Privacy policy

Who we are and what this covers

YourClinicDesk builds the assistants, booking tools and websites that clinics use to answer patients and fill their diaries. We are based in Western Australia and we are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

This policy covers two different relationships.

• Visitors to this website. Anyone who reads these pages, books a demo or sends us a question. Where that applies, we decide what is collected and why, and we answer for it.
• Clinics who use our service, and their patients. When a clinic runs our assistant, the clinic decides what it asks patients and what it records. We handle that information on the clinic’s behalf and under our written agreement with them.

That second point matters more than it might look. If you are a patient and you want to know what your clinic holds about you, or you want it corrected or deleted, the clinic is the right place to ask. They hold the record. We will always help them answer you, and you can contact us directly if you would rather start with us.

The information we collect

When you contact us

If you book a demo or send an enquiry, we receive your name, your clinic’s name and your email address. You can also add a phone number, your website, what you would like to fix and any notes you want to send. Everything past the first three is optional and the form works without it.

When your clinic becomes a client

We collect the business details we need to set the service up and bill for it: a billing contact, an address, the services and hours your clinic wants the assistant to know about, and the calendar or practice software we are connecting to. Card details go straight to our payment provider and are never stored on our systems.

Through the service, once it is running

The assistant handles messages, emails and calls between your clinic and its patients. Depending on what you switch on, that can include a patient’s name and contact details, the appointment they asked for, a transcript or recording of the conversation, and whatever they chose to tell the assistant along the way.

Technical records

Our hosting and infrastructure providers keep standard server logs, which include IP addresses, browser type and the time of a request. We use these for security and for working out why something broke. We do not use them to build a profile of you.

How we collect it

Nearly always directly from you: you type it into a form, you tell us on a call, or your patients give it to the assistant. Sometimes we receive it from your clinic, for example when you send us your price list or connect your booking calendar.

Why we use it

We use personal information to do the things you would expect.

• To reply to you, run your demo and answer your questions.
• To set up, train and run the assistant for your clinic, and to keep it accurate as your hours, services and prices change.
• To take and confirm bookings, and to send the confirmations and reminders your clinic has asked us to send.
• To bill you and keep the financial records the law requires.
• To keep the service secure, find faults and improve how well it works.
• To meet our legal obligations, and to deal with a complaint or a dispute if one comes up.

We do not sell personal information. We do not rent it, trade it, or hand it to anyone for their own marketing.

Health information and other sensitive information

Health information is treated as sensitive information under the Privacy Act, and it carries stricter rules than an email address does. We take that seriously, and we have built the service so that it collects as little of it as possible.

• The assistant is set up to book appointments and answer practical questions, not to take a clinical history. It is instructed not to ask for clinical detail it does not need.
• When a patient asks something clinical, the assistant does not attempt an answer. It says so plainly and passes the question to a person at the clinic.
• We do not store clinical records. Your practice management system remains the record of care, and we do not copy it.
• Patient conversations are never used to train or fine tune AI models, ours or anyone else’s. Our agreements with the model providers we use prohibit it.

If a patient volunteers health information anyway, which happens, it is handled under the same terms as everything else in this policy and under our agreement with the clinic.

This website, cookies and analytics

This is short, because there is very little to say.

• We do not use tracking cookies, advertising pixels or third party analytics on this website. There is no Google Analytics, no Meta pixel and nothing following you to other sites.
• We do not show a cookie banner because we have nothing to ask you to consent to.
• Fonts and images are served from our own domain, so simply reading this page does not hand your IP address to another company.

If that changes, we will update this section before the change goes live, not after.

Who else sees it

We share personal information only where we need to, and only with organisations bound to protect it.

• Suppliers who run parts of the service. Hosting and infrastructure, email delivery, payment processing, and the language model, voice and telephony providers that power the assistant. They may only use the information to provide their service to us.
• Your clinic. If you are a patient, what you tell the assistant goes to the clinic you were contacting. That is the entire point of it.
• Professional advisers. Accountants and lawyers, where they need it and under a duty of confidence.
• Where the law requires it.A court order, a regulator, or a serious threat to someone’s life, health or safety.
• A buyer, if the business is ever sold or merged. We would tell you before your information moved, and any buyer would be held to this policy.

Sending information overseas

Some of the suppliers we rely on are outside Australia, most often in the United States and the European Union. That means some personal information is stored or processed overseas.

Before we disclose personal information to an overseas recipient we take the steps Australian Privacy Principle 8 requires of us: we satisfy ourselves the recipient handles information to a standard at least as protective as the Australian Privacy Principles, and we put contractual terms in place that hold them to it.

If you would like the current list of the suppliers we use and where each one is located, ask us and we will send it to you.

How we protect it

Information is encrypted while it travels between you, us and our suppliers. Access inside our team is limited to the people who need it to do their job, and it is removed when they no longer do. Our suppliers are chosen partly on their security record, and we review that as we go.

We will not pretend a system can be perfectly secure, because none can be. What we can tell you is that we hold very little that would interest an attacker, we keep it for no longer than we need it, and we will tell you promptly if something goes wrong.

How long we keep it

• Enquiries and demo requests are kept for two years from your last contact with us, then deleted.
• Client and billing records are kept for as long as you are a client, and then for seven years afterwards, because tax and corporations law requires it.
• Patient conversations handled by the assistant are kept for the period your clinic sets in its agreement with us. When that period ends, or when your clinic asks us to remove them earlier, they are deleted.

Where we no longer need information and no law requires us to keep it, we delete it or de identify it.

Seeing and correcting your information

You can ask us what personal information we hold about you and ask for a copy of it. You can ask us to correct anything that is wrong, out of date or incomplete. You can ask us to delete it, and we will unless a law requires us to keep it.

Write to hello@yourclinicdesk.com. We will reply within thirty days. There is no charge for making a request, although we may charge a reasonable amount for a large or unusual one, and we will tell you the cost before we begin.

We may need to confirm who you are before we hand anything over, which protects you rather than us. If we refuse a request, we will tell you why in writing and explain how to complain about it.

If something goes wrong

If personal information we hold is lost, or accessed or disclosed without authorisation, we investigate straight away and act to contain it.

Where a breach is likely to result in serious harm, the Notifiable Data Breaches scheme requires us to notify both you and the Office of the Australian Information Commissioner, and we will. If the information belonged to a clinic’s patients, we will notify the clinic immediately so they can meet their own obligations to the people affected.

Children and young people

This website is aimed at clinic owners and practice managers, not at children, and we do not knowingly collect information from a child through it.

Clinics do treat children, so the assistant may take a booking that involves a young patient. In that case the clinic is responsible for consent and for how the record is kept, in line with the health privacy rules that already apply to them.

Changes to this policy

We update this policy when the way we handle information changes. The date at the top always tells you which version you are reading.

If a change materially affects you, we will tell clients by email before it takes effect rather than quietly swapping the page.

Questions and complaints

Start with us. Email hello@yourclinicdesk.com or call +61 484 254 868, and tell us what happened. We will acknowledge your complaint within five business days and give you a written answer within thirty days.

If you are not satisfied with how we handled it, you can take the matter to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992. You do not need our permission to do that.