Privacy Policy

1. What information do we collect?

The Privacy Act 1998 (Cth) ("Privacy Act") defines types of information, including Personal Information and Sensitive Information. This Privacy Policy applies to the collection of your Personal Information and/or Sensitive Information.

Under the Act:

• Personal Information is information about an identifiable individual, whether true or not, and whether recorded or not.
• Sensitive Information includes information such as an individual's health, ethnicity, religious beliefs, or membership of professional bodies.

For the purposes of this Privacy Policy, "Information" refers to Personal Information and Sensitive Information, as the case may be.

The kind of Information we collect depends on how you use the Platform and Services. It may include:

Information about you and others which you provide

• Name, date of birth, profession and personal contact details including email and/or phone number
• Your location (state or postcode), IP address and the date and time of your access to our Platform or Services
• Communications from you including survey responses, testimonials, feedback or complaints
• Details about your family members, including your parents, or persons close to you, your care preferences, your parents' medical and health conditions and your activities relating to care
• General health and wellness information which you provide to us
• Any information you choose to share with us, either directly or when using our Services or Platform

Conversation Data

• The content of your conversations when using the Platform
• Date and time of interactions
• Recording of your conversation when using our Platform
• Transcript of your conversation when using our Platform
• Topics discussed and resources recommended

Assessment Information

• Responses to Vera’s clinically validated situational assessment (Vera 75), including your care needs, urgency and priority of support required
• Clinical and social context notes generated from your assessment, for the purpose of preparing a referral
• Your assessment status and outcome, where you consent to a referral

Technical Information

• IP address, device type, browser type
• Platform usage data (e.g., session duration, features accessed)
• Session identifiers (temporary, non-personal)
• Cookies to understand Platform use and customise your experience (these do not generally identify you personally)

Please be aware that when using our Platform and Services, if safety concerns are detected in conversations (such as mentions of self-harm, suicide, or abuse), these interactions are flagged and logged for clinical review to ensure safety. These flagged interactions may include contextual conversation history necessary for proper assessment. You hereby expressly consent to us reporting such interactions to a medical professional or emergency services, which includes disclosing your personal information to that third party, if we determine there is a harm to you or others.

We collect only the information reasonably necessary to deliver and improve the Platform and Services. We do not collect or use government-related identifiers.

2. How we collect your Information

We collect information when you:

• Use the Platform and/or our Services
• Engage in conversation with Vera, by way of written conversation or an audio conference, through the Platform
• Copies of the audio conference recordings or conversation transcripts when you engage with the Platform and/or our Services
• Browse publicly available resources on the Platform
• Contact us directly via email or support channels

AI Conversation Collection

Vera is an AI-powered conversational assistant. Conversations with Vera on the Platform may be stored, monitored and reviewed to:

• Ensure your safety (particularly when crisis keywords are detected)
• Improve the quality and accuracy of Vera's responses
• Develop and refine our Services
• Comply with legal obligations

Anonymous Browsing

You may browse publicly available resources, guides, and educational content on the Platform anonymously. However, engagement with the AI conversation tool, Vera, and other features will require you to provide some Information and may involve collection of your data. Please note there is no guarantee of anonymity when using the Platform and our Services.

3. Purpose of Collection and Use

Through the course of engagement on the Platform including a conversation with Vera, you may choose to share Information with us. We collect and use your Information to:

• Provide you with the Platform and our Services
• Provide you with personalised support and guidance through the Vera AI companion
• Direct you to appropriate resources, guides, and support services
• Ensure your safety and the safety of others
• Improve and develop our AI technology and Services
• Analyse usage patterns to enhance user experience
• Comply with our legal obligations

Please note: If conversations indicate you may be in crisis or at risk of harm, we may be required to review this information and may be legally obligated to take action to prevent serious harm.

We may use software and services to track activity on our website for marketing purposes. This includes, but is not limited to, the tracking of inbound telephone calls and emails made through the website, and the tracking of movement on our website for marketing purposes.

We value your privacy and are committed to protecting your Information. We do not sell or rent the Information you provide to us, other than as set out in this Privacy Policy, unless we have obtained your consent. Your Information will only be used as necessary to deliver our Platform, Services and improve your experience.

In some instances, we may use your Information and share it with third parties for the purposes of conducting research in order to support our mission. We will use our best endeavours to notify you of any research activities or organisation which we are involved with regarding the use of your Information.

De-identified and Aggregated Data

We may use and share de-identified or aggregated data for purposes such as:

• Improving AI technology and conversation quality
• Conducting research on caregiving challenges and life planning
• Developing insights to enhance support services
• Industry reporting and analysis

This information does not identify you personally and is managed in accordance with the Australian Privacy Principles.

Use of AI

We may use artificial intelligence ("AI"), machine learning and automated technologies in connection with the provision, operation and improvement of our Platform and/or Services. This may include using AI to process, analyse, organise, generate or otherwise assist with information and content provided to or generated through the Platform.

Where appropriate and permitted by law, personal information may be processed by AI systems or third-party AI service providers engaged by us to support the operation and delivery of the Platform and Services. We take reasonable steps to ensure that any use or disclosure of personal information in connection with AI is undertaken in accordance with applicable privacy laws, including the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

AI systems may produce results that are inaccurate, incomplete, outdated or inconsistent. We do not rely solely on AI-generated information where human review or verification is reasonably required, particularly where the information may have a material effect on an individual.

We will not use personal information to train or develop an AI model where doing so would be inconsistent with our obligations under applicable privacy laws or the purposes for which the information was collected, unless otherwise permitted or authorised by law.

Where our use of AI involves the disclosure of personal information to a third-party AI provider, that provider may process the information in accordance with its own terms and privacy practices. Where applicable, we will take reasonable steps to ensure that such disclosures are undertaken in accordance with the Australian Privacy Principles, including applicable requirements relating to overseas disclosures.

AI Training and Development

Any data or Information we collect during your use of the Platform and/or Services, including conversation data, may be used to train and improve our Platform's AI models. When used for this purpose we will endeavour to ensure:

• Data is de-identified wherever possible
• Personal identifiers are removed or pseudonymised
• Strict security and access controls are maintained
• Data is used only to improve the quality and safety of the Service

4. Third Parties

The Platform and our website contain links to other websites. You should review the privacy policy of the other websites as we are not responsible for the privacy practices of third-party linked websites. We may collect personal data about you from third-party sources from time-to-time, such as publicly available materials or information and data from our marketing partners. This information is used to better supplement our services to ensure we can personalise and improve our offerings to you, whilst also giving us a method to validate any Information we hold.

We may disclose information to third-party service providers who assist us in:

• Hosting and operating the Platform
• Processing AI conversations and providing AI infrastructure
• Providing clinical review services for safety concerns
• Maintaining our systems and security infrastructure
• Delivering analytics and improving Services

We use our best endeavours to ensure that all third-party providers engaged by us comply with the Privacy Act and:

• Use information only for the specific purpose for which it is shared
• Maintain privacy, confidentiality, and security standards compliant with Australian law
• Implement appropriate safeguards to protect against unauthorised access, misuse, or disclosure

Referral Partners: Where you consent to a referral, we disclose your Information to aged care providers who pay us a fee to receive the referral. The Information disclosed for this purpose may include:

• Your full name, date of birth and address
• Your My Aged Care (MAC) identification number, where applicable
• Your living situation, care needs and diagnosis or health condition
• The name, relationship, phone number and email address of anyone enquiring or caring on your behalf
• Your funding or payer type
• Any interpreter or language needs you have told us about

We only disclose this Information to a referral partner where you have consented to that referral.

If you request us to transfer your Information to a third party overseas recipient, the overseas recipient may have laws which are different and potentially not as protective as the laws of your own country. In the circumstances, we do not require the overseas recipients to comply with the Privacy Act and we will not be liable for any mishandling of your Information in such circumstances.

5. Security and data retention

We host and store your Information on our primary servers in Australia. You hereby consent to your Information being processed and stored in Australia.

We engage a number of third party providers in order to assist us in providing the Platform and Services, some of which are based in the United States of America and/or have global operations. Please note that while our primary servers are located in Australia, some of your Information may be stored or processed overseas in connection with our third party providers.

No Information will be transferred or stored outside Australia without appropriate safeguards.

In some circumstances, the European Union General Data Protection Regulation (GDPR) provides additional protection to individuals located in Europe. The fact that you may be located in Europe does not, however, on its own entitle you to protection under the GDPR. The Platform, website and Services do not specifically target customers located in the European Union and in fact target people located in Australia, we also do not monitor the behaviour of individuals in the European Union, and accordingly the GDPR does not apply.

You acknowledge that if you request us to transfer your Information to an overseas recipient, the overseas recipient may have laws which are different and potentially not as protective as the laws of your own country. In the circumstances, we do not require the overseas recipients to comply with the Australian Privacy Act 1988 (Cth) and we will not be liable for any mishandling of your information in such circumstances.

Security Measures

To protect your privacy and security, we take reasonable steps to verify your identity before granting you access to your account, including authentication methods such as granting you secure one-time verification codes sent to your registered phone number or email address. You are responsible for maintaining the secrecy of your account information, and for controlling access to your email communications from us at all times.

We will take appropriate security measures to protect against unauthorised access to or unauthorised alteration, disclosure or destruction of your personal information. These measures may include internal reviews of our data collection, storage and processing practices and security measures, including appropriate encryption and physical security measures to guard against unauthorised access to systems where we store personal information.

We also ensure access to information is restricted to authorised personnel only and governed by internal access controls and clinical reviewers are bound by professional confidentiality obligations. Furthermore, all conversations through the Platform are encrypted in transit and at rest using industry-standard encryption protocols.

We do not warrant that these security measures will prevent any unauthorised access to or unauthorised alteration, disclosure or destruction of the data. We disclaim all liability in relation to any unauthorised access, alteration, disclosure or destruction of data that is outside our reasonable control.

We take reasonable steps to ensure the information we hold is accurate, up-to-date, complete, and relevant to the purposes for which it is used.

Data Retention

We may review, monitor and retain data we collect in respect of your use and interactions with the Platform and Services.

You may request deletion of your conversation data by contacting us as set out in this Privacy Policy.

6. Access and Control of your Information

Under the Australian Privacy Principles, you have rights regarding your information:

• Access (APP 12): You may request access to information we hold about you.
• Correction (APP 13): You may request correction of any inaccurate or incomplete information we hold about you.
• Deletion: You may request deletion of your conversation data, subject to legal retention requirements, legitimate business purposes (such as ongoing safety monitoring), or technical limitations.
• Complaints: You have the right to make a complaint about our handling of your Information.

To make a request for access, correction or deletion of your Information please contact us at privacy@vera.guide with sufficient details to identify your conversations (such as date, time, and general topics discussed).

We will endeavour to respond to access, correction, or deletion requests within 30 days. In some circumstances, we may not be able to provide access, make corrections, or delete data (for example, where retention is required by law or where deletion would compromise safety monitoring).

7. Important safety considerations

Crisis Situations

If your use of the Platform and/or Services indicates that you or someone else may be at risk of serious harm (such as suicide, self-harm, violence, or abuse), we may:

• Review your conversation data
• Share your Information and a copy of the conversation data and transcripts to relevant medical professionals and/or emergency services, as the case may be
• Be legally required to disclose information to emergency services, police, or relevant authorities to prevent serious harm
• Make reasonable efforts to inform you of any such disclosure where it is safe and lawful to do so

Mandatory Reporting

Australian law requires reporting of certain information to authorities, including:

• Child protection: Suspected child abuse or risk of harm to a child under relevant state/territory legislation
• Elder abuse: In jurisdictions where mandatory reporting applies
• Serious threats: Threats to public safety or serious violence

Mandatory reporting obligations vary by state and territory. Where we are required to make a report, we will do so in accordance with applicable laws.

Legal Compliance and Law Enforcement

We may disclose your Information where required or authorised by law.

8. Cookies and tracking technologies

You acknowledge and agree that we may use Cookies in our provision of the Platform and Services to you. We may use cookies and similar technologies to:

• Maintain conversation sessions
• Remember your preferences during your visit
• Analyse Platform usage and improve functionality
• Detect and prevent security threats

We may use the following cookies, or similar technologies:

• Essential cookies: Required for the Platform to function
• Analytics cookies: Help us understand how users interact with Vera
• Preference cookies: Remember your settings during a session

You can control cookies through your browser settings. However, disabling certain cookies may limit your ability to use some features of the Platform.

We may use third-party analytics services (such as Google Analytics) to understand Platform usage. These services may use cookies and are subject to their own privacy policies.

9. Changes to this Privacy Policy

We may update this Privacy Policy from time to time at our sole discretion.

We will notify you of material changes by:

• Posting the updated Privacy Policy on the Platform with a new "Last Updated" date
• Displaying a prominent notice on the Platform
• Where practicable, providing other forms of notice

Your continued use of the Platform after changes are posted constitutes your acceptance of the updated Privacy Policy. We encourage you to review this policy periodically.

10. Sale of Business

If we, or any of our group companies, merge with, or is acquired by, another business, sells all or a portion of its assets, or undergoes reorganisation, financing or change of control, your Information may be disclosed to our advisers and any prospective purchaser's adviser and may be among the assets transferred/sold to an acquirer. However, your Information will always remain subject to this Privacy Policy.

11. Governing Law

This Privacy Policy and any contract to which they apply shall be governed by the laws of New South Wales and are subject to the jurisdiction of the courts of New South Wales.

12. Contact and Feedback

For all privacy enquiries, access or correction requests, complaints, or general questions:

Twilight Labs Pty Ltd privacy@vera.guide

For complaints not resolved to your satisfaction:

Office of the Australian Information Commissioner www.oaic.gov.au enquiries@oaic.gov.au 1300 363 992