Privacy Policy

1. Open and transparent management (APP 1)

This Privacy Policy describes how we manage your personal information. It is publicly available at /privacy and linked in our footer and signup flow. You may contact us at hello@intoset.com with any privacy enquiries.

2. Anonymity and pseudonymity (APP 2)

Hospital post reviews are published anonymously. Your identity as a reviewer is stored for moderation and audit purposes only and is never displayed publicly under any circumstances. Where practicable, you may interact with parts of the platform without identifying yourself (e.g., the CV Calculator).

3. What information we collect (APP 3)

We collect only what is necessary to provide the intoSET service:

• Account information: name, email address, password (hashed)
• Professional information: current hospital, post-graduate year, target specialty
• Portfolio evidence: your responses to rubric questions and linked evidence URLs
• AHPRA registration number (supervisors only, for verification)
• Usage data: pages visited, features used (with your consent)
• Payment information: processed by Stripe (United States); we store only a Stripe customer reference ID

4. Unsolicited personal information (APP 4)

If we receive personal information we did not request and do not need, we will destroy or de-identify it as soon as reasonably practicable, provided it is lawful and reasonable to do so.

5. Notification of collection (APP 5)

We notify you of the collection of your personal information at signup and through this Privacy Policy. For each type of information collected, we describe the purpose in Section 6 below.

6. How we use your information (APP 6)

• To provide the intoSET service, including CV scoring and portfolio tracking
• To match you with relevant research projects and audit opportunities
• To send you transactional emails (account confirmations, application updates)
• To moderate content and verify supervisor credentials
• To improve the platform using aggregated, anonymised analytics

We do not sell your personal information to any third party. We do not share your information with specialty colleges, hospitals, or training authorities.

7. Direct marketing (APP 7)

We may send you a weekly digest email summarising new projects and opportunities matching your specialty. You can unsubscribe from digest emails at any time via the unsubscribe link in any email or through Account Settings. Transactional emails (account confirmations, application decisions) cannot be opted out of while your account is active.

8. Cross-border disclosure (APP 8)

Your account data, portfolio entries, and reviews are stored at rest in Australia, in our Supabase database in the Sydney (ap-southeast-2) region. However, some processing necessarily occurs overseas. The overseas recipients of your personal information, and the countries in which they hold or process it, are:

• Vercel (United States) — application hosting. Pages are rendered on Vercel servers in the Washington, D.C. (iad1) region, so information you submit or view passes through the United States in transit, even though it is stored in Australia.
• Stripe (United States) — payment processing. Card details are entered directly with Stripe and never reach our servers; we store only your Stripe customer reference ID.
• Resend (United States, with email processed in its Tokyo, Japan (ap-northeast-1) region) — transactional email delivery. Your email address and the contents of the email are processed in Japan in order to send it.

We do not currently use any product-analytics service. If we enable one in future, this Policy will be updated before it is switched on, and analytics cookies will only be set after you consent.

We take reasonable steps to ensure these overseas recipients handle your information in accordance with the APPs. Each is engaged under its own data-processing terms. By using intoSET you acknowledge that your personal information will be processed overseas as described above.

9. Government-related identifiers (APP 9)

AHPRA registration numbers are collected from supervisors for identity verification only. They are not used as a primary identifier, not disclosed to third parties, and not used for any purpose beyond confirming supervisor credentials.

10. Quality of personal information (APP 10)

You may update your profile information at any time through Account Settings. We encourage you to keep your information accurate and current.

11. Data storage and security (APP 11)

We use industry-standard security measures including encryption in transit (TLS) and at rest, row-level security on our database, and short-lived session tokens. Passwords are hashed and never stored in plain text. Daily database backups are maintained. When data is no longer needed, we securely destroy or de-identify it.

12. Access to your information (APP 12)

You may export your portfolio data at any time from Account Settings. For access to other personal information we hold about you, contact us at hello@intoset.com. We will respond within 30 days.

13. Correction of personal information (APP 13)

You may correct your profile information through Account Settings. For correction of other information (such as a moderated post review), contact us at hello@intoset.com. We will respond within 30 days.

14. Cookies and analytics

We use only the cookies necessary to keep you signed in and to remember your consent choice. No product-analytics service is currently enabled, and no analytics cookies are set. If we enable analytics in future you will be asked for consent first, and no analytics cookies will be set unless you accept. You may decline without affecting your ability to use the service. Your consent choice is stored in your browser.

15. Anonymous post reviews

Hospital post reviews are published anonymously. We store your identity as the reviewer in a restricted database field accessible only to platform administrators for moderation and dispute-resolution purposes. This field is excluded from all public API responses by database-level access controls. It is never displayed publicly under any circumstances.

16. Account deletion and data retention

You may delete your account at any time through Account Settings. On deletion, your personal profile data, portfolio entries, and application records are permanently erased. Anonymous CV Calculator snapshots created before signup are deleted after 30 days. Approved post reviews are retained in anonymised form (your identity removed) to preserve the value of the review database for the community.

17. Contact

Privacy enquiries: hello@intoset.com
Complaints may also be directed to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.