Privacy Policy

1.Who we are

ClinicComply is an Australian healthcare compliance platform operated by Better Networks Pty Ltd (ABN 51 702 162 632), an Australian-owned company. We help GP clinics, dental practices, allied health centres, and managed service providers manage their regulatory obligations. In this policy, "we", "us", and "our" refer to Better Networks Pty Ltd.

2.What information we collect

Account information

When you sign up, we collect your name, email address, and the details of your practice (name, address, type). If you subscribe to a paid plan, payment is processed by Stripe: we do not store credit card numbers on our servers.

Compliance data

Information you enter while using the platform, including checklist responses, documents you upload, vendor details, and team member profiles. This data belongs to you.

Information you store about other people

Most of what you record in the platform is about people who are not our customers: patients, NDIS participants, complainants, staff members and vendor contacts. It includes incident and complaint details, staff credentials such as AHPRA registration and NDIS worker screening numbers, immunisation and screening status, and conflict of interest declarations. Some of it is health information.

We collect it from you, not from the individual it is about. We hold it on your behalf and use it only to provide the service. Your practice decides what to record and answers the requests of the people concerned. Section 7 says what we do if one of them contacts us.

Acceptance records

When you sign up we record which version of this policy and of our Terms of Service you agreed to, the time you agreed, and the IP address you agreed from.

Support requests

The Help and support form also sends us your browser type, your practice and plan, and the page you were on, so we can work out what happened.

Analytics

We use Google Analytics to understand how our public website and our signed-in application are used. It sets two cookies (_ga and _ga_<id>, which last two years and identify your browser across visits) and sends Google the pages you visit, the features you use, and information about your browser and device, which Google processes in the United States. Inside the application we replace record identifiers in page addresses with a placeholder before anything is sent, and we never send your name, your email address, your practice's name or the content of any record. Google Signals and advertising personalisation are turned off, and analytics is not linked to any advertising account. We also use a cookieless page-performance analytics service provided by our hosting provider, which receives page and performance data only. Pages that carry a private link (team invitations, vendor uploads and feedback forms) send nothing to either service.

Advertising

We advertise ClinicComply on Facebook and Instagram, and we use Meta's pixel and Conversions API to measure those ads and to show them to people likely to be interested. This applies to our public website only. The pixel never runs inside the signed-in application, on the sign-in and sign-up pages, or on pages that carry a private link, and nothing you do once signed in is sent to Meta.

On our public website, unless you decline, the Meta pixel sets two cookies (_fbp, which identifies your browser, and _fbc, which records the ad you clicked to reach us, if any; both last 90 days) and sends Meta the pages you visit and information about your browser and device.

Our servers also tell Meta when someone uses one of our free tools or downloads a free template, starts a trial, or subscribes, so we can see which ads work. With each of these we send a one-way hashed copy of the email address given, the IP address and browser type of the request, and the two cookie values above if your browser has them. For a subscription we also send the plan price. We never send the answers you give a free tool, your name, your practice's name, or anything you store in the platform.

We may also give Meta a hashed list of the email addresses people have given us on our public website, so that Meta can show our ads to them or leave them out of an audience. Meta uses the list to find matching accounts and deletes the hashes that do not match. People who have unsubscribed from our emails are left off the list.

Meta processes this information in the United States and Ireland under its own privacy policy, and may use it to improve its advertising services. How Meta handles information about you is governed by Meta's privacy policy, not this one.

If you decline, the pixel does not load and our servers send Meta nothing about your visit. You can change your choice at any time with the "Ad cookies" link at the foot of every page of our public website, and we treat a Global Privacy Control signal from your browser as declining. You can also control how your activity is used for the ads you see in your Facebook and Instagram ad settings. To be left off the hashed list, email us at the address below.

Free templates, tools, and other resources

You do not need an account to download our free templates or use our free calculators and checkers. When you request one, we collect the email address you enter and a record of which resource you asked for. We use that address to send the download link and, unless you opt out, occasional compliance guidance about that resource, and to measure our advertising as described above. Every one of those emails has an unsubscribe link that takes effect immediately.

To keep these resources free while preventing automated or bulk collection, we also record against each download a one-way cryptographic hash of your IP address and your browser type. We do not retain the IP address itself, and the hash cannot be reversed. We use this only to apply our free download limits and to detect abuse, never for advertising, profiling, or tracking across other websites.

Cookies

We use essential cookies to keep you signed in and remember your preferences (such as your selected practice). We also set a functional cookie that counts how many free resources have been downloaded from your browser, so we can apply our free download limits. Google Analytics sets the two cookies described above. On our public website only, and unless you decline, the Meta pixel sets the two advertising cookies described under Advertising. We also set a cookie that remembers your advertising choice for 12 months.

3.How we use your information

• To provide, maintain, and improve the ClinicComply platform
• To authenticate your account and enforce access controls
• To record your acceptance of our terms
• To send transactional emails (invitations, notifications, billing receipts)
• To help you get started during a free trial, with an unsubscribe link in every one of those emails
• To send service notices, such as changes to these documents
• To deliver the free resources you request, and to send related compliance guidance you can unsubscribe from at any time
• To apply our free download limits and prevent automated or bulk collection of our resources
• To measure and target our own advertising on Facebook and Instagram, as described in section 2
• To monitor platform performance and fix issues
• To comply with our legal obligations, including the Australian Privacy Act 1988

We handle the information you store about other people only to provide the service, on your instructions, never for our own purposes. We do not sell, rent, or trade personal information. We do not use your compliance data, or anything else you store in the platform, for advertising or to train machine learning models.

4.Where your data is stored

Our hosting and database providers store your compliance data, your documents and our database records in Sydney, Australia. The application is delivered globally for performance, but your stored data stays in Australian data centres.

Our payment processor (Stripe) processes billing information, and our email delivery service processes the emails we send you, in the United States. Our usage analytics service (Google Analytics) processes usage information in the United States. Meta processes the advertising information described in section 2 in the United States and Ireland.

5.Who we share data with

We share your data only with the service providers described in section 4, and only as far as each needs it:

• Hosting, database and file storage: hold your data in Australia
• Payment processor (Stripe): handles subscription billing; we do not see or store your full card details
• Email delivery service: sends our transactional emails and the free resources you ask for
• Usage analytics service (Google Analytics): receives the usage information described in section 2
• Advertising (Meta): receives the public website activity and hashed information described under Advertising in section 2, unless you decline

Some records are also visible to people you authorise. An IT provider or group owner you authorise to manage your account can see your practice's records. A vendor you invite sees only what the upload link shows, which our Terms of Service describe.

We do not sell your data or share it with data brokers, and apart from the advertising measurement described in section 2 we do not share it with advertisers or any other third parties. We may disclose information if required by Australian law or a valid court order.

A full list of our service providers is available to customers on request.

6.Data retention

Ninety days after you cancel, ask us to delete your account, or let a trial expire, your account becomes scheduled for deletion. We email the account's owners and administrators 30 days, 7 days and 1 day before the deletion date. On or after that date the account's data is permanently deleted from our live systems, and backup copies expire within 30 days after that.

If you have a lawful reason to keep the data for longer, such as an investigation or a retention obligation, ask us and we will hold the deletion.

You remain responsible for your own record-keeping obligations, including the retention periods that apply to health records in your state. Export your data before the deletion date.

If you have only downloaded a free resource and never created an account, we keep your email address and download record until you unsubscribe or ask us to delete them, whichever comes first. Unsubscribing stops all further email immediately. You can request deletion at any time using the contact address below, and we will action it whether or not you hold an account with us.

Analytics data is kept by Google for 14 months. Meta keeps advertising information under its own retention policy. Acceptance records are kept for the life of the account and for 7 years after it closes.

7.Your rights

Under the Australian Privacy Act 1988, you have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your account and associated data
• Export your data from your account settings, which owners and administrators can do once per practice per day

To exercise any of these rights, contact us at support@cliniccomply.com.au.

If a patient, participant or staff member asks us about information a practice holds about them, we refer the request to that practice. The practice controls the record and answers the request, and we help it respond.

If you are not satisfied with how we have handled your personal information, write to us at the address above first, and we will respond within 30 days. You can also lodge a complaint with the Office of the Australian Information Commissioner (OAIC) if you believe we have breached your privacy.

8.Security

We commit to the following:

• Your data is kept separate from other practices' data.
• Every account must use multi-factor authentication.
• Data is encrypted in transit and at rest.
• Key actions on your account, including exports, are logged.
• If we confirm a data breach that affects you, we tell you promptly, with the facts you need for your own assessment.

We review our security practices regularly. If you discover a vulnerability, please contact us at support@cliniccomply.com.au.

9.Automated assessments

The platform flags things for a person to decide. It makes no decisions about anyone.

• It indicates whether an incident you have recorded may be reportable to the NDIS Commission, and the notification deadline that applies.
• It flags staff credentials and training that are due to expire or have expired.
• Our free worker screening expiry tool answers a question from the details entered into it.

Each one is an indicator based on the information you entered. A person at the practice makes every decision, including whether to notify a regulator. You are welcome to reuse this description in your own privacy policy.

10.Children

ClinicComply is a business platform for healthcare professionals. We do not knowingly collect information from anyone under 18. If we become aware that a child has provided us with personal information, we will delete it. You may store records about children, such as paediatric patients or child participants, and you are responsible for the retention rules that apply to them.

11.Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify you via email or an in-app notification. The version, effective date and a summary of the changes are always shown at the top of this page, and previous versions are available on request.

12.Contact

If you have questions about this privacy policy or how we handle your data, contact us at support@cliniccomply.com.au.