Privacy Policy

loomahealth.au (the “Website”) and the Looma Health Apps platform (the “Services”) are operated by [COMPANY LEGAL NAME] (ACN [ACN]) of [REGISTERED ADDRESS] (“we”, “us”, “our”).

We provide AI-assisted workflow automation for Australian healthcare practices, including AI Document Assistance (document capture, classification, extraction and allocation), identity and account services, Best Practice Premier integration via Halo Connect, and related platform modules as described on our Website.

This Privacy Policy explains how we collect, use, store and disclose personal information relating to health care providers and practice staff. We comply with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth).

If you are a patient, your personal information is generally provided to us by your practice when they use the Services. Your practice remains responsible for maintaining a compliant patient privacy policy and obtaining any required consents. Please contact your practice for patient-facing privacy information.

Provider and practice information

We may collect:

• Your name, email address, practice name, practice address and phone number
• Account credentials and profile details (display name, role, tenant affiliation)
• Information relating to your use of the Services (usage metrics, module subscriptions)
• Service enquiries, demo requests and preferred contact times
• Feedback, survey responses and support correspondence
• Administrative or billing information (excluding payment card details)

Payments (when enabled) are processed by Stripe. We do not store payment card information.

Medical practice information

In using the Services, you may upload or allow us to access information relating to your patients (“Medical Practice Information”), including:

• Incoming clinical and administrative documents (fax, email, scanned mail, pathology, imaging, specialist correspondence)
• Extracted patient details such as name, date of birth, Medicare number, address, phone and sex
• Document text, summaries, classification results and matched EMR patient identifiers
• Practice site and clinician mapping data used for Best Practice / Halo Connect integration (for example site IDs, provider numbers)

We process Medical Practice Information solely on your behalf and only in accordance with your instructions and these terms. You are responsible for ensuring you have lawful authority to provide that information to us.

If you do not provide required information:

• We may be unable to create or administer your account
• We may be unable to provide the Services
• We may be unable to contact you about service updates or support

We collect and use your personal information and Medical Practice Information to:

• Administer, manage and support your account and tenant subscriptions
• Provide and improve the Services, including document classification, extraction and allocation
• Match documents to patients and clinicians and, after staff approval, support import into Best Practice
• Respond to enquiries, demo requests and support tickets
• Send service updates (and marketing communications where you have consented)
• Monitor performance, reliability and security
• Conduct system troubleshooting and quality control
• Enforce our policies and comply with Australian legal obligations

To classify documents and extract structured details, document content may be processed by artificial intelligence providers acting as our subprocessors. Our primary AI processing uses Google Vertex AI (Gemini) configured for the australia-southeast1 region. In some configurations, OpenAI models may be used.

AI output is a draft for staff review. Final filing and clinical decisions remain with your practice. We do not use Medical Practice Information to train public third-party models for unrelated purposes.

We may disclose your personal information to:

• Technology providers that host or operate the Services (including cloud AI providers as described above)
• Stripe, for payment processing when billing is enabled
• Halo Connect / Best Practice, to the extent required for EMR integration you enable
• Professional advisers (lawyers, accountants, auditors)
• Contractors supporting security or service operations, under confidentiality obligations
• Regulatory authorities or government agencies where legally required

We do not sell your personal information. We do not disclose personal information unless legally required, reasonably necessary to provide the Services, or you have provided consent.

Third parties that receive personal information must use it only for the purpose provided and maintain confidentiality and security consistent with this Privacy Policy.

Application data (accounts, tenants, documents and related metadata) is stored on our Australian-hosted infrastructure, including PostgreSQL databases and document file storage on our VPS. Identity and authentication are provided via our identity service.

As noted above, document content may be transmitted to AI subprocessors for processing. Where OpenAI is configured, that may involve processing outside Australia. We will take reasonable steps consistent with APP 8 when personal information is disclosed overseas.

Security measures include:

• TLS encryption for data in transit
• Tenant isolation and role-based access controls
• Authentication via our identity platform (including OIDC tokens)
• Internal service-to-service authentication for platform APIs
• Staff-in-the-loop review before documents are filed to the EMR
• Operational controls and logging appropriate to a healthcare workflow platform

No method of transmission or storage is completely secure. We take reasonable steps to protect personal information against misuse, interference, loss, and unauthorised access, modification or disclosure.

We retain personal information only for as long as reasonably necessary to provide the Services, meet legal obligations, resolve disputes and enforce our agreements.

• Medical Practice Information (documents and extractions): [DOCUMENT RETENTION PERIOD — e.g. for the duration of your subscription plus a reasonable backup period]
• Provider account and billing records: [ACCOUNT DATA RETENTION PERIOD — e.g. for the duration of your account plus records required by law]

After these periods, personal information is permanently deleted or destroyed, subject to any legal retention requirements and backup cycles.

The public marketing site at loomahealth.au includes a contact form that opens your email client (mailto). That form does not store submissions on the Website itself. Demo requests submitted through our identity API (where enabled) are stored to allow us to respond to your enquiry.

We may send marketing communications with your consent, or as otherwise permitted by law. You may opt out at any time by contacting us or using unsubscribe mechanisms we provide.

Our Website or Services may contain links to third-party websites. We are not responsible for the privacy practices of those websites.

You may request access to, or correction of, your personal information at any time. If we cannot make a requested correction, we will take reasonable steps to associate a statement of your disagreement with the information.

Email: hello@loomahealth.au — Attention: Privacy Officer

You may also contact the Office of the Australian Information Commissioner (OAIC): https://www.oaic.gov.au/privacy/privacy-complaints/

You can make a complaint about the way we have handled your personal information by contacting us at hello@loomahealth.au. We will investigate and respond in a reasonable timeframe.

If you are not satisfied with our response, you can complain to the OAIC: https://www.oaic.gov.au/privacy/privacy-complaints/

We may update this Privacy Policy from time to time. We will publish the updated version on the Website and revise the “Last updated” date. Continued use of the Services after changes take effect constitutes acceptance of the updated policy, except where consent is required by law.