You can get in touch with us at any time about the way we handle and safeguard your information.If you want to:
ask questions
update your information
update or delete your Heidi Platform account
change your user preferences
register a concern
opt out of marketing
anything else…
We're just a call or a few clicks away.If you have any questions or complaints about how we handle your information you can get in touch with us at support@heidihealth.com
2. About us
As part of our service, we provide the Heidi Platform application (Platform) to qualified medical practitioners (including their relevant medical clinic) and other health professionals (Practitioners) for patients of Practitioners.The Platform facilitates the delivery of healthcare services including by:
we, our or us– we mean Heidi Health Trading Pty Limited (ABN 84 649 783 871), and our related bodies corporate identified below at section 14.
our services – we mean the provision of the Platform to you as a Practitioner and related services that we provide.
you- we mean you, the reader of this policy.
your information– we mean your personal information that you may share with us
privacy laws– we mean all privacy and data protection laws that apply to us when we handle your information, including applicable health information laws
3. What information do we collect?
We collect and hold the following categories of information, including personal information, health information, payment information, device information, and general information to help us improve our services.
When you access and use our website, Platform, or other services, we collect and hold the following main categories of information as detailed in the table below. The collection of extensive data sets, including device information, is crucial for enhancing user experience, optimising service functionality, and ensuring robust security measures. We process such information based on legitimate interests—improving our services and maintaining security—and where applicable, through explicit consent, which is transparently obtained at the point of data collection. If you choose not to provide the requested information, it may impact our ability to deliver these services to you fully.
Additionally, we may collect other types of information from you to further tailor and secure our offerings, adhering to all requirements under all relevant regulations, ensuring transparency and giving you control over your personal data.
Category
Details
Your general personal information
This includes information or an opinion about you that is reasonably identifiable. For example: your name, address, age or date of birth, gender, contact number and email address. Where you are a Practitioner, we may also collect information relating to your qualifications, registrations, training and educational background.
Payment and claim information
We may collect information from you in order to pay for services, or for us to make claims on your behalf. This may include credit card information, bank account details and Medicare card and claim details.
Sensitive Health information
This includes any health information that practitioners provide when accessing or using our website, platform, or other services. We may collect health information from you for the purposes of facilitating the delivery of Heidi. Additionally, we may collect health information about patients from Practitioners, including information arising out of or in connection with the use of Heidi. This may include information that a practitioner provides directly to us or otherwise makes available. Types of health information we may collect include medical history, clinical notes, test results, disease status, and prescribed medications, among others.For the sake of clarity, all sensitive health information undergoes a pseudonymization process where all personal identifiers that can reasonably identify an individual are removed, ensuring there is no reasonable likelihood of re-identification by malicious actors. Any sensitive health information is only retained for the duration as requested by the practitioner. For the avoidance of any doubt, no patient data from users is used to train, develop, or improve any of our AI models.
Device information
This includes your device ID, device type, geo-location information, computer and connection information, statistics on page views, traffic to and from the sites, ad data, IP address and standard web log information.
Additional information you provide
This includes information you provide to us through customer surveys, directly through our website or indirectly through your use of our website or Platform or online presence or through other websites or accounts from which you permit us to collect information.
Information collected for our own business improvement
We may de-identify your general personal information and use it in aggregate form to conduct analysis on how our website, Platform and other services are being used to help us improve our services and provide benefits back to our users. When we refer to 'de-identified' information, we mean information that has undergone a process of removing all personal identifiers that can reasonably identify you so that there is no reasonable likelihood of re-identification occurring. When we use this information for the purposes of business improvement, it is always in de-identified form.
Information collected by cookies
We may collect de-identified information via cookies on our website, such as your browser type, operating systems and other websites visited. We may also collect some personal information when using cookies, such as where a cookie is linked to your account. There are more details about cookies in section 9.
Information collected for recruitment purposes
When you apply for a job or position with us we may collect certain information from you (including your name, contact details, working history and relevant records checks) from any recruitment consultant, your previous employers and others who may be able to provide information to us to assist in our decision on whether or not to make you an offer of employment or engage you under a contract.
4. How do we collect your information?
We collect your personal information when you engage with us or from third parties.
In many instances, we collect personal information directly from you. Here are some of the main ways.
Category
Details
Registration
When you register on our website or Platform.
Communication
Where you communicate with us through correspondence, questionnaires, chats, email, or when you share information with us from other services or websites. Communications may occur through the Platform.
Interaction
When you interact with our sites, Platform, services, content and advertising or use our Platform or services.
We may also collect information about you from our related companies, third party service providers and other organizations that we partner with. For example:
when you apply for a job or position with us, we may collect information about you from any recruitment consultant, your previous employers, referees, CV checking agencies or others who may be able to provide information to assist us with our decision; and
where you are a Practitioner, we may collect information about your qualifications, registrations, training and education background from third party sources, for purposes which include verifying your status as a qualified medical practitioner.
5. How do we use your information?
We use your personal information to enable us to deliver and improve our products and services.
We adhere to privacy by design principles by integrating data protection from the outset of designing our systems and business practices. Our measures include robust encryption, stringent access controls, and continuous threat monitoring. Privacy impact assessments are conducted regularly to ensure potential risks are identified and mitigated, ensuring data protection is a foundational aspect of our operations.We implement rigorous de-identification techniques to ensure personal and health data are psuedonymised, stripping identifiable markers to prevent re-identification by malicious actors. These processes are reinforced by stringent security protocols, including multi-layered encryption and access controls, to safeguard the integrity and confidentiality of the de-identified data.
If we use personal information already collected in a manner different from that stated within this Privacy Policy, we will notify users via an updated information notice. This notice will inform you of the new use of the data and provide you with choices regarding its use.
Category
Details
Access
To enable you to access and use our website, Platform and other services.
Improvement
Design, provide, improve and manage our website, Platform and other services, business and your experience, such as to perform analytics and marketing.
Health care services
To facilitate the delivery of healthcare services to Patients. For example, information relating to Patients' medical history, complaints or symptoms may be collected and used by the Platform so that Practitioners can make treatment decisions.
De-identified information for Platform functions and improvement
We may de-identify and/or aggregate your personal information, for the purposes of using that de-identified information to provide certain functionality and develop and improve the Platform.For the removal of any doubt, this purpose does not include the use of any sensitive health information and no patient data is used to train, develop, or improve any of our AI models.
Support
Send you service, support and administrative messages, reminders, technical notices, updates, security alerts, and information requested by you.
Contact
Contact you when we need to tell you something important about the website, Platform and other services, or your information.
Marketing
Send you marketing and promotional messages and other information that may be of interest to you.
Law
Comply with laws, and assist government or law enforcement agencies where we are required and authorized to do so.
Employment
Consider your employment application.
Unless permitted or required by law, we won't use your health information without your consent.
6. How do we use your personal information for marketing, and how do you opt out?
You can opt-out at any time from our marketing communications.
We may send you direct marketing communications and information about our services or products. This may take the form of emails or other forms of communication. We'll always conduct our marketing practices in accordance with privacy laws and other applicable laws. If we do send you marketing messages using your information, you'll be able to opt out at any time – either by using the unsubscribe facility in the relevant message or by contacting us (it's easy – see section 1).We may also market our services to you generally – including via social media, advertising through our website and other digital or non-digital platforms. We'll always do this in accordance with our legal requirements.Without your consent, we will not:
use any of your health information to send you marketing communications; or
disclose any of your information to a third party in order for them to market to you.
7. Do we store or share information outside of your country?
Your personal information is stored in your local jurisdiction
We understand the importance of data security and privacy and we're committed to safeguarding your information. We have implemented data localization solutions for customers located in Australia, Canada, US, UK and EU. Please note that some functionalities of our Platform depend on third-party services, whose servers may be located internationally. Whenever these third-party services are utilised, we ensure that data processing agreements are entered into. These agreements are crucial as they enforce compliance with data protection standards and legal requirements, safeguarding your personal information from unauthorised use or disclosure. This contractual measure helps maintain the integrity and confidentiality of your data while enabling us to provide enhanced functionality through external services.
8. Who do we share your information with?
We may share your personal information with our other partners and for other reasons we tell you about in this policy, on our website, on our Platform or where we otherwise communicate this to you.
We may share your personal information with:
our employees and related companies;
third party suppliers and service providers (including providers for the operation of our Platform, websites and/or our business);
professional advisers, dealers and agents;
payment systems operators (eg, merchants receiving card payments);
anyone to whom our assets or businesses (or any part of them) are transferred;
specific third parties authorised by you to receive information held by us, and other parties involved in the delivery of healthcare services; and/or
other persons, including government agencies, regulatory bodies and law enforcement agencies, or as required, authorized or permitted by law.
9. Using our website and Platform
We use cookies on our website to track your website usage and remember your preferences.
You have the right to access, correct, update, or delete the personal information we collect about you. You may also object to or restrict certain forms of data processing, including for marketing purposes, and you have the right to withdraw consent at any time where processing is based on consent.
Cookies and Consent Preferences
When you first visit our website, you will be presented with options to manage your cookie preferences through a consent banner. We use cookies to support site functionality, analyse usage, personalise content, and deliver relevant advertisements. These include:
Cookie Type
Description
Strictly necessary cookies
Enable basic features like page navigation and access to secure areas of the website.
Analytics cookies
Help us understand how users interact with our site so we can improve it.
Personalisation cookies
Tailor your experience based on usage patterns.
Advertising cookies
Used to serve personalised ads through services like Google.
You can update or withdraw your consent at any time by adjusting your browser settings. No personal information is collected or shared for advertising or analytics purposes unless you have explicitly consented. For further information or to exercise your rights under applicable law, please contact us at compliance@heidihealth.com.
10. How do we protect your information?
We take a number of measures to keep your information safe.
We generally hold personal information in our electronic databases. Our website and Platform and our working environment are built with integrated physical, electronic and managerial processes designed to safeguard your information and protect it from misuse, interference, loss and unauthorized access, modification or disclosure. Here are some of the key things we do to protect your information.
Category
Details
Staff training
We put our staff through training about how to keep your information safe and secure at all times.
Encryption
We employ bank industry encryption on all data both at rest and in transit.
De-identification tools
We use a range of tools designed to de-identify your information before it is used or disclosed for certain purposes, as described in this policy.
Secure storage and handling
We use a combination of techniques and measures to maintain the security of our website and Platform and to protect your account and your information.
Destroying or de-identifying your information
We only keep your information for as long as you want it or are lawfully required to keep it.
11. What are your rights in relation to your information?
You have rights in relation to your personal information. You can contact us to exercise any of your rights in relation to your information.
Here are the things you can ask us to do in relation to your information at any time while you use our website, Platform or other services.
Category
Details
Access
You can request a copy of your information.
Correct
You can ask us to correct or update your information.
Complain
You can express your concerns or complaints to us about your privacy or the way we are handling your information. We take your concerns seriously and will seek to fix any problem as soon as possible.
When you contact us regarding a request for access, correction, erasure, or to make a complaint, or if you wish to object to processing, withdraw consent, or request data portability, please include your name and contact details (such as email address and phone number) and clearly describe your request. We are committed to addressing your inquiries promptly and will acknowledge receipt of your correspondence swiftly. We aim to formally respond to all requests within 30 days. If we are unable to fulfill your request due to legal or other reasons, we will explain why. Verification of your identity may be required to protect your information and ensure it is not disclosed improperly.
If you have any questions or concerns about how we handle your personal information or our privacy practices more broadly, you are welcome to contact our privacy officer and compliance team at compliance@heidihealth.com. We are committed to addressing your enquiry promptly and transparently. If you are not satisfied with our response or believe your privacy rights have been infringed, you have the right to lodge a complaint with your relevant data protection authority.
12. Employees
Category
Details
Your general personal information
This includes information or an opinion about you that is reasonably identifiable. For example: your name, address, age or date of birth, contact number, email address and image.
Educational and social information
This includes details of your education, references from your institutions of study, and information relating to your interests and extra-curricular activities. It also includes lifestyle information and social circumstances, for example ‘life events’ such as marriage, divorce, bereavement, or adoption or birth of children.
Sensitive information
This includes information concerning your health and medical conditions, certain criminal convictions and offences, racial or ethnic origin, religious or philosophical beliefs, sexual orientation.
Financial information
This includes your bank account number, tax identifier and status (including residence status), and credit checks (where required).
Work related information
This includes details of your work history, professional activities and interests, involvement with and membership of industry bodies and professional associations and any personal information captured in the work product(s) you create while employed by us.
If you are a current or former employee and you have any questions in relation to our handling of your personal information, please contact us at hello@heidihealth.com
13. Users in South Africa
Heidi is committed to protecting the personal information of users in South Africa in accordance with the Protection of Personal Information Act, 2013 (POPIA). We process personal and health-related information lawfully and transparently, ensuring data is collected for specific, explicit, and legitimate purposes with informed consent where required. All data is securely stored on servers located in the European Union (EU), ensuring a high standard of data protection consistent with both POPIA and the EU General Data Protection Regulation (GDPR). We implement strong encryption, access controls, and continuous monitoring to safeguard your information.
In accordance with POPIA, Heidi has designated an Information Officer responsible for overseeing compliance with POPIA and managing matters related to the processing of South African users’ personal information. The designated Information Officer is John Stanley Giles (South African ID Number 7312045097088), who can be contacted via email at john@michalsons.com. This officer is physically located within South Africa and acts as the primary point of contact for data subjects and the South African Information Regulator. South African users have the right to access, correct, delete, or object to the processing of their personal data, ensuring Heidi meets its obligations under POPIA. To exercise this right, data subjects can contact our designated Information Officer.
14. Related companies
Heidi Health Ltd (15878893) is located at 49 Greek St London United Kingdom W1D 4EG. You can contact us via email at hello@heidihealth.com. If you have any questions regarding privacy or security, please contact us via email at support@heidihealth.com. We are related to Oscer Enterprises Pty Limited (Incorporated in Australia), Heidi Health Trading Pty Ltd (Incorporated in Australia), Heidi Health Corp (Incorporated in the State of Delaware, United States) and Heidi Health Canada Inc (Incorporated in the Province of Ontario, Canada).We may disclose your personal information to our related companies, including as set out in this policy. If we do disclose your personal information to our related companies they may use your information in accordance with this policy. If you access the services of our related companies, you should also consider their privacy policy as it may be different to this policy.
