Privacy Policy

Last updated: 13 October 2026 · Version 2.0

ClinicIQ Solutions (ABN 55 882 511 758) is committed to protecting your personal information and respecting your privacy. This Privacy Policy explains how we collect, use, disclose and protect personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

It applies to our website (cliniciq.com.au) and to the ClinicIQ SaaS products listed below. Our Camog clinical photo documentation product is a separate implementation and is covered by its own privacy policy, published with that application.

1. Scope and our role

This policy covers two kinds of information handling:

  • Website and enquiries: information you give us directly through cliniciq.com.au, our contact forms and our chat assistant. In this context, ClinicIQ Solutions is the collector of your personal information.
  • SaaS products: information handled inside our products, which health practices and small businesses subscribe to. In this context, the subscribing organisation decides what information is entered into the product, and we store and process it on that organisation's instructions in order to provide the service. The subscribing practice remains responsible for the lawfulness of the information it enters, including de-identifying patient information before entry as required by each product's data rules (see section 3).

The products covered by this policy

  • Docsert AI — a documentation and templating assistant for GP clinics that turns information a clinician has already captured into drafts of GP management plans, health assessments and care plans. The clinician makes every clinical decision; the product does the typing.
  • cIQventory — stock and inventory management for GP practices. It is designed for inventory only and is not a patient data system.
  • NursEpod — shared task management for practice nursing teams.
  • PipQBoard — quality improvement dashboards for practices, limited to aggregate, de-identified performance metrics.

2. Information we collect

  • Account and organisation information: name, email address, phone number, organisation or practice name, and your role.
  • Billing information: handled by our payment processor, Stripe. We do not store your credit card details.
  • Communication information: enquiries, support requests, feedback and chat transcripts.
  • Product content: the business information users of a subscribing organisation enter into a product — for example inventory records and supplier details (cIQventory), tasks (NursEpod), aggregate KPI values (PipQBoard), or the de-identified clinical content a clinician enters into Docsert AI to generate a draft.
  • Technical information: IP address, browser and device type, and usage data, collected for security and service improvement.

3. Health and other sensitive information

Health information is sensitive information under the Privacy Act, so our products are designed to avoid or minimise it:

  • cIQventory is an inventory system only. It does not collect patient health information, and users must not enter patient-identifiable information into it.
  • PipQBoard accepts aggregate performance metrics only. Patient-identifiable information is strictly prohibited, and automated pattern detection prompts users to review or delete entries that look like patient identifiers (for example Medicare, IHI, DVA or record numbers).
  • Docsert AI accepts de-identified clinical content only — identifiable patient information must not be entered. The subscribing practice is responsible for removing all direct and indirect identifiers (names, dates of birth, addresses, contact details and record numbers) before entry.
  • NursEpod is a shared task manager for practice teams. It is not a clinical data system: patient-identifiable information is strictly prohibited and must not be entered.

Website chat: please do not enter patient-identifiable information or sensitive health information into our website chat. It is for general and workflow questions only.

4. Website chat assistant and enquiries

Our website chat widget is an automated assistant. This is exactly how your chat details are handled:

  • What we collect: before chatting we ask for your name, email address and (optionally) phone number. Your chat messages are also collected.
  • How it is processed: your message is sent through our website host (Netlify) to our automation server (n8n, hosted by us at johnsaenz.au), which uses OpenAI's API (United States) to generate replies.
  • How it is stored: when a chat enquiry is completed, your name, contact details and answers are recorded in our internal enquiry database on our own server, and a summary is emailed to our administrator mailbox so we can respond. You also receive an automatic confirmation email.
  • Retention: chat enquiry records are retained for up to 24 months and are deleted earlier on request.
  • AI limitations: chat replies are automated and may be reviewed by us. They are not professional or clinical advice.

5. How we use your information

We use personal information to:

  • provide, operate, maintain and support the products and our services;
  • manage subscriptions, billing and payments;
  • respond to enquiries and provide support;
  • improve the products (on a de-identified or aggregated basis where possible);
  • detect, prevent and address security or technical issues;
  • send service updates and, with your consent, marketing communications (every marketing email includes an opt-out); and
  • comply with our legal obligations.

We only use personal information for the primary purpose of collection, or a related purpose you would reasonably expect, unless you consent or the use is otherwise permitted by law.

6. Disclosure and service providers

We do not sell, rent or trade personal information. We disclose it only to the service providers that help us operate the website and products, to organisations you or your practice authorise, where required by law, or to protect our rights, property or safety. Our main providers are:

  • Netlify — website hosting (United States).
  • Supabase — application database and authentication (Docsert AI, NursEpod; hosted in Sydney, Australia — region ap-southeast-2).
  • Firebase / Google Cloud — database, authentication and hosting (cIQventory, PipQBoard; data centres may be in the United States and Singapore).
  • OpenAI — AI processing (United States): website chat replies, default-model Docsert AI drafting, cIQventory inventory insights (non-identifying inventory data only) and PipQBoard insights.
  • OpenRouter — AI routing for selected Docsert AI subscription models: drafting requests are routed to the relevant model provider, which may be located outside Australia.
  • Google Gemini — AI insights for PipQBoard (KPI names, numeric values and clinic names).
  • Stripe — payment processing (payment information only).
  • Cloudflare Web Analytics — cookieless, aggregate traffic analytics in our products (no cookies, no personal data).
  • Google Analytics 4 — website usage analytics.
  • Email / SMTP and Google Gmail — delivery of enquiry notifications to our administrator mailbox.

We may also disclose personal information to professional advisers (for example accountants, auditors or insurers) under confidentiality, and to others where required or authorised by law.

7. Overseas disclosure

Some of the providers listed above are located, or store and process data, outside Australia (including in the United States and Singapore). Before disclosing personal information overseas we take reasonable steps, in accordance with APP 8, to ensure the recipient does not breach the APPs, including requiring our processors to provide at least the same level of protection as required under Australian privacy law.

Our Supabase-hosted products (Docsert AI and NursEpod) are hosted in Sydney, Australia. If the hosting location of any product matters for your own compliance obligations (for example RACGP accreditation or state health records requirements), contact us at admin@cliniciq.com.au and we will confirm the current hosting location for the product you use.

8. Data security

We take reasonable steps under APP 11 to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure, including:

  • encryption of data in transit and at rest using industry-standard protocols;
  • access controls, tenant isolation between organisations, and logging of access to data;
  • encrypted off-site backups;
  • secure software development practices and regular updates; and
  • IT liability and cyber liability insurance — a certificate of currency is available on request.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You also play a role by keeping your login credentials confidential and telling us promptly about any suspected unauthorised access to your account.

9. Retention and deletion

  • Product data is retained while your account is active. You may export your data at any time through the service interface. After cancellation or a deletion request, product data is deleted from our systems within 30 days.
  • Chat and enquiry records are retained for up to 24 months, or deleted earlier on request.
  • Tax and billing records are retained for at least 5 years as required by Australian tax law.
  • We may retain information longer where required by law or in relation to actual or pending legal proceedings.

10. Access, correction and your rights

You have a right under APP 12 and APP 13 to request access to the personal information we hold about you and to request correction of anything inaccurate. To make a request, email admin@cliniciq.com.au or write to us at Wollongong NSW 2500.

To request deletion of your personal information, email admin@cliniciq.com.au with "Data Deletion Request" in the subject line, including your full name, email address and the data you want deleted. We will acknowledge your request within 5 business days and complete it within 30 days, subject to the retention exceptions in section 9.

Where a subscribing practice entered patient-related information into a product, we will coordinate access, correction and deletion requests with that practice, because the practice is responsible for the information it holds about its patients.

11. Notifiable Data Breaches

We comply with the Notifiable Data Breaches (NDB) scheme. If we become aware of an eligible data breach:

  • we will promptly assess whether it is likely to result in serious harm to any individual (within the 30-day assessment window);
  • if serious harm is likely, we will notify the affected individuals and the Office of the Australian Information Commissioner (OAIC) as soon as practicable, with a description of the breach, the kinds of information concerned and recommended steps; and
  • where the affected data belongs to a subscribing practice, we will notify the practice immediately so it can meet its own obligations.

12. Cookies and analytics

Website

This is a static informational website. We do not operate user accounts, process payments, or run a shopping cart on the website itself, so we have no need for session, authentication or checkout cookies.

We use Google Analytics 4 to understand which pages are most useful to clinic staff. GA collects anonymous usage data including pages visited, time spent on the site, and approximate geographic region (derived from IP address). It sets cookies (such as _ga and _ga_*) on your browser to do this.

Our consent model: GA loads by default so we retain usage data, and you can opt out at any time. We do not use marketing or advertising cookies, and we do not share GA data with any advertising network.

Cookie banner: on your first visit you will see a cookie banner offering:

  • Accept — keeps Google Analytics enabled; or
  • Decline — disables Google Analytics immediately and removes its cookies.

Your preference is stored in your browser's local storage for 12 months, after which you will be asked again. You can change your cookie preferences at any time using the "Cookie Settings" link in the site footer, or by adjusting your browser settings to block or delete cookies.

Products

Our products use Cloudflare Web Analytics, which collects privacy-friendly, cookieless aggregate usage data (page views, country, referrer, browser/device) for service improvement. No cookies are set and no individuals are identified. Essential local storage is used for authentication and your preferences, and can be cleared through your browser or by logging out.

13. Complaints and contact

If you believe we have breached the Australian Privacy Principles or otherwise mishandled your personal information, contact our Privacy Officer:

We will acknowledge your complaint within 5 business days and respond within 30 days. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

General enquiries: admin@cliniciq.com.au · Security matters: security@cliniciq.com.au

14. Changes to this policy

We may update this policy from time to time. The current version is always published on this page with its "last updated" date. Material changes affecting how we handle personal information will be notified on our website or by email to account holders. By continuing to use the website or our products after a change, you accept the updated policy.

ClinicIQ Assistant

Online