1. Who we are
GP Edge is operated by The GP Edge (ABN [ABN — NOT YET OBTAINED]), registered in Queensland, Australia. In this policy, “GP Edge”, “we”, “us” and “our” refer to that entity.
GP Edge is a platform for Australian general practitioners and registrars. It provides examination preparation for the Australian General Practitioner Fellowship examinations, and Billing Assist, a search tool for finding Medicare Benefits Schedule item numbers relevant to a described service. GP Edge is not affiliated with, endorsed by, or accredited by the Royal College of General Practitioners (RACGP) or Australian College of Rural Remote Medicine (ACRRM).
We are committed to protecting your privacy and we comply with the Australian Privacy Principles (APPs) contained in the Privacy Act 1988 (Cth). A copy of the APPs is available from the Office of the Australian Information Commissioner at oaic.gov.au.
This policy applies to the GP Edge website, the GP Edge application, and any related services we provide.
2. What personal information we collect
Account information
Your account is created and managed through Clerk, our authentication provider. Clerk holds:
- Your name
- Your email address
- Your password — stored and managed entirely by Clerk. GP Edge never receives, stores or has access to your password.
- Authentication events, such as sign-ins and verification codes
Payment and subscription information
We use Stripe to process payments. We do not collect or store your card number, expiry date or security code — these go directly to Stripe. Our database holds your subscription tier, status, billing period, and renewal or cancellation dates.
Performance and usage data
Generated as you use the question bank:
- Which questions you have attempted and the answers you selected
- Whether your answers were correct
- Test attempts, quiz configurations, and subject mastery scores
- Badges, notifications and progress records
Billing Assist
When you search in Billing Assist, your search text is sent to Google’s Gemini API so that matching MBS item numbers can be returned. This text is not stored by us — see section 8. Items you save to your favourites are stored against your account.
Cancellation feedback
If you cancel a subscription, we ask why. Your selected reason, and any free-text comments you add, are stored against your account.
Support and correspondence
Anything you send us — support enquiries, error reports about specific questions, feedback — along with our replies.
Technical information
Standard web server and network data handled by Cloudflare in the course of delivering the site, including IP address and request metadata.
3. Sensitive information
“Sensitive information” has the meaning given in the Privacy Act, and includes health information, racial or ethnic origin, and membership of a professional body.
We do not seek to collect health information about you. GP Edge is an education product, not a health service. We are not your treating practitioner and we do not create or hold clinical records about you.
The clinical scenarios in our question bank describe fictional patients. They are constructed for teaching purposes and contain no real patient information. Please do not include real patient information in any feedback, error report or correspondence you send us. If you do, we will delete it.
If we ever need to collect sensitive information, we will do so only with your consent, or where required or authorised by law.
4. How we collect your information
We collect information:
- Directly from you, when you create an account, subscribe, use the platform, or contact us
- Automatically, as you use the platform
- From Clerk, in relation to your identity and authentication
- From Stripe, in relation to your subscription — including automated webhook updates when your subscription status changes
Wherever it is reasonable and practicable, we collect personal information only from you.
5. Anonymity and pseudonymity
You cannot use GP Edge anonymously, because we need a persistent account to store your progress and manage your subscription.
6. Why we use your information
We use your personal information to:
- Create and administer your account, and authenticate you
- Provide the question bank and track your progress
- Process payments, manage your subscription, and issue receipts
- Respond to your support enquiries and error reports
- Improve the accuracy and quality of our questions
- Maintain security and prevent misuse — including detecting account sharing, which our Terms of Service prohibit
- Understand why subscribers leave, using cancellation feedback
- Send you service messages about your account, billing or material changes to the service
- Send you marketing about GP Edge, where you have not opted out (see section 10)
- Meet our legal obligations
We do not sell your personal information.
7. Your performance data
This section sets out commitments that go beyond what the Privacy Act requires, because we think exam performance deserves particular protection.
We will never disclose an individual learner’s performance data to a third party. Specifically, we will not disclose it to:
- Your employer or practice
- A regional training organisation, training provider, or supervisor
- The RACGP or any other college or regulator
- Any organisation that purchases a group or institutional subscription
This applies even where a third party pays for your subscription. An organisation that buys seats receives billing and seat-usage information only — who has an active account, and whether it is being used. It receives no scores, no topic breakdowns, and no individual results.
The only exceptions are where you expressly and specifically direct us to share your results, or where we are compelled by law.
8. Who we share your information with
We disclose personal information to the service providers who operate GP Edge. Each is bound to use it only for the purposes we specify.
| Provider | Purpose | Data involved |
|---|---|---|
| Clerk | Authentication and identity | Name, email address, password, sign-in events |
| Neon | Database hosting | Account records, subscription data, performance data |
| Stripe | Subscription payments | Name, email, payment details, transaction history |
| Cloudflare | Content delivery and network security | IP address, request metadata |
We use Google Gemini to power the search in Billing Assist. When you search, your search text is sent to Google’s embedding API so that matching MBS item numbers can be returned. We use Google’s paid API tier, under terms that exclude customer content from being used to train Google’s models.
Your Billing Assist searches are not stored by us. They are processed and discarded — not written to our database, and not written to our application logs.
Google does retain them briefly for its own safety purposes. Under Google’s terms for paid API use, prompts and responses are logged for up to 55 days solely to detect misuse of the service and to meet legal obligations, and are not used to train Google’s models. After that period they are deleted.
If you save an MBS item to your favourites, that saved item is stored against your account.
Please do not enter patient-identifying details into Billing Assist. Describe the consultation without names, dates of birth, addresses or anything else that could identify the patient.
We may also disclose personal information:
- Where you consent
- Where required or authorised by law, including to a court, tribunal or regulator
- To our professional advisers, under obligations of confidentiality
- To a purchaser or successor entity, if GP Edge is sold or transferred — in which case we will notify you and the purchaser will be bound by this policy or one at least as protective
9. Where your information is stored
Your account records, subscription data and performance data are stored in Australia, in Neon’s Sydney region.
Several of the providers we rely on are overseas companies, and the following information is handled outside Australia:
| Information | Provider | Where it is handled |
|---|---|---|
| Account, subscription and performance records | Neon | Sydney, Australia |
| Name, email address, password, authentication events | Clerk | United States (Northern Virginia) |
| Payment and transaction data | Stripe | United States, and other jurisdictions where Stripe’s affiliates and sub-processors operate |
| IP address and request metadata | Cloudflare | Globally, including the United States. Requests are served from Asia-Pacific edge locations, but traffic logs are processed across Cloudflare’s global network |
| Billing Assist search text (retained by Google for up to 55 days; not stored by us) | Google Gemini | Globally, including the United States |
Before disclosing personal information overseas, we take reasonable steps to ensure the recipient does not breach the APPs, including by relying on the data processing terms each provider offers. Overseas recipients may be subject to the laws of their own jurisdiction, and we cannot guarantee the same enforcement rights would be available to you there.
10. Direct marketing
We may send you information about GP Edge — new content, features, exam-relevant updates and offers.
Every marketing message includes an unsubscribe link, and you can opt out at any time by using that link or emailing admin@thegpedge.com.au. We comply with the Spam Act 2003 (Cth).
Opting out of marketing does not stop service messages about your account, your billing, or material changes to the platform. You cannot opt out of those while you hold an account.
We do not use or disclose your personal information for the direct marketing purposes of any other organisation.
11. Cookies and tracking
We use cookies only where they are necessary to run the platform:
- Authentication cookies, set by Clerk, to keep you signed in
- Security and performance cookies, set by Cloudflare, to protect the site and route traffic
We set no analytics cookies, no advertising cookies, and no cross-site tracking of any kind. We do not use tracking pixels, and we do not share data with advertising networks.
You can configure your browser to refuse cookies, but you will not be able to sign in without the authentication cookies.
12. Security
We take reasonable steps to protect your personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. These include:
- Passwords are never stored by GP Edge. Authentication is handled by Clerk, a specialist provider.
- Encryption in transit, enforced on all database connections and web traffic.
- Encryption at rest, provided by Neon and Clerk.
- Restricted production access, held through environment credentials and the Neon console, which supports multi-factor authentication.
- Administrative audit logging of actions taken by administrators.
- Identity verification before account deletion, so a compromised session cannot destroy your data.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Keep your password confidential and do not share your account — account sharing is prohibited under our Terms of Service and materially increases the risk to your data.
13. Data breaches
We comply with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act.
If we become aware of a data breach involving your personal information that is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner as soon as practicable, and tell you what happened, what information was involved, and what steps you should take in response.
If you believe your account has been compromised, contact us immediately at admin@thegpedge.com.au.
14. How long we keep your information
While you hold an account
We retain your account and performance data for as long as your account exists.
Ending a subscription does not delete your data. When a subscription is cancelled or expires, your account reverts to the free tier and your records — including your performance history — are retained. This means your progress is still there if you resubscribe.
When you delete your account
You can delete your account at any time from your account settings. Deletion is:
- Immediate. There is no grace period once you confirm.
- Verified. Clerk will ask you to confirm your identity first.
- Complete. Every record linked to your account is removed — payments, subscriptions, test attempts, quiz configurations, badges, notifications and cancellation feedback.
- Permanent. Records are physically deleted, not hidden or flagged. Nothing is retained. Your name and email address are removed from our database and your Clerk identity is deleted.
- Irreversible. Neither you nor we can recover your account or your history afterwards.
There is no refund of any unused subscription period on deletion.
Backups
Our database provider keeps a short recovery history, so that data can be restored if something goes wrong. Deleted records may remain recoverable within that window for up to 7 days before they age out permanently.
Records held by our payment provider
Stripe retains transaction records independently of our systems, in order to meet its own legal and taxation obligations. Deleting your GP Edge account does not delete Stripe’s records of payments you have made.
Data export
We do not currently offer a self-service data export. If you would like a copy of your data before deleting your account, email admin@thegpedge.com.au and we will provide it (see section 15).
15. Accessing and correcting your information
You may request access to the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading. Email admin@thegpedge.com.au.
There is no charge for making a request, or for us providing access.
We will respond within 30 days.
We may ask you to verify your identity before releasing information.
In limited circumstances we may refuse access or correction — for example where doing so would unreasonably affect another person’s privacy. If we refuse, we will tell you why in writing and explain how to complain.
You can update most of your account details yourself in your account settings.
16. Complaints
If you have a concern about how we have handled your personal information, contact us first at admin@thegpedge.com.au. We will acknowledge your complaint within 14 business days and aim to resolve it within 30 days.
If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner:
- Online: oaic.gov.au/privacy/privacy-complaints
- Phone: 1300 363 992
- Post: GPO Box 5288, Sydney NSW 2001
17. Changes to this policy
We may update this policy from time to time. The current version is always available at https://thegpedge.com.au/privacy with its effective date at the top.
If we make a change that materially affects how we handle your personal information, we will notify you by email or through the platform before it takes effect.
18. Contact us
Privacy enquiries: admin@thegpedge.com.au
General support: admin@thegpedge.com.au