ReceptionBuddy Privacy Policy

Clinic customers and users

We may collect:

• name;
• email address;
• telephone number;
• clinic or business name;
• role or relationship with a clinic;
• account information;
• subscription and billing information;
• support communications;
• login and authentication information; and
• usage and technical information.

Patients and callers

When ReceptionBuddy handles calls for a clinic, we may process information including:

• caller telephone number;
• patient name;
• information used to identify or verify a patient;
• appointment information;
• practitioner preferences;
• requested services;
• messages provided for the clinic;
• call audio;
• call transcripts;
• information contained in conversations with Ava; and
• other information reasonably necessary to handle the caller's request.

Some of this information may constitute sensitive information or health information under Australian privacy law.

We may collect personal information:

• directly from clinic customers;
• when users create or manage ReceptionBuddy accounts;
• when patients or other people call a ReceptionBuddy-powered telephone number;
• through conversations with Ava;
• through connected systems such as Cliniko;
• through support requests;
• through payment providers;
• through our website and application; and
• automatically through security, operational and usage systems.

ReceptionBuddy uses artificial intelligence and automated systems to provide its virtual receptionist functionality.

AI may be used to:

• understand spoken requests;
• transcribe speech;
• determine the caller's administrative intent;
• generate conversational responses;
• determine which authorised ReceptionBuddy function should be used;
• assist with appointment-management workflows;
• answer configured clinic questions; and
• assist with service monitoring and reliability.

Callers are informed that Ava is a virtual receptionist.

ReceptionBuddy is not intended to provide medical diagnosis, treatment advice or clinical decision-making.

We may collect, hold and use personal information to:

• provide ReceptionBuddy;
• answer and manage clinic calls;
• identify patients where necessary;
• check appointment availability;
• book, reschedule and cancel appointments;
• take and deliver messages;
• answer clinic questions;
• operate connected integrations;
• authenticate users;
• provide customer support;
• process subscriptions and billing;
• monitor service reliability;
• investigate failures and security incidents;
• prevent fraud and misuse;
• maintain and improve the service;
• comply with legal obligations; and
• communicate with our customers.

Where sensitive information is involved, we handle it only where permitted by applicable law.

ReceptionBuddy generally processes patient information in connection with services requested and configured by a clinic.

The clinic remains responsible for its relationship with its patients and for ensuring it has appropriate authority to use ReceptionBuddy.

ReceptionBuddy may separately collect and use limited information for its own legitimate operational purposes, including security, billing, support, fraud prevention and service reliability, subject to applicable law.

ReceptionBuddy may process call audio and generate transcripts in order to provide the service.

Call information may be used for purposes including:

• understanding caller requests;
• performing authorised receptionist functions;
• maintaining call history;
• troubleshooting;
• investigating support requests;
• security;
• monitoring service quality; and
• improving the reliability of ReceptionBuddy.

Clinics are responsible for any notices or consents required for their use of ReceptionBuddy's call-processing functionality.

Because ReceptionBuddy is used by healthcare practices, conversations may contain health or other sensitive information.

We seek to limit collection and use of this information to what is reasonably required to provide the service and authorised functionality.

We do not sell patient health information.

ReceptionBuddy does not intentionally use identifiable patient health information or private call transcripts to train general-purpose AI models for unrelated purposes.

Where third-party AI providers process information to provide ReceptionBuddy functionality, their processing is governed by the applicable service arrangements and privacy/security terms.

Any material change to how identifiable patient information is used for AI model training would require appropriate privacy assessment and changes to our disclosures and, where required, consent.

We may disclose or make information available to service providers where reasonably necessary to operate ReceptionBuddy.

These may include providers of:

• cloud hosting and databases;
• artificial intelligence;
• speech recognition;
• voice generation;
• telecommunications;
• email delivery;
• payment processing;
• monitoring and security;
• customer communication; and
• practice-management integrations.

We require providers to handle information consistently with applicable contractual and legal requirements appropriate to their role.

Where a clinic connects ReceptionBuddy to Cliniko, ReceptionBuddy may access and update information in that clinic's Cliniko account as required to provide enabled functionality.

Depending on configuration, this may include accessing information about:

• patients;
• appointments;
• practitioners;
• appointment types;
• clinic locations; and
• availability.

ReceptionBuddy only performs actions that are enabled and permitted by the connected configuration.

Payments are processed by our third-party payment provider.

ReceptionBuddy does not need to store full payment-card details in order to provide the service.

We may receive information about your subscription, payment status, billing periods and transaction status.

We may use clinic customer contact information to communicate about ReceptionBuddy, including onboarding, product information, service announcements and marketing where permitted by law.

Customers can unsubscribe from marketing communications using the unsubscribe facility provided in those communications.

We do not use patient information obtained through clinic calls to market ReceptionBuddy directly to patients.

ReceptionBuddy may synchronise limited clinic account and product-usage information with our customer relationship and marketing systems.

This may include information such as:

• clinic name;
• account email;
• subscription status;
• setup status;
• whether Cliniko is connected;
• whether Ava is live;
• aggregate call and booking counts; and
• customer lifecycle milestones.

Patient information, call transcripts, patient appointment details and caller health information are not intentionally included in this marketing synchronisation.

We use technical and organisational measures designed to protect personal information.

These include measures such as:

• access controls;
• authentication;
• encryption of sensitive credentials;
• server-side authorisation;
• monitoring;
• incident detection;
• logging;
• restricted internal administration access; and
• safeguards around appointment actions.

Our internal monitoring may collect limited technical information necessary to detect and investigate failures.

Support requests may also automatically include safe technical diagnostic information about the clinic's ReceptionBuddy configuration.

They are designed not to include patient information, transcripts, caller details or credentials.

Some of the service providers used to operate ReceptionBuddy may process or store information outside Australia.

The countries involved may vary depending on our service providers and their infrastructure.

Where Australian privacy law requires us to take steps in relation to overseas disclosure, we will take reasonable steps appropriate to the circumstances.

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, our contractual and operational requirements, and applicable legal obligations.

Retention periods may differ depending on the type of information.

Cancellation of a ReceptionBuddy subscription does not necessarily result in immediate deletion of historical account or service information.

You may request access to personal information we hold about you or ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading.

Requests can be sent to:

support@growyourpractice.com.au

We may need to verify your identity before fulfilling a request.

Where ReceptionBuddy holds information on behalf of a clinic concerning one of that clinic's patients, we may refer the request to the relevant clinic where appropriate.

You may contact us to request deletion of personal information.

Whether information can be deleted will depend on why it is held, our role in relation to the information, applicable legal requirements and legitimate retention obligations.

Where patient information is controlled by a clinic, requests may need to be directed to that clinic.

We take reasonable steps appropriate to our role to ensure personal information we use or disclose is accurate, current, complete and relevant for its intended purpose.

Because ReceptionBuddy may receive information verbally from callers or from connected systems, errors can occur.

Clinic customers should keep their ReceptionBuddy and connected practice-management information current.

We maintain processes for identifying and responding to security and privacy incidents.

Where a data breach is subject to notification requirements under applicable law, we will take appropriate steps in accordance with those requirements.

Our website and application may collect technical information such as:

• IP address;
• browser and device information;
• login activity;
• pages or features used;
• timestamps;
• security events; and
• application performance information.

We use this information to operate, secure, analyse and improve ReceptionBuddy.

If we introduce additional advertising or analytics technologies, this policy will be updated where required.

ReceptionBuddy may process information relating to children where a healthcare practice provides services to children and a parent, guardian or other person contacts the practice.

Such information is handled for the purpose of providing ReceptionBuddy services to the relevant clinic and is subject to the same privacy and security protections described in this policy.

If you believe we have mishandled your personal information, please contact us.

We will investigate the complaint and respond within a reasonable period.

Contact:

Privacy Officer — ReceptionBuddy

Email: support@growyourpractice.com.au

If you are not satisfied with our response, you may have the right to make a complaint to the Office of the Australian Information Commissioner.

We may update this Privacy Policy as ReceptionBuddy, our service providers or applicable laws change.

The latest version will be made available through our website or application.

Where appropriate, we will notify customers of material changes.

For privacy questions, access or correction requests, or complaints:

Email: support@growyourpractice.com.au