Scribely Privacy Policy

1.About this policy

This Privacy Policy explains how Medihealth Ventures Pty Ltd trading as Scribely (ABN 41 697 690 270) (Scribely, we, us, our) collects, holds, uses and discloses personal information, including health information, through the Scribely website and platform.

We handle personal information in line with the Privacy Act 1988 (Cth), including the Australian Privacy Principles, and with state and territory health records laws where they apply to us.

2.Who this policy is about

Scribely is a workflow platform for Australian IV clinics, practitioners and the independent doctors (prescribers) who review their script requests. We handle two kinds of information:

• Account information about the people who use Scribely: practitioners, nurses, clinic owners and staff, doctors, and organisation administrators.
• Patient (client) information that clinics enter into Scribely about the people they treat, including health information.

Clinics collect patient information from their own patients and decide what to record. They are responsible for giving their patients the privacy notices and obtaining the consents the law requires. We hold and process that information to provide Scribely to the clinic, including sending script requests to the doctor the clinic chooses. If you are a patient, you can contact your clinic or us about your information.

3.What we collect

About people who use Scribely:

• name, email address, phone number, clinic or business name and address
• professional details such as AHPRA registration number, prescriber number, qualifications, training and competency documents
• business and invoicing details such as legal name, ABN and GST status
• signatures, clinic logos and signed agreements
• login and two-factor sign-in details (passwords are stored only in encrypted, one-way form; we cannot see them)
• subscription and payment details: card payments are handled by Stripe, and we keep only the card brand, the last four digits and payment status
• records of what you do in Scribely, such as scripts created and signed and changes to clients and profiles (who changed what, and when)

About patients (entered by clinics): name, date of birth, contact details and address, medical questionnaire answers and other health information, consent forms, clinical notes, treatments and script items, aftercare instructions, appointment details and signatures.

When a script or consent form is signed, we record the date and time, the signer's IP address and, if the signer's browser allows it, the device's location. This is kept as evidence of the signature.

When you use our contact form: your name, email address and message.

Our servers also keep short-term technical logs (such as IP address, browser and pages requested) to run and secure the service. We also keep a record of the browsers you sign in from and of downloads (with IP address and approximate location), so we can warn you about sign-ins you don't recognise and spot unusual activity.

4.How we collect it

• directly from you, when you sign up, complete onboarding, use the platform or contact us
• from clinics, about their patients and team members
• from an organisation (for example, a licensee network) that sets up accounts for the clinics and practitioners in it
• from public sources, such as the AHPRA register and the Australian Business Register, to verify registration and ABN details
• from Stripe, about the status of payments and subscriptions

5.How we use it

• to provide Scribely: client records, consent forms, scripts, documents, aftercare and appointments
• to send script requests and related information to the doctor chosen by the clinic, and signed scripts back to the clinic
• to check that users are eligible and appropriately registered
• to bill subscriptions and script fees, pay doctors and issue invoices
• to send service emails, such as account set-up, password resets and script updates
• to keep Scribely secure, prevent fraud and misuse, and keep records of activity
• to provide support, including, when needed, a Scribely administrator viewing an account as its user to resolve an issue
• to comply with the law and respond to lawful requests
• to understand and improve Scribely, using combined or de-identified information where possible

We do not sell personal information. We do not use patient information for marketing or advertising, and we do not use it to train artificial intelligence. If we ever send marketing emails, we will only do so with consent and with an unsubscribe link in every email.

6.Who we share it with

• Doctors (independent prescribers): the patient and treatment information in a script request goes to the doctor the clinic selects, so they can review it.
• Your clinic: members of a clinic can see that clinic's records, according to their role.
• Organisations: if your clinic is part of an organisation (for example, a licensee network), that organisation's administrators can see reports and, where the organisation has been given that access, records for its clinics.
• Patients: clinics can email consent forms, aftercare instructions and booking details to their patients through Scribely.
• Service providers who help us run Scribely (listed below).
• Others where required or authorised by law, such as regulators, courts or law enforcement, or to our professional advisers, or as part of a sale or restructure of our business (with the information protected in line with this policy).

7.Service providers and overseas disclosure

Scribely's database, file storage and application servers are located in Sydney, Australia. Some of our service providers are based overseas or may handle information outside Australia:

We choose providers that protect personal information to a standard similar to the Australian Privacy Principles and only give them what they need to provide their service.

8.Cookies and tracking

Scribely only uses cookies and browser storage that it needs to work:

• sign-in cookies that keep you logged in
• a cookie that remembers your time zone, so dates and times show correctly
• a cookie used when a Scribely administrator views an account to provide support
• a cookie that recognises a browser you have signed in from before, so we can warn you about sign-ins from new devices
• browser storage for display preferences, such as which view you last chose

We do not use advertising cookies, analytics or tracking tools, or session recording. The font used on Scribely is served from our own servers. The video on our home page uses YouTube's privacy-enhanced mode, which does not set cookies until you play it.

9.How we protect it

• information is encrypted when sent over the internet and when stored
• access rules in the database limit each user to the records of their own clinic, the scripts sent to them as a doctor, or the clinics of their organisation
• two-factor sign-in is required for Scribely and organisation administrators, and available to every user
• changes to records and accounts are logged with who made them and when
• Scribely staff access is limited to what is needed to run and support the service

No system is completely secure. Please keep your login details private and tell us straight away if you think your account has been accessed without permission.

10.How long we keep it

We keep information while an account is active and afterwards for as long as we need it for the purposes in this policy or the law requires. Health records laws generally require health records to be kept for at least 7 years after the last entry, and longer for records about children. Tax laws require financial records to be kept for 5 years.

When information is no longer needed, we delete it or de-identify it.

11.Accessing and correcting your information

You can ask to see the personal information we hold about you, or ask us to correct it, by emailing support@scribely.com.au. Most account details can also be updated in your Profile. We will respond within 30 days. In limited cases the law allows us to refuse access (for example, where it would affect someone else's privacy); if so, we will tell you why.

If you are a patient, your clinic can usually help you fastest, as it controls your records. You can also contact us.

12.Using Scribely anonymously

You can ask us general questions without identifying yourself. To use Scribely, we need to know who you are, because scripts and clinical records must identify the practitioner, doctor and patient.

13.Age

Scribely accounts are for adults (18 or over) using Scribely in a professional capacity. Clinics may record information about patients under 18 when treating them, and are responsible for obtaining any consent required from a parent or guardian.

14.Data breaches

If a data breach is likely to cause serious harm to anyone whose information is involved, we will notify them and the Office of the Australian Information Commissioner (OAIC), as required by the Notifiable Data Breaches scheme. Where patient information is involved, we will also work with the affected clinics.

15.Questions and complaints

If you have a question or complaint about how we handle personal information, email support@scribely.com.au. We will acknowledge it promptly and aim to resolve it within 30 days.

We aim to resolve every complaint directly with you. You also have the right to contact the Office of the Australian Information Commissioner (oaic.gov.au, 1300 363 992).

16.Changes to this policy

We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated. If we make significant changes, we will let account holders know.