ISN Innovations
VIC Privacy Statement
1. About this statement
This statement explains how ISN Innovations Pty Ltd (ABN 88 641 431 423) ("we", "us") handles personal information in VIC, the Virtual Interactive Client. We handle it in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth).
VIC is a psychology client simulator. Students practise therapy by talking with AI-driven virtual clients, and instructors use it to teach, set work and mark. It is licensed to universities and training institutions, including ISN Psychology and partner institutions.
This statement covers all of VIC: the website at vic.isn.au, the app you sign into there, sessions streamed to your browser, and VIC exercises used through partner learning platforms.
If you use VIC through your university or training provider, your institution also has its own privacy policy. That policy covers what your institution does with information it gets from VIC, such as marks it exports into its own learning system.
2. What we collect
We collect only what VIC needs to run, teach and improve. We do not collect health information about you, and the Terms of Use ask you not to share real personal or health information about yourself or anyone else during sessions.
| Kind of information | What it includes |
|---|---|
| Account details | Your name, email address, sign-in identifiers, and the sign-in provider you use (such as Microsoft or Google) |
| Institution details | Your institution, your role (such as student, instructor or administrator), and your courses |
| Session records | A text transcript of each session, plus timing, duration, objectives, scores, progress, AI-generated feedback and anything your instructor adds |
| Coursework | Assignments you submit, attempts, due dates, and marks and feedback from your instructor |
| Terms acceptance | Which version of the Terms of Use you accepted, and when |
| Technical information | Your IP address, browser and device type, and records of how your streamed session started and ended (used to fix connection problems) |
| Enquiries | What you send through the contact or feedback forms: your name, email, organisation and message |
Your voice is not recorded. VIC turns your speech into text in real time and keeps only the text transcript. The audio is not stored. Open Roleplay practice sessions do not keep a transcript at all.
3. How we collect it
- From your institution. Your institution sets up your account, usually by adding your email address to a course roster.
- When you sign in. Your sign-in provider (such as your university's Microsoft account) passes us your name, email address and an account identifier.
- When you use VIC. Session records and coursework are created as you practise, submit work and receive marks.
- When you contact us. We keep what you send through the contact or feedback forms.
- From your browser. The site keeps small items in your browser's storage to remember that you are signed in, your role (so it shows the right menus) and your institution's branding. We do not use advertising or tracking cookies, and we do not use third-party analytics.
4. Why we use it
We use your information to:
- sign you in and give you the access your institution has set up
- run your sessions, including the AI client's replies, its voice and its animation
- give you feedback and scores, and track your progress across sessions
- let your instructors teach, set and mark work, and keep a gradebook
- answer your enquiries and provide support
- keep VIC secure, investigate misuse, and uphold academic integrity
- understand how VIC is used and improve it, as set out in the Terms of Use
We do not sell your information, and we do not use it for advertising. We do not send your sessions to outside AI companies: VIC's AI runs on our own systems in Australia.
5. Who can see it
| Who | What they can see | Why |
|---|---|---|
| You | Your own session records, coursework, feedback and released marks | So you can review your own practice and progress |
| Authorised staff at your institution (instructors, supervisors, administrators) | Session records and coursework of students in the courses they teach or manage | Teaching, assessment and grading, feedback, supervision and moderation, and investigating misuse or academic-integrity concerns |
| VIC support staff | For partner institutions: read-only access to your institution's area of VIC, for a limited time and logged. This never includes session transcripts. | Support, administration and service monitoring |
| Service providers | Only what each service needs: Google (sign-in), Amazon Web Services (streaming sessions to your browser) and Microsoft (forwarding contact-form enquiries to the VIC support inbox) | Running VIC (see section 6) |
| Partner platforms | If you use a VIC exercise through another learning platform, that exercise's results are returned to that platform | Delivering the exercise you started there |
Staff can see their own session transcripts only; other staff cannot read them.
We may also disclose information where the law requires or allows it, for example to a regulator or under a court order.
6. Where it is stored, and what goes overseas
Your session records, coursework and other VIC data are stored in Australia, on systems we operate. Backups are kept in Australia too. VIC's AI (the client's dialogue, speech recognition, voice and animation) runs on our own systems in Australia.
Four supporting services can handle limited information outside Australia:
| Service | What it handles | Where |
|---|---|---|
| Google Firebase Authentication (sign-in) | Your name, email address and sign-in identifiers | May be held on Google infrastructure outside Australia |
| Amazon Web Services (cloud streaming) | The sound and picture of your live session, processed in memory only while you are in a session. Nothing is stored. | The Asia-Pacific region, currently Australia or Japan depending on availability |
| Microsoft 365 (contact-form enquiries) | Your name, email, organisation and message, forwarded to the VIC support inbox | May be outside Australia |
| Google Fonts and other content delivery networks (CDNs) | Your IP address and browser details, received when your browser loads the site's fonts and code | May be outside Australia |
Streaming is encrypted in transit, and the streaming service keeps no copy of your session.
7. How long we keep it
We keep your information while your institution licenses VIC and your account is active. When the licence ends or your account is closed, we delete your information or remove anything that identifies you within a reasonable time. We may keep it longer if your institution asks us to or the law requires it. Database backups are deleted automatically after about 90 days.
You can delete your own transcripts. VIC lets you delete your session transcripts yourself. Deleting a transcript does not delete the scores, progress records, marks or instructor feedback linked to it. We may also keep a copy where we reasonably need to for academic integrity or assessment, to comply with the law, or to keep VIC secure.
We keep contact-form enquiries for as long as we need them to respond and follow up. Our servers keep technical logs, including IP addresses, for a limited time to keep VIC secure and fix problems.
8. How we protect it
- Everything travels over encrypted connections (HTTPS).
- Session transcripts are encrypted in our database.
- Access is limited by role: each person sees only what their role at their institution allows.
- Staff access to another institution's data is read-only, time-limited and logged.
- Backups cannot be altered or deleted before their retention period ends.
No system is perfectly secure. If a data breach is likely to cause you serious harm, we will tell you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.
9. Seeing and correcting your information
You can see most of your information yourself: your sessions, transcripts, feedback and released marks are all in VIC. You can also ask us for a copy of the personal information we hold about you, or ask us to correct it. Email vic.support@isn.edu.au and we will reply within 30 days. We may need to confirm who you are first.
If we refuse a request, we will tell you why and how to complain. Some details, such as your name, role and courses, come from your institution, so we may ask your institution to correct them.
10. Questions and complaints
For any privacy question or complaint, contact the VIC support team:
- Email: vic.support@isn.edu.au
- Post: Privacy, ISN Innovations Pty Ltd, Office 2, 35 Cotham Road, Kew VIC 3101
We aim to resolve complaints within 30 days. If you are not satisfied with our response, or we have not responded within 30 days, you can complain to the Office of the Australian Information Commissioner (OAIC) on 1300 363 992.
11. Changes to this statement
We will update this statement when VIC or the law changes. The current version is always at vic.isn.au/privacy, with the date it took effect. For significant changes, we will also tell you in VIC.
This version takes effect on 6 November 2026.