alfi — apps for humansGet Started

alfi people Pty Ltd

Privacy policy

Last updated: 26 September 2026

1. About this policy

This policy explains how alfi people Pty Ltd (ABN 57 603 868 435) (“alfi”, “we”, “us”) collects, holds, uses and discloses personal information, and how you can access and correct it or make a complaint. It is published to meet Australian Privacy Principle 1 (open and transparent management of personal information) under the Privacy Act 1988 (Cth).

alfi builds software that may involve patient or NDIS participant data. Our apps use artificial intelligence to help clinicians with documentation, summaries and correspondence. When our apps handle information about patients, the practice that uses the app is the organisation that collects and holds that information; alfi processes it on the practice’s behalf under contract. This policy covers both the information we process for practices and the information we collect directly (for example, from practice staff who use our apps, and from visitors to our website).

A plain-language summary of how we protect patient information is available at How alfi protects patient data. This policy is available free of charge on our website, and we will provide it in another format on request.

2. What we collect and how

Kinds of personal information

  • Patient information processed for practices: names, dates of birth, contact details, Medicare or health-fund numbers, and health information such as clinical notes, assessments, referrals, reports, care plans and correspondence. Health information is sensitive information under the Privacy Act.
  • Practice staff information: name, role, work email and phone, login credentials, and records of how you use our apps (including audit logs of access to patient records and use of AI features).
  • Customer and supplier information: contact and billing details for the practices and businesses we work with.
  • Website and support information: contact details and the content of enquiries, and technical data described in section 9.

How we collect it

  • Patient information is collected by the practice and provided to us through the practice’s use of our apps, or through integrations the practice authorises with its practice-management or clinical systems. We do not collect patient information directly from patients.
  • Staff and customer information is collected when a practice sets up an account, when you use our apps, and when you contact us.
  • We collect information lawfully and fairly, and sensitive information only with the consent of the individual (obtained by the practice) or where otherwise permitted by law.

How we hold it

We hold personal information in encrypted electronic systems hosted in Australia, as described in section 6. Conversation history from AI features in our apps is held by alfi in those systems and is not retained by our AI provider.

3. Why we collect, hold, use and disclose personal information

We process patient information only for the purposes the practice has engaged us to perform, which are directly related to the delivery of health services by that practice:

  • producing clinical documentation such as session notes, assessments and progress summaries
  • drafting reports, referrals, letters and other correspondence
  • summarising and answering questions about a patient’s record for the treating clinician
  • supporting practice administration such as scheduling and care coordination
  • maintaining security, audit and integrity of the practice’s records

We do not use patient information for any purpose of our own, including marketing, product analytics on identifiable data, or training artificial-intelligence models. Where we use information to improve our apps, it is de-identified first.

We use staff, customer and website information to provide and support our apps, manage accounts and billing, communicate with you, meet legal obligations, and keep our systems secure. We will only use or disclose personal information for another purpose with your consent or where the Privacy Act permits, for example where required by law.

4. Artificial intelligence and automated processing

Our apps use Claude, a large language model provided by Anthropic, PBC, to generate drafts, summaries and answers from the information a clinician selects. AI features are designed so that:

  • only the information needed for the specific task is sent to the model, and identifiers are removed where the task does not require them
  • the model is accessed under a commercial agreement that prohibits Anthropic from using our data to train its models
  • our production environment is configured for zero data retention, so Anthropic does not store the information we send or the responses it returns after a request is completed, other than safety classifier results retained to enforce its usage policy
  • content produced by AI is labelled as AI-generated and the source inputs are preserved

Decisions about you

AI features in our apps assist clinicians; they do not make decisions about patients on their own. Any AI-generated content about a patient — including notes, assessments, care-plan drafts and correspondence — is reviewed by a treating health professional before it becomes part of the patient’s record or is acted on. Our apps do not use computer programs to make decisions that could significantly affect an individual’s rights or interests without human involvement.

Automated decision-making disclosure

From 10 December 2026, the Privacy Act requires us to tell you where a computer program is used to make, or substantially and directly assist in making, a decision that could reasonably be expected to significantly affect your rights or interests. The following alfi features fall into this category.

Support and care applications for disability service providers. In apps we build for disability organisations, support workers and coordinators may rely on the app to know about a participant’s health and support needs, including seizure management plans, medication schedules and administration records, allergies, behaviour support plans, and incident history. The app uses this information to:

  • present alerts, reminders and prompts about medication timing, seizure risk and required observations
  • flag incidents that need to be reported or escalated, and pre-fill incident reports
  • suggest priorities and actions for a shift or visit based on the participant’s plan

The kinds of personal information used are the participant’s identity and contact details, health information including diagnoses, medications, seizure and incident records, and support plans, together with records of what workers have logged in the app. The decisions assisted are operational care decisions, for example when to administer medication, whether an incident must be reported, and what care tasks take priority. The role of the computer program is to organise and surface this information and to generate drafts and prompts; it does not decide on its own. A support worker, coordinator or clinician always makes the final decision and can override any prompt, and the participant’s plan as approved by their health professionals remains the authoritative source.

Clinical documentation applications for allied-health practices. AI features draft notes, summaries, reports and correspondence for a treating clinician. They use the patient’s health record and the clinician’s inputs, and their role is limited to drafting; the clinician reviews and approves all content before it enters the record or is acted on. We do not consider these features to make decisions about patients, but we describe them here for transparency.

If you have questions about how a program has been used in a decision about you, you can contact our Privacy Officer using the details in section 9.

5. Who we disclose personal information to, including overseas

We disclose personal information only where necessary to provide our apps and services:

  • The practice — patient information is always available to the practice that holds it.
  • Service providers — cloud hosting, email and support tooling, and our AI provider, each under contracts that restrict them to processing on our instructions.
  • Professional advisers, regulators and law enforcement — where required or authorised by law.

Overseas disclosure

When an AI feature is used, the information selected for that task is transmitted to Anthropic, PBC, whose systems process it in the United States. This is the only routine overseas disclosure of patient information we make. Before making it we have taken steps to ensure the information is handled consistently with the Australian Privacy Principles, including:

  • a data processing agreement with Anthropic incorporating standard contractual clauses
  • a contractual prohibition on use of our data for model training
  • a zero data retention configuration for our production environment
  • review of Anthropic’s ISO 27001 certification and SOC 2 Type II attestation
  • a documented privacy impact assessment and cross-border disclosure assessment

Our own hosting, databases and conversation records are located in Australia. Where an app sends a fax on a practice’s behalf, the document is transmitted through Notifyre, an Australian fax service provider, under contract.

6. How we protect and retain personal information

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure. Our measures include:

  • data encrypted at rest and in transit, hosted in Australian data centres
  • role-based access so that practice staff see only the records they are authorised to see, and multi-factor authentication for all administrative access
  • logging of every access to patient records and every use of an AI feature, retained for audit
  • security practices aligned to the Australian Cyber Security Centre’s Essential Eight
  • independent security testing before our apps handle real patient data and at least annually thereafter
  • staff training and a written acceptable-use policy that prohibits entering patient information into any AI tool outside our controlled production environment

Retention and destruction

We retain patient information for as long as the practice’s contract with us requires, and return or securely delete it when the contract ends or on the practice’s instruction. Audit logs are retained for 7 years. Conversation history from AI features is retained for 12 months and then deleted, unless the practice requires a different period; any content the clinician saves from a conversation into the patient’s record is retained with that record. Staff and customer information is kept while the account is active and for a reasonable period afterwards to meet legal and accounting obligations, then destroyed or de-identified.

7. Access and correction

You may ask for access to the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading. This includes any content that was generated with the help of AI.

If you are a patient, please contact your practice first, as it holds your health record and can act on your request directly; we will assist the practice as needed. Practice staff and other individuals can contact us using the details in section 9.

We will respond within 30 days. We do not charge for making a request, though we may charge a reasonable fee for providing access in some circumstances. If we refuse access or correction, we will tell you why in writing and how you can complain. If we decline to correct information, you can ask us to attach a statement noting that you believe it is inaccurate.

8. Complaints

If you believe we have handled your personal information in a way that breaches the Australian Privacy Principles, please contact our Privacy Officer using the details in section 9. Please include your contact details and a description of the concern.

We will acknowledge your complaint within 7 days, investigate it, and give you a written response within 30 days. If we need longer we will tell you why and when to expect a response. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at www.oaic.gov.au or on 1300 363 992.

9. Other matters

Data breaches

We maintain a data breach response plan under the Notifiable Data Breaches scheme. If a data breach is likely to result in serious harm to individuals, we will notify the affected practice, work with it to notify affected individuals, and notify the Office of the Australian Information Commissioner as required.

Website and cookies

When you visit our website we may collect technical information such as your IP address, browser type, pages visited and referring site, to operate and improve the site. Our website does not currently use third-party analytics or advertising cookies. Cookies are set only when you sign in to the client portal, to keep you signed in. You can control cookies through your browser settings.

Anonymity

You may deal with us anonymously or under a pseudonym for general enquiries. This is not practicable for our apps, which require identified user accounts.

Changes to this policy

We review this policy at least annually and whenever our practices change. The current version is always published on our website with the date it was last updated.

Contact

Privacy Officer, alfi people Pty Ltd
Email: privacy@alfi.com.au

Last updated: 26 September 2026