Privacy Policy

Overview

Avilo Health Pty Ltd (ACN 698 695 019) ("Avilo", "we", "us") provides an AI-assisted patient-communications service for allied health clinics: answering calls, handling text messages, sending appointment reminders and confirmations, and running patient recall on behalf of the clinics that subscribe to us (each a "Clinic").

We handle health information, which is sensitive information under Australian privacy law. We treat it accordingly. We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles ("APPs"), and by applicable state and territory health records legislation including the Health Records and Information Privacy Act 2002 (NSW) and the Health Records Act 2001 (Vic).

This policy has three parts:

• Part A: information we collect for ourselves (website visitors, customers, Clinic staff).
• Part B: patient information we handle on behalf of Clinics.
• Part C: how our AI works, what it decides, and who reviews it.

Part A: Information we collect for ourselves

A1. What we collect

• Website and enquiries: name, email, phone, clinic name and role when you contact us or request a demo; technical data such as IP address, browser and pages visited, recorded in standard web server logs.
• Customer accounts: names, work email addresses, roles and credentials of Clinic staff who use Avilo; account settings.
• Billing: billing contacts and transaction records. Card details are held by Stripe; we do not store full card numbers.
• Support: the content of your emails, calls and support requests.

A2. Why (APP 3, APP 6)

To provide and administer the service; to support accounts; to bill; to answer enquiries; to improve the product; to send service notices; and, with consent or as permitted by law, marketing you can opt out of at any time. We do not sell personal information.

Some of the providers listed in B5, including our billing, email, demo-booking and enquiry-form providers, handle this information overseas. B5 explains where our providers are located and how we manage overseas disclosure.

A3. Cookies and third-party content

Essential functionality only. This website does not run analytics, advertising or tracking cookies, and does not load fonts, scripts or images from third parties. Our web fonts are served from our own domain, so simply browsing the site sends nothing to anyone but us. If we introduce analytics in future, we will update this policy before doing so.

The booking calendar is the one exception, and it is opt-in. Our demo booking calendar is provided by Calendly. It does not load unless you click to load it. If you do, your browser connects to Calendly and Calendly may set its own cookies at that point. You can book by sending us an enquiry instead if you would rather not load it.

You can disable cookies in your browser; parts of the site may not work.

---

Part B: Patient information we handle for Clinics

B1. What flows through Avilo

• Identity and contact details: name, phone, email, from the Clinic's practice management system ("PMS") or from the patient directly.
• Appointment information: times, appointment types, practitioners, attendance history, cancellations, confirmations, waitlist status.
• Communication content: text messages sent and received on the Clinic's Avilo-managed number; written transcripts of calls answered by our AI assistant; messages we generate for the Clinic (reminders, recall check-ins).
• Health information volunteered in a conversation: what a patient chooses to say when booking or messaging, for example describing an injury. Where a patient books a new appointment, this may include a short reason for the visit recorded against that appointment.

What we deliberately do not collect or hold:

• No call audio. Calls are transcribed as they happen and only the written transcript is kept. Audio recording is switched off at source, not deleted afterwards. Callers are told at the start of every call that they are speaking with an AI assistant and that a written record is kept.
• No clinical notes. We do not read or process practitioner treatment notes from the PMS, and we do not use clinical content to personalise messages.
• No patient payment card data.

B2. How we collect it (APP 3, APP 5)

Most patient information reaches us from the Clinic's PMS under an API connection the Clinic authorises, or from patients messaging or calling the Clinic's Avilo-managed number.

New patients. Where someone who is not yet a patient of the Clinic calls or messages, Avilo may create a patient record and book an appointment on the Clinic's behalf. In that case we collect your information, including a brief reason for your visit, directly from you, for the Clinic. We tell you at the start of the call that you are speaking with an AI assistant and that a written record is kept, and the booking confirmation links to the Clinic's privacy policy. You can ask for a person at any point and the assistant will transfer you or take a message.

We collect health information only where reasonably necessary to book or manage your appointment, and ask for no more than that. Please don't send clinical detail through this channel; anything clinical is passed to the Clinic's team rather than handled by the AI.

B3. What we do with it (APP 6)

Only what is needed to run the service for the Clinic:

• read and respond to patient messages and calls (booking, rescheduling, cancelling, answering the Clinic's approved practice questions);
• write appointment changes back to the Clinic's PMS;
• send appointment reminders and confirmation requests for the Clinic;
• send recall and reactivation messages the Clinic has configured and approved (see B4);
• escalate to Clinic staff anything the AI is not confident about, and anything clinical, urgent, ambiguous, or where a patient asks for a human;
• surface conversations, escalations and reporting to authorised Clinic staff.

We never contact a Clinic's patients for any purpose of our own, and we do not use patient information for our own marketing.

B4. Recall and reminder messages (APP 7, Spam Act 2003)

Clinics can use Avilo to send appointment reminders and to check in with patients they haven't seen for a while.

• Recall and check-in messages are commercial electronic messages. Every one carries the Clinic's name and a working opt-out. Reply STOP at any time and you will receive no further campaign messages from that Clinic. Opt-outs are processed before any AI handling, and applied immediately and permanently.
• Opting out of recall does not stop transactional messages about an appointment you have actually booked: confirmations, reminders, and replies to your own messages.
• Recall messages do not reference your condition, symptoms, diagnosis or treatment. They use your name, when you were last in, and which practitioner you saw. This is a design limit, not a setting: we do not put clinical detail into a message that may appear on a phone screen someone else can see.

B5. Who we disclose it to, including overseas (APP 8)

We use the service providers below, each bound by contract to use information only to provide services to us:

Where the data sits. Our primary database and our application hosting are both in Australia. The remaining providers process information in the United States in the course of delivering their functions.

Overseas access, even to Australian-hosted data. Supabase and Fly.io are companies incorporated in the United States. Although the data they hold for us is stored in Australia, their personnel and support systems may be able to access it from outside Australia. We therefore treat every provider in this table as an overseas recipient rather than relying on the storage location alone. The countries in which recipients are likely to be located are Australia and the United States.

Before disclosing personal information overseas we take reasonable steps under APP 8.1 to ensure the recipient handles it consistently with the APPs. This includes binding contractual data-protection terms with each provider that limit it to acting on our instructions, prohibit use of the information for its own purposes, and require it to protect the information to a standard consistent with the APPs.

The table above is our current list of sub-processors. Clinics receive at least 30 days' notice before we add or replace a provider that handles patient information.

We may also disclose where required by law, or to our professional advisers under confidentiality.

B6. Security (APP 11)

Encryption in transit (TLS) and at rest; PMS credentials encrypted with AES-256-GCM; tenant isolation enforced at the database layer so a Clinic's data is only reachable within that Clinic's tenancy; role-based access for Clinic staff; multi-factor authentication for administrative access; access and audit logging.

Access by Avilo personnel. Avilo is a small team. Personnel with technical access can reach patient content when required to investigate a specific fault or support request. Such access is limited to what the issue requires, and is logged. We also review escalated conversations to improve how the service handles them; see Part C.

B7. Data breaches

If a breach occurs that is likely to result in serious harm, we begin assessing immediately, notify affected Clinics without undue delay and in any case within 72 hours of becoming aware, and comply with the Notifiable Data Breaches scheme, including notification to the OAIC and to affected individuals where required, working with the affected Clinic.

B8. Access, correction, retention (APP 11.2, APP 12, APP 13)

• Patients: contact your clinic first. If you contact us at privacy@avilo.com.au we will verify your identity, coordinate with your clinic, and respond within 30 days.
• Retention: conversation records including call transcripts, 12 months by default and configurable by the Clinic; recall campaign records, 2 years then anonymised; no call audio at any time. We destroy or de-identify personal information when it is no longer needed for the purposes above.
• On a Clinic leaving: the Clinic may export its data within 30 days; we delete from production within 90 days; encrypted backups purge on the next rotation, except where law requires retention.

---

Part C: How our AI works, and what it decides

We publish this section voluntarily, ahead of the APP 1 automated-decision transparency obligations that commence on 10 December 2026.

C1. What is automated

When a message or call arrives, software classifies it: what the patient appears to want, how urgent it seems, and how confident the system is. It then either handles the request (booking, rescheduling, cancelling, answering the Clinic's approved practice questions) or escalates to Clinic staff. It uses the content of your message or call and your contact and appointment details, the categories listed in B1.

Booking itself is not decided by AI: which appointment slots exist and can be booked is determined by ordinary programmed rules reading the Clinic's calendar.

C2. The decision that matters, and its limits

The consequential automated decision is whether a human sees your message, and how quickly. We build conservatively around it:

• anything appearing clinical, urgent or ambiguous is escalated, and this cannot be switched off;
• anyone asking for a person gets one;
• urgent and clinical escalations always actively notify Clinic staff, who can take over any conversation at any time.

C3. Human review, and how the system improves

We review escalated conversations to correct mistakes and tune the system for that Clinic.

Boundaries we hold to:

• Patient content is never used to train AI models. Our AI providers are contractually prohibited from training on it.
• Patient content is never shared between Clinics. What Avilo learns from a Clinic is used for that Clinic only.
• General improvements use de-identified, aggregated information only. One Clinic's patient conversations are never used to serve another.

C4. If you disagree with how something was handled

Tell your clinic, or contact us at privacy@avilo.com.au. A person will review what happened, and the full conversation is available to your clinic.

---

Complaints and contact

Privacy questions or complaints: privacy@avilo.com.au. We acknowledge within 7 days and respond within 30 days.

Not satisfied? Complain to the Office of the Australian Information Commissioner: oaic.gov.au, 1300 363 992.

Changes

Material changes are notified to Clinics by email at least 30 days before taking effect. The current version is always at avilo.com.au/privacy.

Avilo Health Pty Ltd (ACN 698 695 019) · Effective August 2026 · Last updated 2 August 2026. See also our Terms of Service.