Privacy Policy

This Privacy Policy explains how OptiMap (“OptiMap”, “we”, “us”, or “our”) collects, uses, stores, and protects personal information. It applies to practitioners who hold an OptiMap account and to the client information practitioners enter into the platform.

OptiMap is a clinical decision-support and practice-management tool for health practitioners. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

By using OptiMap, you agree to the handling of information as described in this policy.

OptiMap operates on a clear two-tier model, and the distinction matters:

Practitioner account data. When you register, OptiMap collects your account information (name, email, phone number). For this, OptiMap is the data controller.

Client information. When a practitioner enters information about their clients, the practitioner is the controller of that client information. The practitioner decides what to collect, enters it, and is responsible for obtaining any necessary consent from their clients. OptiMap acts only as a processor of client information — we store and process it strictly on the practitioner’s behalf and under their direction. OptiMap does not own or independently control the client information a practitioner enters, and the practitioner retains full control over it at all times.

From practitioners (account holders):

• Name
• Email address
• Phone number
• Payment information (processed securely by our payment provider — see Section 5)

Client information entered by practitioners may include:

• Name and contact details (email, address)
• Date of birth
• Health information, including functional diagnostic test results
• Clinical notes and history

Health information is “sensitive information” under the Privacy Act and receives a higher level of protection. As above, the practitioner is the controller of this information and is responsible for their clients’ consent.

We use practitioner account information to provide and maintain the service, process subscription payments, communicate with you about your account, and provide support.

We use client information solely to provide the service to the practitioner — to collate client data and generate clinical reasoning and protocol suggestions for the practitioner’s review. OptiMap’s output is a reasoning and collation aid, not a diagnosis, and the practitioner always makes the final clinical decision.

Your personal information is stored and processed in Australia. OptiMap uses a small number of trusted, reputable service providers — including secure cloud database hosting, application hosting, automated reasoning and collation, payment processing, and email delivery. These providers process data within Australia, only to the extent necessary to perform their function. We do not transfer your personal information overseas.

We require all service providers to handle personal information securely and in accordance with the Australian Privacy Principles.

How automated processing works. OptiMap uses automated processing to collate client data and generate clinical reasoning and protocol suggestions. This is used solely to produce that output for the practitioner’s review. The information is not used to train or develop any external system or model, and it is not retained by any processing provider after the output is generated. Every output is provided to the practitioner for their professional judgement.

We do not sell personal information. We do not use client health information for advertising, and OptiMap does not display third-party advertising.

Google Calendar (optional integration). Where a practitioner chooses to connect their Google Calendar, OptiMap reads calendar information from Google LLC, which processes that information on servers outside Australia, including in the United States. This is the only circumstance in which OptiMap accesses personal information held overseas, and it occurs only at the practitioner’s election and only for calendars the practitioner explicitly selects.

What we access, and what we write. To calculate when you are available, OptiMap reads the names of your calendars and the start and end times of the periods you are busy — never event titles, descriptions, locations, attendees, or guest lists. In addition, when an appointment is booked OptiMap creates a single event in your primary Google calendar for that appointment. That event contains the client’s name and the appointment type. OptiMap can update and delete the events it creates — for example when an appointment is rescheduled or cancelled — but it does not read, alter, or delete any other event in your calendar. If you disconnect the integration, OptiMap removes the events it created for your future appointments.

Your responsibility. Because each event OptiMap creates carries the client’s name, you are responsible for who can see the calendar it is written to. A calendar you have shared with other people, or made public, would expose those client names to them.

Why. The times you are busy are read solely to calculate when you are available, so that appointment times offered to your clients do not clash with commitments already in your calendar.

What we store. The names and identifiers of your calendars, which of them you have selected, the start and end times of your busy periods, the email address of the connected Google account, and an encrypted access credential that allows OptiMap to refresh this information. Busy periods are stored as times only, with no description of what they are.

Where. In our Australian database, alongside your other account information.

How long. Until you disconnect the integration, or your account is closed. Disconnecting revokes OptiMap’s access with Google, deletes the events OptiMap created for your future appointments, and immediately deletes your stored calendar names, selections, busy times, and access credential from our systems. You may also revoke OptiMap’s access at any time from your Google Account security settings.

Google user data is never sold, never shared with any third party, never used for advertising, and never used to train or develop any artificial intelligence model. It is used only to calculate your availability within OptiMap, and it is visible only to you — not to other practitioners, and not to your clients.

Deleting an individual client. A practitioner may delete any client record at any time. Deletion is immediate and permanent — the client’s information is removed from OptiMap’s active systems and cannot be recovered.

When a subscription ends. Access to OptiMap ends at the end of your current billing period. Your client data is then retained, intact and unaltered, for a further 28 days. If you reactivate within that window, your workspace is fully restored exactly as you left it. At the end of the 28 days, if the subscription remains cancelled, all client data associated with the account is permanently deleted by an automated process and cannot be recovered.

Exporting before deletion. Before that deletion occurs, you can export your client records — client details, notes, session history, client reports, and prescribed protocols. Generated interpretive output produced by OptiMap is not included in the export. We notify you when your subscription is cancelled and again before the retention window closes.

This matters for your own record-keeping obligations. Health practitioners are generally required to retain client health records for far longer than OptiMap retains them — in Victoria, seven years from last contact for adults, and until age 25 for minors. It is your responsibility to export and retain your own copy of any records you are legally required to keep, before your access ends. OptiMap’s retention period is not a substitute for your professional record-keeping obligations.

Practitioner account data. We retain your account information while your account is active. On account closure it is deleted on the same schedule as above.

Backups. Deleted data is removed from active systems immediately, but may persist briefly in our infrastructure provider’s automated rolling backups until those backups age out and are overwritten in the normal cycle — generally within 30 days. This is a standard automatic function of database backups, not deliberate retention.

Payment records. Records of subscription payments may be retained as required by Australian taxation law. This applies only to billing records on practitioner accounts — never to client health information.

We take reasonable steps to protect personal information from misuse, loss, and unauthorised access. Data is stored within Australia. Access to client information is restricted to the practitioner account it belongs to and others within the same practice — one practice cannot see another’s client information. Credentials for connected third-party services, such as Google Calendar, are stored encrypted. Access to OptiMap requires authentication, and client portal access is separately authenticated and limited to that client’s own information.

No system is completely secure, but we work to protect your information to a high standard. If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required under the Notifiable Data Breaches scheme.

Practitioners may access and correct their own account information at any time through the platform or by contacting us.

Requests relating to client information should be directed to the practitioner who controls that data. Where a client wishes to access or correct their information, they should contact their practitioner.

Under the Privacy Act, you may request access to the personal information we hold about you and ask us to correct it. We will respond within a reasonable period.

If you have a concern about how we have handled your personal information, please contact us first (Section 11) and we will work to resolve it. If you are not satisfied, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

We may update this policy from time to time. The “Last updated” date reflects the current version.

For any questions about this policy or how we handle personal information:

support@optimap.health