Last updated: 1 October 2026
Privacy Policy
Mindspan Pty Ltd (ABN 57 636 648 336), called "Mindspan", "we" or "us" here, operates the platform at app.mindspan.com.au. This policy explains how we collect, hold, use, and disclose personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
Where we need your agreement, for example before we keep a quiz result, we ask for it directly.
1. Who we are
Mindspan is an independent educational platform operated by a registered psychologist (AHPRA registration current). We provide psychoeducational resources, study programs, and related digital content. We are not a clinical service and do not provide psychological treatment through this platform.
2. Information we collect
Account information: Name, email address, and password (hashed) when you create an account.
Purchase information: Payment is processed by Stripe. We receive confirmation of payment and your email address, plus any invoice details you choose to add at checkout (for example a name, organisation, ABN, purchase order, registration reference or invoice email), which we keep with your purchase record for the tax invoice and support. We do not store card numbers or bank details.
Your privacy choices: When you create an account or buy, we ask you to acknowledge how we collect your information (including any sensitive information, such as self-reflection results) and to agree to our Terms of Service and this policy. At checkout, ticking the second box agrees to the Terms and this policy for your purchase. If you are already a customer, we show you the same two statements once, with an OK button. We record that you agreed, the date and time, and which version of this policy it was, on your account (if you are signed in) and on the purchase. A cookie on your device (ms_consent) remembers the version, so we only ask again when this policy changes.
Usage data: Pages visited, resources accessed, and program progress within the platform, collected via Supabase.
Site analytics: We run our own analytics on Mindspan’s websites. We record a randomly generated visitor ID stored in a cookie on your device, the site that referred you, any campaign tags (UTM parameters) in the address you arrived on, the forms you submit (that you signed up, not what you wrote), your purchases and course enrolments, and — where enabled — whether you opened or clicked a link in an email we sent you. Our own analytics may also record the pages you view and the links you click. This information is stored in our own Supabase database in Australia, is visible only to Mindspan staff, and is never sold or shared with advertisers. We also run Google Analytics and Vercel Analytics on our public pages, which collect their own usage statistics separately under their own privacy terms — our own analytics data described here is not sent to them. Our analytics does not record what you type into any form or message box, the content of your answers to any questionnaire, or anything clinical. It does not store your IP address — some signup forms separately store a one-way hash of your IP purely to detect abuse, from which your address cannot be recovered.
Communications: If you contact us by email, we retain your message and any follow-up correspondence.
Email marketing: If you purchase a program or subscribe to updates, your name and email are added to our email platform (Brevo) for delivery of program emails and relevant updates. You may unsubscribe at any time.
Self-reflection results (quizzes and tools): Some of our free self-reflection quizzes and tools (for example an anxiety check informed by the GAD-7) give you a result band, such as “mild”.
- If you choose to have your result sent to your email, we keep the band and overall score with your email address in our own database in Australia (Supabase), and we add the band to your contact record with Brevo, our email provider, which holds it in the European Union, so the emails that follow suit your result.
- Because a result like this is about your wellbeing, it is health information, which Australian privacy law treats as sensitive information. Before we keep it, we ask you to tick two boxes: one acknowledging what we keep and where, and one consenting to us handling it in line with this policy. Agreeing to our Terms of Service is not needed to get a result. Without both ticks nothing is saved.
- We use it to send your result and related emails. A copy of the result, with your email, is also sent to our practice inbox (info@mindspan.com.au), which is hosted by Google and may be stored outside Australia. We never sell it or share it with advertisers.
- We keep the result for 2 years after your last result, then delete it from our database, or sooner if you ask. If you gave us your email but didn't finish a quiz, we delete it after 12 months, or sooner if you ask. The copy in our practice inbox is kept with our email records, and the band on your Brevo contact stays until you ask us to delete it. For questionnaires that check for distress we keep only the band, never your individual answers. These quizzes are general education, not a diagnosis. Apart from these results, we do not collect health information through this platform.
3. How we use your information
- To create and manage your account
- To process purchases and grant access to paid programs
- To deliver program-related email sequences
- To respond to enquiries and support requests
- To improve platform content and user experience
- To comply with legal obligations
We do not use your information for automated decision-making that produces legal or significant effects.
4. Disclosure to third parties
We disclose personal information only to the following third-party service providers, each bound by their own privacy commitments:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication, file storage | Australia (ap-southeast-2) |
| Stripe | Payment processing | USA |
| Brevo (Sendinblue) | Email delivery and automation | European Union |
| Vercel | Web hosting, deployment and site analytics | USA |
| Google Analytics | Aggregate website usage statistics | USA |
We do not sell personal information. We do not share information with advertisers.
Where personal information is disclosed to overseas recipients (Stripe, Vercel and Google Analytics in the USA; Brevo in the EU), we take reasonable steps to ensure those recipients handle it in a manner consistent with the APPs (APP 8).
5. Data storage and security
Account and program data is stored in Supabase on servers in the AWS ap-southeast-2 (Sydney) region. Passwords are hashed using bcrypt and are never stored in plaintext. Payment data is held solely by Stripe and is not stored on our servers.
We use industry-standard security measures including TLS encryption in transit, row-level security in our database, and access control policies. No system is completely secure — if you become aware of a security issue, please contact us immediately at info@mindspan.com.au.
6. Retention
We retain account information while your account is active and for seven years thereafter for financial and legal compliance purposes. Purchase records are retained for seven years in accordance with the Income Tax Assessment Act 1997 (Cth). Some information linked to your account is kept for much less time, and each is deleted sooner if you ask: feedback or a review you send us is deleted 2 years after the last activity on it, a quiz or tool result 2 years after your last result, and the record of when you first saw a limited-time offer 12 months after the offer ends. Our Data Handling Policy lists every kind of information and how long we keep it. Email addresses on marketing lists are retained until you unsubscribe or request deletion.
7. Your rights (APP 12 and APP 13)
You have the right to:
- Access the personal information we hold about you
- Correct personal information that is inaccurate, out of date, or incomplete
- Request deletion of your account and associated data (subject to our legal retention obligations)
- Unsubscribe from marketing emails at any time via the unsubscribe link in any email or by contacting us
To exercise these rights, email info@mindspan.com.au. We will respond within 30 days.
8. Cookies and tracking
We use session cookies necessary for authentication and platform function, and a cookie (ms_consent) that remembers which version of this policy you agreed to, so we do not ask again until it changes. We also set one first-party cookie holding a randomly generated visitor ID. It is shared across Mindspan’s own sites on mindspan.com.au (and never with other companies’ sites). It lets us see a single visit as one journey rather than a series of disconnected page views (see “Site analytics” above). When a limited-time offer is running, it also records when you first saw the offer, so the deadline you are shown is genuine and stays the same across our sites (see our Data Handling Policy). We do not use third-party advertising cookies and we do not sell cookie data. Google Analytics may set its own cookies on our public pages under Google’s terms. Scripts on a page can read first-party cookies, including ours. Disabling cookies will prevent you from logging in to the platform. If your browser sends a Do Not Track or Global Privacy Control signal, our in-browser tracking of the pages you view and the links you click switches off. Our servers still record the things you do with us against your visitor ID, because the service needs them: signing up, downloads, course enrolments, logging in and purchases. If you visit while a limited-time offer is running, we also still note when you first saw the offer, so the deadline you see is genuine and does not change. None of this is used for advertising, and we will delete it if you ask.
9. Children
This platform is intended for adults aged 18 and over. We do not knowingly collect personal information from individuals under 18. If you become aware that a minor has provided us with personal information, contact us and we will delete it.
10. Complaints
If you believe we have breached the APPs, please contact us first at info@mindspan.com.au. If we do not resolve the matter to your satisfaction, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au. For health information, you can also contact the Health Complaints Commissioner in Victoria (hcc.vic.gov.au).
11. Updates to this policy
We may update this policy from time to time. Material changes will be communicated by email or a notice on the platform. If we change this policy in a way that affects what you agreed to, we will ask you again.
Contact: info@mindspan.com.au | Mindspan Pty Ltd | Melbourne, Victoria, Australia