Privacy Policy | Medilee

Medilee Pty Ltd (ACN 685 703 913) (we, us or our) understands that protecting your personal information is important. This Privacy Policy sets out our commitment to protecting the privacy of personal information provided to us, or collected by us, when interacting with you, including through our website and our cloud-based medico-legal platform (Platform).

This Privacy Policy takes into account the requirements of the Privacy Act 1988 (Cth). Individuals located in the European Union or European Economic Area (EU) may also have rights under the General Data Protection Regulation 2016/679, and individuals located in the United Kingdom (UK) may have rights under the UK GDPR and the Data Protection Act 2018 (together, the GDPR). Appendix 1 outlines the additional rights of individuals located in the EU and UK and how we process their personal information.

This Privacy Policy was last updated on 24 July 2026.

Our role and health information

The Platform is used by health practitioners, clinics and other organisations (our customers) to prepare medico-legal reports and related case materials. In doing so, our customers upload information about their patients and other third parties, which may include health information. In respect of that information:

our customers are responsible for collecting the information lawfully, including obtaining any consents and providing any collection notices required by applicable privacy and health records laws;
we handle that information on behalf of, and on the instructions of, our customers, to provide the Platform and as described in this Privacy Policy and our customer agreements; and
if you are a patient or third party whose information has been uploaded to the Platform, we recommend you direct any access, correction or complaint request to the practitioner or clinic that holds your treating relationship in the first instance. You can also contact us using the details below and we will assist, in consultation with the relevant customer.

The information we collect

Personal information is information or an opinion, whether true or not and whether recorded in a material form or not, about an individual who is identified or reasonably identifiable. The types of personal information we may collect include:

Identity Data including your name, age and profession.
Contact Data including your telephone number, address and email.
Financial Data including bank account and payment card details. Payment card details are collected and stored by our third-party payment processor, Stripe (we do not have access to your full card details).
Transaction Data including details about payments between you and us and details of products and services you have purchased from us.
Technical and Usage Data including your internet protocol (IP) address, login data, browser session and geo-location data, page view and session statistics, device and network information, acquisition sources, search queries and browsing behaviour, and communications with our website and Platform (including through cookies and tracking pixels).
Profile Data including your username and password, content you create, send, receive and share through the Platform (such as medical reports and case materials), and support requests.
Professional Data including your qualifications, professional registrations (such as AHPRA registration) and, where you are a worker of ours or applying for a role with us, your professional history.
Interaction Data including information you provide when you participate in surveys, promotions, activities or events.
Marketing and Communications Data including your marketing and communication preferences.

Sensitive information is a subset of personal information given a higher level of protection, and includes health information. The types of sensitive information we collect include:

where our customers use the Platform to prepare medico-legal reports: health information about their patients and examinees, such as medical histories, clinical notes, referral documentation, test results and report content;
where you apply for a role with us: results of criminal records checks and your professional registrations and associations (where applicable).

How we collect personal information

We collect personal information in a variety of ways, including:

when you provide it directly to us, including in person, over the phone, over email or online;
when you register for an account, complete a form, register for events or newsletters, or respond to surveys;
when you or your organisation upload information to the Platform in the course of preparing medico-legal reports;
when you use any website we operate (including from analytics and cookie providers; see the Cookies section below);
from third parties, such as referrers, other medical examiners, lawyers or insurers; and
from publicly available sources.

Why we collect, hold, use and disclose personal information

We collect, hold, use and disclose personal information for the following purposes:

to enable you to access and use our Platform, including to provide you with a login and to supply the services you have subscribed for;
to work with you as a customer or supplier of our business, including to share your information with other medical examiners, insurers and lawyers involved in a matter, where authorised;
to contact and communicate with you, including in response to support requests and enquiries;
for internal record keeping, administration, invoicing, billing and subscription management;
for analytics, market research and business development, including to operate and improve our business and the Platform;
for advertising and marketing (we do not use health information for marketing);
to run promotions or offer additional benefits to you;
if you apply for employment with us, to consider your application; and
to comply with our legal obligations or as otherwise required or authorised by law.

Sensitive information: we only collect, hold, use and disclose sensitive information for: the primary purpose for which it is collected (facilitating the preparation of medico-legal reports by our customers); purposes you consent to; directly related secondary purposes; contacting emergency services or your family, partner or support person where we reasonably believe there is a serious risk to the life, health or safety of you or another person and it is impracticable to obtain consent; and where otherwise required or authorised by law.

Use of artificial intelligence (AI)

The Platform uses artificial intelligence and machine learning technologies, including AI technologies provided by third parties (AI Technologies), to provide assistive features such as document summarisation, transcription and report drafting support. Our commitments in relation to AI Technologies are:

Assistive only: AI-generated outputs are drafts for review by qualified practitioners. Practitioners remain responsible for reviewing, verifying and approving all outputs before professional use. The Platform does not make automated decisions that produce legal or similarly significant effects on individuals without human review.
No training on identifiable data: we do not use personal information (including health information) in identifiable form to train, fine-tune or develop any AI model, and we contractually require our AI Technology providers not to train their models on data we submit.
De-identified data: we may use irreversibly de-identified and aggregated data for Platform improvement, quality assurance, model evaluation and security testing. We will not attempt to re-identify individuals from de-identified data.
Transparency: we will inform you when AI Technologies are used to make decisions that may significantly affect you, and this Privacy Policy will be updated to reflect any information required to be included about automated decision-making under the Privacy Act, including the reforms commencing in December 2026.
Security and oversight: we implement technical and organisational measures to maintain the security and integrity of personal information processed by AI Technologies, including testing and monitoring of outputs and human oversight of significant AI-assisted processes.

Our disclosures of personal information to third parties

Personal information (excluding sensitive information): we may disclose personal information to: our employees, contractors and related entities; IT service providers, data storage, web-hosting and server providers (including Microsoft Azure); marketing or advertising providers; professional advisers, bankers, auditors, insurers and insurance brokers; payment systems operators and processors (including Stripe); our existing or potential agents or business partners; any prospective purchaser and its advisers if we merge with, are acquired by, or sell all or part of our assets to another company; courts, tribunals, regulatory authorities and law enforcement officers as required or authorised by law; analytics and cookie providers; and other third parties as required or permitted by law.

Sensitive information: we only disclose sensitive information with consent or where permitted by law, and only to: our employees, contractors and related entities; IT service providers, data storage, web-hosting and server providers engaged to deliver the Platform; the parties involved in the relevant medico-legal matter as directed by our customer (such as the referring insurer, lawyer or examiner); professional advisers; any prospective purchaser and its advisers in a corporate transaction; and courts, tribunals, regulatory authorities and law enforcement as required or authorised by law.

Data location and overseas disclosure

We store personal information, including all health information processed through the Platform, on infrastructure located in Australia. If we launch the Platform in other countries, customer data for those regions will be hosted in-region to support data sovereignty, and we will update this Privacy Policy accordingly. Some technical service providers (for example, support tooling or analytics) may store or access limited personal information (excluding health information) outside Australia. Where they do, we will only disclose personal information overseas in accordance with the Australian Privacy Principles, including by using providers subject to appropriate contractual safeguards.

Storage, security and data breaches

We are committed to ensuring the personal information we collect is secure. We are independently certified to ISO/IEC 27001:2022, and we have completed a SOC 2 Type 1 examination, with the SOC 2 Type 2 examination currently in progress. We maintain an information security management system certified to ISO/IEC 27001:2022, and put in place physical, electronic and managerial procedures to safeguard personal information and protect it from misuse, interference, loss and unauthorised access, modification and disclosure, including encryption in transit and at rest, role-based access controls, logging and monitoring, and regular security testing.

If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner in accordance with the Notifiable Data Breaches Scheme under the Privacy Act 1988 (Cth).

While we are committed to security, no transmission over the internet can be guaranteed as completely secure, and transmission is at your own risk.

Retention and deletion

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including satisfying legal, regulatory, tax, accounting or reporting requirements. When a customer's subscription ends, we make their data available for export for 30 days and then delete it, except to the extent we are required by law to retain it or it is held in routine backups pending deletion, in which case we continue to protect it until deleted.

Your rights and controlling your personal information

Your choice: you do not have to provide personal information to us, however if you do not, it may affect our ability to provide our services to you.

Information from third parties: if we receive personal information about you from a third party, we will protect it as set out in this Privacy Policy. If you provide personal information about somebody else, you represent and warrant that you have that person's consent, or another lawful basis, to provide it to us.

Restrict and unsubscribe: to object to processing for direct marketing or unsubscribe from communications, contact us using the details below or use the opt-out facility in the communication.

Access: you may request access to the personal information we hold about you. An administrative fee may be payable. In some situations we may be legally permitted to withhold access, in which case we will tell you why and how you can complain about the refusal.

Correction: if you believe information we hold about you is inaccurate, out of date, incomplete, irrelevant or misleading, contact us and we will take reasonable steps to promptly correct it. If we cannot, we will tell you why and how you can complain.

Complaints: if you wish to make a complaint, contact us with full details and we will promptly investigate and respond in writing. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (oaic.gov.au).

Cookies and analytics

We may use cookies, tracking pixels and similar technologies on our website and in our emails. Cookies are text files placed in your browser to store preferences; tracking pixels are tiny images embedded in web pages or emails that send information to our servers when loaded. These do not, by themselves, identify you, but may be linked to personal information you provide. You can block cookies through your browser settings and block tracking pixels using ad-blocking or privacy extensions, though this may affect your ability to use parts of our website. We may use Google Analytics (including Advertising Features) and Meta tools (such as the Meta Pixel). You can opt out of Google Analytics using Google's opt-out browser add-on and manage Meta ad preferences in your Meta settings.

User-generated content and links

If we enable you to post public content (such as reviews), anything you submit will be accessible by others, and we are not responsible for its use or misuse by third parties. Our website may contain links to third-party websites, which are not governed by this Privacy Policy.

Amendments

We may vary this Privacy Policy at any time by publishing the amended policy on our website. We recommend you check our website regularly for the current version.

Contact us

For any questions or notices, please contact our Privacy Officer at:

Medilee Pty Ltd (ACN 685 703 913)
Email: privacy@medilee.com.au

You can also use our contact form for general enquiries.

Appendix 1: Additional rights and information for individuals located in the EU or UK

Under the GDPR, individuals located in the EU and UK have additional rights in relation to their personal information (personal data). This Appendix applies to the personal information described in this Privacy Policy, including sensitive information (special categories of data under the GDPR).

Legal bases for processing: we process personal data only where we have a legal basis, including: performance of a contract with you (providing Platform access, support and billing); compliance with legal obligations (record keeping, tax); consent (where obtained, including for special categories of data); and our legitimate interests (operating, improving, securing and marketing our business), balanced against your rights. Where we process special categories of data on behalf of our customers for the preparation of medico-legal reports, our customers are responsible for establishing the applicable condition for processing, such as explicit consent or processing necessary for medical or legal purposes.

Purpose of use / disclosure	Type of Personal Information
To enable you to access and use our software, including to provide you with a login.	Identity Data; Contact Data
To work with you as a customer or supplier of our business, including to share your information with other medical examiners, insurers and lawyers.	Identity Data; Contact Data
To contact and communicate with you about our business, including in response to any support requests you lodge with us or other enquiries you make with us.	Identity Data; Contact Data; Profile Data
To contact and communicate with you about any enquiries you make with us via any website we operate.	Identity Data; Contact Data
For internal record keeping, administrative, invoicing and billing purposes.	Identity Data; Contact Data; Financial Data; Transaction Data
For analytics, market research and business development, including to operate and improve our business, associated applications and associated social media platforms.	Profile Data; Technical and Usage Data
For advertising and marketing, including to send you promotional information about our events and experiences and information that we consider may be of interest to you.	Identity Data; Contact Data; Technical and Usage Data; Profile Data; Marketing and Communications Data
To run promotions, competitions and/or offer additional benefits to you.	Identity Data; Contact Data; Profile Data; Interaction Data; Marketing and Communications Data
If you have applied for employment with us, to consider your employment application.	Identity Data; Contact Data; Professional Data
To comply with our legal obligations or if otherwise required or authorised by law.	Any relevant Personal Information
Sensitive information: any purposes you consent to; the primary purpose for which it is collected; directly related secondary purposes, including disclosure to the third parties listed in this Privacy Policy as reasonably necessary to work with you as a customer or supplier; contacting emergency services or your family, partner or support person where we reasonably believe there is a serious risk to life, health or safety and it is impracticable to obtain your consent; and where otherwise required or authorised by law.	Sensitive Information

Data transfers: where we transfer personal data outside the country in which you are based, we will use appropriate safeguards required by applicable data protection laws, including transferring only to countries with an adequacy decision or using standard contractual clauses.

Data retention: we retain personal data only for as long as reasonably necessary for the purposes we collected it for, including legal, regulatory, tax, accounting or reporting requirements, and potentially longer in the event of a complaint or prospective litigation.

Your rights: you may request details of the personal data we hold and how we process it, and you may have rights to rectification, erasure, restriction of processing, objection to automated decision-making that produces legal or similarly significant effects, and data portability. If you are not happy with how we process your personal data, you may complain to your local Data Protection Authority, though we would appreciate the chance to address your concerns first using the contact details above.