Privacy Policy

1. Our role and your clinic

Leemie supplies software to clinics. Your clinic decides which patient records to collect, who may access them and how they are used for care. The clinic remains responsible for its clinical records, collection notices, consent and health-record obligations. Leemie handles clinic information to provide the service and meet its own legal obligations.

If you are a patient, contact your clinic first about your care, appointment, bill or clinical record. You can also contact Leemie about information we hold or our handling of it. This policy does not replace your clinic’s privacy policy or any rights under the Privacy Act 1988 (Cth), Australian Privacy Principles or applicable state and territory health privacy laws.

2. Information we collect and hold

• Staff and account information: names, email addresses, job titles, clinic memberships, permissions, authentication records and account preferences.
• Clinic operations: business and location details, staff schedules, appointment information, settings and subscription arrangements.
• Patient and health information: contact and demographic details, dates of birth, alerts, referrals, medical history, clinical notes, treatment information, files, forms and communications entered or received through the service. This can include sensitive information and information about children supplied by an authorised person.
• Billing information: invoices, payer details, payments, refunds and payment provider references. Payment providers collect payment credentials through their own payment flows; do not put card numbers or security codes in notes, messages or uploads.
• Service and security information: request and audit records, device/browser information, network identifiers (which may be hashed), integration activity and error records. These records can identify an account or activity.
• Support and optional AI information: enquiries, feedback, and the context, instructions and draft output associated with AI features a clinic chooses to use.

3. How we collect information

We receive information from account holders, clinic staff, patients and authorised representatives through forms, bookings, imports, uploads and correspondence. Clinics may provide records obtained from referrers, other providers or guardians where authorised. Enabled integrations may supply information on the clinic’s instructions. Technical records are generated when the service is used.

Clinics must have an appropriate legal basis to supply information, including consent where required for health information. Publishing this policy is not a request for blanket consent. Where lawful and practical you may make a general enquiry anonymously or using a pseudonym; we need to verify identity before releasing records or changing account access. Without information required for an account, booking or request, we may be unable to provide that feature.

4. Why we use information

We use information to operate accounts and clinic workflows; support appointments, clinical records, communications, billing and reporting; deliver features selected by a clinic; answer enquiries; investigate faults; prevent misuse; maintain security; and meet legal obligations. We use only the information reasonably needed for the relevant purpose.

Patient and clinical information is not sold, used for targeted advertising or used by Leemie to train general-purpose AI models. Product analysis should use de-identified or aggregated information where practical; we do not treat identifiable health records as anonymous analytics. Marketing messages require an appropriate legal basis and an unsubscribe option. Essential account and security messages may still be sent.

5. Who can receive information

Information is available to authorised clinic users according to their roles and, where a feature permits, patients or recipients selected by the clinic. We may use service providers for hosting, private file storage, email/SMS, payments, monitoring and support. Enabled AI and accounting integrations may receive the information needed for their tasks. Providers receive information only for the relevant service, subject to appropriate arrangements and law.

Payment flows may involve Tyro Health, and configured AI features may use OpenAI. These are examples of integrations supported by the product, not a statement that every clinic uses them. Other providers and their locations must be confirmed for the production service before launch. Clinics should review their selected integrations and the providers’ own privacy terms.

Access by Leemie personnel must be authorised and limited to a legitimate operational, security, legal or support need. Information may also be disclosed to professional advisers, where required or authorised by law, or in a business transfer with appropriate confidentiality and privacy protections. We do not grant unrestricted support access to clinical records.

6. Overseas handling

Hosting, remote support and integrations can involve processing or access outside Australia. An Australian hosting region alone does not mean every provider processes information only in Australia.

Disclosure pending: the production provider list and countries of likely overseas recipients are still being confirmed. We will provide those details before real patient information is processed in the production service.

Before arranging an overseas disclosure, we assess the applicable privacy requirements and take reasonable steps required by law to protect the information. This policy does not ask you to waive cross-border protections. Contact us for details about a proposed integration before enabling it for patient information.

7. AI features

AI features are optional and depend on clinic settings and permissions. Relevant context may be sent to the configured model provider. Health information must not be sent until the clinic has approved that processing and the provider’s privacy, retention and location arrangements have been reviewed. Provider settings and terms determine the provider’s handling; Leemie does not promise that a provider retains no information.

AI output can be inaccurate. Clinical and patient-facing drafts need human review before use or release. Do not include unnecessary patient information in instructions or feedback.

8. Cookies and external resources

The app uses session and security cookies to keep users signed in and protect forms against misuse. Blocking these may prevent account features from working. Some interface resources are loaded from external content delivery networks, including jsDelivr and unpkg; your browser sends those services technical request information such as an IP address. Leemie does not use advertising cookies in the app. A future optional tracking feature would need an updated notice and any consent required by law.

9. Security and incidents

Controls include clinic and role-based access checks, authentication, private-file download controls and audit records. Production security requires correct deployment and provider configuration. No system is completely secure. Clinic staff must protect credentials, use available security controls and promptly report suspected unauthorised access.

We investigate suspected breaches, work to contain them and assess applicable notification obligations. We notify affected clinics, individuals and regulators where required by law, including under the Notifiable Data Breaches scheme where applicable.

10. Retention, export and deletion

We retain information for the service and legitimate legal, security and recordkeeping needs. Clinical, financial and audit records may need to be kept after account closure. There is no single retention period for every record; clinics must account for jurisdiction, patient age, professional obligations, disputes and legal holds.

Account closure or a deletion request does not immediately erase clinical records, backups or legally required records. We assess requests, arrange authorised export or return where available, and delete or de-identify information no longer needed where required by law. Backups may retain information until their scheduled expiry, with access restricted. Production retention and backup schedules must be confirmed before launch and communicated to customers.

11. Access and correction

Use the contact at the top of this page to request access to or correction of personal information we hold. For patient records, contacting the treating clinic first usually helps us direct the request appropriately. We may verify your identity and authority and coordinate with the clinic. Do not send a full medical record in an initial enquiry.

We respond within a reasonable period and aim to respond within 30 days. Requests are subject to lawful exceptions and other people’s privacy. If we refuse a request, we explain the reason where permitted and how to complain. Making a request or correcting information is free; any lawful, reasonable access charge will be explained beforehand.

12. Privacy complaints

Contact us with what happened, the relevant clinic or account and your preferred resolution. We acknowledge the complaint, investigate and aim to provide a written response within 30 days. If more time is needed, we explain why and provide an update. You may ask for the matter to be escalated within Leemie.

If you are dissatisfied, you may contact the Office of the Australian Information Commissioner or the relevant state or territory privacy authority. This does not limit any other available right or remedy.

13. Updates

We publish the current policy with its version date and notify account holders of material changes where appropriate. New uses of information require an appropriate legal basis; changing this policy does not itself provide consent. You may request a copy in another accessible format.