Privacy Policy

Hello Florense – Bladder and Bowel Diary Platform

*Privacy Policy and Terms of Use (Pilot Phase)*

Effective date: 21 April 2026

Last reviewed: October 10, 2026

Contact: kathryn@helloflorense.com.au

Privacy Policy

1. About this policy

Ivoryrose Group Pty Ltd ACN 611 936 380 (Ivoryrose Group, we, our, or us) respects your privacy and is committed to protecting personal and sensitive health information in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth) (Privacy Act) and in accordance with other applicable privacy laws.

This document, also referred to as our Privacy Policy explains how we collect, use, store, disclose, and protect information collected through our web-based bladder and bowel diary platform (the Platform), which is currently operating as a limited pilot.

This Privacy Policy applies to everyone who interacts with us. In this Privacy Policy, “you” refers to any individual whom we collect Personal Information.

By accessing or using the Platform, you acknowledge that you have read and understood this Privacy Policy.

2. The law we follow

We are bound by the Privacy Act and the APPs, which govern how we collect, use, store, and disclose Personal Information, including Sensitive Information. We also comply with the Notifiable Data Breaches scheme. By using our services, our website, or providing us with your information, you consent to your information being handled as described in this Privacy Policy.

3. Information We Collect and How It Is Used

3.1 Personal and Sensitive Information

Personal Information is any information or opinion about an identified or reasonably identifiable individual.

Sensitive Information is a subset of Personal Information that includes health information, and it carries a higher level of protection.

Because of the nature of our work, much of the information we hold about clients is Sensitive Information, and we only collect it with your consent or where the law permits.

3.2 Patient Identifying Information

The Platform is designed to minimise the collection of identifying information. The only identifying features collected about a patient are:

• Full name (used to associate diary entries with the correct clinical record and to allow the treating clinician to identify the patient);
• Date of birth (used to verify identity and to support age-appropriate clinical interpretation);
• Weight (used by the treating clinician to assist with clinical interpretation of fluid intake and urine output data).

No other directly identifying information, such as address, Medicare number, or contact telephone number is collected by the Platform during the pilot phase.

3.3 Sensitive Health Information

The Platform is intentionally designed to capture bladder and bowel diary data. The following categories of sensitive health information are entered by the patient for review and evaluation by their treating clinician:

• Bladder diary data, including timing and volume of urine output, episodes of urgency, incontinence events, pad use, and related symptoms;
• Fluid intake data, including timing, type, and volume of fluids consumed;
• Bowel diary data, including stool frequency, Bristol Stool Scale classification, urgency, continence, and related symptoms;
• Optional free-text notes or symptom descriptions entered by the patient or clinician.

This information is classified as sensitive information and health information under the Privacy Act. It is collected only with the patient's express consent and is used solely to support clinical review, evaluation, and care by the treating clinician.

3.4 Clinician Information

We collect basic professional details from participating clinicians, including name, practice name, professional registration details where relevant, and professional email address. Clinician details are used to administer clinician accounts, provide the Platform, and communicate about the pilot.

3.5 Technical and Usage Information

When you use the Platform, we automatically collect limited technical information necessary to operate and secure the service, including log data (such as timestamps, authentication events, and device/browser type) and error reports. This information is used solely to maintain the integrity, security, and availability of the Platform.

3.6 Demo Booking and Marketing Information

Separately from the Platform, we collect limited contact information from clinicians, practice owners, and other prospective users who book a demonstration of the Platform, subscribe to our mailing list, or otherwise enquire about the Platform. This may include name, email address, practice or organisation name, role, telephone number (where provided), any information you choose to include in a booking or enquiry form, details of your booking, and information about your interactions with our emails (such as whether an email was opened or a link within it was clicked).

We use the following third-party service providers to collect and manage this information on our behalf:

• Cal.com, an online scheduling service, which we use to allow you to book, reschedule, or cancel a demonstration of the Platform and to send related confirmations and reminders; and
• Klaviyo, an email marketing service, which we use to manage our mailing list, send general news and marketing communications about the Platform and our services, and follow up on demonstration bookings and other enquiries.

These services are not part of the Platform and are not used to collect, store, or process patient diary data or any other Sensitive Information. You should not include health information about yourself or any patient in a demonstration booking, an enquiry, or a reply to a marketing email.

4. How We Use Information

Personal and Sensitive Information collected through the Platform is used for the following purposes:

• To enable patients to record bladder and bowel diary data for review by their treating clinician;
• To enable clinicians to review, evaluate, and act on that information in the context of clinical care;
• To authenticate users, maintain account security, and support the operation of the Platform;
• To communicate with users about the pilot, including technical updates, safety-related notices, and feedback opportunities;
• To Improve and administer our services;
• To fulfil administrative functions, such as billing and staff training; To comply with legal, regulatory, and professional obligations; and
• To respond to enquiries and complaints

Aggregated, de-identified data derived from pilot feedback (collected separately through questionnaires rather than through diary records) may be used to improve the Platform and to inform the development of current or future features, such as additional tracking tools, reminders, or reporting functionality. No identifying or sensitive patient diary data will be used for product development.

Contact information collected through our demonstration booking and marketing services (described in section 3.6) is used to arrange and conduct demonstrations of the Platform, to follow up with you after a demonstration or enquiry, and, where you have consented or where otherwise permitted under the Spam Act 2003 (Cth), to send you news and marketing communications about the Platform and our services. Each marketing email will identify us and include a functional unsubscribe link, and you may opt out at any time as set out in section 5(a).

We only use your Personal Information for the purpose it was provided, for directly related purposes you would reasonably expect, or where the law requires or permits it.

5. Consent and Withdrawal of Consent

Where we rely on your consent to collect, use, or disclose your Personal or Sensitive Information, you have the right to withdraw that consent at any time.

You may withdraw consent by contacting our Privacy Officer in writing (by email) using the details set out below.

We will act on your withdrawal promptly. Withdrawal of consent does not affect the lawfulness of anything we did with your Personal or Sensitive Information before the withdrawal. However, withdrawal may limit our ability to continue providing some or all of our services to you. We will tell you if that is the case.

There are circumstances in which we may be permitted or required to continue holding or using your Personal or Sensitive Information despite withdrawal of consent. We will explain the position to you if this arises.

The following specific consents you can withdraw are as follows:

• Marketing communications: opt out at any time via the unsubscribe link in our emails or by contacting us.
• Referrals and third-party sharing: if you have authorised us to share your Personal or Sensitive Information with another practitioner or third party, you may withdraw that authorisation for future disclosures.

6. Permitted Health Situations

As a healthcare provider, we are sometimes permitted under the Privacy Act to collect, use, or disclose your Sensitive Information without your consent, in circumstances called "permitted health situations" (section 16B of the Privacy Act) and "permitted general situations" (section 16A of the Privacy Act). We do not rely on these exceptions routinely and our default is always to obtain your consent.

• We may collect your Sensitive Information without your explicit consent where it is necessary to provide a health service to you, and the collection is required or authorised by law, or is conducted in accordance with professional confidentiality rules binding our practitioners. In practice, this covers the clinical information our physiotherapists and exercise physiologists need to assess and treat you
• We may collect Sensitive Information about a third party (for example, a family member's relevant medical history) from you as a patient, where it is necessary to provide your health service and the information is part of the patient history taken from you.
• In limited circumstances, Sensitive Information may be collected for research relevant to public health or safety, or for the management or monitoring of health services, where it is impracticable to obtain consent and the collection is conducted in accordance with guidelines approved by the Australian Information Commissioner under section 95A of the Privacy Act. We will only do this where the public interest in the collection substantially outweighs the privacy interest
• Similarly, we may use or disclose Sensitive Information for research or statistical purposes relevant to public health or safety, where consent is impracticable and the activity is conducted under Commissioner-approved guidelines. Any recipient of Sensitive Information under this provision will not be permitted to further disclose it.
• We may disclose genetic information obtained in the course of providing a health service to a genetic relative of yours, where we reasonably believe disclosure is necessary to lessen or prevent a serious threat to that relative's life, health, or safety, and the disclosure is conducted under Commissioner-approved guidelines
• Where you are physically or legally incapable of giving consent, we may disclose Sensitive Information to a responsible person (such as a next of kin or guardian) to the extent necessary for your appropriate care or treatment, or for compassionate reasons, provided the disclosure is not contrary to any wish you expressed while capable.
• We may collect, use, or disclose Sensitive Information (including health information) without consent where necessary to lessen or prevent a serious threat to the life, health, or safety of any individual, or to public health or safety, and it is unreasonable or impracticable to obtain consent

If you have questions about when we may act under these provisions, please contact our Privacy Officer

7. Disclosure of Information

We do not sell, rent, or trade personal or sensitive information. We only disclose information in the following limited circumstances:

• To the patient's treating clinician and authorised members of their clinical team, for the purposes of clinical review and care;
• To trusted technology service providers who host or support the Platform on our behalf under contractual confidentiality and data-protection obligations;
• Where required or permitted by law, including in response to lawful requests by public authorities, or to protect the safety of an individual.

Except as set out below, we do not disclose personal information to overseas recipients. Data is hosted within Australia.

Contact information collected through our demonstration booking and marketing services (described in section 3.6) is disclosed to, and held by, Cal.com and Klaviyo, which may store and process that information on servers located outside Australia, including in the United States. Before disclosing that information, we take reasonable steps to ensure these providers handle it in a manner consistent with the APPs, including by relying on their contractual privacy and data-protection commitments. No patient diary data or other Sensitive Information collected through the Platform is disclosed to these providers.

Information about how these providers handle personal information is available in the privacy policies published on their respective websites.

8. Export of Diary Data to Clinician Practice Systems

To support continuity of care and to allow clinicians to keep a complete clinical record in their usual practice systems, the Platform allows diary data (together with the minimum identifying information of name, date of birth, and weight) to be exported as a PDF. Clinicians may then save that PDF into their own customer relationship management (CRM), electronic medical record, or practice management software.

Patients should be aware that:

• Once a PDF is exported from the Platform, the exported file sits outside the Platform and is governed by the privacy, security, and record-keeping arrangements of the clinician's own practice systems;
• The treating clinician, and their practice, are responsible for the security, storage, access controls, retention, and any further disclosure of exported PDF records in accordance with the Privacy Act, applicable State or Territory health records legislation, and their professional obligations;
• Exported PDFs form part of the patient's clinical record held by the treating clinician's practice and may be retained in accordance with that practice's record-keeping policies, even if the patient subsequently requests deletion of their data within the Platform;
• We do not have visibility of, or control over, what happens to an exported PDF once it leaves the Platform.

Clinicians using the PDF export feature must only do so for bona fide clinical record-keeping purposes in relation to their own patients and must ensure exported records are transferred and stored securely.

9. Data Security

We take reasonable and appropriate steps to protect personal and sensitive information from misuse, interference, loss, unauthorised access, modification, or disclosure. Security measures include:

• Encryption of data in transit (TLS) and at rest;
• Role-based access controls, so that clinicians can only access information for patients assigned to their care;
• Authentication requirements for all users, including secure password handling;
• Logging and monitoring of access to sensitive information;
• Regular review of our security practices as the Platform evolves through the pilot.

While we take these steps seriously, no method of electronic storage or transmission is completely secure. Users should protect their own login credentials and notify us immediately if they suspect unauthorised access to their account.

If we become aware of a data breach involving your Personal Information we will assess it in accordance with the Privacy Act, and, notify affected individuals and the Office of the Australian Information Commissioner (OAIC), along with recommended steps to reduce the risk of harm.

10. Data Storage and Hosting

All Platform data is stored in Google Cloud, Sydney Region (Australia). Data is encrypted in transit and at rest. We do not transfer personal or sensitive information outside Australia as part of normal Platform operations.

11. Data Retention

In accordance with the My Health Records Act 2012 (Cth), any Personal Information collected will be securely retained for 30 years after your death. If the date of death is unknown, any personal information will be retained for 130 years from your date of birth.

12. Access, Correction, and Deletion of your Personal Information

You may request to access the Personal Information we hold about you. To request access to your Personal Information please contact our Privacy Officer using the details set out below.

You will not be charged for making a request to access your Personal Information, but you may be charged a fee for the reasonable time and expense incurred in compiling information in response to your request.

We take reasonable steps to ensure the Personal Information we collect, use or disclose is accurate and up to date. If you believe your Personal Information contains an error, please let us know so that we can make the necessary amendments.

Please make any requests in writing to info@ivoryrosephysio.com.au. We aim to respond within 30 days.

We may decline your request for access or correct Personal Information, in accordance with the APPs and Privacy Act. If we do refuse your request we will provide you with a reason for our decision.

13. Role of the Treating Clinician

The Platform is a tool to support clinical care. It is not a substitute for a patient's formal medical record. The treating clinician remains responsible for:

• Clinical decision-making, interpretation of diary data, diagnosis, and treatment;
• Maintaining the patient's formal medical record in their own practice systems in accordance with applicable laws and professional standards;
• Confirming identity of patients and managing consent in the clinical context.

Diary entries collected through the Platform are intended to inform clinician review and evaluation; they do not constitute a complete medical record.

14. Cookies and Similar Technologies

The Platform uses strictly necessary cookies and similar technologies to keep users signed in, maintain session security, and remember basic preferences. We do not use advertising or cross-site tracking cookies on the Platform.

15. Children and Young People

Where the Platform is used in the care of a patient under 18, the treating clinician is responsible for obtaining appropriate consent from the patient and/or their parent or guardian in accordance with applicable laws and professional guidelines. We do not knowingly collect information directly from children without clinician and guardian involvement.

16. Changes to this Privacy Policy

We may update this Privacy Policy from time to time as the Platform evolves or as required by law. The latest version will be made available through the Platform, and your continued use of our services after any update indicates your acceptance of the revised Privacy Policy.

17. Complaints

If you have any questions, concerns, or complaints about how your personal or sensitive information is handled, please contact our Privacy Officer (details are shown below) so we can try to resolve it. We will aim to respond to your complaint within a 30 days.

The Privacy Officer will first consider your complaint to determine whether there are simple or immediate steps which can be taken to resolve the complaint. However, if your complaint requires further investigation, we will acknowledge receipt of your complaint within a week and endeavor to complete our investigation into your complaint promptly. We may ask you to provide further information about your complaint and the outcome you are seeking.

If you are not satisfied with our response to your complaint, or you consider that we may have breached the APPs or the Privacy Act, a complaint may be made to the OAIC. The OAIC can be contacted by telephone on 1300 363 992 or by using the contact details on the OAIC website

15. Contact Us

Our Privacy Officer is responsible for overseeing our compliance with this policy and with our obligations under the Privacy Act and the APPs. Specifically, the Privacy Officer:

• Manages and responds to all privacy complaints, access requests, and correction requests;
• Oversees staff training and awareness on privacy obligations;
• Ensures this policy is reviewed and updated regularly;
• Coordinates our response to any suspected or actual data breach, including assessing whether notification to the OAIC is required; and
• Acts as the first point of contact for any privacy-related queries from clients, staff, or regulators.

You may contact our Privacy Officer for any privacy-related matter, including to make a complaint, request access to or correction of your Personal Information, withdraw consent, or ask a question about how your Personal Information is handled.

Privacy Officer: Kathryn Warr, Privacy Officer

Email: kathryn@helloflorense.com.au

Post: Ivoryrose Physiotherapy, 67 Kensington Road, Norwood SA 5067