VocaMinds
Privacy Policy
1 About this Privacy Policy
In this Privacy Policy, ‘us’, ‘we’, ‘our’ or ‘VocaMinds’ means VocaMinds Pty Ltd (ACN 699 352 960).
This Privacy Policy sets out our commitment to protecting the privacy of your Personal Information provided to us, or otherwise collected, used, stored, handled or disclosed by us when providing the VocaMinds mobile application and the other services we make available from time to time (together, the Services), or when otherwise interacting with you.
VocaMinds is a self-reflection and journaling tool. It is not a health service provider. We do not provide medical, psychological, psychiatric, therapeutic, counselling or crisis services, and we do not provide medical advice, diagnosis or treatment.
The Services are made available through the App only and are intended for users located in Australia. We also operate an informational website at www.vocaminds.com, which provides information about VocaMinds, shares updates, and directs users to download the App. The Services themselves are not accessed through the website.
We handle Personal Information in accordance with the Privacy Act 1988 (Cth) (Privacy Act), the Australian Privacy Principles and other privacy laws that apply to us.
Because your Journal Entries and related content may reveal Sensitive Information about you, including information about your health, thoughts and emotions, we treat that information with particular care, as described in this Privacy Policy.
By using the Services, or in providing any Personal Information to us, you consent to our collection, use, storage, handling and disclosure of your Personal Information in accordance with this Privacy Policy and any other arrangements that apply between us.
We may update this Privacy Policy from time to time by publishing the updated version in the App. We encourage you to review it periodically. Where a change materially affects how we handle Personal Information, we will take reasonable steps to notify you via email in advance or at the time the change takes effect, where practicable and appropriate, and we will seek any consent required by law for a new use or disclosure.
2 Definitions
In this Privacy Policy:
App means the VocaMinds mobile application and any related digital interfaces.
AI Features means any artificial intelligence, machine learning or automated functionality that we make available as part of the Services, including the transcription of voice recordings, the summarisation of Journal Entries, and the detection of language patterns that may indicate you could benefit from Support Resources.
Journal Entry means any entry you create through the App, whether by voice recording or by typing, together with any transcription or summary of that entry.
Personal Information has the meaning given in the Privacy Act and includes information or an opinion about an identified or reasonably identifiable individual. For example, this may include your name and contact details.
Sensitive Information has the meaning given in the Privacy Act and includes health information, and information about your racial or ethnic origin, political opinions, religious beliefs, sexual orientation or practices, criminal record or biometric information.
Services has the meaning given in section 1.
Support Resources means the supportive messaging and details of third-party support services (including Australian support hotlines) made available through the App.
User Account means the account you register in order to access the Services.
A reference to User, you or your means any individual to whom this Privacy Policy applies, according to the context.
3 Personal Information we collect
The Personal Information we collect depends on how you interact with us and the Services. We only collect Personal Information that is reasonably necessary for our functions and activities, or as otherwise permitted, required or authorised by law.
3.1 Account and profile information
When you register for and use a User Account, we may collect:
(a) your email address;
(b) authentication information, including the verification code sent to your email address and your password, which we store in a secured form;
(c) your date of birth;
(d) the profile information you choose to provide; and
(e) the State or Territory you select in order to receive relevant Support Resources.
3.2 Journal Entries and related content
When you use the App, you may create Journal Entries by speaking into your device’s microphone or by typing. Voice recordings are processed only momentarily to generate a transcription and are not stored by us (see section 7). We collect and store:
(a) the text you type;
(b) transcriptions of your voice recordings generated using AI Features; and
(c) summaries of your Journal Entries generated using AI Features.
Journal Entries are personal to you and may contain Sensitive Information, including information about your health, thoughts and emotions. We treat Journal Entries as private to your User Account and handle them as described in this Privacy Policy.
3.3 Support Resources information
The App uses AI Features to detect language patterns in a completed Journal Entry that may indicate you could benefit from support. Where such patterns are detected, the App may display a supportive message and details of relevant Australian support hotlines for your selected State or Territory.
We do not monitor Journal Entries in real time, and we do not contact emergency services, any support service or any other third party on your behalf. Whether you contact a support service is your decision. The support services shown are selected from a list of Australian support services that we maintain.
3.4 Information we collect automatically
When you use the App, we may automatically collect technical and usage information for security, operational, support and performance purposes. We do not currently collect usage analytics or de-identified behavioural information about you. The technical information we may collect includes:
(a) device, operating system, app version and unique device identifier information;
(b) Internet Protocol (IP) address and general location derived from it;
(c) login, session, authentication and security information; and
See section 14 for more information about the analytics and similar technologies we may use.
3.5 Sensitive Information
Some Personal Information we collect is Sensitive Information, in particular the content of your Journal Entries, which may reveal health information and other Sensitive Information about you.
We collect Sensitive Information only where it is reasonably necessary for our functions or activities and with your consent, or where otherwise permitted, required or authorised by law. By creating Journal Entries and using the Services, you consent to our collection, use, storage, handling and disclosure of that Sensitive Information as described in this Privacy Policy.
We use and disclose Sensitive Information only for the purpose for which it was collected, for directly related purposes you would reasonably expect, or as permitted, required or authorised by law.
4 How we collect Personal Information
4.1 Direct collection
We may collect Personal Information directly from you when you:
(a) create or use a User Account;
(b) create Journal Entries;
(c) select a State or Territory or otherwise use the Support Resources feature;
(d) contact us, request support, make a complaint or provide feedback;
(e) subscribe to updates or a waitlist (for example, through our website); or
(f) otherwise interact with us or the Services.
4.2 Collection through your use of the App
We also collect information automatically through your use of the App, as described in section 3.4.
4.3 Consent
By using the Services and providing Personal Information to us (including by creating Journal Entries), you consent to our handling of that information, including any Sensitive Information it contains, in accordance with this Privacy Policy. You may withdraw your consent as described in section 4.5.
4.4 Children
The Services are intended for users who are at least 18 years old (see our Terms and Conditions). We do not knowingly collect Personal Information from a person who is not eligible to use the Services. If we become aware that we have done so, we will take reasonable steps to delete that information.
4.5 Withdrawal of consent
You may withdraw your consent to our handling of your Personal Information by contacting us, or by deleting your User Account (see section 12). Withdrawal does not affect any handling of Personal Information that occurred lawfully before the withdrawal, and it may prevent us from providing some or all of the Services.
5 How we use Personal Information
We may collect, hold, use and disclose your Personal Information for the following purposes:
(a) to enable you to access and use the Services, including to create, store, transcribe and summarise your Journal Entries;
(b) to operate, protect, support, maintain and improve the Services;
(c) to provide the Support Resources feature;
(d) to create and administer your User Account and verify your identity;
(e) to communicate with you and respond to your enquiries, support requests and complaints;
(f) to prevent, detect and investigate fraud, misuse, errors, unauthorised access and security incidents; and
(g) to maintain records, conduct audits and comply with our legal, regulatory and other obligations.
We may also use or disclose Personal Information for another purpose where you have consented, you would reasonably expect the use or disclosure and it is permitted by law, or the use or disclosure is otherwise permitted, required or authorised by law.
We do not sell your Personal Information, and we do not use the content of your Journal Entries for advertising or targeted marketing.
6 What happens if we cannot collect your Personal Information?
If we cannot collect the Personal Information we reasonably require, we may be unable to provide some or all of the Services, create or maintain your User Account, verify your identity, or respond to your enquiries, complaints or support requests.
You may deal with us anonymously or using a pseudonym where it is lawful and practicable, such as when making a general enquiry. However, this will generally not be practicable where we need to identify you to provide the Services or comply with our legal obligations.
7 AI Features
(a) We use AI Features to transcribe your voice recordings into text, to generate summaries of your Journal Entries, and to detect language patterns that may indicate you could benefit from Support Resources.
(b) If you use AI Features, we may collect and handle:
(i) the content you submit to the feature, including voice recordings and typed text;
(ii) the transcriptions, summaries and other output generated by the feature; and
(iii) technical, usage, performance, security and audit information associated with the feature.
(c) AI Features are limited to the functions described above. They do not provide medical, psychological or other professional advice, and they do not make decisions about you. You remain responsible for reviewing any AI-generated content before relying on it.
(d) We use third-party cloud service providers to deliver the AI Features, and your User Content is transmitted to and processed by them for that purpose. In particular, AssemblyAI provides speech-to-text transcription and language detection (processing your voice recordings), and OpenAI provides summarisation of your Journal Entries and the selection of relevant Support Resources from the list we maintain (processing the text of your entries). We disclose User Content to these providers only as reasonably necessary to provide, secure and support the relevant feature and in accordance with our arrangements and applicable law.
(e) Where an AI Feature involves materially different information-handling practices, we may provide an additional collection notice or seek specific consent at or before the relevant collection, use or disclosure.
8 Service communications and direct marketing
(a) We may send you communications that are reasonably necessary to provide, administer, secure or support the Services, including verification messages, account notices, service updates, support messages, safety notices and security alerts. You may not be able to opt out of communications required to provide an active Service.
(b) Where you have consented, or where otherwise permitted by law, we may send you marketing communications about VocaMinds features, updates and related content, including where you subscribe to updates or a waitlist through our website. You may opt out at any time by using the unsubscribe facility in the communication, updating any available communication preferences, or contacting us. Opting out of marketing does not affect service communications.
(c) We do not use the content of your Journal Entries for direct marketing or targeted advertising.
9 Who we may disclose your Personal Information to
(a) We do not sell the Personal Information we collect about you. However, we work with other companies that help us provide the Services, and we may disclose Personal Information to them for that purpose. Where reasonably necessary for the purposes described in this Privacy Policy, we may disclose Personal Information to:
(i) our service providers and contractors, including providers of cloud hosting, infrastructure, storage, transcription, AI or model access, analytics, security and customer support services;
(ii) our professional advisers, auditors and insurers;
(iii) our employees and contractors who require access to perform their duties;
(iv) courts, tribunals, regulators, government bodies and law enforcement agencies where permitted, required or authorised by law; and
(v) any other person to whom you direct or authorise us to disclose information.
(b) Our service providers are only provided with access to Personal Information as is reasonably necessary for the purpose for which we engage them, and we require them to comply with our standards and all applicable laws.
(c) If you choose to export a Journal Entry as a PDF and share it with another person, that disclosure is made by you and is outside our control. We are not responsible for how any recipient accesses, uses, stores or further shares a Journal Entry you share.
10 Overseas disclosure and access
(a) Some of our service providers may be located outside Australia or may store or access Personal Information from overseas. This may include providers of cloud infrastructure, storage, transcription, AI, analytics and security services.
(b) Your Journal Entries and account information are stored in Australia, on Amazon Web Services infrastructure. However, to provide the AI Features, the text of your Journal Entries (and, transiently, your voice recordings) is transmitted to and processed by AssemblyAI and OpenAI, who may be located outside of Australia, as described in section 7. Some of our other service providers may also be located outside Australia or access Personal Information from overseas.
(c) Where we disclose Personal Information to an overseas recipient, we take reasonable steps to ensure the recipient handles it consistently with the Australian privacy requirements, unless an exception applies. We may also disclose Personal Information overseas where permitted, required or authorised by law.
(d) The countries in which overseas recipients are likely to be located may vary according to the relevant provider and Service. In relation to the AI Features, overseas recipients are likely to be located in the United States. We will identify any other relevant countries in this Privacy Policy or an additional collection notice where practicable.
11 Security and data breaches
(a) We take reasonable steps to protect Personal Information from misuse, interference, loss and unauthorised access, modification or disclosure.
(b) Our safeguards are designed having regard to the nature and sensitivity of the information, the risks presented by the relevant systems and activities, and current operational and technical practices. Depending on the relevant system and use case, these may include:
(i) encryption of data in transit using TLS 1.2 or higher;
(ii) encryption of data at rest on Australian-hosted servers (AWS, Sydney);
(iii) access controls and authentication measures to restrict access to authorised personnel only; and
(iv) regular security reviews and testing of our systems.
(c) As part of our security protocols, we may occasionally ask for proof of identity before disclosing Personal Information to you.
(d) While we take reasonable steps to safeguard Personal Information, no method of electronic transmission or storage is completely secure, and accordingly we cannot guarantee the absolute security of your Personal Information.
(e) If a data breach occurs, we will respond in accordance with our legal obligations. Where the breach is an eligible data breach under the Privacy Act, we will notify the Office of the Australian Information Commissioner (OAIC) and affected individuals as required by the Notifiable Data Breaches scheme.
12 Retention and deletion
12.1 How long we keep your information
We retain Personal Information only for as long as reasonably necessary for the purposes for which it was collected, including to provide the Services, comply with our legal and regulatory obligations, resolve disputes and enforce our agreements. In determining the appropriate retention period, we consider the nature and sensitivity of the information, the purposes for which it is held, the risk of harm from unauthorised use or disclosure, and our legal and other obligations.
12.2 Deleting your account
You may delete an individual Journal Entry at any time, in which case it is deleted from our active database immediately. You may request to delete your User Account at any time through your account settings in the App. As described in our Terms and Conditions:
(a) once you request deletion, your data is maintained in a deactivated state for 30 days;
(b) if you log back into the App within that 30-day period, your deletion request is automatically cancelled and your User Account is fully reactivated; and
(c) if you do not log in within 30 days, your User Account and all associated user data are permanently deleted from our systems, except to the extent we are required or permitted to retain certain data by law.
12.3 Deletion and de-identification
When Personal Information is no longer required, we take reasonable steps to destroy or de-identify it, unless we are required or authorised by law to retain it. If immediate deletion is not reasonably practicable, including where information is held in backups, we securely restrict it from further active use until deletion or de-identification is possible. A deletion request does not apply to any Journal Entry you have already exported or shared with another person.
13 Access and correction
(a) You may request access to, or correction of, Personal Information we hold about you at any time by contacting us at contact@vocaminds.com. We may need to verify your identity before acting on a request.
(b) We will respond to your request within the period required by applicable law. We may refuse or limit access or correction where permitted or required by law and, if we do, we will provide written reasons and explain any available complaint process, unless it would be unlawful or unreasonable to do so.
(c) Where information we hold is inaccurate, incomplete, out of date, irrelevant or misleading, we will take reasonable steps to correct it as required by law.
14 Cookies and similar technologies
We may use cookies, web beacons and similar technologies on our App to operate and secure the Services, maintain sessions, remember preferences, understand usage and improve performance.
Where information collected through these tools is Personal Information, we handle it in accordance with this Privacy Policy.
The types of cookies we may use include:
(a) essential cookies, which are necessary to operate the Services, authenticate users, maintain sessions and protect security;
(b) functional cookies, which remember your preferences and settings to improve your user experience;
(c) analytics cookies, which help us understand how the website and Services are used and improve their performance; and
(d) marketing cookies, which may be used on our public website to measure advertising and deliver relevant marketing, where permitted by law and subject to any required consent.
You may manage non-essential cookies through available cookie controls. Disabling certain cookies may affect the operation or functionality of the Services.
15 De-identified and aggregated information
(a) We may create and use aggregated or de-identified information for internal analytics, security, service quality and improvement of the Services.
(b) We take reasonable steps to ensure that this information is no longer reasonably identifiable, and we do not attempt to re-identify it except as permitted or required by law.
16 Links
The Services may include information about, or links or contact details for, third-party support services and other third parties, including the Support Resources. Unless we state otherwise, we do not control those third parties and are not responsible for their privacy practices or content. You should review the privacy information provided by the relevant third party before providing Personal Information to it.
17 Privacy complaints
(a) If you think we have breached the Privacy Act, or you wish to make a complaint about the way we have handled your Personal Information, you can contact us using the details in section 18 with full details of your complaint.
(b) We will acknowledge and investigate your complaint and respond within a reasonable period. We may ask for further information or need to verify your identity.
(c) If you are not satisfied with our response, you may contact the OAIC at https://www.oaic.gov.au/.
18 Contact us
For questions about this Privacy Policy, or to request access, correction or deletion, withdraw consent or make a complaint, please contact us at:
VocaMinds Pty Ltd (ACN 699 352 960)
Email: contact@vocaminds.com.