BAITL - Privacy Policy

BAITL ("we", "us", "our") is committed to protecting privacy and handling personal information responsibly.

This Privacy Policy explains how personal information is collected, used, processed, stored, and disclosed when BAITL is used by:

• Businesses and clinics that subscribe to BAITL ("Customers"), and
• Patients, visitors, or members of the public who interact with BAITL as a digital front-of-house or receptionist replacement ("End Users").

This policy is intended to comply with:

• The Privacy Act 2020 (New Zealand)
• The Health Information Privacy Code (where applicable)
• The Australian Privacy Principles
• International best-practice privacy standards

1. Roles and Responsibilities

BAITL's role

BAITL is a technology service provider that supplies administrative and workflow automation tools.

BAITL:

• Acts as a data processor / service provider
• Does not provide medical or clinical services
• Does not determine the purposes for which patient information is used

Customer's role

Clinics and businesses using BAITL:

• Are the data controllers (NZ) / APP entities (AU)
• Are responsible for:
  • Deciding what personal information is collected
  • Obtaining patient consent
  • Complying with health, privacy, and record-keeping obligations

2. Information We Collect

A. Information Collected from Customers (B2B Users)

We may collect and process:

• Account holder name and contact details
• Business or clinic details
• User roles and permissions
• Subscription, billing, and payment information
• Platform usage and configuration data

This information is used to provide and manage the BAITL service.

B. Information Collected from Patients / End Users

When patients or visitors interact with BAITL (for example, checking in, completing a form, or submitting a request), they may input personal information at the direction of the Customer.

This may include personal and health-related identifiers, such as, but not limited to:

• Name
• Phone number
• Email address
• Date of birth
• Address

BAITL:

• Processes this information only to perform the requested task
• Acts as a temporary conduit between the End User and the Customer's systems
• Does not actively store, retain, or maintain patient records within BAITL beyond what is technically necessary to deliver the task

BAITL does not store:

• Clinical notes
• Diagnoses
• Treatment information
• Medical histories

3. How Information Is Used

Personal information is used only to:

• Operate and provide the BAITL platform
• Facilitate front-of-house workflows and task automation
• Authenticate users and manage accounts
• Integrate with Customer-selected third-party systems
• Process subscriptions and payments
• Monitor performance, reliability, and security
• Meet legal and regulatory obligations

We do not use personal information for third-party advertising or sell personal data.

4. Health Information

• BAITL processes health information solely on behalf of the Customer.
• BAITL does not use health information for its own purposes.

Healthcare providers remain responsible for:

• Patient notice and consent
• Clinical governance
• Compliance with the Health Information Privacy Code and equivalent Australian requirements

5. Cookies and Analytics

BAITL uses cookies and similar technologies to operate and improve the platform.

This may include tools such as:

• Google Analytics
• Sentry
• PostHog

These tools collect technical and usage information, not clinical content.

You can manage cookies through your browser settings.

6. Data Storage and Hosting

Data is hosted in Australia-based data centres.

BAITL uses reputable third-party infrastructure providers with appropriate security certifications. As BAITL expands internationally, data may be hosted in additional regions subject to appropriate safeguards.

7. Data Sharing and Disclosure

BAITL may share personal information with:

• Sub-processors: Third-party service providers who assist in delivering the platform (e.g., hosting, payment processing, analytics)
• Customer-selected integrations: Practice management systems or other third-party tools connected at the Customer's request
• Legal authorities: Where required by law or to protect rights and safety

BAITL does not sell personal information to third parties.

8. Data Retention

Personal information is retained only as long as necessary to provide the service and comply with legal obligations.

Upon cancellation or expiry of a subscription, Customers will have a reasonable opportunity to export their data. Following this period, data may be deleted or anonymised.

9. Your Rights

Under applicable privacy laws, you may have the right to:

• Access personal information held about you
• Request correction of inaccurate information
• Request deletion of your information (subject to legal requirements)
• Complain to a privacy regulator (e.g., the NZ Privacy Commissioner or OAIC in Australia)

End Users: If you are a patient or visitor who interacted with BAITL via a clinic or business, please contact that organisation directly regarding your personal information.

Customers: You can manage your account data through BAITL or by contacting us at the details below.

10. Security

BAITL implements reasonable technical and organisational measures to protect personal information, including:

• Encryption in transit and at rest
• Access controls and authentication
• Regular security reviews

No system is completely secure. BAITL will notify affected parties and regulators of notifiable data breaches in accordance with applicable law.

11. Changes to This Policy

BAITL may update this Privacy Policy from time to time. Material changes will be notified where required. The "Last updated" date at the top indicates when the policy was last revised.

12. Contact

For questions about this Privacy Policy or how we handle your information, contact: