Privacy Policy

1. Who this policy covers

This Privacy Policy explains how Port Jackson Investments Pty Ltd ATF Port Jackson Investments Trust (ABN 69 172 518 163), trading as Posture 4 Health ("we", "us", "our"), collects, holds, uses, and discloses personal information through the Posture 4 Health application (the "Application") and our public website at posture4health.com (the "Website"), in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This policy applies to:

• clinic staff (practitioners, receptionists, and administrators) who use the Application ("Staff Users");
• patients/clients whose information is entered into the Application by a clinic ("Patients"); and
• people who visit the Website or contact us through it ("Website Visitors").

Each clinic using the Application ("Clinic") is separately responsible, as the data controller, for its own collection of Patient information and for obtaining any consents required from its Patients — see section 8.

2. Information we collect

2.1 From Staff Users

• Name and email address (for login and account administration);
• Role/permission level within the Clinic;
• Login activity and basic usage data (e.g. last screen viewed, for convenience features such as resuming where you left off);
• Acceptance records for our Terms of Use & Software License Agreement (name/email, date, and version accepted).

2.2 From or about Patients (entered by Clinics)

• Name, age/date of birth, sex, height, and weight;
• Photographs taken for posture assessment (lateral and AP/front-view images), and landmark/measurement data derived from those photographs;
• X-ray images that a Clinic adds to a Patient's file, with the spinal region and view each one shows;
• Calculated posture metrics and scores (e.g. Postural Health Score, Vitality Score, and related breakdowns);
• Exercise prescriptions and clinical notes entered by Staff Users;
• Contact details (e.g. email address and/or mobile number) where a Clinic chooses to email or text a report, reminder, or other communication to the Patient;
• Health history and questionnaire answers a Patient gives in forms their Clinic sends them (for example a new-client intake form, or pain and function questionnaires), and any signature given on a form or consent;
• Appointment details (dates, times, practitioner, location and appointment type), including those synchronised from the Clinic's practice management system;
• Where a Clinic records a workplace injury or transport accident claim: claim details (such as the claim number, date of injury, occupation, work status, and the insurer's or agent's contact details) and the treatment plans prepared for it;
• Activity in the patient portal, where a Clinic gives a Patient access: exercises marked as done, feedback on exercises (for example how an exercise felt), messages the Patient sends their Clinic, and consent records.

2.3 Technical information

• Device/browser information needed for the Application to function (e.g. to request camera access for posture photos);
• Information stored locally on the device (browser local storage / IndexedDB) to allow the Application to work offline and resume sessions — this stays on the device and is not separately collected by us, except where it is synced to our servers as part of normal use (e.g. saving an assessment).
• Location, only if a Patient taps “I’m here” in the patient portal to check in for that day’s appointment, and only if their Clinic has turned this on. The Patient’s device asks their permission first. The location is checked once, at that moment, to confirm the Patient is close to the Clinic; it is not stored, and only whether the check passed is kept. A Patient who would rather not share their location can check in at the Clinic instead.

We do not use cookies, third-party advertising trackers, or analytics services that profile individual Patients or Staff Users.

2.4 From Website Visitors

If you submit the demonstration or enquiry form on the Website, we collect the details you enter: your name, your practice or group name, your email address, your phone number (if you provide one), the number of locations you operate, your team size, your current practice management system, whether you use Xero, the area you would like the demonstration to focus on, and your message. We use these details only to respond to your enquiry and to arrange a demonstration. They are delivered to us by our form provider, EmailJS, in the United States (see sections 5 and 7). Please do not include Patient information in the form.

The Website does not use analytics services, advertising or tracking cookies, or third-party embeds. Our hosting provider, Netlify, keeps standard server logs of requests to the Website (such as IP address, the page requested and the time) for operating and securing the service.

2.5 From a Clinic's connected business systems

• Where a Clinic connects its practice management system (such as PracSuite, Cliniko or Halaxy): Patient names, contact details, dates of birth and appointments, kept in step with that system;
• Where a Clinic connects its accounting system (Xero): summary financial information for the Clinic's own business statistics (invoice and payment amounts, dates, items, practitioner and location).

3. How we collect information

We collect information:

• directly from Staff Users (e.g. when creating an account, entering Patient details, taking photographs during an assessment, or adding X-ray images to a Patient's file);
• automatically, through the Application's normal operation (e.g. camera capture, calculated scores, login timestamps);
• directly from Patients, when they complete a form, questionnaire or consent that their Clinic sends them, or use the patient portal their Clinic gives them access to;
• from the Clinic's own connected systems (its practice management or accounting system), where the Clinic connects them;
• directly from Website Visitors, when they submit the demonstration or enquiry form on the Website.

Information a Patient provides directly is collected on behalf of, and at the request of, their Clinic, in the course of the Clinic's own clinical practice.

4. How we use information

We use the information described above to:

• provide, operate, and maintain the Application, including generating posture assessments, scores, and reports;
• authenticate Staff Users and manage access permissions for each Clinic;
• enable Clinics to send reports, reminders, and related communications to their Patients by email or SMS, where requested;
• generate, with the assistance of a third-party AI service, draft wording for reports, letters to a Patient's other health practitioners, injury-claim treatment plans and care-plan communications, help Staff Users summarise and reply to a Patient's message, and identify which part of the spine an X-ray image shows so it can be filed — see section 5 for exactly what is sent;
• keep a Clinic's connected practice management system in step and, where the Clinic enables it, file completed forms, reports, X-ray images and notes into the Patient's record in that system;
• send portal reminders as browser notifications, where a Patient turns them on;
• maintain records of acceptance of our Terms of Use & Software License Agreement;
• provide customer support and respond to enquiries;
• maintain the security, integrity, and proper functioning of the Application (e.g. detecting and preventing unauthorised access);
• comply with our legal obligations.

We do not use Patient information for marketing, and we do not sell personal information to third parties.

5. Disclosure of information

We may disclose information to:

• the Clinic that the Patient or Staff User is associated with, and to other Staff Users at that Clinic who have appropriate access permissions (e.g. a practitioner viewing a Patient's history);
• people and organisations the Clinic directs us to send information to — for example a report to the Patient's general practitioner, or a treatment plan to a workers' compensation or transport accident insurer or its agent. These are sent only when a Staff User chooses to send them;
• the Clinic's own connected systems (its practice management and accounting systems), under the Clinic's own agreement with that provider;
• service providers (sub-processors) who help us operate the Application — we require each to protect the information and to use it only to provide services to us. Our current sub-processors are:
  • Supabase (database, authentication, and file storage) — Patient and account data is hosted in Australia (Sydney); see section 7;
  • Netlify (application and Website hosting and content delivery, USA/global) — delivers the Application's and the Website's code to your browser and keeps standard server logs of requests; Patient data is not stored on or routed through Netlify, as your browser communicates directly with Supabase in Australia;
  • Resend (transactional email; United States company, sending infrastructure in Japan) — used to send emails such as a Patient report or an account email; receives the recipient's name and email address and the message or report content;
  • ClickSend (SMS, Australia) — used to send text messages, such as reminders, where a Clinic enables this; receives the recipient's mobile number and message content;
  • Stripe (payments, USA) — processes Clinic subscription and billing information; it does not receive Patient health information;
  • EmailJS (Website enquiry form delivery, USA) — delivers the details submitted through the Website demonstration or enquiry form to our inbox; it does not receive Patient information;
  • Anthropic (AI text generation, USA) — used to draft report, letter, treatment-plan and care-plan wording. What is sent is de-identified, structured clinical information: for example posture measurements and scores, questionnaire scores, fixed-choice answers from intake forms, and, for an injury-claim plan, work status and planned treatment. Patient names, dates of birth, contact details, posture photographs, diagnoses and free-text answers are not sent for these. The one exception for wording is the optional "summarise this reply" feature for Staff Users: the text of the Patient's own message is sent as the Patient wrote it (we do not add their name, but the message itself may contain anything the Patient chose to write). Under Anthropic's commercial terms, data sent via its API is not used to train its models;
  • Anthropic (AI image recognition for X-ray filing, USA) — when images are added to a Patient's X-ray section, a reduced-size copy of each one (up to eight per upload, each no larger than 448 pixels on its longest side) is sent so the AI can identify which part of the spine it shows and the view it was taken from. This is for filing only, not diagnosis. Only that reduced-size copy is sent: not the full-size image, the file name, or the Patient's name or other details from their file. Before a copy is sent, the Application makes a best-effort attempt to remove printed identifying text: it trims the dark side margins of the film where it can find them, then blanks a strip along every edge, the four corners, and patches of bright printed text away from the middle of the image, where names, dates of birth and imaging-centre details are usually printed. Because this is automatic, it cannot guarantee that every printed detail is removed. Text in the band running down the middle of the image, and dark, coloured, faint or unusually large lettering, may not be removed unless it falls within a blanked strip or corner, so a name or other detail printed on the film may still be included. If the Application cannot prepare a masked copy, that image is not sent. Under Anthropic's commercial terms, data sent via its API is not used to train its models;
  • Browser push services (operated by the maker of the Patient's web browser, such as Google, Apple or Mozilla) — relay portal reminders when a Patient turns notifications on. Notifications contain no health information;
• government bodies, regulators, or law enforcement, where required or authorised by law;
• a successor entity, in the event of a sale, merger, or restructuring of our business, subject to that entity continuing to protect the information in accordance with this policy (or a policy of at least equivalent protection).

We do not disclose Patient information to other Clinics, or to Staff Users outside the Patient's own Clinic.

6. Security

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure, including:

• role-based access controls, so Staff Users can only access information relevant to their Clinic and role;
• encrypted transmission of data (HTTPS/TLS) between the Application and our servers;
• authentication via Supabase Auth, with the ability for Clinics to deactivate Staff User accounts;
• restricting administrative access to our infrastructure to authorised personnel.

No method of transmission or storage is completely secure. If we become aware of a data breach likely to result in serious harm, we will take steps required under the Privacy Act 1988 (Cth) Notifiable Data Breaches scheme, including notifying affected individuals and the Office of the Australian Information Commissioner (OAIC) where required.

7. Storage location and overseas disclosure

7.1 Patient and account information collected through the Application is stored using Supabase infrastructure, hosted in Australia (Sydney, ap-southeast-2). Backups of this information are also held in Australia.

7.2 Some of our service providers are located overseas, which means limited personal information may be disclosed outside Australia in the course of operating the Application (Australian Privacy Principle 8). Specifically:

• email content and recipient details are processed by Resend, a United States company: emails are sent using infrastructure in Japan (Asia Pacific — Tokyo), and the associated email metadata, logs and delivery records are stored by Resend in the United States;
• de-identified, structured clinical information is processed by Anthropic in the United States when AI-assisted wording is generated — no Patient names, dates of birth or contact details are sent (the text of a Patient's own message is sent only when a Staff User asks for it to be summarised, as described in section 5);
• a reduced-size copy of each image added to a Patient's X-ray section is processed by Anthropic in the United States to identify the part of the spine it shows. Printed identifying text is removed on a best-effort basis before the copy is sent, but this cannot be guaranteed, so a name printed on the film may still be included (section 5);
• portal reminder notifications are relayed by browser push services, which may be located outside Australia (they contain no health information);
• Clinic subscription and billing information is processed by Stripe in the United States (no Patient health information is sent);
• details submitted through the Website demonstration or enquiry form are processed by EmailJS in the United States;
• the Application's and the Website's code is delivered via Netlify's global content delivery network, which keeps standard server logs of requests, but Patient data is not stored on that network.

SMS messages are sent via ClickSend in Australia. Where a Clinic connects its own practice management or accounting system, information is exchanged with that provider under the Clinic's own agreement with it. We take reasonable steps to ensure these providers handle personal information in a manner consistent with the Australian Privacy Principles.

8. Clinics' responsibilities for Patient consent

Clinics are responsible for:

• ensuring they have a lawful basis (including, where required, the Patient's informed consent) to collect Patient personal and health information and enter it into the Application, including taking posture photographs and adding X-ray images;
• informing Patients that their information will be processed using the Application, including that reduced-size copies of their X-ray images are processed by an AI service in the United States for filing (section 5), and, where appropriate, providing Patients with a copy of (or a link to) this Privacy Policy or the Clinic's own privacy policy;
• responding to Patient requests to access, correct, or delete their information held in the Application, in accordance with the APPs and any applicable health records law — we will assist Clinics to action such requests within the Application where technically possible.

9. Data retention and deletion

9.1 We retain information for as long as the relevant Clinic's account remains active, plus any additional period required by law (including health records retention requirements, which can be longer than general business records).

9.2 A Clinic may request deletion of a Patient's record via the Application (where this feature is available) or by contacting us. We will action such requests unless we are required by law to retain the information. Clinics should note that health records legislation in their state (e.g. the Health Records Act 2001 (Vic) or equivalent) may impose minimum retention periods for patient health records (commonly around 7 years from the last consultation, or until a minor patient turns 25) — Clinics are responsible for ensuring any deletion request is consistent with their own record-keeping obligations before requesting deletion via the Application.

9.3 On termination of a Clinic's licence to use the Application, we will retain the Clinic's data for 90 days to allow export, after which it may be deleted in accordance with our data retention practices, subject to section 9.1.

10. Access and correction

10.1 Staff Users can access and update their own account information within the Application (e.g. via Settings).

10.2 A Patient who wishes to access, correct, or delete their personal information should contact their Clinic in the first instance, as the Clinic controls that information. If the Clinic is unable to assist, the Patient (or the Clinic on their behalf) may contact us using the details in section 12.

11. Children's information

The Application may be used by Clinics to record posture assessments for minors, with the consent of a parent/guardian obtained by the Clinic in accordance with its own policies and applicable law. We do not knowingly collect personal information directly from children.

12. Complaints and contact

If you have a question, concern, or complaint about how we handle personal information, please contact us at contact@posture4health.com.

We will acknowledge your complaint and aim to respond within a reasonable time. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

13. Changes to this policy

We may update this Privacy Policy from time to time, for example to reflect changes in the Application, our service providers, or the law. The "Last updated" date at the top of this policy will be revised, and material changes will be notified to Staff Users (e.g. by email or in-app notice).

A link to the current version of this Privacy Policy is available within the Application (Settings → Account) and on request.

Version 1.6 (23 October 2026) corrected the name of the entity that provides the Application: Port Jackson Investments Pty Ltd ATF Port Jackson Investments Trust (ABN 69 172 518 163). Version 1.5 (19 October 2026) added: the patient portal’s optional “I’m here” check-in, which checks the Patient’s location once and does not store it. Version 1.4 (18 October 2026) added: X-ray images held in a Patient's file, and the AI-assisted filing of X-ray images, including the best-effort removal of printed identifying text before an image is sent. Version 1.3 (15 October 2026) added: forms, questionnaires and consents completed by Patients; the patient portal; workplace injury and transport accident claim records; connected practice management and accounting systems; reports and plans sent to other practitioners and insurers at a Clinic's direction; browser notifications; and the wider uses of AI-assisted wording, including what is and is not sent. Version 1.2 (13 October 2026) added the Website and its enquiry form.