Privacy PolicyPre-deployment

Effective Date: Upon commercial deployment (anticipated Q2 2026)
Last Updated: 24 October 2025
Version: 1.2 (Pre-deployment Draft)

1. Introduction

This Privacy Policy describes how Clexa ("we", "our", or "us") collects, uses, stores, and protects personal information in connection with our clinical inbox management platform. This policy applies to all users of Clexa services, including healthcare providers, clinicians, and healthcare organizations.

Clexa is committed to protecting the privacy of individuals whose information is processed through our platform. We comply with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

1.1 Our Commitment to Privacy

1.2 Implementation Status

Current Status: Pre-deployment documentation and planning phase

This Privacy Policy represents Clexa's firm commitments regarding data handling, security, and privacy practices. While vendor selection is in progress, all provisions in this policy will be fully implemented before processing any patient data. We are documenting our privacy approach early to ensure:

Key Pre-deployment Activities:

Timeline: We anticipate completing vendor selection and security implementations by Q1 2026, with full operational readiness for patient data processing by Q2 2026.

2. Scope and Application

2.1 Who This Policy Applies To

This Privacy Policy applies to:

2.2 What This Policy Covers

This policy covers all personal information and health information processed through Clexa's clinical inbox management platform, including:

3. Information We Collect

3.1 Clinical Information (Minimal Collection)

Clexa is designed with data minimization principles. We collect and store only:

What We Collect:

What We Do NOT Collect or Store:

3.2 User Information

For healthcare providers and staff accessing Clexa:

3.3 Technical Information

3.4 De-identified Information Processing

Before AI analysis, clinical documents undergo de-identification:

4. How We Use Your Information

4.1 Primary Purpose: Clinical Decision Support

We use collected information to:

4.2 Secondary Purposes

We may use information for:

Important - No LLM Training on Patient Data: We do NOT use patient data, clinical documents, or any identifiable health information to train, fine-tune, or improve AI/LLM models. Any improvements to AI algorithms are based solely on:

  • Aggregated, fully de-identified performance metrics
  • Clinical validation studies with synthetic or publicly available medical literature
  • Expert clinical feedback on suggestion quality (without patient-specific data)

4.3 Human-in-the-Loop Principle

Critical: All AI-generated suggestions require explicit clinician approval. No automated changes are made to patient records. Clinicians maintain full control over all clinical decisions.

5. How We Share Your Information

5.1 Sharing with Healthcare Providers

5.2 Subprocessors

We engage trusted subprocessors to assist in delivering our services. All subprocessors will be bound by data processing agreements and must comply with Australian privacy laws and our security requirements.

Subprocessor Categories and Requirements:

Prior to commercial deployment, we will finalize vendor selection across the following categories. All vendors will meet our strict security and privacy requirements:

Subprocessor Category Purpose Data Processed Location Requirement Security Requirements
Cloud Infrastructure Platform hosting, data storage, compute resources All operational data Australia (Sydney/Melbourne) Data Processing Agreement, ISO 27001, SOC 2 Type II, encryption at rest and in transit
De-identification Service PII removal and data anonymization Clinical documents (temporary processing only) Australia Data Processing Agreement, zero data retention, encryption in transit
Medical Terminology Service Medical terminology validation (Ontoserver or equivalent) AI suggestions, terminology codes Australia Data Processing Agreement, access via secure API, minimal data transfer
LLM Provider AI-powered clinical analysis De-identified clinical content only Australia Data Processing Agreement, zero data retention, no model training clause, encryption in transit
Security Monitoring Security monitoring and threat detection System logs, access logs Australia Data Processing Agreement, SOC 2, limited data retention

Pre-deployment Commitments:

Subprocessor Commitments (Post-deployment):

Subprocessor Changes: We will notify customers of any new subprocessors or changes to existing subprocessors via email at least 30 days in advance, allowing customers to object if they have legitimate concerns.

5.3 Required Disclosures

We may disclose information when required by law:

5.4 No Overseas Disclosure

Important: All data remains within Australia. We do not transfer personal information or health information to overseas recipients. All processing, including AI analysis, occurs on Australian-hosted infrastructure.

6. Data Storage and Security

6.1 Australian Data Residency

6.2 Infrastructure Security

Encryption:

Access Controls:

Network Security:

Application Security:

6.3 De-identification Process

Clinical documents undergo automated de-identification before AI processing:

6.4 Data Retention

Operational Data:

User Account Data:

System Logs:

6.5 Data Deletion

Upon request or at end of retention period:

7. Your Privacy Rights

Under the Australian Privacy Act 1988 and Australian Privacy Principles, you have the following rights:

7.1 Right to Access

For Healthcare Providers:

For Patients: Due to our data minimization design, we store only pseudonymized patient identifiers and do not maintain complete patient records. Patients seeking access to their clinical information should contact their healthcare provider, who maintains the complete medical record. We can provide information about:

7.2 Right to Correction

You can request correction of inaccurate or incomplete information:

Note for Patients: Due to data minimization, corrections to clinical information should be made through your healthcare provider's patient management system, which maintains your complete medical record.

7.3 Right to Complain

You have the right to complain about our privacy practices:

7.4 Right to Restrict Processing

In certain circumstances, you may request restriction of processing:

Note: Restriction requests from patients should be coordinated through their healthcare provider, who can control whether clinical documents are sent to Clexa for processing.

7.5 Data Portability

For Healthcare Providers: Where technically feasible, healthcare provider organizations can request export of:

For Patients: Due to our data minimization approach, we do not store complete patient records or sufficient identifying information to facilitate direct patient data portability requests. Patients seeking portability of their complete medical records should contact their healthcare provider. We can provide (via the healthcare provider):

Data portability may be subject to technical limitations and must be coordinated through the healthcare provider for patient requests.

8. Data Breach Notification

8.1 Our Commitment

We are committed to protecting your information and have implemented comprehensive security measures. However, in the event of a data breach, we will act swiftly and transparently.

8.2 Detection and Response

8.3 Notification Process

To Affected Individuals:

Our Commitment: While the NDB scheme requires notification within 72 hours where practicable, we are committed to notifying affected parties as rapidly as possible once we have verified the breach and assessed its scope, even if this occurs sooner than the statutory requirement.

To OAIC (Office of the Australian Information Commissioner):

To Healthcare Organizations:

8.4 Eligible Data Breaches

Under the Notifiable Data Breaches (NDB) scheme, we will notify if:

8.5 Post-Breach Actions

9. Clinical Governance and Quality Assurance

9.1 AI Model Oversight

9.2 Terminology Validation

All AI suggestions validated against authoritative medical terminology databases via Ontoserver:

9.3 Audit Trail

Complete audit trail maintained for:

9.4 Clinical Safety

10. Consent and Lawful Basis

10.1 Healthcare Provider Consent

By using Clexa, healthcare providers consent to:

10.2 Patient Consent

Patient consent for Clexa processing is typically obtained by the healthcare provider as part of:

Healthcare providers are responsible for ensuring appropriate patient consent.

10.3 Lawful Basis for Processing

We process health information under the following legal bases:

Primary Purpose (APP 6.1):

Secondary Purpose (APP 6.2):

11. Children's Privacy

Clexa is a healthcare professional tool, not directed at children. Clinical information about patients of all ages, including paediatric patients, may be processed through our platform.

Our Approach:

Healthcare providers remain responsible for obtaining appropriate consent from parents or legal guardians for the treatment of minors.

12. Changes to This Privacy Policy

12.1 Updates

We may update this Privacy Policy from time to time:

12.2 Version History

13. Contact Information

13.1 Privacy Officer

For privacy-related questions, requests, or complaints:

Privacy Officer
Email: privacy@clexa.health

13.2 General Inquiries

For general questions about Clexa:

Email: support@clexa.health

13.3 Regulatory Complaints

If you are not satisfied with our response to your privacy complaint, you may contact:

Office of the Australian Information Commissioner (OAIC)
Website: www.oaic.gov.au
Email: enquiries@oaic.gov.au
Phone: 1300 363 992

14. Definitions

AI Suggestion: A clinical recommendation generated by Clexa's artificial intelligence system based on analysis of de-identified clinical documents.

De-identification: The process of removing personally identifiable information from clinical documents while preserving clinical content for analysis.

Evidence Excerpt: A short text snippet from a clinical document that supports an AI-generated suggestion.

Health Information: Information or opinion about the health or disability of an individual, as defined in the Privacy Act 1988.

Personal Information: Information or opinion about an identified individual, or an individual who is reasonably identifiable, as defined in the Privacy Act 1988.

Pseudonymization: Replacement of identifying information with pseudonyms (e.g., patient ID instead of patient name).

Subprocessor: A third-party service provider engaged by Clexa to process personal information on our behalf, subject to data processing agreements and security requirements.

Terminology Validation: The process of verifying that AI suggestions refer to valid medical terms in authoritative databases such as SNOMED CT, AMT, or PBS.

Appendix A: Australian Privacy Principles Compliance

This section demonstrates Clexa's compliance with the Australian Privacy Principles (APPs):

APP 1 - Open and Transparent Management:

APP 2 - Anonymity and Pseudonymity:

APP 3 - Collection of Solicited Personal Information:

APP 5 - Notification of Collection:

APP 6 - Use or Disclosure:

APP 7 - Direct Marketing:

APP 8 - Cross-border Disclosure:

APP 9 - Adoption, Use or Disclosure of Government Related Identifiers:

APP 10 - Quality of Personal Information:

APP 11 - Security:

APP 12 - Access to Personal Information:

APP 13 - Correction:

Appendix B: Vendor Selection Criteria

To ensure our privacy commitments are met, all vendors must satisfy these requirements before selection:

Mandatory Requirements

Australian Data Sovereignty:

Security Certifications:

Contractual Commitments:

Healthcare Industry Experience:

Technical Capabilities:

Business Continuity: