Status: the privacy duties are set out in our Privacy Policy; this statement is voluntary.

Information security

• Every piece of information is classified before any work starts: public, internal, or client and personal. Client and personal information stays inside our own business accounts.
• Our business accounts use multi-factor authentication. Access is limited to the people who need it.
• Sensitive information, intake information and session notes are kept in our Microsoft 365 workspace, which stores data in Australia.
• Artificial intelligence (AI) assistants work only through our own business accounts, under the Principal's login and on the Principal's instruction. They are connected to our Microsoft 365 workspace and our practice management workspace and can read and edit business files there. Our rules do not allow them to open client session records or cultural material. Anything they remove goes to a recycle bin first, so it can be restored. A written protocol sets out what any automated tool may and may not do.
• We do not record a session unless both sides have agreed it in writing beforehand. Where we record, it starts when the business part of the session begins. Our voice recorder is for our own notes and is switched off in sessions, meetings and yarns with clients.
• Credentials for business systems are held in a business password manager, not in browsers or documents.
• If a data breach is likely to cause serious harm, we assess it and notify the people affected and the Office of the Australian Information Commissioner where the Privacy Act 1988 (Cth) requires.

The page Platforms that may hold your information sets out where each kind of information is kept and the kinds of platform we use.

Business continuity

• Our systems are cloud-based, so work can continue from another device if one is lost or damaged.
• Records and systems are held in business accounts, separate from personal accounts, so access can be transferred.
• A separate emergency-access account exists for the business's core systems, so the business can regain access if the Principal is unavailable.
• For longer engagements we can introduce an associate, named to you, who can step in if the Principal cannot continue.

Part of Statements. For a signed copy on letterhead, email [email protected].