Draft for review. This wording has not been approved yet and may change before it applies.

Go—Practitioner

Data processing agreement

Your practice's records stay yours. We hold them for you, in Australia, under NZ privacy law.

This agreement is between Coreshift (“we”), which runs Go—Practitioner in partnership with Go—, and each practice that uses it (“the practice”). It applies to the personal and health information about the practice's clients and staff that the practice puts into Go—Practitioner. It sits alongside our privacy policy.

1. Roles

The practice is the agency responsible for its client information under the Privacy Act 2020 and the Health Information Privacy Code 2020. We hold it as the practice's agent under section 11 of the Act: only to provide Go—Practitioner to the practice, and not for any purpose of our own.

2. What we will do

• Use the practice's information only to run Go—Practitioner for it, or where the law requires us to.
• Never sell it, use it for advertising, or combine it with other practices' information.
• Keep it in Sydney, Australia, encrypted when stored and when sent, and backed up every day.
• Keep each practice's records apart, so no other practice can see them.
• Log every time a client record is opened, and give the practice that log on request.
• Let our own people see client information only when the practice asks us to help, or to fix a fault, and keep that to the minimum needed.
• Help the practice answer a client's request to see or correct their information.

3. Services we use

We use these services to run Go—Practitioner. We tell practices before we add or replace one.

• Supabase (database and file storage, Sydney, Australia). Holds all records, including clinical notes.
• Railway (app hosting, Singapore). Handles requests; keeps no copy of the records.
• Stripe (payments). Holds card details and payment records, in the practice's own Stripe account.
• Cloudflare (email sending and bot checks on the booking page). Sees email addresses and the content of the emails we send, never clinical notes.

4. Privacy breaches

If we become aware of a privacy breach affecting the practice's information, we will tell the practice without undue delay and within 48 hours. We will say what happened, what information was involved and what we are doing about it, and help the practice decide whether to notify the Privacy Commissioner and the people affected.

5. Keeping records

Health records must be kept for at least 10 years after a client's last treatment (Health (Retention of Health Information) Regulations 1996). Signed clinical notes can't be changed or deleted in Go—Practitioner; corrections are added as dated addenda.

6. If the practice stops using Go—Practitioner

We will give the practice a copy of all its records in a standard format on request. After that, we keep the records on the practice's behalf until the retention period ends, or hand them over and delete our copy when the practice instructs us in writing, whichever the practice chooses.

7. Contact

Practices can reach us about this agreement, a client's request or a suspected breach at support@go-practitioner.com.

Questions or concerns: support@go-practitioner.com. Last updated 2 November 2026.