Privacy policy

1. About this Privacy Policy

‍

At Clean Slate, your privacy matters as much as your recovery. We treat your information with care, discretion and without surprises, collecting only what we need, sharing only what helps you, and being clear about how it works.

Clean Slate Clinic (Clean Slate, we, us or our) is committed to protecting your privacy. Clean Slate Clinic is the trading name used by Applied Recovery Co Pty Ltd in Australia and Clean Slate Clinic Ltd in the United Kingdom. The Clean Slate entity that provides services to you is the data controller (in the United Kingdom) or APP entity (in Australia) responsible for your personal information.

Our app, The Clean Slate App, is published by Clean Slate Clinic Ltd. For people using our app in the United Kingdom, Clean Slate Clinic Ltd is the data controller. For people using our app in Australia, Applied Recovery Co Pty Ltd is the data controller. The contact details for each entity are set out in Appendix A.

We comply with the data protection laws that apply to us, including:

• the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs), as amended (including the reforms made in 2024), and applicable Commonwealth and State or Territory health-records legislation in Australia; and
• the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025, and the Privacy and Electronic Communications Regulations 2003 (PECR) in the United Kingdom.

This Privacy Policy explains how we collect, hold, use, disclose and protect your personal information – including your sensitive or special category health information – when you visit our website, use our client app, receive our at-home alcohol withdrawal and recovery services, or otherwise interact with us.

This Privacy Policy explains how we collect, hold, use, disclose and protect your personal information – including your sensitive or special category health information – when you visit our website, use our app, receive our at-home alcohol withdrawal and recovery services, or otherwise interact with us.

In particular, it explains:

‍

• the kinds of personal information we collect and hold, and how we collect and hold it;
• the lawful bases on which we rely, and the purposes for which we collect, hold, use and disclose your personal information;
• that we record and transcribe certain calls, and how you can ask us not to;
• how our app uses your information, and when it is added to your clinical record;
• who we share your information with, and when it may be processed overseas;
• your choices about marketing and how we use cookies and similar technologies;
• how we use automated tools and artificial intelligence;
• your rights, including how you can access or correct your information, delete your app account, and how to make a complaint.

‍

If you would like this Privacy Policy in an alternative format, please contact us using the details in Appendix A.

‍

​​

2. What we do

Our mission is to improve the health and wellbeing of people experiencing alcohol dependence, and to make withdrawal (detox) and recovery services accessible regardless of where you live or your circumstances.

Clean Slate Clinic delivers at-home alcohol withdrawal and recovery services, supported by a client app and telehealth technology, and by a team of clinicians and support staff. You can find out more about our services on our website.

‍

Our app. Our app, The Clean Slate App, is for adults aged 18 and over who want to reduce or stop drinking. It offers tools such as goal setting, tracking your drinking and mood, exercises, and suggestions based on what you tell us. It also lets you book an appointment or contact our team. The app does not replace care from a clinician.

Information you enter in our app is not monitored in real time. If you are unwell, experiencing withdrawal symptoms or worried about your safety, contact emergency services (000 in Australia, 999 in the United Kingdom) or use the urgent help options shown in the app.

‍

3. The information we collect

‍
The personal information we collect depends on your relationship with us and the services you use. It may include the following.
‍
Identity and contact details

‍

Your name, date of birth, gender, and contact details (such as address, phone number and email); details of your nominated support person or emergency contact; details of your usual general practitioner or other treating health providers; and identity verification information where we need to confirm who you are.

‍

‍Health information

Because we provide alcohol withdrawal and recovery care, much of the information we collect is health information. This may include your medical and treatment history; information about your alcohol and other substance use; withdrawal symptoms; mental health and wellbeing; medications, allergies and adverse reactions; pathology and test results; your treatment and care plans, progress and outcomes; and the clinical notes and messages created in the course of your care.

‍

Information from your calls with us

Voice recordings and written transcripts of certain telephone calls – including intake and triage calls, support and aftercare calls, and administrative calls – unless you ask us not to record (see Section 6).

‍

Payment, billing and claims

Payment method and billing details, transaction history, and (where relevant to billing or claiming) any national health or insurance identifier you provide, or private health fund details.

‍

Medication, prescription and delivery information

Where medication forms part of your program, information needed to prescribe, dispense and deliver it safely, including prescription and dispensing records and delivery details.

Information you enter in our app

Your account details; the information you choose to record, such as your goals, substance use, cravings, mood, reflections, goals, responses to exercises and questionnaires, and your notification preferences. Much of this is health information.

‍

Information we create in our app

Progress summaries, scores and suggestions that our app creates from the information you enter (see section 6A).

‍

App, website and device information

Account and app-usage information, device identifiers, IP address, browser and operating-system details, log and analytics data, crash and performance reports, push notification tokens, and approximate location derived from your device or IP address (see Section 10).

‍

Information from connected devices

Our app does not currently connect to wearable devices, Apple Health or Health Connect.

‍

Recruitment and business contacts

If you apply for a role with us, your application and employment-related information; and, if you are a supplier or business partner, your business contact details.

‍

Sensitive and special category information

Some of the information we collect is treated as sensitive information under the Privacy Act, or as special category data under the UK GDPR. This includes information about your health, genetic information, racial or ethnic origin, sexual orientation, religious or philosophical beliefs and criminal record. Because of the nature of our services, most of the information we hold about you, including the content of recorded calls and much of what you enter in our app, is sensitive or special category information.

‍

We only collect sensitive or special category information with your consent, or where the collection is required or authorised by or under law, or otherwise permitted under applicable data protection law including the provision of healthcare under Article 9(2)(h) of the UK GDPR.

Children. Our services and our app are for adults aged 18 and over. We do not knowingly collect information from anyone under 18. If we learn that an app account belongs to someone under 18, we will close it and delete the information, unless we need to keep it to protect that person's safety or as required by law.

‍

​

4. How we collect your information

We collect personal information by lawful and fair means, and wherever reasonable we collect it directly from you. We collect it:

• directly from you, for example, through our website and app, online forms and questionnaires, telephone calls, and your consultations and messages with our team;
• from your use of our app including the information you enter and the information our app creates from it (see section 6A);
• automatically through cookies and similar technologies, and from your use of our website and app (see Section 10);
• from people you authorise such as your nominated support person or a family member, with your consent;
• from other health providers involved in your care such as your general practitioner, hospital, or a pathology or diagnostic provider, where you consent or as otherwise permitted by law;
• from our service providers and partners such as our telephony and transcription provider, and any pharmacy or dispensing partner; and
• from government and official sources where relevant to your care or billing, for example, external systems holding your medical records, public health insurance schemes, healthcare identifier services, or electronic prescription services where you consent or as permitted by law.

If we collect personal information about you from a third party, we take reasonable steps to ensure you are made aware of the collection and how we will handle the information. If we receive unsolicited personal information, we deal with it in accordance with applicable law and will destroy or de-identify it if we could not have lawfully collected it.

‍

We will only collect personal information about people who may be vulnerable where this is required or authorised by law or otherwise permitted under applicable data protection law, and we apply additional safeguards including in relation to obtaining valid consent when we do.
‍
​

5. Why we collect, use and disclose your information, and our lawful bases

We collect, hold, use and disclose your personal information for purposes including:

​​

• providing, coordinating and delivering our clinical and support services – including assessing your eligibility and suitability, planning and delivering treatment, conducting telehealth consultations, and providing follow-up and aftercare;
• providing our app including showing your progress, personalising tools, content and suggestions, sending the notifications you choose, and letting you book or contact us;
• if you are a Clean Slate client and agree, adding relevant information from our app to your clinical record so your clinician can discuss it with you at your appointments (see section 6A);
• maintaining, securing, fixing and improving our app, using de-identified information wherever practicable;
• recording and transcribing certain calls for staff training and coaching, to improve and train our automated and AI-assisted systems, to analyse common themes across calls, and to investigate incidents and complaints where required (see Section 6);
• arranging the prescribing, dispensing and delivery of medication, where this forms part of your program;
• processing payments and managing billing, and any insurance or public health scheme claims;
• communicating with you about your care including appointment reminders, results, safety notifications, changes to our services, and support messages;
• protecting health and safety where we reasonably believe it is necessary to lessen or prevent a serious threat to your life, health or safety, or that of another person (or, under the UK GDPR, to protect the vital interests of you or another person), we may use or disclose your information, including to contact emergency services or another appropriate person. Given the nature of withdrawal and recovery, this is an important part of providing safe care;
• improving and evaluating our services including quality improvement, service evaluation and research, using de-identified or anonymised information wherever practicable;
• sending you marketing communications, where you have consented or it is otherwise permitted, with an easy way to opt out at any time (see Section 9);
• meeting our legal, regulatory and professional obligations including health, record-keeping, identity-verification, mandatory-reporting obligations in each region in which we operate, tax and accounting requirements and preventing, detecting and investigating fraud, misuse and security incidents; and
• in connection with a sale, merger, restructure or financing of our business, subject to appropriate confidentiality protections.

‍
Lawful bases under the UK GDPR

Where the UK GDPR applies to our processing of your personal information, the lawful bases on which we rely include:

‍

• performance of a contract with you (Article 6(1)(b)) for example, to provide and administer your program or provide our app;
• our legitimate interests (Article 6(1)(f)) for example, to improve and secure our services, where these interests are not overridden by your rights;
• compliance with a legal obligation (Article 6(1)(c)) for example, retaining health records as required by law;
• your consent (Article 6(1)(a)) for example, for certain marketing or non-essential cookies and similar technologies in our app; and
• protection of vital interests (Article 6(1)(d)) in life-or-death situations.

‍

For special category data such as your health information, we rely on:

‍

• the provision of healthcare and the management of health services (Article 9(2)(h));
• your explicit consent (Article 9(2)(a)), where appropriate including for health information you enter in our app when you are not receiving care from us; and
• the establishment, exercise or defence of legal claims (Article 9(2)(f)), where relevant.

‍

In Australia, we collect the sensitive information you enter in our app with your consent, which we ask for before you first record health information.

Under the Privacy Act, we will only use or disclose your personal information for a secondary purpose where you would reasonably expect us to and that purpose is related to the primary purpose (or, for sensitive information, directly related), where you have consented, or where the use or disclosure is otherwise permitted or required by law.

If you do not provide information. You do not have to give us information, but if you do not, we may not be able to provide our services, and some app features will not work.

‍

​

6. Call recording and transcription

‍

Which calls we record, and how

We record and transcribe certain telephone calls with us, including intake and triage calls, support and aftercare calls, and administrative calls (such as scheduling and general enquiries). We do this on an opt-out basis: at the start of the call we will tell you that the call is being recorded and transcribed, and you can ask us not to record it.

‍

Asking us not to record

You can ask us not to record a call at any time, before or during the call, and you do not need to give a reason. If you ask us not to record, we will turn off recording for that call, and you will still be able to access our services, although this may affect our ability to provide some or all of our services to you. We may still keep a record that the call took place, but not a recording or transcript of what was said once the recording has been turned off.

‍

Recordings and transcripts are sensitive information

Because our calls often include health information, recordings and transcripts are treated as sensitive information under the Privacy Act and as special category data under the UK GDPR, and we handle them with additional safeguards. Telling you that a call is being recorded and giving you a genuine opportunity to decline is how we seek your agreement to record, in addition to our reliance on the healthcare-purposes basis under Article 9(2)(h) of the UK GDPR where applicable.

‍

Why we record, and the limits on use

We use call recordings and transcripts only for the following purposes:

‍

• staff training and coaching, to improve the quality and safety of our services;
• improving and training the automated and AI-assisted systems that support our services (see Section 11);
• theme analysis identifying common themes, needs and trends across calls to improve our programs; and
• investigating incidents and complaints, where required.

‍

We do not use call recordings or transcripts to make clinical decisions about you, and we do not sell them. Where it is practicable, we de-identify recordings and transcripts before using them for theme analysis and to train our systems, so the information used for those purposes does not identify you.

‍

How calls are recorded and where they're processed

Our telephone calls are handled by Freshcaller, the cloud telephony product within the Freshworks platform we use to run our services. Freshcaller is provided by Freshworks Inc. and uses Twilio Inc. as a sub-processor for the underlying carrier-grade voice infrastructure. As a consequence of how that platform is built, call recordings are stored in the United States. This is Twilio's default storage region. It is not a Clean Slate configuration choice, but our choice of telephony supplier means it applies to us, and we have assessed and accepted that transfer with the safeguards described in Section 8.

‍

​Retention

We keep recordings and transcripts only for as long as necessary for the purposes above and as required by applicable health-records law, after which we securely delete or de-identify them (see Section 13).

‍

6A. Using our app

‍

How our app uses your information. Our app uses the information you enter to show progress, tools, content or services.

‍
If you are not a Clean Slate client. The information you enter in our app is not added to a clinical record and is not seen by our clinicians. If you later become a client, we will ask whether you want to share your app information with your care team.

If you are a Clean Slate client. Substance use diaries from our app are added to your clinical record so your clinician can review it with you at your appointments. It is recorded as information you reported. Our clinicians do not monitor app entries between appointments, so please do not use the app to tell us about anything urgent.

Who holds your app information. Clean Slate Clinic Ltd operates our app and holds the information you enter in it. If you are a client in Australia, information added to your clinical record is held by Applied Recovery Co Pty Ltd. If you are a client in the United Kingdom, it is held by Clean Slate Clinic Ltd.

Notifications. You can choose which reminders and notifications you receive and change this at any time in the app or in your device settings. We send marketing notifications only if you have opted in (see section 9).

‍

‍

7. Who we share your information with

‍
We share your personal information only where it is necessary and permitted under applicable data protection law. Depending on the services you use, we may share it with:

​

• our treating clinicians and support staff who provide your care – some treating practitioners may, in certain circumstances, be independent controllers of your clinical record and subject to their own professional and privacy obligations;
• our group entities, where this is necessary to operate our services consistently across the regions in which we work, including between Clean Slate Clinic Ltd and Applied Recovery Co Pty Ltd to operate our app for people in Australia;
• pharmacy and dispensing partners, and delivery or courier providers, to prescribe, dispense and deliver medication where this forms part of your program;
• pathology and diagnostic providers, where testing is part of your care;
• our technology and operational service providers – for example, secure cloud hosting, our telephony and transcription provider, customer-support tools, clinical record systems, app hosting, crash reporting and notification services, and analytics, security and identity-verification providers;
• artificial intelligence providers that process information on our behalf to deliver app features, under contracts that do not allow them to use your information to train their own models (see section 11);
• payment processors, funding providers and financial institutions, to process payments and claims;
• our professional advisers, such as lawyers, auditors and insurers;
• government agencies, regulators, courts and law enforcement, where required or authorised by law, including to meet mandatory reporting obligations that apply to us in each region; and
• a purchaser or successor in connection with a sale, merger, restructure or financing of our business, subject to appropriate confidentiality protections.

‍

We require our service providers to protect your personal information to a standard consistent with applicable data protection law and to use it only for the purposes for which we provide it. We do not sell your personal information. We do not share information from our app with advertising or social media platforms.

​​

​

8. Sending your information overseas

We store and process most personal information within the country in which you receive our services. However, some of our service providers process or store information outside that country, and we may transfer information between our Australian and UK group entities where necessary to operate our services, including our app.

‍

Our app is hosted in the United Kingdom. Because our app is operated by Clean Slate Clinic Ltd in the United Kingdom, information entered by people in Australia is transferred to the United Kingdom, and information added to Australian clinical records is transferred back to Australia.

Before disclosing personal information to a recipient outside the country in which you receive our services, and on an ongoing basis, we take reasonable steps to ensure the recipient handles it in a manner consistent with applicable data protection law.

‍

• For transfers from Australia, this is consistent with APP 8 including contractual data-protection terms with our providers and the other steps set out below.
• For transfers between our UK and Australian group entities, we rely on the UK International Data Transfer Agreement entered into between Clean Slate Clinic Ltd and Applied Recovery Co Pty Ltd, supported by a transfer risk assessment. Where Applied Recovery Co Pty Ltd discloses personal information to Clean Slate Clinic Ltd, it does so in accordance with APP 8 and under that same agreement.

‍

The steps we take include entering into contractual data-protection terms with our providers; requiring encryption in transit and at rest; applying access controls and limiting the information shared to what is necessary; conducting transfer risk assessments; verifying recipients' privacy practices through vendor due diligence; and monitoring our overseas providers.

For UK clients, the transfer of call recordings to the United States is made to a company that self-certifies under the UK Extension to the EU-US Data Privacy Framework, supported by a Transfer Risk Assessment. For Australian clients, the disclosure is consistent with APP 8 and is recorded in our supplier register.

​

​

9. Marketing communications and your choices

Where you have consented, or where it is otherwise permitted by law, we may send you communications about our services, programs, health information, and offers – by email, SMS, push notification or telephone.

In the United Kingdom, if you have been a client, we may occasionally write to you by email or SMS about similar Clean Slate programs or support that could help. You can opt out in any message and at the point we first collect your details. This is the 'soft opt-in' permitted under PECR. If you use our app but have not been a client, we will send you marketing only if you have opted in. In Australia, we comply with the Spam Act 2003 (Cth) and the Do Not Call Register Act 2006 (Cth). For marketing calls and electronic messages that require consent, we will obtain it before sending.

​​

We will not use or disclose your sensitive or special category information, including your health information, for marketing purposes without your consent. We never use the information you enter in our app for marketing or advertising.

‍

You can opt out of marketing at any time – by using the unsubscribe or opt-out option in any marketing message, or by contacting us using the details in Appendix A. We will action your request promptly. Opting out of marketing will not affect the service and care communications we need to send you about your treatment, or the app notifications you have chosen to receive.

‍

​

​10. Cookies, analytics and online advertising

We use cookies, pixels, software development kits (SDKs) and similar technologies (together, cookies) on our website and app to:

​

• operate and secure our website and app, and remember your preferences;
• understand how our website and app are used and how they perform (analytics); and
• measure the effectiveness of our communications and, where permitted, deliver and measure advertising on our website.

‍
Where we use advertising and analytics partners (such as social media and search platforms), this may involve limited identifiers in hashed or pseudonymised form, the creation of audiences (including 'lookalike' audiences) and retargeting based on your interactions with our website, subject to your choices. We do not use your health information for advertising.

‍

In our app, we use only the SDKs needed to run, secure and fix the app, and analytics SDKs, listed in our app store privacy information. We ask for your consent in the app before using any that are not strictly necessary, and on Apple devices we ask your permission before any tracking. You can change these choices at any time in the app settings. We do not use advertising or retargeting technologies in our app.

We will seek your consent through our cookie banner or in-app settings before setting non-essential cookies where the law requires it (including under PECR in the United Kingdom). You can manage cookies through our cookie banner or settings and through your browser or device controls. Some parts of our website or app may not work properly if you disable certain cookies.

​

​

11. Artificial intelligence and machine learning

‍

We use artificial intelligence (AI) and automated tools to support and improve our services. This section explains how we protect your privacy when we do.

AI-assisted call transcription and analysis

We use AI-assisted tools, provided by a third-party processor, to transcribe recorded calls, to analyse common themes across calls, and to train and improve these and other automated systems. This processing necessarily involves identifiable information, which may include health information, because audio cannot be de-identified before it is transcribed. We will tell you when a call is being recorded and transcribed, and you can ask us not to record (see Section 6). Where it is practicable, we de-identify recordings and transcripts before using them for theme analysis and to train our systems.
‍

Automated tools and AI in our app

Our app uses the information you enter, such as your goals, drinking, cravings and mood, to create progress summaries and tools, content or services. If an app feature sends your information to a third-party AI provider, we will tell you in the app and ask your explicit permission first.

Automated decisions

The kinds of personal information our computer programs use are the information you enter in our app, your app usage, and, for clients, information from your care. The kinds of decisions they make or help make are: which content, tools and reminders to show you; which of our services to suggest; and reminders associated with service delivery of our program. App suggestions do not decide whether you can use our services although you can book an appointment or contact us at any time. Decisions about your eligibility and care are made by our clinicians and operational staff.

You can ask us how an automated suggestion was produced, ask for a person to review it, and tell us if you disagree with it, using the details in Appendix A.

How we govern our use of AI

Our use of AI is subject to oversight by our clinical governance function, quality controls, regular accuracy and bias testing, privacy impact assessments, and clinical safety reviews. We aim to use the minimum personal information needed, apply pseudonymisation or de-identification where feasible, apply access and security controls, and keep training and evaluation datasets only for as long as needed before deleting or de-identifying them. Our AI providers process information on our behalf under contract and may not use it to train their own models.

AI does not replace clinical judgment

AI tools support our staff and clinicians but do not replace human clinical judgment. We do not use AI to make decisions about you that produce legal effects or similarly significant effects without human involvement (Articles 22A to 22D, UK GDPR); significant decisions are made by qualified healthcare practitioners or operational staff. Where an AI feature could materially affect you, we maintain appropriate human oversight and a way for you to contact us. You have the right to know when AI is being used, to ask us not to record your calls, to ask how AI affects decisions about you, and to ask us to correct errors.

‍

‍

12. Keeping your information secure

We take reasonable steps and, where the UK GDPR applies, appropriate technical and organisational measures to protect your personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. Our measures include:

​

• multi-factor authentication and role-based access controls;
• encryption of information in transit and at rest, including encryption of call recordings and information held by our app;
• security monitoring, regular security assessments and penetration testing, including of our app;
• supplier and third-party security assessments;
• mandatory staff privacy and security training;
• incident response procedures, including notification of personal data breaches to regulators and affected individuals where required (see Section 16);
• physical security measures for any paper records and our premises.
  ‍

​We do not store your app health information in your personal cloud backup service (such as iCloud).

​

‍

13. How long we keep your information

We keep personal information including health information and call recordings and transcripts only for as long as it is needed for the purposes for which it was collected, and as required by applicable health-records and other legislation in your country.

As a general rule, we retain adult health records for at least 10 years from the date of last service. This aligns with medical defence and indemnity guidance for healthcare providers in both Australia and the United Kingdom, and meets or exceeds the statutory minimums in each region. Where a longer period is required by law, professional standards, or in response to an ongoing matter (for example, a complaint or claim), we will retain records for that longer period.

‍

App information. If you are not a client, we keep the information in your app account until you delete your account, or for 12 months after your last use of the app, and then delete or de-identify it. If you are a client, app information added to your clinical record is kept for the health-records period above.

When we no longer need your personal information and we are not required by law or professional standards to retain it, we take reasonable steps to securely destroy, delete or de-identify it.

‍

‍

​14. Your rights, including accessing and correcting your information

​
You have rights in respect of the personal information we hold about you. Depending on the country in which you receive our services, these may include the rights to:

‍

• access the personal information we hold about you;
• have inaccurate, out-of-date, incomplete, irrelevant or misleading information corrected;
• request erasure of your personal information (the 'right to be forgotten'), where the UK GDPR applies and the conditions are met;
• restrict or object to our processing of your personal information, where the UK GDPR applies;
• receive a copy of certain personal information you have provided to us, and have it transmitted to another controller, in a structured, commonly used and machine-readable format (data portability), where the UK GDPR applies;
• withdraw consent at any time, where we rely on your consent (this will not affect the lawfulness of processing before withdrawal); and
• not be subject to a decision based solely on automated processing that produces legal or similarly significant effects on you, and where automated decisions are made, to receive information about them, make representations, obtain human intervention and contest the decision.

‍

Deleting your app account. You can delete your account at any time in the app settings, or by contacting us using the details in Appendix A. When you delete your account, we delete the information held in your app account within two working days. Information already added to your clinical record is kept as required by health-records law (see section 13).

‍

To make a request, contact us using the details in Appendix A. We will respond within a reasonable time, usually within 30 days for Australian requests, and within one month for UK GDPR requests, with the ability to extend by a further two months where the request is complex. We may need to verify your identity first.

‍

Requests are generally free of charge. We may charge a reasonable fee, or refuse to act, only where a request is manifestly unfounded or excessive (United Kingdom), or where the Privacy Act otherwise permits a reasonable cost-recovery charge for access (Australia). In some cases we may decline access, correction or other rights where applicable law permits for example, where giving access would unreasonably affect another person's privacy. If we decline, we will explain why and tell you how to complain, and if we decline to correct information, you can ask us to attach a statement noting that you consider it inaccurate, out of date, incomplete, irrelevant or misleading.

‍

Please keep us informed if your details change, so the information we hold remains accurate and up to date.

‍

‍

15. Anonymity and your other choices

‍

Where it is lawful and practicable, you can deal with us anonymously or using a pseudonym for example, when making a general enquiry. In many cases, however, we will need to identify you to provide safe clinical care, and it may not be practicable to deal with you anonymously. Where a call is recorded, it cannot be anonymous, because the recording captures your voice and what you say, however you can ask us not to record (see Section 6).

‍

Where we rely on your consent to collect or use your information, you can withdraw that consent at any time by contacting us, although this may affect our ability to provide some or all of our services to you. You can also opt out of marketing at any time (see Section 9).

​

‍

16. Data breaches

‍

We take seriously, and act promptly on, any unauthorised access to, disclosure of, or loss of personal information (a data breach), including any breach involving call recordings, transcripts or app information.

‍

In Australia, we comply with the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act, and notify the Office of the Australian Information Commissioner (OAIC) and affected individuals of any 'eligible data breach'. In the United Kingdom, we comply with our breach-notification obligations under the UK GDPR and the Data Protection Act 2018 – notifying the Information Commissioner's Office (ICO) without undue delay, and where feasible within 72 hours of becoming aware of a notifiable personal data breach, and notifying affected individuals where the breach is likely to result in a high risk to their rights and freedoms.

‍

Our response includes containment, risk assessment, notification where required, post-incident review, and steps to prevent recurrence.

‍

‍

17. Complaints

‍

If you believe we have breached applicable data protection law or mishandled your personal information, please contact us first using the details in Appendix A, so we can investigate and try to resolve your concern. We prefer complaints in writing, with enough detail for us to investigate, and your contact details so we can respond. You can make a complaint by email or through our feedback form on our website. We will acknowledge your complaint within 30 days, keep you updated, and respond as soon as practicable. You will not be disadvantaged for making a complaint.

‍

If you are not satisfied with our response, you can complain to the data protection regulator in your country.

‍

In Australia – Office of the Australian Information Commissioner (OAIC)

• Telephone: 1300 363 992
• Email: enquiries@oaic.gov.au
• Website: www.oaic.gov.au
• Post: GPO Box 5218, Sydney NSW 2001

‍

In the United Kingdom – Information Commissioner's Office (ICO)

• Telephone: 0303 123 1113
• Website: www.ico.org.uk
• Post: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

‍

Both regulators generally ask that you raise your complaint with us before they will investigate.

‍

‍

18. Changes to this Policy

‍

This Privacy Policy was last updated in September 2026. We review it regularly and may update it to reflect changes in privacy law or our practices. Where changes are material, we will take reasonable steps to notify you for example, through our website, the app (including an in-app notice), or by direct communication.

‍

‍

19. Contact us

‍

For questions about this Privacy Policy, to exercise any of your rights, opt out of marketing, or make a complaint, please use the contact details for your country in Appendix A.

‍

‍

Appendix A. Contact details by market

‍
United Kingdom

‍