Privacy Policy.

Visitors, customers, authorised users, and patients

This Privacy Policy applies to people who visit the Website, request information, subscribe to updates, contact us, create an account, use the platform, or otherwise interact with Notly.ai.

Where a healthcare practice, hospital, clinic, company, government body, or other organisation subscribes to Notly.ai, that organisation is usually responsible for deciding what clinical information is collected and entered into Notly.ai, who may access it, and how it is used in its clinical workflow.

Notly.ai may act as a service provider, contractor, processor, or similar operational role for customer clinical data. Where this applies, we process that information to provide the service and in accordance with our agreement with the customer, applicable law, and this Privacy Policy.

Patients should direct requests about their clinical record, care, consent, or correction of clinical content to their healthcare provider.

The kinds of information we may collect

We may collect and hold personal information that is reasonably necessary for our functions and services, including:

1. Contact information: name, email address, phone number, organisation, role, specialty, practice details, and enquiry details.
2. Account information: login details, user profile details, permissions, authentication information, workspace details, and account settings.
3. Billing and subscription information: plan details, invoices, payment status, billing contact details, and transaction records. Card or bank details may be processed by a third-party payment provider and may not be stored directly by Notly.ai.
4. Support and communications: emails, form submissions, chat messages, feedback, product requests, troubleshooting information, and support history.
5. Usage and device information: IP address, browser type, operating system, device identifiers, approximate location, access times, pages viewed, features used, audit logs, diagnostics, and performance data.
6. Integration information: information required to connect Notly.ai to authorised third-party systems, such as practice management systems, document systems, communication tools, or other customer-approved integrations.

Patient, health, audio, transcript, and clinical note data

When customers or authorised users use Notly.ai for clinical documentation, they may submit or generate information that includes patient names, demographic details, consultation audio, transcripts, clinical histories, examination findings, diagnoses, medications, allergies, investigation results, procedures, referrals, discharge summaries, billing or coding prompts, and other health information.

This type of information may be sensitive information, health information, confidential information, or protected clinical information under applicable laws, professional obligations, and customer policies.

Customers and authorised users are responsible for ensuring they have appropriate authority, consent, notice, and lawful basis to record, upload, disclose, process, or use patient information in Notly.ai.

Notly.ai uses clinical information to provide the documentation service, generate and format draft outputs, support authorised workflows, maintain security, troubleshoot issues, meet contractual and legal obligations, and perform other actions requested or authorised by the customer.

How we use personal information

We may use personal information to:

1. provide, operate, maintain, and improve the Website and platform;
2. create, authenticate, secure, and manage accounts and workspaces;
3. process clinical documentation workflows requested by customers and authorised users;
4. respond to enquiries, provide support, troubleshoot issues, and send service communications;
5. process subscriptions, billing, renewals, plan changes, and customer administration;
6. monitor performance, reliability, security, fraud prevention, misuse, and unauthorised access;
7. develop, test, evaluate, and improve features, templates, workflows, accuracy, usability, and service quality;
8. send product updates, educational content, marketing communications, or event information where permitted by law, with opt-out options where required;
9. comply with laws, court orders, regulatory obligations, professional obligations, and contractual commitments;
10. protect the rights, safety, property, and legitimate interests of Notly.ai, customers, clinicians, patients, and others.

AI processing and model improvement

Notly.ai uses AI and automation to help transform authorised inputs into draft clinical documentation, summaries, letters, coding prompts, templates, and workflow outputs.

We may process prompts, transcripts, notes, edits, feedback, metadata, and usage data to provide, secure, debug, evaluate, and improve the service. Where clinical information is involved, this processing is subject to the applicable customer agreement, privacy obligations, and any relevant data processing terms.

Notly.ai does not use identifiable patient information from the platform to train public or general-purpose AI models unless this is expressly authorised by the relevant customer and permitted by applicable law.

We may use aggregated, de-identified, or anonymised information to understand service performance, improve workflows, monitor quality, and develop features, provided the information is handled so that individuals are not reasonably identifiable.

When we may share information

We do not sell patient clinical information. We may disclose personal information where reasonably necessary to provide and operate Notly.ai, including to:

1. authorised users within the relevant customer workspace or organisation;
2. service providers who support hosting, storage, security, analytics, payment processing, communications, customer support, AI processing, monitoring, and business operations;
3. customer-approved third-party integrations and systems;
4. professional advisers, auditors, insurers, legal advisers, and compliance advisers;
5. regulators, courts, law enforcement, government agencies, or other parties where required or permitted by law;
6. a successor or prospective successor in connection with a merger, acquisition, financing, restructuring, sale of assets, or similar business transaction, subject to appropriate confidentiality protections;
7. other parties with consent or as directed by the relevant customer or authorised user.

We require service providers who handle personal information for us to use it only for authorised purposes and to apply reasonable privacy, confidentiality, and security protections.

Cookies, analytics, and online activity

We may use cookies, pixels, local storage, web beacons, logs, analytics tools, and similar technologies to operate the Website and platform, remember preferences, maintain sessions, secure accounts, measure traffic, understand usage, improve performance, and support marketing where permitted.

The information collected may include IP address, device and browser information, pages viewed, referrer URLs, time spent, feature use, click activity, and approximate location.

You can usually configure your browser to reject or delete cookies. Some parts of the Website or platform may not work properly if cookies or similar technologies are disabled.

Third-party analytics, advertising, support, or embedded content providers may also collect information under their own privacy policies. You should review those policies where applicable.

How we protect information

We take reasonable technical, organisational, and contractual measures designed to protect personal information from misuse, interference, loss, unauthorised access, modification, or disclosure.

These measures may include access controls, authentication controls, encryption, audit logging, monitoring, segmentation, staff confidentiality obligations, vendor due diligence, secure development practices, backup processes, and incident response procedures.

No method of transmission or storage is completely secure. You should use secure networks, protect passwords and devices, apply appropriate access controls in your organisation, and contact us promptly if you suspect unauthorised access or misuse.

Retention, deletion, and de-identification

We retain personal information for as long as reasonably ncessary to provide the service, maintain accounts, meet contractual obligations, comply with legal and regulatory requirements, resolve disputes, enforce agreements, maintain security, and support legitimate business purposes.

Clinical information may be retained, exported, deleted, or controlled according to the customer agreement, workspace settings, retention configurations, applicable health record obligations, and instructions from the relevant customer.

Where personal information is no longer needed for a permitted purpose, we will take reasonable steps to delete, destroy, de-identify, or anonymise it, unless retention is required or permitted by law, contract, backup integrity, audit requirements, or dispute preservation obligations.

Access, correction, communications, and complaints

You may request access to personal information we hold about you, ask us to correct inaccurate information, or raise a privacy question or complaint by contacting us at support@notly.ai.

We may need to verify your identity before responding. In some cases, we may be unable to provide access or correction where the law permits or requires refusal, where another person’s privacy would be affected, or where the relevant information is controlled by a customer healthcare organisation.

You may unsubscribe from marketing emails by using the unsubscribe link or contacting us. You cannot opt out of essential service, security, transactional, legal, or account-related communications.

If your request relates to a patient record, consultation note, clinical documentation output, or care episode controlled by a healthcare provider, we may direct you to the relevant provider.

Notly cannot access generated notes after they are created, except where limited technical access is necessary for security, compliance, support, or service operation.

Notly cannot retrieve deleted notes once they have been removed from the user’s account.

Storage, hosting, and overseas recipients

Notly.ai may use cloud hosting, infrastructure, AI processing, analytics, support, security, and business service providers located in Australia.

As Notly.ai expands into other countries, we intend to support local data residency so that customer data is processed and stored in the country or region where the service is provided, where technically and legally available.

Personal information is stored, accessed, or processed inside the country where it is collected. The countries may include Australia, the United States, United Kingdom and other locations where our approved service providers operate.

Children and minors

The public Website is not directed to children. We do not knowingly collect personal information directly from children through the public Website without appropriate consent.

Clinical information about children or minors may be processed through the platform only where submitted by an authorised healthcare provider or customer in connection with their clinical workflow and applicable consent, notice, and legal obligations.

If you believe a child has provided personal information to Notly.ai through the public Website without appropriate consent, please contact us so we can review and take appropriate steps.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The updated version will be posted on the Website with a new effective date.

Where required by law or contract, we may provide additional notice of material changes. Continued use of the Website or platform after an updated Privacy Policy is posted means the updated policy applies from its effective date.

Contact Notly.ai about privacy

For privacy questions, access or correction requests, data handling questions, or privacy complaints, contact Notly.ai using the details below.