Privacy Policy

ClinicMira Pty Ltd ("ClinicMira", "we", "our" or "us") provides an operations platform for occupational health providers ("Service"). We are committed to handling personal information responsibly and in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), including the heightened protections that apply to health information as sensitive information.

This policy explains what information we collect, how we use it, who we share it with, and the choices available to you. It applies to our websites, web portals, AI voice and chat agents, and related services.

2.1 Clinic account data

When a clinic or organisation signs up for the Service, we collect business contact details for its users — name, work email address, phone number, role and organisation details — together with authentication and access records.

2.2 Booking and clinical form data

In operating the platform, we process booking records, clinical form responses, assessment results and related documents on behalf of the clinics that use ClinicMira. Clinics are the custodians of this information; we process it under our agreements with them and do not use it for any purpose other than providing and securing the Service.

2.3 Candidate contact details

We hold contact details for candidates (workers attending appointments) — such as name, phone number and email address — so that bookings, reminders and results notifications can be delivered. Candidates access the platform through secure one-time-code sessions and do not need an account.

2.4 Call recordings

Where a clinic has enabled call recording and the caller has consented, we record and transcribe phone and web voice interactions handled by our AI voice agents or support teams. Recordings are retained according to the controlling clinic's retention settings.

2.5 Support conversations

We collect the contents of support tickets, live chat sessions and related correspondence so we can resolve issues and improve the Service.

2.6 Usage data

We automatically collect log files, device information and performance metrics to operate, secure and improve the platform.

We collect, hold and use information to:

• Provide, maintain and improve the Service, including bookings, scheduling, digital forms, documents and communications.
• Deliver appointment reminders, results notifications and other messages configured by clinics.
• Manage accounts, billing and support.
• Monitor, secure and audit the platform, including maintaining immutable audit trails.
• Comply with our legal obligations and enforce our Terms of Service.

We do not sell personal information, and we do not use clinical data to train AI models.

ClinicMira includes AI voice and chat agents that can answer calls, book appointments and respond to enquiries. When these features are used, voice audio is processed by speech AI providers engaged under contract with confidentiality and data protection obligations. Recording consent and retention are controlled per clinic, callers are identity-verified before any booking or report status is disclosed, and the agents are designed never to give medical advice. AI activity is logged and auditable.

We may disclose information in limited circumstances:

• Service providers: Vendors who help us operate the platform — cloud hosting, telephony and SMS, email delivery, speech AI and support tooling — under contracts that restrict their use of the information to providing services to us.
• The controlling clinic and its authorised parties: Booking and clinical information is disclosed as directed by the clinic that owns the record, for example to an employer where the candidate's assessment relates to their engagement and disclosure is authorised.
• Legal requirements: Where required or authorised by law, or in response to valid requests by regulators or public authorities.
• Business transfers: In connection with a merger, acquisition or sale of assets, subject to equivalent privacy protections.

6.1 Australian data residency: Platform data is hosted in Australian cloud regions. Where a sub-processor operates outside Australia, we take reasonable steps consistent with APP 8 to ensure it handles personal information in line with the APPs.

6.2 Security measures: We apply ISO 27001-aligned practices, including encryption in transit and at rest, managed key storage, role-templated fine-grained access controls, rate limiting, continuous monitoring and a regular penetration testing program.

6.3 Data breach response: We maintain an incident response plan and will assess and notify eligible data breaches in accordance with the Notifiable Data Breaches scheme under the Privacy Act.

We retain personal information only as long as needed for the purposes described in this policy, to meet the retention settings configured by the controlling clinic, and to comply with legal and clinical record-keeping obligations. When information is no longer required, we take reasonable steps to destroy or de-identify it.

Under the Privacy Act you may request access to, or correction of, the personal information we hold about you. Where the information is held on behalf of a clinic, we may refer your request to that clinic as the record custodian and assist them in responding. If you have a privacy concern, contact us using the details below; if you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC).

ClinicMira is built for the Australian market. If you access the Service from the European Economic Area or the United Kingdom, you may have additional rights under the GDPR or UK GDPR, such as rights to access, rectification, erasure and portability. You can exercise those rights by contacting us at the address below.

We may update this Privacy Policy from time to time. We will post the updated policy on this page and revise the "Last updated" date above.

Questions about this policy or our data handling practices can be directed to our privacy team:

privacy@clinicmira.com

ClinicMira Pty Ltd, Level 18, 108 St Georges Terrace, Perth WA 6000, Australia.