Privacy Policy

At Kavanii, ensuring the privacy of everyone who entrusts us with personal information is of the utmost importance. This Privacy Policy explains how we collect, hold, use, disclose and protect personal information, and how you can access or correct it or make a complaint. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

Who we are

In this policy, "Kavanii", "we", "us" and "our" means ePractice Technologies Pty Ltd (ABN 44 604 779 259), the company behind the Kavanii software application and its associated services. Other terms used in this policy:

• Agreement means the Kavanii Terms of Service.
• Customer means a user of Kavanii who has accepted our Terms of Service.
• Personal information means information or an opinion about an identified, or reasonably identifiable, individual.
• Services means the Kavanii software application and platform and any related services, such as customer support.

Contact: 526/368 Sussex St, Sydney NSW 2000, Australia · privacy@kavanii.com.au

Information we collect

Personal information we collect directly from you

We collect personal information directly when you complete a form on our website, sign up for a trial or subscription, chat with us, engage with us through Kavanii, or contact us by email or phone. We may also collect some personal information when you interact with us on social media. Depending on the interaction, this may include your name, practice or business name, profession, contact details (such as address, phone number and email address), number of practitioners and locations, the software you currently use, and the content of your enquiry.

We do not ask for, and you should not provide, sensitive information through our website forms or chat — for example health information about patients, racial or ethnic origin, religious or philosophical beliefs, sexual orientation, political opinions, trade union membership, genetic or biometric data, or criminal records.

Personal information we collect indirectly

We collect personal information indirectly when a Customer uses Kavanii to record information about other people — most commonly when a healthcare provider records information about a patient. This may include names, gender, dates of birth, countries of birth, addresses, phone numbers, email addresses, emergency contact details, health insurance information and medical records, including sensitive health information. See Data controlled by our customers.

We also collect

• Browser and device information, such as IP address, device type, operating system, browser type, screen resolution and language.
• Information from cookies and similar technologies, such as pages visited and time spent on pages — optional technologies are used only with your consent (see Cookies and analytics).
• Transaction information, such as details of your Kavanii subscription, payment dates and renewal dates. We do not receive or store full card numbers.

Our website and Zoho services

Our website uses services provided by Zoho Corporation to handle enquiries, subscriptions and chat, and by Anthropic for AI answers in Kavanii Help. Where available, Zoho services are configured to use Zoho's Australian data centre.

These providers process this information on our behalf. You can read about their practices in the Zoho Privacy Policy and Anthropic Privacy Policy.

How we use information

We primarily use the personal information we collect to operate Kavanii and our business. In particular, we use it to:

• respond to enquiries, arrange demonstrations and call you back when you ask us to;
• set up trials and subscriptions, bill you and send invoices and receipts;
• identify and authenticate Customers and communicate with them about their account;
• provide customer service and support;
• analyse trends, administer and improve Kavanii and our website, and monitor usage — using optional analytics only with your consent;
• prevent unauthorised use or abuse of Kavanii, and detect, investigate or prevent activities that breach our policies or are unlawful; and
• comply with our legal obligations.

Data entered into Kavanii by a business or practitioner about third parties is used strictly to provide the Services and support and technical assistance to our Customers.

How information is disclosed

Unless set out in this policy, we do not share, sell or rent personal information without your consent or unless required by law. We work with third-party service providers — such as our web host, data backup providers, Zoho (forms, billing and chat), Anthropic (AI answers in Kavanii Help), payment providers and, with your consent, Google (website analytics) — who may access personal information only for the purposes for which they are engaged. We minimise the personal information these providers can access.

Customers may provide API keys to third-party apps, allowing those apps to access data in their Kavanii account. We do not control the privacy practices of those third parties.

In exceptional circumstances we may be required to disclose personal information to comply with the law, to protect our rights, or in connection with a transfer of the ownership or assets of ePractice Technologies Pty Ltd.

Overseas disclosure

We work with service providers located in Australia and the United States. Some of our providers, including Zoho, Google and Anthropic, operate internationally and may store, access or process information outside Australia — for example in the United States, India or other countries where they or their sub-processors operate — when providing their services. Where we disclose personal information overseas, we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles.

Cookies and analytics

We use essential cookies to make our website work. With your permission, we also use analytics (such as Google Analytics) and marketing and engagement technologies (such as Zoho SalesIQ). Optional technologies are switched off until you choose to allow them, and you can change or withdraw your choice at any time using the Cookie Preferences link in our footer. Withdrawing consent stops future optional tracking on this website; it does not delete information already collected by third parties. Full details are in our Cookie Policy.

Marketing communications

We send marketing emails, such as news, tips, updates and special offers, only where you have consented, in line with the Spam Act 2003 (Cth). Every marketing message identifies Kavanii and includes a way to unsubscribe, and we will act on unsubscribe requests promptly. Service messages about your account, billing or the security of the Services are not marketing and will continue while you are a Customer.

Information security

We take security seriously. Data is encrypted and stored in secure facilities with access restricted to necessary personnel, and our technology is regularly reviewed. Our security measures include:

• Access control — access to sensitive data is restricted on a need-to-know basis, privileges are assigned by role, and two-factor authentication is enforced for administrative access.
• Encryption in transit — data sent between your browser and our servers is encrypted using industry-standard protocols such as TLS.
• Network protection — firewalls monitor and control network traffic to prevent unauthorised access.
• Updates and secure coding — software is regularly patched, and developers follow secure coding practices to prevent common vulnerabilities.
• Backup and recovery — regular, securely stored backups are tested periodically.
• Incident response — we maintain a plan to detect, respond to and mitigate security incidents, and train our staff in security awareness.

If a data breach is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme. Where your directly collected personal information is compromised, we aim to notify you within 72 hours of discovery with details of the information involved, the steps we have taken and what you can do. Where information collected indirectly is affected, we will notify the relevant Customers.

Data retention

We keep personal information only for as long as we need it for the purposes described in this policy, or as required by law, and then securely destroy or de-identify it. For example:

• enquiry, demo and callback records are kept while we are responding to you and managing our relationship with you;
• subscription and billing records are kept for as long as required for tax, accounting and legal purposes;
• under our Terms of Service, Customer content and data in Kavanii is deleted 90 days after an account is cancelled or terminated; and
• your privacy choice on this website is stored in a cookie for up to 12 months, after which we ask you again.

Data controlled by our customers

Customers may submit information to the Services for hosting and processing ("Customer Data"). We will not review, share, distribute or reference Customer Data except as provided in our Terms of Service or as required by law. We may access Customer Data only to provide the Services, to prevent or address service or technical problems, or as required by law.

If a Kavanii Customer (for example, your healthcare provider) has submitted personal information about you and you wish to access, correct or delete it, please contact that Customer directly. If you contact us instead, please tell us which Customer submitted your information; we will refer your request to them and support them in responding.

Kavanii may be used by practices outside Australia. We take reasonable steps to comply with local access and privacy laws to the extent consistent with our obligations under Australian law.

Access and correction

You can ask for access to the personal information we hold about you by emailing privacy@kavanii.com.au. We may need to verify your identity first. We will respond within a reasonable time, generally within 30 days.

• Correction — if information we hold is inaccurate, out of date, incomplete or misleading, ask us to correct it; we may need to verify the new information.
• Deletion — you can ask us to delete your personal information. We will take reasonable steps to do so unless the law requires us to keep it, in which case we will tell you.
• Portability — you can ask us to provide information you gave us in a structured, commonly used, machine-readable format, to you or a third party you choose.
• Withdrawing consent — you can withdraw consent to processing based on consent at any time. This does not affect processing that has already occurred, but may affect our ability to provide some services.

Questions and complaints

If you have a question or complaint about this policy or how we have handled your personal information, contact us at privacy@kavanii.com.au or by post at 526/368 Sussex St, Sydney NSW 2000, Australia. Please give us enough detail to investigate. We will acknowledge your complaint, investigate it and respond in writing, generally within 30 days.

If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or on 1300 363 992.

Changes to this policy

We may update this policy from time to time. The current version will always be published on this page, and we will notify Customers through Kavanii and other appropriate channels when we make material changes. When this policy or our Cookie Policy changes materially, we will ask website visitors to review their privacy choices again.