hello@supriva.com.au or to the Privacy Officer, your message and our replies are held in our email. Our email runs on Google Workspace, so Google holds that correspondence in the United States the way an email provider holds any business’s mail. The contact page and the enquiry form for organisations keep a coded form of the address each message came from. We keep that code for a day, to stop anyone flooding us through either form.
Automatically
Our servers keep logs of requests for 90 days, including the address your device connects from and the pages you asked for. Anything that would identify you in a web address, such as an email address or a one-time link, is removed before it is written. We set five cookies. They keep you signed in, protect your account and our forms, remember where you were on your dashboard, and note which advertisement or email brought you to Supriva. None of them follows you around the web or builds a profile of you. Nobody else reads them. We run no analytics.
Sensitive information
The Privacy Act treats some information more strictly, and it reaches this policy in two forms.
Your registering body membership. The Act’s category is membership of a professional association. We collect it with your consent, as a step of its own, because checking it is how a supervisor becomes findable and how we know which rules apply to you.
Preferences that imply something. A preference for a faith-informed or LGBTQIA+ affirming supervisor is not a fact about you, but it can suggest one. We collect these preferences only if you offer them, use them only in matching, show them to nobody, and never combine them with anything else.
Supervision discusses clinical work, and those conversations stay between the people in the session. We do not record, transcribe or keep any part of what is said, so we collect no health information about you, or about anybody you work with.
How we use your information
We use what we collect to run your account; to check your registration; to work out your supervision requirement and record hours towards it; to show practitioners the supervisors who fit what they have told us about their practice; to take bookings and collect payment on the supervisor’s behalf; to run sessions; to keep your record of supervision; to answer you; and to keep the platform safe.
Two things we do not do. We do not decide whether your hours meet your requirement. We record the supervision you book through Supriva and report it towards your requirement; whether your registering body accepts those hours is their decision. We do not recommend supervisors. We show you who fits what you told us, and we check the registration and insurance details supervisors give us. The choice is yours.
We will send you messages about your account, your sessions and your record, which you cannot opt out of while you have an account. We will also send you news about Supriva and invitations to the community events we run, and every one of those carries an unsubscribe. We never share your information for anyone else’s marketing, and we never sell it.
Who sees your information
The people you work with Australia
A supervisor sees a practitioner’s name, contact details, date of birth, registration, practice details and record of sessions with them. A practitioner sees a supervisor’s public profile and their sessions together. You are in a supervision relationship, and this is what holding one takes.
Search engines United States
A supervisor’s profile page is public. Anybody holding its link can open it, and it shows what the supervisor put on it, including their registering body. Once we have approved the profile, search engines such as Google can list the page and keep a copy of it, unless the supervisor opts out. A supervisor can opt out in Settings at any time, and search engines drop the page the next time they read it.
Stripe United States
Payment and payout details, and the identity information Stripe requires of the people it pays. Stripe handles payments.
Amazon Web Services Australia
Everything we hold, since our systems run there, including our support tickets, our video conferencing and any AI tools we use.
Google United States
The email address you sign in or connect a calendar with, as a hint to Google’s sign-in page. A request naming your practice address, if you offer in-person sessions, so Google’s validation service can check it; Google already maps the place, so what we send is the question rather than anything new about you. The email you exchange with our team at hello@ and with the Privacy Officer, since our own email runs on Google Workspace; mail to support@ only passes through it. When you sign in with Google or connect a Google calendar, information flows the other way: Google tells us your name and email, or when you are busy. If you ask us to add your Supriva sessions to your Google calendar, we keep a calendar called Supriva in your account, or use one of your own calendars that you choose. We send Google the time of each session and a link to it, never who it is with.
Microsoft United States
Only the email address you connect an Outlook calendar with, as a hint to Microsoft’s sign-in page. The calendar itself flows from Microsoft to us, and we keep only the busy times. If you ask us to add your Supriva sessions to your Outlook calendar, we keep a calendar called Supriva in your account, or use one of your own calendars that you choose. We send Microsoft the time of each session and a link to it, never who it is with. We send Microsoft nothing else about you.
Apple United States
Nothing about you goes from us to Apple. Sign in with Apple runs the other way: Apple tells us the email address you chose to share and, the first time you authorise, your name. If the address you chose is one of Apple’s private relay addresses, the email we send you reaches you through Apple.
Your registering body Nothing
We read their public registers. We send them nothing about you.
Regulators and courts Australia
What the law requires, when it requires it.
Our staff can see what they need to do their jobs. One internal tool lets our team resolve a registration number against our copy of the public registers when reviewing a registration claim; it returns the register’s own public page, never a name.
Information that leaves Australia
Stripe holds your payment, payout and identity information in the United States. Google holds the email you exchange with our team at hello@ and with the Privacy Officer, since our own email runs on Google Workspace, and receives a request naming your practice address when we check it, which is a place Google already maps. Microsoft holds nothing about you from us beyond the email address you connect a calendar with. If you ask us to add your Supriva sessions to a Google or Outlook calendar, that company also holds the time of each session and a link to it, in a calendar we keep for them, never who it is with. Apple holds nothing about you from us at all, though mail addressed to one of its private relay addresses reaches you through Apple.
A calendar or a practice management system you connect is not on this list. We retrieve when you are busy from Google, Microsoft, Halaxy, Cliniko, Splose, Zanda or Acuity, and disconnecting deletes what we kept. If you ask us to add your Supriva sessions to one of them, what we send is the time of each session and a link to it, never who it is with, so it tells them nothing about you beyond that you are busy.
For each of them we take reasonable steps so that they handle information in line with the Australian Privacy Principles, principally through their contracts with us and their published privacy commitments. Our video conferencing, and any AI tools we use, run on Amazon Web Services in Australia.
Search engines are the exception, for a supervisor who has not opted out of search. We send them nothing. They read the public page as anybody can and keep their own copy, mostly in the United States. We have no contract with them, which is why every supervisor can opt out.
How we protect it
Your information is encrypted in transit and at rest. Our systems run in Australia, access is limited to the people who need it and is logged, and we keep those logs so that if something goes wrong we can find out what. Credentials you give us for your calendar or practice system are encrypted with a key held separately from the data.
We never store your password. What we keep is a scrambled form that cannot be turned back into the original, so there is nothing for anyone to read, including us. Nobody at Supriva can look up your password or tell you what it is; if you have forgotten it, we can only help you set a new one.
We have a written data breach response plan. If a breach is likely to cause you serious harm, we will tell you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.
How long we keep it
| Information | Kept for |
|---|---|
| Your account and profile | While your account is open, and 30 days after you close it. Then we delete it, including your name. We keep your email address only in a scrambled form that cannot be read back. It lets us find your record if you write to us from that address. |
| Your record of supervision sessions and hours | Exported to you when you close your account. We keep it for seven years, then delete it. Seven years is the period your registering body or a court may ask about. Your name stays in the records of the people you met with, as part of their record, for the same seven years. |
| Insurance readings and registration-check evidence | With the record, for seven years. |
| Payment and invoice records | Seven years, as the law requires. |
| Calendar and practice-system credentials, and busy times | Until you disconnect, which deletes them. |
| Details of people you invited who did not join | 30 days. |
| Messages | Until 30 days after everyone in the conversation has closed their account. Your messages stay with the other person until then, under “A former member”. |
| Reports of a message | With the conversation, or 12 months after our team closes the report, whichever comes first. |
| Support tickets, with the files and pictures in them | Two years after the ticket is solved, then deleted. A message we mark as spam, 30 days. |
| Server logs | 90 days. |
| Backups | Up to 13 months in locked backups, never restored except to recover the whole service. |
Seeing and correcting your information
Most of what we hold about you is on your dashboard and your profile, and you can change most of it there yourself.
For everything, your account will include an export that gives you a complete copy of what we hold, in a form you can read and a form another system can read. Because it is yours, it is free.
For anything you cannot see or change yourself, write to the Privacy Officer at privacy@supriva.com.au from the address on your account. We will confirm the request is yours before acting on it, and we will answer within 30 days. If you have closed your account, write from the address it was registered under; your record of supervision outlives your account and you can still have a copy.
If we correct something, we will tell you. If we decline a request, we will tell you why in writing, and how to complain.
If you are a practitioner’s client
You are never on Supriva, and we never know who you are. Your practitioner may discuss their work with you in supervision, which is a requirement of their profession and exists to protect you. We do not record or transcribe sessions, so nothing said in one is held by us. If you have a question about information a practitioner has discussed about you, your practitioner is the right person to ask first. If you believe Supriva holds information about you, write to privacy@supriva.com.au and we will look.
If you are on a public register
ACA and PACFA publish registers of their supervisors. To check that a supervisor on Supriva is who they say they are, we keep a copy of the smallest part of those registers that answers that question: the body, the registration number, the state, whether the person is listed as a supervisor, the address of their public register page, and their name held only in a scrambled form we cannot reverse.
We hold no email address, phone number or practice address from the registers, we never use the copy to contact anyone, and we refresh it from the registers themselves. If you are on a register and have never used Supriva, that is all we hold about you. The register is the source; if you think our copy is wrong, tell us, and we will check it against the register.
Complaints
If you think we have mishandled your information, write to the Privacy Officer at privacy@supriva.com.au. We will acknowledge your complaint, look into it, and reply within 30 days. If you are not satisfied with our answer, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.
Changes to this policy
When we change this policy we update the date at the top. We keep every earlier version, and you can ask us for the one that applied on any given day. If a change affects how we use information you have already given us, we will tell you before it takes effect.
Contact
Privacy Officer, Supriva Pty Ltd, privacy@supriva.com.au.
The terms for the public parts of this site are the website terms of use.