AccuNote Privacy Policy

1. Introduction

AccuNote Pty Ltd ABN 47 688 712 683 ("AccuNote", "we", "our" or "us") is committed to protecting the privacy and security of personal information.

This Privacy Policy explains how we collect, use, hold, disclose and protect personal information in connection with the AccuNote platform, website, applications, services and related support activities.

This Privacy Policy is intended to comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

This Privacy Policy should be read together with our Terms of Service.

By accessing or using AccuNote, you acknowledge that you have read and understood this Privacy Policy.

2. Who This Policy Applies To

This Privacy Policy applies to personal information we handle about:

• customers and prospective customers;
• authorised users of the AccuNote platform;
• aged care, disability, retirement living and home care organisations;
• staff, contractors and representatives of customer organisations;
• residents, participants, clients and care recipients whose information is entered into AccuNote by customers;
• family members, guardians, nominees or authorised representatives;
• website visitors;
• support contacts and enquiry submitters;
• job applicants and other individuals who interact with us.

3. Our Role

AccuNote provides software and related services to care providers.

Where a customer enters care recipient, resident, participant, client, staff or organisational information into the AccuNote platform, the customer is generally responsible for determining what information is collected, why it is collected, and how it is used.

AccuNote handles that information to provide the Service to the customer.

For account information, billing information, website information, sales enquiries, support requests and other information collected directly by AccuNote, we handle that information in our own capacity.

Customers remain responsible for obtaining all required consents, permissions and authorities before entering personal information, health information or sensitive information into AccuNote.

4. Information We Collect

4.1 Account and User Information

We may collect personal information about users and customer representatives, including:

• name;
• email address;
• phone number;
• job title;
• organisation name;
• facility or location;
• role or permission level;
• login credentials;
• authentication information;
• support communications;
• training and onboarding information.

4.2 Customer and Billing Information

We may collect information needed to manage customer accounts and subscriptions, including:

• organisation details;
• ABN or billing details;
• billing contact information;
• subscription plan information;
• invoices and payment records;
• payment status.

Payment information may be processed by secure third-party payment providers.

AccuNote does not intentionally store full credit card numbers unless expressly stated.

4.3 Care Recipient and Health Information

Customers may enter personal information, sensitive information and health information into AccuNote.

This may include:

• resident, participant, client or care recipient names;
• identifiers or reference numbers;
• date of birth;
• contact details;
• care plans;
• progress notes;
• clinical observations;
• medication-related information;
• behavioural observations;
• incident notes;
• risk assessments;
• support needs;
• disability-related information;
• health assessments;
• voice recordings;
• transcriptions;
• AI-assisted summaries or documentation;
• information about family members, guardians, nominees or representatives.

Health information is sensitive information and is handled with additional care.

4.4 Voice Recordings and Transcription Data

Where customers or users use voice-to-text or transcription features, AccuNote may process audio recordings and related metadata.

Audio may be processed for:

• transcription;
• documentation assistance;
• quality assurance;
• troubleshooting;
• security and audit purposes;
• service improvement, where permitted.

Unless otherwise agreed, voice recordings are handled as Customer Data and are subject to the same privacy and security protections as other Customer Data.

Identifiable health information contained in voice recordings, transcriptions or AI-assisted documentation is stored and processed in Australia.

4.5 Technical and Usage Information

We may automatically collect technical information when you use our website or platform, including:

• IP address;
• device type;
• browser type;
• operating system;
• login times;
• session activity;
• pages or features accessed;
• system logs;
• error reports;
• security logs;
• usage patterns;
• approximate location based on IP address.

This information is used to operate, secure, troubleshoot and improve AccuNote.

4.6 Website and Enquiry Information

When you visit our website, submit a form, book a demo, request a trial, contact support or subscribe to communications, we may collect:

• name;
• email address;
• phone number;
• organisation;
• message content;
• website interaction data;
• marketing preferences.

Users should not include identifiable health information in website forms, general enquiry forms, marketing forms or non-secure communications.

4.7 Job Applicant Information

If you apply for a role with AccuNote, we may collect:

• name and contact details;
• resume and cover letter;
• employment history;
• qualifications;
• references;
• interview notes;
• right-to-work information;
• other information relevant to recruitment.

5. Australian Data Residency

AccuNote stores and processes identifiable health information in Australia.

For the purposes of this Privacy Policy, "identifiable health information" means health information about an individual who is identified or reasonably identifiable, including resident, participant, client or care recipient information, care notes, clinical observations, health assessments, medication-related information, incident notes, audio recordings, transcriptions and AI-assisted documentation.

Identifiable health information entered into the AccuNote platform is not stored or processed overseas.

Some limited business, billing, website analytics, support, security or technical information may be processed by third-party providers outside Australia where required to operate the Service. This information must not include identifiable health information.

6. How We Collect Information

We may collect personal information:

• directly from you;
• from customer organisations;
• from authorised users;
• from information entered into the AccuNote platform;
• through integrations with third-party systems;
• through support requests and communications;
• through website forms;
• through cookies and analytics tools;
• from payment providers;
• from publicly available sources;
• from referees or recruitment platforms, where relevant.

Where practicable, we collect personal information directly from the individual. However, in many cases Customer Data is provided to us by customer organisations that use AccuNote.

7. How We Use Information

7.1 Providing the Service

We use information to:

• create and manage accounts;
• provide access to the AccuNote platform;
• generate transcriptions;
• assist with care documentation;
• store and manage care records;
• provide reporting and analytics;
• operate integrations;
• provide support and troubleshooting;
• maintain backups;
• deliver training and onboarding.

7.2 Artificial Intelligence and Transcription

AccuNote may use artificial intelligence technologies, transcription services and large language models to provide documentation assistance.

We may process information to:

• convert speech to text;
• format care notes;
• suggest documentation structure;
• generate summaries;
• assist with compliance review;
• improve workflow efficiency.

AccuNote does not provide medical, clinical, nursing, legal or professional advice.

AccuNote does not make clinical decisions and is not a clinical decision-support system.

All AI-assisted content must be reviewed, verified and approved by appropriately authorised personnel before being relied upon for care delivery, clinical activities, compliance, regulatory reporting, legal purposes or business decision-making.

Information submitted through the Service is not used to train public AI models unless expressly disclosed by AccuNote.

Identifiable health information processed by AccuNote's AI or transcription functionality is stored and processed in Australia.

7.3 Account, Billing and Administration

We use information to:

• manage subscriptions;
• process payments;
• issue invoices;
• communicate about accounts;
• manage renewals;
• respond to enquiries;
• maintain business records.

7.4 Security and Compliance

We use information to:

• monitor system security;
• detect unauthorised access;
• prevent fraud and misuse;
• investigate incidents;
• maintain audit logs;
• enforce our Terms of Service;
• comply with legal and regulatory obligations.

7.5 Product Improvement

We may use information to:

• improve platform performance;
• develop new features;
• understand usage patterns;
• identify bugs or errors;
• improve user experience;
• enhance security and reliability.

Where practicable, we use aggregated or de-identified information for product improvement.

7.6 Communications and Marketing

We may use contact information to send:

• service updates;
• security notices;
• product announcements;
• training materials;
• support communications;
• marketing communications.

You may opt out of marketing communications at any time.

You cannot opt out of essential service, security, billing or account communications.

8. De-Identified and Aggregated Information

AccuNote may create and use aggregated or de-identified information for:

• analytics;
• benchmarking;
• product development;
• reporting;
• service improvement;
• research and trend analysis.

We will take reasonable steps to ensure that de-identified or aggregated information does not identify individual residents, participants, clients, care recipients, staff or customer organisations.

9. Disclosure of Information

AccuNote may disclose personal information where reasonably necessary to operate, support, secure and improve the Service.

We may disclose personal information to:

• customer organisations that manage the relevant AccuNote account;
• authorised users within a customer organisation;
• hosting and infrastructure providers;
• security, monitoring and audit logging providers;
• payment processors;
• email, communication and customer support providers;
• analytics and website service providers;
• professional advisers, insurers and auditors;
• regulators, courts, law enforcement agencies or government authorities where required or authorised by law;
• a purchaser or prospective purchaser in connection with a business sale, merger, acquisition or restructure;
• other parties with consent or as otherwise permitted by law.

AccuNote does not sell, rent or trade personal information.

AccuNote does not disclose identifiable health information to third parties for their own marketing purposes.

AccuNote does not disclose identifiable health information to overseas recipients.

Where AccuNote uses third-party service providers, we take reasonable steps to ensure they handle personal information securely and only for authorised purposes.

10. Subprocessors and Third-Party Providers

AccuNote may engage trusted third-party providers to help deliver the Service.

These providers may assist with:

• Australian cloud hosting;
• secure data storage;
• backups;
• authentication;
• security monitoring;
• audit logging;
• payment processing;
• email delivery;
• customer support;
• website analytics;
• transcription;
• artificial intelligence processing;
• platform functionality.

AccuNote requires that identifiable health information, including identifiable care records, progress notes, resident or participant information, audio recordings, transcriptions and AI-assisted documentation, is stored and processed in Australia.

AccuNote does not permit third-party providers to store or process identifiable health information overseas.

Some third-party providers may process limited business, technical, billing, support, website analytics or account information outside Australia where required to provide the Service. This information will not include identifiable health information.

Where support activities involve Customer Data, AccuNote will take reasonable steps to ensure that identifiable health information is not accessed, stored or processed overseas.

Users should not include identifiable health information in general support tickets, emails, website forms or non-secure communication channels unless expressly requested by AccuNote through an approved secure process.

11. Overseas Disclosure

AccuNote is designed to store and process identifiable health information within Australia.

AccuNote does not store or process identifiable health information overseas.

Identifiable health information entered into the AccuNote platform, including care records, progress notes, resident or participant information, audio recordings, transcriptions and AI-assisted documentation, is stored and processed in Australia.

AccuNote may use overseas service providers for limited non-health functions, such as:

• payment processing;
• email delivery;
• customer relationship management;
• website analytics;
• error reporting;
• business administration;
• support ticketing;
• general technical operations.

These overseas services must not be used to store or process identifiable health information.

Where information is processed overseas, AccuNote takes reasonable steps to ensure that overseas recipients handle information in a manner consistent with applicable Australian privacy requirements.

AccuNote may use aggregated, statistical or de-identified information for analytics, benchmarking, product improvement and service development, provided that such information does not identify individual residents, participants, clients, care recipients, staff members or customer organisations.

12. Data Storage and Security

AccuNote takes reasonable administrative, technical and organisational steps to protect personal information from misuse, interference, loss, unauthorised access, modification or disclosure.

Security measures may include:

• encryption of data in transit;
• encryption of data at rest;
• access controls;
• role-based permissions;
• authentication controls;
• audit logging;
• secure cloud infrastructure;
• monitoring and alerting;
• backup procedures;
• vulnerability management;
• staff access controls;
• internal security policies.

However, no method of transmission, storage or processing is completely secure.

AccuNote does not guarantee that the Service will be free from security vulnerabilities, cyber attacks, unauthorised access or operational interruptions.

Customers are responsible for managing their own user access, device security, staff training, password practices and internal governance controls.

13. Notifiable Data Breaches

AccuNote maintains procedures for responding to suspected data breaches.

Where AccuNote becomes aware of a suspected or actual data breach involving personal information, we will take reasonable steps to:

• contain the incident;
• investigate the incident;
• assess the likely risk of harm;
• take remedial action where possible;
• notify affected customers where appropriate;
• notify affected individuals and the Office of the Australian Information Commissioner where required by law.

Where a data breach involves Customer Data, AccuNote may work with the relevant customer to determine appropriate notification steps.

14. Data Retention

We retain personal information for as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

Customer Data is retained in accordance with:

• the customer's subscription;
• the Terms of Service;
• any applicable customer agreement;
• legal, regulatory and operational requirements.

Customers are responsible for determining their own health record, aged care, disability, employment and regulatory record-keeping obligations.

Following termination of a customer account, Customer Data may remain available for export for the period stated in our Terms of Service or applicable customer agreement.

After that period, Customer Data may be securely deleted or de-identified, unless retention is required by law or legitimate business necessity.

Backup copies may remain for a limited period before being overwritten or deleted in accordance with backup cycles.

15. Access and Correction

You may request access to personal information we hold about you.

You may also request correction of personal information that is inaccurate, out of date, incomplete, irrelevant or misleading.

If you are an authorised user, customer representative, website visitor or support contact, you may contact AccuNote directly.

If you are a resident, participant, client, care recipient, family member, guardian or nominee whose information has been entered into AccuNote by a customer organisation, you should generally contact that organisation first. AccuNote may need to refer your request to the relevant customer because the customer controls the relevant care records.

We will respond to access and correction requests within a reasonable period and in accordance with applicable law.

16. Privacy Complaints

If you have a concern about how AccuNote handles personal information, you may contact our Privacy Officer.

We will:

• acknowledge your complaint within a reasonable period;
• investigate the issue;
• request further information where needed;
• provide a response within a reasonable timeframe.

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner.

17. Cookies and Analytics

AccuNote uses cookies and similar technologies on its website and platform.

Cookies may be used for:

• authentication;
• session management;
• security;
• remembering preferences;
• website performance;
• analytics;
• product improvement.

We may use analytics tools to understand how visitors interact with our website and improve our services.

We do not knowingly configure analytics or advertising tools to collect health information from within care records.

You can manage cookies through your browser settings. Disabling certain cookies may affect the functionality of the website or platform.

18. Direct Marketing

We may send marketing communications where permitted by law.

You can opt out at any time by using the unsubscribe link in the communication or by contacting us.

Even if you opt out of marketing, we may still send important service, account, legal, billing or security communications.

19. Anonymity and Pseudonymity

Where practicable, individuals may interact with AccuNote anonymously or using a pseudonym, such as when making a general website enquiry.

However, because AccuNote provides secure care documentation software, users generally cannot use the platform anonymously. We need to identify users to manage access, security, audit logs, billing, support and compliance.

20. Children and Young People

AccuNote is designed for use by care providers, healthcare workers, disability support providers, aged care staff and authorised professional users.

AccuNote does not knowingly allow children to create user accounts.

However, customers may enter information about children or young people into AccuNote where they provide disability, home care, support, clinical or related services.

Where a customer enters information about a child or young person, the customer is responsible for ensuring that appropriate consent, authority or legal basis exists, including from a parent, guardian, nominee or authorised representative where required.

21. Automated Decisions

AccuNote may use automation and AI to assist with transcription, formatting, summarisation, workflow support and documentation assistance.

AccuNote does not use personal information to make final automated decisions about a person's care, eligibility, health status, services, rights or legal interests.

Customers and their authorised users remain responsible for reviewing and approving any output generated or assisted by AccuNote.

22. Links to Third-Party Websites

Our website or platform may contain links to third-party websites, services or integrations.

AccuNote is not responsible for the privacy practices of third parties.

You should review the privacy policies of any third-party services you use.

23. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements or services.

The updated version will be published on our website with the updated "Last Updated" date.

Where changes are material, we may notify customers through the platform, by email or by other reasonable means.

24. Contact Us

For privacy questions, access requests, correction requests or complaints, please contact:

Privacy Officer
AccuNote Pty Ltd
Email: [email protected]
Support: [email protected]
Address: Sydney, New South Wales, Australia