Privacy Policy — RecallQ

Thomas William Groves, trading as RecallQ (ABN 84 202 664 713) ("RecallQ", "we", "us") is committed to protecting personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy explains what personal information we handle, how and why, and how individuals can access, correct, or complain about it.

1. About RecallQ and our role

RecallQ provides software that dental, physiotherapy, optometry and similar health practices use to send appointment-recall and reminder messages to their patients by SMS and email, and to manage the replies.

Patient information (information about a practice's patients) is handled by RecallQ on behalf of, and under the instructions of, the patient's practice. The practice decides what patient information is uploaded and why. If you are a patient and want to access, correct, or delete your information, your practice is the first point of contact; we will assist the practice to action your request (see section 8).
Practice and practice-user information (information about our business customers and their staff) is collected by RecallQ directly to provide and bill for the Service.
Prospective-customer and website-visitor information (people who contact us, book a call with us, or visit our website) is collected by RecallQ directly.

2. The personal information we handle

Patient information (uploaded and managed by the practice):

Name (first and last)
Mobile phone number and/or email address
Date of birth (where provided)
The practice's own internal patient reference
Recall/appointment timing information (such as the last visit date, the next recall date and booking details, including whether a booking was attended)
Communication preferences and consent and opt-out status for SMS and email, including the basis on which the practice recorded consent
The content of reminder messages sent, and of patient replies, for a limited period (see section 6). A reply may contain whatever the patient chooses to write, which can include health information (for example, a symptom).

We treat patient information as sensitive given its connection to health services and handle it accordingly.

Practice and practice-user information:

Business name, ABN, and physical address (used for lawful sender identification on messages)
Sender display name and time zone
Account user details managed through our authentication provider (such as the staff member's login email address; passwords are stored by that provider in hashed form and are never visible to us)
The contact/billing email address you nominate for account, billing and staff-notification emails
Where you use AI replies: your practice FAQ text and booking link; where you use ROI reporting: the average visit value you enter
Subscription and billing status
Your marketing-email preference, and the version of our Terms you accepted and when
The marketing source of your sign-up (campaign tags such as utm_source, utm_medium and utm_campaign, and the practice type of the page you came from), where present

Billing information:

We use Stripe to process payments. Card details are entered directly with Stripe and are not stored by RecallQ. We retain billing references (such as a customer and subscription identifier) and your business billing/tax details, which we treat as sensitive.

Prospective customers and correspondence:

When you email us, we hold your email address, name and whatever you include in the message. Our business mailboxes are hosted by Google Workspace (see section 5).
When you book a sales call with us through the booking page on our website, our scheduling provider, Cal.com (United States), collects your name, email address, practice name, an optional mobile number and the plan you were viewing, on our behalf. We use them only to arrange and run the call. The call takes place on Google Meet, so Google Calendar and Google Meet also receive your name and email address. Your browser contacts Cal.com, and loads its script, when you point at, tab to or select a Book a call button, so Cal.com also receives your IP address and browser details at that point. Please do not enter patient information.

3. How we collect personal information

Patient information is provided to us by the practice (by CSV upload). We generally do not collect patient information directly from patients, except when a patient interacts with a message (for example, replying to an SMS, replying STOP, or using an unsubscribe link).
Practice and practice-user information is collected directly from you when you sign up, configure your account, or contact us.

Website and portal usage analytics. We use Vercel Web Analytics to understand how our website and the practice portal are used. It is cookieless and does not collect patient information. It records the address of the page viewed (with query strings and fragments removed, except marketing campaign tags), the referring website, the browser and device type, the country (derived from the request), and funnel events such as button clicks. When a practice signs up, we store the marketing source of the visit (such as campaign tags and the practice type the visitor came from) with the practice account and use it internally to understand how practices find us.

4. Why we use personal information

We use personal information to:

Send appointment-recall and reminder messages by SMS and email on behalf of the practice
Process patient replies (confirm, cancel, reschedule, questions) and opt-out/unsubscribe requests, and send short automated acknowledgement and safety messages in response (see below)
Maintain booking information related to reminders and report to the practice on recalls sent, patients reactivated and estimated recovered revenue
Send practices the account emails needed to run the Service (sign-up confirmation, welcome and getting-started emails, password-change notices, billing notices and, where enabled, a digest of patient replies that need staff attention)
Send practice users marketing emails about RecallQ only where they have opted in; the preference can be changed at any time in the Service
Tell the RecallQ founders internally that a new practice has signed up (that notification contains the practice name, plan and marketing source only — never the sign-up email address, password or any patient information)
Provide, secure, support, and improve the Service, including limiting abuse of sign-up and email-confirmation requests
Bill for the Service and meet tax obligations
Keep audit records and meet our legal and compliance obligations

Use of artificial intelligence. On the Pro plan, and on Managed (which is the Pro plan run for you by RecallQ), we use AI providers for four things:

Understanding patient replies. When a patient replies to an SMS, the AI may be asked what the reply means (for example, a confirmation or a request to reschedule). For this we send only the reply text (shortened to 500 characters) and whether the original message was a recall or an appointment reminder. No patient name, phone number or practice identity is attached, although the reply may contain whatever the patient chose to write.
Drafting recall messages. The AI may help word recall SMS messages. For this we send the practice name, how many days a recall is overdue, and the wording of the practice's own message template. No patient details are included by design.
Summarising the ROI report. The AI may write a short summary on the practice's return-on-investment report. For this we send the practice's overall totals only.
Replying to simple questions (only where a practice turns this on). The AI may answer simple questions from the practice's own FAQ, such as opening hours, address, parking, what a check-up involves, or how to book. For this we send the last few messages exchanged with that patient (each shortened to 500 characters, with e-mail addresses and long numbers removed), the practice's own FAQ text and booking link, and the practice name; patient names, phone numbers and dates of birth are never attached, though a message may contain whatever the patient typed.

When the AI is confident about what a reply means, the result may be acted on automatically: it may confirm or reschedule an existing appointment booking, or create a pending booking when a patient confirms a recall. The AI never cancels a booking and never opts a patient out — cancellations and opt-outs are handled only by recognised keywords (such as STOP) or by practice staff. Replies the AI is not confident about are shown to practice staff to handle. Where a practice has turned on AI replies, the AI may answer simple questions from that practice's own FAQ; it can never change bookings or opt-outs, never gives clinical advice, hands anything clinical, urgent, or a complaint to practice staff, and stops after a small number of exchanges so that a person takes over. Every AI message is identified with the practice name and carries the STOP instruction.

Separately, after a patient replies RecallQ may send a short fixed acknowledgement (for example, that the practice will call to arrange a time); no AI is involved in those messages. If a reply looks like an emergency, RecallQ sends a fixed safety message telling the patient to call 000 if it is an emergency and otherwise to call the practice, and flags the message for practice staff. That check is a fixed word match rather than AI, and it runs for every practice on every plan.

Recall messages may also be personalised with the patient's first name. That personalisation is done by our own software from your template; the name is not sent to an AI provider.

Patient self-booking (Pro and Managed plans). Where a practice on the Pro or Managed plan has switched it on, a patient who replies to a recall message can open a booking page hosted by RecallQ and choose an appointment time. The booking page receives only an opaque booking reference and appointment times — not the patient's name, phone number or email address — and the practice sees the resulting booking in the Service. A patient who has booked this way can reply to ask to move the booking and is sent a link to choose a new time.

Delivery status. Where our email and SMS providers notify us, we record what happened to the recall emails and SMS messages we send to patients, for example that an email was delivered, delayed or bounced, that the recipient marked an email as spam, or that an SMS was delivered. If an email address permanently bounces or is suppressed by the provider, we flag it as undeliverable so we stop sending recall emails to it and the practice can correct it; correcting the address clears the flag. If a patient marks a recall email as spam, we treat that as a request to stop and opt them out of further email. We keep only status codes from the provider, never the provider's message text, and use them only for delivery, compliance and support.

We do not sell personal information, and we do not use patient information for our own marketing.

5. Where personal information is stored and disclosed (including overseas)

All patient information is stored in Australia (in our database hosted in the AWS Asia Pacific (Sydney) region).
Our application servers run in Singapore and process information in transit only — patient information is not stored at rest there by design.
Our error-monitoring provider is located in the European Union, and patient personal information is scrubbed from error reports before they leave our systems.
On the Pro and Managed plans, our AI providers in the United States — Anthropic, and OpenAI as a backup if Anthropic is unavailable — receive a shortened copy of patient SMS reply text to classify it, with no patient name, phone number or practice identity attached. Anthropic also receives the practice name, scheduling information and the practice's message template to draft recall wording, and practice-level totals to summarise the ROI report. Where a practice has turned on AI replies, Anthropic also receives the last few messages exchanged with that patient (shortened, with e-mail addresses and long numbers removed), the practice's FAQ text and booking link, and the practice name. RecallQ does not store this information overseas.
Recall and account emails are sent through an email delivery provider in the United States, which handles the recipient's email address and the email content in order to deliver it.
Our own business mailboxes (including the unsubscribe address patients can write to, and the addresses you email for support or privacy enquiries) are hosted by Google Workspace, which may store this data in the United States or other countries.
Our scheduling provider for sales calls, Cal.com, is located in the United States and handles the name, email address, practice name and optional mobile number of prospective customers who book a call. It does not handle patient information. Calls take place on Google Meet, which receives the booker's name and email address through Google Workspace (above).
The practice portal and this website are served through Vercel, whose edge servers for our deployment are in Sydney but whose company and some systems are in the United States. Vercel does not store patient information.

We use a small number of third-party service providers ("sub-processors") to operate the Service, some of which are located overseas. Each is listed, with its country and the categories of data it handles, on our Sub-Processors list on the legal hub at https://recallq.com.au/legal/. Before disclosing personal information to an overseas recipient we take reasonable steps as required by APP 8, including data-minimisation and relying on each provider's published data-processing terms. The overseas locations currently include Singapore, the European Union, and the United States (see the Sub-Processors list for the current providers).

6. How long we keep personal information

We keep personal information only as long as needed for the purposes above and to meet our legal obligations, consistent with APP 11:

Message content (the body of reminder messages and patient replies) is automatically purged 90 days after the message reaches a final state; non-identifying records such as timestamps, status, and an integrity hash are retained.
Resolved operational error records are deleted after 90 days.
Audit records (a log of key actions, used for accountability and compliance) are retained for 7 years, then deleted. Audit records do not contain patient names or contact details.
Unconfirmed sign-ups (an account whose email address is never confirmed) are deleted automatically after 72 hours.
Checkout records (the practice name and owner email of a practice that starts a subscription checkout) are deleted after 12 months.
Email unsubscribe links remain valid for 12 months; an unsubscribe request is honoured even after the link has expired.
Patient records are retained while the patient is active with the practice. On a valid deletion request, or when a practice closes its account, patient information is deleted in accordance with section 8 and our retention practices.

7. Opt-out and unsubscribe

We honour opt-out requests immediately:

SMS: Replying STOP (or a similar keyword) to a message opts the patient out of further SMS straight away. The opt-out applies across all future SMS to that patient. Opt-outs are recognised by a fixed keyword match — never by AI.
Email: Every recall email includes a one-click unsubscribe link and an unsubscribe@recallq.com.au address. Selecting the link opts the patient out of further email immediately. Requests sent by email to the unsubscribe address are read and actioned by us within 5 business days. We honour unsubscribe requests even if a link has expired. If a patient marks a recall email as spam and our email provider notifies us, we treat that as an unsubscribe request and opt them out of further email.

Every SMS includes business identification and an opt-out instruction, and every recall email includes the practice's name, ABN and physical address and a one-click unsubscribe, as required by the Spam Act 2003 (Cth).

8. Accessing, correcting, or deleting personal information

Patients: Because we handle patient information on behalf of your practice, please contact your practice to access, correct, or delete your information. We support practices to action these requests, including by providing an export of, or deleting, the relevant information.

Practices: You can access and correct most account information directly in the Service, or by contacting us. On account closure or a valid request, we provide a data export within 30 days and complete deletion within 60 days, subject to records we are required to retain (such as audit and tax records).

We will respond to access and correction requests as required by APP 12 and APP 13. We may need to verify identity before actioning a request and may decline a request where permitted by law (we will explain why).

9. How we protect personal information

We take reasonable steps to protect personal information, including:

Strict tenant isolation so each practice can only access its own data (enforced at the database level)
Encryption in transit (TLS) for connections to and between our service providers, and encryption at rest provided by our database host
Authentication controls on access to the Service, including a minimum password length
Removal of personal information from logs and error reports before they leave our systems
Signature verification on inbound messages from our SMS, email, and payment providers
Rate limiting of sign-up and confirmation-email requests by network address and email address to limit abuse
Internal access controls and least-privilege practices

No system is completely secure, but we maintain a documented process to assess and respond to data breaches.

10. Data breaches

We maintain a Notifiable Data Breaches response process. If a data breach occurs that is likely to result in serious harm, we will assess it promptly (and within 30 days of becoming aware of it) and, where required under Part IIIC of the Privacy Act 1988 (Cth), notify the Office of the Australian Information Commissioner (OAIC) and affected individuals (in the case of patients, generally working with the relevant practice) as soon as practicable.

11. Complaints

If you have a privacy concern or complaint, contact us at privacy@recallq.com.au. We will acknowledge and investigate your complaint and respond within a reasonable time. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or 1300 363 992.

12. Changes to this policy

We may update this policy from time to time. The current version is always available at https://recallq.com.au/legal/privacy.html, and the "last updated" date above reflects the latest change.

13. Contact us

Thomas William Groves, trading as RecallQ, ABN 84 202 664 713

Privacy enquiries: privacy@recallq.com.au

How we handle personal information.