Privacy Policy

AutoMed Systems Pty Ltd – This version: 2 October 2026

AutoMed Systems Pty Ltd (ABN 69 614 929 476) (“AutoMed”, “we”, “us” or “our”) is committed to providing quality services to Clinics and their Patients, including our email Services, SMS Services, Online Services, Mobile App (AMS Connect), Digital Form processing, Payment Processing, Telehealth Interfaces, AI Clinic Assistant Chatbot and our AI Reception Voice Bot (together, our “Services”). This policy outlines our ongoing obligations in respect of how we manage Personal Information and Health Information. We make a clear distinction between Clinics and Patients. Clinics are defined as a physical or virtual medical centre, the staff of the medical centre and their Personal Information. Patients are defined as any user of a Clinic’s services, including anyone who interacts with our Services.

1. Background

1.1 AutoMed does not create or maintain Patient accounts. We use a real-time interface to validate and exchange Patient data directly with the Practice Management Software (“PMS”) operated by the Clinic. The Clinic remains the sole custodian and owner of Patient data at all times; AutoMed does not own, and does not claim any ownership of, Patient data. AutoMed only collects and processes Patient data for the purpose of providing our services to the Clinic.

1.2 We have adopted the Australian Privacy Principles (APPs) contained in the Privacy Act 1988 (Cth) (“Privacy Act”), including the amendments made by the Privacy and Other Legislation Amendment Act 2024 (Cth). Those amendments strengthened the enforcement powers of the Office of the Australian Information Commissioner (OAIC), introduced a statutory tort for serious invasions of privacy, and are progressively introducing new transparency requirements for the use of automated decision-making. The APPs govern the way in which we collect, use, disclose, store, secure and dispose of Personal Information.

1.3 A copy of the Australian Privacy Principles, and further information about your privacy rights, is available from the OAIC at www.oaic.gov.au.

2. Purpose of Our Policy

2.1 AutoMed Systems Pty Ltd provides Online Appointment Booking, Mobile Apps (AMS Connect and AMS Doc Connect), Reminders, Recall and Result Notification, Bulk Communications, Payments, Telehealth, Advanced Reporting, Tenant Service Fee Reporting, Digital Forms, our AI Clinic Assistant Chatbot, our AI Reception Voice Bot, and associated technologies to Clinics (together, the “Services”).

2.2 We have adopted this Privacy Policy to ensure we have standards in place to protect the Personal Information and Health Information (which is a form of sensitive information) we collect and obtain about Clinics and Patients, to the extent necessary to:

• 2.2.1 provide the Services we offer; and
• 2.2.2 carry out the normal day-to-day operations of our business.

2.3 This Privacy Policy follows the standards of the APPs set by the Australian Government for the handling of Personal Information under the Privacy Act.

2.4 By publishing this Privacy Policy, we aim to make it easy for Patients and Clinics to understand what Personal Information and Health Information we collect, obtain and use, why we do so, how we collect or obtain that information, and the rights a Patient and Clinic have in respect of their Personal Information and Health Information in our possession, including information generated through their use of our Services.

3. Definitions

3.1 In this Privacy Policy:

• “AI Services” means our AI Clinic Assistant Chatbot and our AI Reception Voice Bot, and any other AI-enabled product we may release from time to time.
• “Conversation Data” means the text, voice audio or transcript of an interaction between a Patient or Clinic and our AI Services, including any Personal Information or Health Information disclosed during that interaction.
• “Personal Information” and “Health Information” have the meanings given in the Privacy Act.
• “PMS” means the Practice Management Software operated and controlled by a Clinic.
• “Clinic” means a physical or virtual medical centre and its staff.
• “Patient” means any user of a Clinic’s services, including a caller to, or user of, our AI Services.

4. What is Personal Information and Health Information, and Why Do We Collect It?

4.1 Personal Information has the meaning given under the Privacy Act which includes but not limited to name, date of birth, address, email address and telephone number.

4.2 Personal Information or Health Information is obtained in many ways, including interviews, correspondence, telephone (including via our AI Reception Voice Bot), email, our website www.automedsystems.com.au, our AI Clinic Assistant Chatbot, other websites, media and publications, other publicly available sources, cookies, and third parties. We do not guarantee the content or privacy practices of authorised third-party websites we may link to.

4.3 We collect a Clinic’s Personal Information primarily to establish, manage and administer our business relationship with the Clinic, including account set-up, delivery of our Services, invoicing and support. We may also use a Clinic’s Personal Information for the secondary purpose of providing product information and marketing about our services, being a purpose a Clinic would reasonably expect given our business relationship. Each marketing communication we send will include a functional facility to opt out or unsubscribe, and Clinics may opt out or unsubscribe at any time by emailing support@automedsystems.com.au.

4.4 We collect a Patient’s Personal Information, including Health Information, solely to provide the Services to the Clinic, including enabling the Clinic to deliver reminders, recalls, results notifications and other communications to the Patient. Where we send communications to a Patient on the Clinic’s behalf, each such communication will include a functional facility at any time by contacting the Clinic directly.

4.5 Health Information includes information about health or disability, and information collected in relation to a health service, such as: notes of symptoms, diagnosis and treatment; specialist reports and test results; appointment and billing details; prescription and pharmaceutical purchase details; dental records; genetic information; healthcare identifiers; and information about race, sexuality or religion collected by a health service provider. The Health Information AutoMed collects is limited to the following: appointment data, recall category and due date, and billing details for AutoMed payment options.

4.6 Health Information – including any Health Information disclosed as Conversation Data – is obtained and accessed solely to provide the Services to the Clinic, including to enable our AI Services to respond to a Patient’s request. No analysis, profiling, special processing or aggregation of Health Information is undertaken for any other purpose.

4.7 When we collect Personal Information we will notify you of the matters set out in APP 5.2 (including the purpose of collection) at or before the time of collection, or as soon as practicable afterwards, except where an exception under APP 5.2 applies. This includes where an interaction is being handled by our AI Services.

5. Who and What This Policy Applies To

5.1 Our Privacy Policy explains how we handle both “Personal Information” and “Health Information” as those terms are defined in the Privacy Act. Where relevant, this Policy addresses Health Information separately given its status as sensitive information under the Act.

5.2 Our Privacy Policy does not apply to information we collect about businesses or companies; however, it does apply to information about the people in those businesses or companies which we store.

5.3 This Privacy Policy applies to all forms of information, physical and digital – including Conversation Data generated through our AI Services – whether collected or stored electronically or in hardcopy.

5.4 If, at any time, a Clinic or Patient provides Personal Information or other information about someone other than themselves, the individual providing that information warrants that they have authority or consent required under the Privacy Act to do so, including, in the case of a child, that they are a parent or guardian with authority to make privacy-related decisions on the child’s behalf having regard to the child’s age and maturity.

6. The Information We Collect

6.1 In the course of business, it is necessary for us to collect Personal Information. We only do this on behalf of Clinics and their Patients, and this information allows us to identify who a Patient is in relation to a Clinic for the purposes of providing our Services. Without limitation, the type of Personal Information we may collect are:

• 6.1.1 Health Information, limited to the matters set out in clause 4.5;
• 6.1.2 Personal Information such as a Patient’s name, location, date of birth, and nationality, used to identify the individual and provide our core Services, such as new patient registration;
• 6.1.3 Contact Information such as email, telephone, residential, business and postal address, used to contact the Clinic or the Patient on the Clinic’s behalf;
• 6.1.4 Financial Information, such as bank or credit card details used to transact with us;
• 6.1.5 Statistical Information collected from a Clinic solely for reporting to the Clinic;
• 6.1.6 personal correspondence sent to us by a Clinic or Patient, or sent to us by others about their activities; and
• 6.1.7 Conversation Data. When a Patient or Clinic interacts with our AI Services, we process the words spoken or typed during that session – together with any Personal Information or Health Information disclosed – for the sole purpose of understanding and responding to the request in real time, as further described in section 9.

All information described in clause 6.1 is only ever used for the purpose it was supplied or collected for, consistent with our ISO 71001-aligned information security practices. Such information, including Conversation Data and Statistical Information, is never shared with any third party except as expressly described in this Privacy Policy or required by law.

6.2 We may also collect non-Personal Information about a Clinic or Patient, such as limited technical system logs generated by our Services that do not contain conversation content. Where information collected under this clause does not identify, and is not reasonably capable of identifying, an individual, the APPs do not apply to that information. This data is typically used for proactive system monitoring, fault diagnosis and network security. Where an IP address or similar technical identifier is capable of identifying an individual, either alone or in combination with other information we hold, it will be treated as Personal Information and handled in accordance with this Policy.

7. How Clinic Information is Collected

7.1 Most information will be collected in association with a Clinic’s use of the Services, an enquiry about AutoMed, or generally dealing with us. We may also receive Personal Information from sources such as advertising, a Clinic’s own promotions, public records, mailing lists, contractors, and our business partners. Information is likely to be collected as follows:

• 7.1.1 Registrations/Subscriptions – when a Clinic registers or subscribes for a service, list, account, connection or transaction;
• 7.1.2 Accounts/Memberships – when a Clinic submits details to open an account or become a member;
• 7.1.3 Supply – when a Clinic supplies us with goods or services;
• 7.1.4 Contact – when a Clinic contacts us in any way;
• 7.1.5 Access – when a Clinic accesses us physically or online, including via cookies or analytics; and/or
• 7.1.6 Pixel Tags – enabling us to send readable email messages and tell whether mail has been opened.

7.2 We will notify a Clinic of the collection of their Personal Information, and the matters set out in APP 5.2, at or before the time of collection, or as soon as practicable afterwards, except where an exception under APP 5.2 applies.

7.3 Where we receive Personal Information about a Clinic or a Patient that we did not solicit, we will assess whether we could have lawfully collected that information under APP 3 had we solicited it. If we could not have lawfully collected it, we will destroy or de-identify the information as soon as practicable, unless it is contained in a Commonwealth record or it is unlawful for us to do so. If we could have lawfully collected it, we will handle it in accordance with this Policy as if we had solicited it, including notifying the Clinic or Patient (as relevant) in accordance with clause 7.2.

8. How Patient Information is Collected

8.1 Patient data is obtained from the Clinic’s PMS, or directly from a Patient’s own interaction with the Services (including the AutoMed Mobile App, Online Appointments, our AI Clinic Assistant Chatbot, or our AI Reception Voice Bot).

8.2 Patient data obtained under clause 8.1 is used solely for the purpose of providing the Services to the Clinic – specifically, for processing automated notifications and reminders, and, where relevant, for enabling the Services to respond to a Patient’s enquiry.

8.3 A Patient’s identity is validated in real time against the data in the Clinic’s PMS when a Patient uses the AutoMed Mobile App, Online Appointments, our AI Clinic Assistant Chatbot, or our AI Reception Voice Bot.

8.4 AutoMed does not create Patient accounts and Patients are not able to register with AutoMed. This applies equally to our AI Services: each interaction is validated in real time against the Clinic’s PMS, and no separate Patient profile or account is created or retained by AutoMed as a result of that interaction.

9. Our AI Clinic Assistant Chatbot and AI Reception Voice Bot

9.1 Overview. Our AI Clinic Assistant Chatbot (a text-based assistant) and our AI Reception Voice Bot (a voice-based telephone assistant) help Patients with everyday administrative tasks, such as making or changing appointments, answering general queries, and passing on messages to a Clinic. Our AI Services do not provide medical advice, make clinical decisions, or replace the professional judgement of a Clinic or its staff. Where a Patient’s interaction with our AI Services indicates a possible medical emergency, the Patient will be directed to contact emergency services or the Clinic directly.

9.2 Local, Australian-based processing. All processing performed by our AI Services takes place on AutoMed’s own dedicated servers, located in dedicated rack space within Australia. We do not use third-party or public cloud AI providers, and we do not send Conversation Data outside Australia, to power our AI Services.

9.3 No retention of Conversation Data. Conversation Data is used only for the duration of the interaction – to generate a response and, where relevant, to validate or update information in real time against the Clinic’s PMS. Once a conversation ends, the Conversation Data is not retained, stored, or accessible by AutoMed, except for limited technical logs (which do not include the content of the conversation) kept for system monitoring, fault diagnosis and security purposes, or where retention is otherwise required by law.

9.4 No external access or sharing. Conversation Data is not shared with, or made accessible to, any person or system outside AutoMed’s dedicated infrastructure, and is not shared between Clinics.

9.5 No use for AI training. We do not use Conversation Data, or any Patient data obtained via the PMS interface, to train, fine-tune or otherwise improve any AI model – whether our own or a third party’s – beyond the immediate purpose of responding to that interaction.

9.6 Human oversight and limitations. Our AI Services are designed to support, not replace, human staff. Responses are generated automatically and may occasionally be incomplete or inaccurate. Patients and Clinics should confirm any important information (such as appointment details) directly with the Clinic where there is any doubt, and Clinics remain responsible for clinical decisions.

9.7 Voice recording and disclosure. Calls handled by our AI Reception Voice Bot involve real-time processing of the caller’s voice to generate a response, and a verbal notice is provided at the start of the call to inform the caller that they are speaking with an automated system, and that their voice is being processed to generate that system’s responses. Call recording and disclosure obligations in Australia arise under both the Telecommunications (Interception and Access) Act 1979 (Cth) and State and Territory surveillance/listening devices legislation, which vary by jurisdiction. Clinics using our AI Reception Voice Bot are responsible for ensuring the disclosure provided to callers meets the requirements applicable in their State or Territory, and for offering a path to a human staff member where a caller does not wish to proceed with the automated system.

9.8 Automated decision-making. Our AI Services support administrative functions only (such as scheduling, reminders and general information) and are not used to make decisions about clinical diagnosis, treatment, or a Patient’s eligibility for care. Where provisions of the Privacy Act relating to automated decision-making apply to any aspect of our processing, we will provide the additional information required by those provisions, including on request.

10. When Clinic Personal Information is Used & Disclosed

10.1 In general, the primary principle is that we will not use any Clinic’s Personal Information other than for the purpose for which it was collected. The purpose of collection is determined by the circumstances in which the information was collected and/or submitted.

10.2 We retain a Clinic’s Personal Information for the period necessary to fulfil the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

10.3 We will only disclose a Clinic’s Personal Information to third parties in the circumstances described in clause 10.5 or otherwise as permitted or required by the Privacy Act. We do not sell a Clinic’s Personal Information.

10.4 Information is used to enable us to operate our business, especially as it relates to an individual. This may include:

• 10.4.1 the provision of goods and services between a Clinic and us;
• 10.4.2 verifying a Clinic’s identity;
• 10.4.3 communicating with a Clinic about their relationship with us and our goods and services;
• 10.4.4 our own marketing and promotions to Clinics, in accordance with clause 4.3;
• 10.4.5 competitions, surveys and questionnaires;
• 10.4.6 investigating any complaints about or made by a Clinic, or suspected breach of our terms or unlawful activity; and/or
• 10.4.7 as required or permitted by any law (including the Privacy Act).

10.5 There are some circumstances in which we must disclose a Clinic’s information:

• 10.5.1 where we reasonably believe a Clinic may be engaged in fraudulent, deceptive or unlawful activity, and disclosure to a governmental authority is reasonably necessary for that authority’s enforcement functions;
• 10.5.2 as required by any law (including the Privacy Act); and/or
• 10.5.3 in order to sell our business (in that we may need to transfer Personal Information to a new owner).

11. When Patient Personal Information is Used & Disclosed

11.1 In general, the primary principle is that we will not use a Patient’s Personal Information other than for the purpose for which it was collected.

11.2 We retain a Patient’s Personal Information for the period necessary to fulfil the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

11.3 Patient data is solely retained for the purpose of delivering the primary Service to the related Clinic.

11.4 We will not disclose or sell a Patient’s Personal Information to third parties under any circumstances, except:

1. where necessary to prevent or lessen a serious threat to the life, health or safety of the Patient or another person, including directing or connecting a Patient to emergency services;
2. as required or authorised by law, including in response to a subpoena, warrant or other lawful process; or
3. as otherwise permitted under the Privacy Act.

11.5 Information is used to enable us to provide our core services to Clinics.

11.6 Patient Information is not shared between Clinics under any circumstances.

12. Opting “In” or “Out”

12.1 AutoMed provides Opt OUT functionality on all communication portals between Clinics and their Patients, allowing Patients to opt out of receiving communications from the Clinic.

13. Hosting, Security and Overseas Disclosure

13.1 All AutoMed systems, including the infrastructure powering our AI Services, are hosted in dedicated rack space located within Australia. We do not use third-party or public cloud hosting providers for these systems.

13.2 AutoMed fully owns and controls its mail servers, hosted in Australia, used to relay email communications to Clinics and Patients.

13.3 AutoMed uses a Tier 1 Australian-based SMS provider. SMS message data is securely stored within Australia and is permanently deleted on a periodic basis.

13.4 We take all reasonable precautions to protect Patients’ and Clinics’ Personal Information from unauthorised access, including appropriately securing our physical facilities, electronic networks, and dedicated servers.

13.5 AutoMed uses SSL/TLS encryption to store and transfer Personal Information. Despite this, the security of online transactions and communications sent by electronic means or by post cannot be guaranteed, and each individual providing information to us via the internet or by post does so at their own risk. We cannot accept responsibility for misuse of, loss of, or unauthorised access to, Personal Information where the security of that information is not within our control.

13.6 We are not responsible for the privacy or security practices of any third party to whom we are permitted to disclose an individual’s Personal Information in accordance with this Privacy Policy or applicable law.

13.7 We do not disclose Personal Information, Health Information or Conversation Data to any entity located outside Australia. If this changes in future, we will only disclose such information to an overseas recipient in a jurisdiction with a similar privacy regime to the APPs, or where that recipient has agreed in writing to safeguard the information to the same standard as this Policy, and we will update this Policy accordingly.

13.8 If an individual suspects any misuse of, loss of, or unauthorised access to their Personal Information, they should let us know immediately at support@automedsystems.com.au.

13.9 We are not liable for any loss, damage or claim arising from another person’s use of Personal Information where we were authorised to provide that person with the Personal Information.

14. Notifiable Data Breaches

14.1 AutoMed has procedures in place consistent with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act. If we become aware of an eligible data breach that is likely to result in serious harm to an individual, we will notify affected individuals and the OAIC as soon as practicable, in accordance with our legal obligations.

14.2 Individuals may also have the right to bring a claim under the statutory tort for serious invasions of privacy introduced into the Privacy Act, in circumstances involving a serious and intentional or reckless invasion of their privacy. Further information about this right is available from the Office of the Australian Information Commissioner (oaic.gov.au).

15. How to Access and/or Update Information

15.1 Clinics can update their data via the AutoMed Dashboard. If AutoMed does not agree to a correction requested by a Clinic, we will provide reasons for that decision and, if requested, will take reasonable steps to associate a statement with the information noting that the Clinic disputes its accuracy.

15.2 AutoMed does not create or manage Patient accounts, as AutoMed is a real-time system. The Clinic is the primary custodian of Patient data, and a Patient wishing to update their data should contact the Clinic directly. Where a Patient contacts AutoMed directly to access or correct their Personal Information, we will respond to that request in accordance with clauses 15.3 and 15.4.

15.3 Subject to the APPs, an individual has the right to request from us the Personal Information we hold about them, and Clinic information is available in real time on the AutoMed Dashboard. As we do not retain Conversation Data after an interaction with our AI Services ends, there is generally no Conversation Data for us to provide access to beyond the immediate session.

15.4 Requests by Patients will be forwarded to the relevant Clinic as soon as practicable, and in any event within a reasonable period in accordance with the Privacy Act. If a Patient does not receive a response from the Clinic within a reasonable time, they may contact us at support@automedsystems.com.au and we will make reasonable efforts to follow up with the Clinic on the Patient’s behalf.

15.5 It is a Clinic’s responsibility to provide us with accurate and truthful Personal Information. We cannot be liable for any information provided to us that is incorrect.

16. Complaints and Disputes

16.1 If a Patient or Clinic has a complaint about our handling of their Personal Information, they should address their complaint in writing to the details in section 18. We will acknowledge receipt of the complaint within a reasonable period, investigate the matter, and provide a response setting out the outcome of our investigation and any steps we propose to take.

16.2 Where a complaint relates to an actual or suspected data breach, we will handle that aspect of the complaint in accordance with clause 14.

16.3 If a complaint is not resolved to an individual’s satisfaction, they may also lodge a complaint with the OAIC at www.oaic.gov.au.

17. Contacting Individuals

17.1 From time to time, we may send a Clinic important notices that are necessary for their use of the Services, such as changes to our terms, conditions and policies, or notices required by law. Because this information is necessary to the Clinic’s ongoing use of the Services, Clinics may not opt out of receiving these specific notices, even where they have opted out of other communications under clause 12.1.

17.2 AutoMed does not market to Patients, and does not use Conversation Data for marketing purposes.

18. Contacting Us

18.1 All correspondence regarding privacy should be addressed to:

The Administration Manager
AutoMed Systems Pty Ltd
62 Boardwalk Boulevard, Point Cook, 3030, VIC
support@automedsystems.com.au

19. Changes to This Policy

19.1 If we decide to change this Privacy Policy, we will post the changes on our webpage at www.automedsystems.com.au.

19.2 We may take additional steps beyond those described in this Privacy Policy where necessary to comply with the Privacy Act or other applicable law.