Privacy policy

Last updated: 1 Nov 2026

Who we are

Group Managed Pty Ltd, trading as Practice Managed (ABN 21 702 423 701), provides compliance and practice management software for Australian general practices. This policy explains how we handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

You can contact us about anything in this policy at hello@practicemanaged.com.au.

What this policy covers, and what it does not

Practice Managed is used by practice staff to manage policies, compliance records and practice operations. We do not collect or store patient health records. The personal information we handle belongs to the people who work at a practice, not the people it treats.

What we collect

Account details. Your name, work email address, and your role at your practice.
Practice details. Practice and site names, addresses, contact details, and operational information entered during setup.
Compliance records. Policy documents your practice writes, records of who has read and acknowledged them and when, version history, and activity records showing who did what in the product.
Sign-in and security records. Sign-in events and security-related events, kept so your practice's records can be trusted.
Technical information. Standard web logs such as IP address and browser type, used to keep the service secure and working.

We collect this information directly from you or from your practice administrator when they invite you.

When you use our website

This part covers practicemanaged.com.au, including the readiness check, the early access list and our free resources.

The readiness check. Your answers to the ten questions. If you ask for your to-do list, your first name, email, practice name and, if you choose, your phone number.
The early access list. Your first name, email, practice name and, if you choose, your phone number.
Free templates. Your first name and email, so we can send you the template.
Your choice about tips. Whether you ticked "Send me occasional tips by email", with the date and time you did. For the readiness check, the date and time you asked for your to-do list, which is when you agreed to our emails.

We use these details to send you what you asked for (your to-do list, the template, or word when the trial opens). If you ticked the tips box, we also send occasional tips by email. If you took the readiness check, we also send five follow-up emails over a month, then weekly tips, as the check says above its button. Your first name and email are kept on our mailing list with Resend until you stop our emails. Every one of these emails has a link to stop them, which takes you off the list straight away. You can also ask us to stop at any time at hello@practicemanaged.com.au.

When you send a form, the details are emailed to our team inbox and your email is sent to you. Both are sent through Resend, the email provider named below.

Our website does not use cookies or tracking tools.

Why we collect it

To provide the service: accounts, policies, acknowledgements, dashboards and reports.
To keep an accurate compliance record for your practice, which is the product's purpose.
To keep the service secure, including detecting misuse.
To communicate with you about the service, such as invitations and notifications.
To reply to you when you use a form on our website, as described above.

We do not sell personal information, and we do not use it for advertising.

Who can see your information

Your practice. Practice Managed is a workplace tool. Your practice's administrators can see your account details and your compliance records, such as which policies you have acknowledged.
Our service providers. We use a small number of providers to run the service, listed below.
No one else, unless the law requires it.

Where your information is stored and processed

Storage. Your practice's data is stored in Australia (Sydney), with our database provider Supabase.
Processing. When you use the app or our website, requests are processed on infrastructure operated by Vercel, which may occur in the United States. Emails such as invitations, notifications and the emails our website sends are sent through Resend, a provider based in the United States.
Backups. Encrypted backup copies are kept in Australia (Sydney) with Google Cloud.
Ask PM. Questions asked in Ask PM, the help assistant inside the app, are answered with AI through Amazon Web Services in Australia (Sydney). Medicare numbers, dates of birth and phone numbers are removed from a question before it is sent.
Payments. Subscription payments are handled by Stripe. We never see or store your full card number.
Address search. When you type an address in the app, Google Maps suggests matches.
If you sign in with Google or Microsoft, those providers handle that sign-in under their own privacy policies.

Where information is processed overseas, we take reasonable steps to ensure the providers handle it consistently with the Australian Privacy Principles.

How we protect it

All connections to Practice Managed are encrypted in transit using TLS with 256-bit encryption.
Access to your practice's data is restricted by role, enforced at the database level.
Compliance records are tamper-resistant: acknowledgement records and policy versions cannot be silently altered.

Access and correction

You can see and update your own details in the app. For anything you cannot change yourself, contact us at hello@practicemanaged.com.au or your practice administrator, and we will respond within a reasonable time. You may request a copy of the personal information we hold about you.

Retention and deletion

Compliance records exist to evidence your practice's accreditation and are retained while your practice uses the service, including records of people who have left the practice, because a compliance record loses its value if it disappears when a person does. If your practice stops using Practice Managed, an administrator can switch off the practice's account in Settings. We keep a switched-off account for 30 days in case it was switched off by mistake, then delete it for good. Copies held in encrypted backups are removed as those backups expire, within a further 30 days. Before leaving, your practice can ask us for a full copy of its information.

Data breaches

If a data breach occurs that is likely to result in serious harm, we will notify affected people and the Office of the Australian Information Commissioner in line with the Notifiable Data Breaches scheme.

Complaints

If you believe we have mishandled your personal information, contact us at hello@practicemanaged.com.au and we will investigate and respond. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Changes to this policy

If we change this policy, we will update it here with a new date. Material changes will be communicated in the app.