Privacy Policy

1. Who we are

Retinote is operated from Brisbane, Queensland, Australia (ABN available on request). We build CPD tracking software for Australian optometrists. This policy explains how we handle your personal information in compliance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

If you have questions about this policy, contact us at support@retinote.com.au.

2. What information we collect

We collect the following categories of information:

• Account data: name, email address, and password (stored as a secure hash) when you register.
• Profile data: professional details you choose to provide, such as your AHPRA registration number or practice location.
• CPD data: activity records, learning goals, notes, reflections, and supporting documents you create inside Retinote.
• Payment data: subscription payments are processed by Stripe. We do not store full card details; Stripe returns a token we use to manage your subscription.
• Usage data: log data, device type, browser, IP address, and pages visited, collected automatically to maintain and improve the service.

We do not knowingly collect information from anyone under 18.

3. How we use your information

We use your information to:

• Provide, operate, and maintain your Retinote account.
• Process subscription payments and manage billing.
• Generate AI-assisted reflections and summaries you request within the app.
• Send transactional emails (account verification, password reset, subscription receipts).
• Send product updates and announcements where you have opted in or where permitted by law.
• Improve and develop the service.
• Comply with our legal obligations and resolve disputes.

We do not sell your personal information to third parties.

4. How we share your information

We share information only with the following categories of third parties, and only to the extent necessary:

• Infrastructure providers: Microsoft Azure (hosting and database), Firebase (authentication and session management).
• Payment processor: Stripe, for subscription billing.
• AI provider: Anthropic, when you request AI-generated reflections. Only the CPD data relevant to your request is sent.
• Analytics and monitoring: Microsoft Azure Application Insights, for application performance monitoring.

All third-party providers are bound by contractual obligations to protect your data. We do not permit them to use your data for their own purposes.

5. Data storage and security

Your data is stored in Microsoft Azure data centres. We implement industry-standard security measures including encryption in transit (TLS), encryption at rest, and access controls restricted to authorised personnel.

No method of transmission over the internet is 100% secure. While we take reasonable steps to protect your data, we cannot guarantee absolute security.

6. Data retention

We retain your account data for as long as your account is active. If you delete your account, we will delete or anonymise your personal information within 30 days, except where we are required to retain it by law (for example, financial records required for tax purposes).

7. Your rights

Under the Australian Privacy Principles, you have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate or incomplete information.
• Request deletion of your account and associated data.
• Complain about a breach of your privacy rights.

To exercise any of these rights, email support@retinote.com.au. We will respond within 30 days.

If you are unsatisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

8. Cookies and tracking

We use cookies and similar technologies to operate the service and analyse usage. For details, see our Cookie Policy.

9. Changes to this policy

We may update this policy from time to time. We will notify you of material changes by email or by displaying a notice in the app. The date at the top of this page reflects when the policy was last updated.