Privacy Policy

This Privacy Policy explains how Akuru Pty Ltd ("Akuru", "we", "us" or "our") collects, uses, stores and discloses personal information.

This policy applies to:

• Clinicians and organisations who use Akuru's software-as-a-service products ("End Users"),
• Patients of those clinicians or organisations, whose information may be entered into Akuru by End Users; and
• other businesses or individuals that may generally interact with Akuru, such as suppliers or job applicants ("Other Individuals").

Akuru is an Australian company. We comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where relevant, we also comply with the New Zealand Privacy Act 2020 and Information Privacy Principles (IPPs) through equivalent protections (Privacy Laws).

1. Who this policy is for

Clinicians and organisations (End Users)

This policy explains how we handle personal information about you, including when you:

• create an account;
• use our software;
• communicate with us;
• engage with us for billing, support or operational purposes; or
• as required by law.

Patients

We use patient information only to:

• provide the software functionality requested by the End User; and
• store and process that information in accordance with the End User's instructions.

Patient information entered into the platform:

• is not accessible to Akuru employees, except to the extent strictly required for system maintenance, security, or support and subject to access controls;
• is held on the platform only for the retention period designated by the End User, up to a maximum of 60 days; and
• is automatically deleted or de-identified in accordance with those instructions. Any de-identified data is only used for quality control and/or to improve our platform.

We do not use patient information for marketing, analytics unrelated to service delivery, or product training.

Other Individuals

This policy also applies to:

• suppliers and service providers who work with us;
• job applicants and candidates; and
• other individuals who interact with us for business purposes.

We collect and use your information to manage our business relationships, assess applications, and fulfil our operational and legal obligations.

2. Information we collect

From End Users:

• name, email, phone number and professional details (including medical specialty and clinic name, college/society membership numbers if relevant);
• payment and billing information;
• service usage data and preferences; and
• IP address and website usage information.

From Patients (entered by End Users):

• health information discussed during consultations;
• medical history and symptoms (for transcription purposes); and
• any other information disclosed during the consultation.

From Other individuals:

• Name, email, phone number and contact details;
• Professional details and business information;
• For job applicants: employment history, qualifications, professional registrations and licences; and
• Payment and transaction details (for suppliers).

How we collect this information

We collect personal information:

• End Users:
  • directly from you when you interact with us, contact us, fill out forms, create an account or use our services;
  • automatically when you visit our website, use our platform or interact with our online services;
  • from third parties including service providers, business partners, public sources, government organisations and people or organisations authorised by you.
• Patients:
  • directly from you if you interact with us or contact us or fill out any forms;
  • from your healthcare providers who are End Users and people or organisations authorised by you.
• Other individuals:
  • directly from you when you interact with us, contact us, fill out forms or apply for a role with us;
  • automatically when you visit our website, use our platform or interact with our online services;
  • from third parties including healthcare providers, service providers, business partners, public sources, government organisations and people or organisations authorised by you.

3. How we use personal information

End User information:

We use End User information to:

• provide and improve our services;
• process payments and manage accounts;
• communicate with you about our services;
• send marketing communications (where you have consented or we are otherwise permitted);
• conduct analytics to improve our platform;
• comply with legal obligations.

Patient information:

We use patient information only as instructed by the End User to provide the software functionality requested, including providing a transcript, drafting referral notes and to generate other documents instructed by the End User.

Other individuals:

We use information from other individuals to:

• manage business relationships with suppliers;
• assess job applications and manage recruitment;
• process payments and maintain records;
• communicate about business matters; and
• comply with legal obligations.

4. AI-enabled functionality

Akuru's software includes artificial intelligence (AI)-enabled functionality delivered as part of our SaaS platform. AI-enabled features are designed, configured and implemented by Akuru. In delivering these features, Akuru utilises a combination of proprietary models and enterprise-grade third-party AI models that are deployed within Australian-hosted cloud infrastructure under Akuru's contractual arrangements.

In relation to personal information:

• personal information may be processed by third-party AI service providers engaged by Akuru under enterprise agreements;
• all such processing occurs within Australian data centres under Akuru's contracted cloud environments;
• Akuru implements contractual, technical and organisational safeguards to ensure that personal information processed through AI services is not used to train general-purpose or foundational AI models;
• personal information is not used to develop or train publicly available AI systems;
• AI functionality operates solely on data provided by or on behalf of the End User; and
• personal information is processed only for the purpose of providing services to that End User, in accordance with this Privacy Policy and applicable Privacy Laws.

Akuru maintains oversight of its AI-enabled services and implements reasonable steps to ensure that personal information handled through such services is protected in accordance with the applicable Privacy Laws.

5. Data storage, security and location

Trust and security are fundamental to our service.

• All data entered into Akuru's SaaS platform is processed and stored in Australia, including data relating to New Zealand clients.
• Data is encrypted at rest and in transit.
• Where information is processed by contracted third-party service providers as described above, such processing occurs solely within Australia and the information is not transferred or disclosed offshore.
• Access is restricted and monitored.

Further details about our security controls are available in our Trust Centre.

6. Disclosure of personal information

We do not sell personal information or deidentified information.

Business operations

For day-to-day business operations (such as billing, customer relationship management, or internal administration), we may use third-party service providers. In those cases:

• only necessary information is shared;
• vendors are subject to strict assessment and contractual safeguards;
• vendors must meet Australian privacy requirements and recognised international information security standards; and
• reasonable steps are taken to ensure compliance with the APPs and, where applicable, IPPs.

We may disclose personal information to:

• professional advisers (lawyers, accountants, auditors);
• our existing or potential agents or our business partners and contractors;
• any third parties you have authorised or as required or permitted by law;
• potential purchasers or investors (in the event of a corporate transaction); and
• government agencies or regulators where required by law.

7. Overseas disclosures

Akuru does not send platform data or clinical information outside Australia or New Zealand.

For limited business operations (such as billing or corporate systems), personal information may be accessed or stored overseas. Where this occurs, we take reasonable steps to ensure:

• the recipient country has privacy protections substantially similar to the APPs and IPPs; or
• contractual measures are in place to protect the information in accordance with Australian law.

8. Cookies and online tracking

We may use cookies or similar technologies on our websites to:

• operate the site;
• improve performance and user experience; and
• understand how our services are used.

These technologies do not provide us with access to your device or personal files.

You can manage cookies through your browser settings.

Meta advertising tools: We use Meta's advertising tools (such as Meta Pixel) to understand how our ads perform and to show you relevant advertisements on Meta platforms like Facebook and Instagram. You can manage these settings through your Meta account preferences.

9. Your rights, access, correction and retention

You can choose whether to provide personal information to us, however, if you don't provide certain information, we may not be able to provide some services.

End Users may request access to or correction of their personal information by contacting us.

Patients should contact their clinician or healthcare provider to access or correct clinical records. We handle access requests in accordance with our Data Subject Access Request Policy.

We keep your personal information only as long as we need it for the purposes we collected it, or as required by law. When we no longer need it, we securely destroy or de-identify it (which will only be used for quality control and/or improvements).

10. Complaints

If you have a complaint about how we handle personal information, please contact us. We will:

• verify your identity before processing your request;
• investigate thoroughly (for complaints) or process your request (for rights);
• respond to you in writing within reasonable timeframes;
• explain what actions we will take and keep you updated on progress;
• not charge you for making a request (except for reasonable access fees if applicable); and
• help you understand and exercise your rights.

11. Contact us

For privacy enquiries, please contact:

Data Protection Officer

Akuru Pty Ltd

Email: data.protection@akuru.com.au

If you are not satisfied with our response, you may contact:

• the Office of the Australian Information Commissioner (OAIC); or
• the Office of the New Zealand Privacy Commissioner (if applicable).