Data & Privacy Policy

1) The information we collect

We collect the minimum information needed to deliver our services:

• Account & identity data: name, job title/role, clinic or practice details, contact details, device and login data.
• Clinical & health information (sensitive information): audio, transcripts, templated notes, diagnosis and treatment details, medications, test results, and other health information you or your practice choose to capture in our products. Collecting sensitive information generally requires consent unless an APP exception applies (e.g., serious threat to life/health). (OAIC)
• Usage & telemetry: app events, performance data, and cookie/SDK analytics.
• Support & communications: feedback, tickets, call/chat recordings.
• Payment & billing: limited billing information where applicable (payments are typically processed by PCI-compliant vendors).

Where lawful and appropriate, we may de-identify information for analytics, benchmarking and product improvement. De-identified information is managed per the OAIC's de-identification guidance and risk-based controls to mitigate re-identification. (OAIC)

2) How we collect information

• Directly from you (sign-up, in-product use, support).
• From your clinic/practice when your organisation enables or provisions accounts.
• Automatically via cookies/SDKs for security, reliability and analytics.
• From integrated systems (with your direction/consent), e.g., PMS/EHRs or secure file uploads.
• Never from public generative AI tools for patient data: in line with OAIC best practice, we do not enter sensitive information into publicly available generative AI tools. (OAIC)

3) Why we collect and how we use information

We use information to:

• Provide and improve our AI-enabled scribing/transcription, templating and document generation services;
• Configure accounts, authenticate users, prevent fraud and secure the service;
• Provide customer support and service communications;
• Conduct quality assurance, safety audits, and training of our models and prompts using de-identified data (we will not use your identifiable patient health information to train foundation models without your explicit opt-in consent);
• Comply with laws and respond to lawful requests.

We only use or disclose personal information for the primary purpose for which it was collected (or a directly related secondary purpose you'd reasonably expect) unless we have your consent or another APP exception applies. (OAIC)

4) Our position on AI models & training data

• Foundation models & third-party AI: We contractually prohibit our AI vendors from using customer content (including health information) to train their public or third-party models, and we scope processing to our instructions only.
• Our prompts & model tuning: We may tune internal prompts and classifiers using de-identified or synthetic data. We conduct privacy impact assessments (PIAs) for material changes, consistent with OAIC guidance. (OAIC)

5) Direct marketing (Spam Act 2003)

We may send service updates and (with consent) marketing communications. You can opt out at any time via in-message links or by contacting us. We follow the Spam Act's requirements: consent, sender identification, and a functional unsubscribe. (ACMA, OAIC)

6) Cross-border processing & where your data lives

Data storage: We store data in Australia.

Processing: Some processing activities (for example, AI inference, speech-to-text, or 24/7 support diagnostics) may occur offshore with vetted service providers acting on our instructions.

Before any cross-border disclosure, we take reasonable steps to ensure overseas recipients handle personal information in accordance with the APPs, and we remain accountable under section 16C if they mishandle information, subject to limited exceptions. Our steps include contractual privacy and security commitments, technical controls, and audits. (OAIC)

7) Disclosures we make

We may disclose personal information to:

• Your practice/health service and other healthcare providers at your direction;
• Vendors and sub-processors (e.g., hosting, AI/ML, communications, analytics, support) bound by confidentiality and privacy obligations;
• Professional advisers (legal, audit, insurance) under duty of confidence;
• Regulators and law enforcement when required or authorised by law;
• Successors in a corporate transaction, subject to equivalent protections.

We do not sell personal information.

8) Security

We take active measures to protect personal information against misuse, interference, loss and unauthorised access, modification or disclosure. Controls include: encryption in transit and at rest, role-based access and least privilege, audit logging, environment segregation, vulnerability management aligned with OWASP best practices, supplier due diligence, staff training, and incident response/testing. We also minimise retention and securely destroy or de-identify data when no longer needed. (OAIC)

9) Retention & deletion

We keep personal information only as long as necessary for service delivery, legal/regulatory requirements, or dispute resolution, then securely delete or de-identify it per OAIC guidance and applicable health-record retention rules (which may vary by state and by clinical record type). (OAIC)

10) Access & correction

You can request access to or correction of your personal information by contacting us (see §15). We will verify your identity, respond within a reasonable time, and explain any lawful grounds if we refuse access/correction (and how to complain). (OAIC)

11) Cookies & analytics

We use cookies and similar technologies for necessary functionality, security, and performance analytics. You can manage cookies through your browser settings; some features may not function without essential cookies.

12) Children and capacity to consent

Where our services involve minors, we obtain consent from a parent/guardian or as otherwise permitted by law and clinical practice.

13) State health-privacy laws

When operating in certain states and contexts, additional health-privacy laws may apply:

• Victoria: Health Records Act 2001 (Vic)
• New South Wales: Health Records and Information Privacy Act 2002 (NSW)
• Western Australia: Privacy and Responsible Information Sharing Act 2024 (WA)

We apply the more protective standard where there is overlap.

14) Data breaches (NDB scheme)

If a data breach is likely to result in serious harm, we will: promptly assess, contain and remediate; notify affected individuals and the OAIC with an eligible data breach statement; and keep records of breaches and decisions. (OAIC)

15) How to contact us

Privacy enquiries, access/correction, complaints:

Email: privacy@prac-ai.com.au

Complaints process: Contact us first. If you are not satisfied, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC). State health-privacy regulators may also have jurisdiction (see §13). (OAIC)

16) Changes to this Policy

We may update this Policy to reflect legal or operational changes. We will post the updated version with a new effective date and, where changes are material, we will provide reasonable notice in-product or by email.