About / Governance
Governance, security and data, ready for your review
Where data is stored, how access is protected, and the document behind every answer.
For reviewers
Every answer a review needs, with its document
Procurement, clinical governance, security, IT and legal reviewers each find their answers here, with the document behind each one.
Who we are
A registered company you can look up
People Tech Revolution builds practice for difficult conversations into hospitals, councils, schools, justice services and enterprises.
Company details
People Tech Revolution Pty Ltd, ABN 66 646 534 858, ACN 646 534 858, at 27/65 Manooka Drive, Cannonvale, Queensland. The Australian Business Register entry is public.
The founders are Leonie Sanderson and Simon Lowe. Read how the company started and who we work with.
Security
Your data, stored where you need it
The controls a security reviewer asks about first.
Where is our data stored and processed?
By default, storage, compute and hosting run in the Australian region australia-southeast1. Where a client needs its data kept in its own country or on its own systems, it is stored where the client chooses.
The subprocessors register lists third-party processing by category, including what runs outside Australia.
How is access protected?
Our cloud projects forbid service-account key files. Machine access is keyless workload identity federation, so there is no long-lived credential to leak or rotate.
Sign-in is fail-closed by design: the token issuer and audience are pinned and the email must be verified. A misconfiguration locks the door instead of opening it.
What safeguards does the privacy policy name?
The Privacy Policy names encryption in transit, encrypted connector credentials, workspace access controls and designated audit records.
Processors and consent
Every processor listed, by category and location
The Subprocessors and Data Locations register lists each category of provider with its purpose, the information it handles, its processing location and the date it was last checked. Hosting and the application database sit in an Australian region; the web caching edge operates outside Australia.
What travels during a live twin call?
The consented reference photograph, live microphone audio and camera video from the browser, the persona prompt, the transcript and any recording. The register records that category as processing outside Australia.
What does a person consent to?
A digital twin operates with consent and with ongoing oversight of what it says on the person’s behalf.
Consent, copyright and ethical governance of a real person’s likeness or voice are settled before the build, a point what a digital twin is takes from UNESCO’s global recommendation on AI ethics.
How long is information kept?
The Privacy Policy keeps information as long as is reasonably required for the service, security, business records, disputes or law, with product-specific retention in the product supplement.
Access, correction, deletion, restriction, objection and export follow applicable law. The policy names the Office of the Australian Information Commissioner for unresolved complaints.
Accessibility and participant safety
Practice every participant can take part in
Our practice, twin and augmented reality products run in a browser, with no headset and no installation.
Has the site been audited for accessibility?
A Web Content Accessibility Guidelines audit of our portal and public site was carried out on 26 July 2026, criterion by criterion. We share it on request.
Every page of this site honours the reduced-motion setting and stops looping video.
Is a headset session comfortable?
The library experiences use limited controller input, simple trigger pulls for people with mobility issues, limited movement and short scenarios that reduce eye strain.
Motion sickness is less common in seated, slower-paced experiences, and glasses can usually stay on. The VR training FAQ covers the rest.
Who runs the debrief?
A trained facilitator, in the room, after the headset comes off.
Participants reflect on what they saw, connect it to real situations and talk through how they might respond differently, the design immersive training and roleplay is built around.
The record
A training record an assessor can inspect
In a hospital the record is the training register. Outside health it is the safety or people lead’s record of who rehearsed what.
How does practice reach a hospital training register?
Action 1.20 of the Clinical Governance Standard asks a health service organisation to implement a mandatory training program and monitor the workforce’s participation in it. See NSQHS Action 1.20 and NSQHS Action 5.34.
At Mater Education the pilot became a program across Brisbane and regional campuses, run by Mater’s own trained facilitators, with the evaluation published under Mater’s name. Read the Mater case study and the pilot write-up.
What does the record look like outside health?
A safety or people lead holds a record of what was rehearsed, by whom, and how often they came back to it, as psychosocial hazards training for managers describes.
Redesigning the work comes first. Rehearsal is for the psychosocial hazards that remain: the manager who still has to raise the concern, and the person who still has to hear it.
Delivery
From a first build to a program you run
PTR builds toward a program the customer’s own people run, with a record their own assessors read.
How is a first build funded and contracted?
A first build is paid for from money already committed: a state grant plus a hospital’s own innovation funding, a regulator-funded pilot a partner already held, or an access and inclusion strategy with an owner and a budget. See how a first build gets paid for.
Contracting sits under the Terms of Service where no separate negotiated agreement applies, with product supplements for specific products. Enterprise terms, order forms or signed agreements control where they conflict.
What does a rollout ask of our devices?
Practice runs typed at a desk or spoken aloud on the laptop the work is already on, and the headset is its deepest version. AI roleplay practice in a browser asks less of a device fleet than a managed headset on every floor.
With XRHealth Australia the funder and the pilot came first, and PTR built the part that needed building, for a program on workplace mental health and recovery in transport.
For IT reviewers
Devices, networks and integration
Library titles have been delivered on standalone headsets such as Meta Quest and Pico, and custom projects are designed for XR platforms, browsers or mobile to fit the use case. Locked-down networks are a constraint the build is designed around. See how the twin widget connects to a host page.
Next step
What to ask us for
The subprocessors register names where to write for the provider information a procurement or regulatory assessment needs. Tell us which product and which reviewer is asking, and the answer goes to them directly.
Reviewing PTR for your organisation?
Sources
Each PTR legal document carries an identifier, a version, a status, an effective date and a SHA-256 checksum of its text, with a machine-readable registry of every version, so a reviewer can pin the exact text they assessed.
Subprocessors and Data Locations
Each category of service provider, with its purpose, the information it processes, its processing location and whether it touches customer content.
Privacy Policy and Terms of Service
Collection, use, international processing, retention, security, rights and complaints. The Terms cover permitted use, accounts, customer content and purchases.
Clinical Governance Standard, Action 1.20
Training systems that assess needs, run a mandatory training program and monitor participation.
People Tech Revolution Pty Ltd, ABN 66 646 534 858
The public record of the company’s registration.
Research and evidence
The peer-reviewed papers and pilot evaluations behind the work, each linked to its publisher.
Case studies
Named organisations, what was delivered, and who evaluated it, each with its own sources.
