Last updated 18 September 2026
Our team at Zavy 360 are committed to protecting your privacy and confidentiality of personal information and maintaining a robust system to protect personal information in our care. This Privacy Policy sets out our policies on the management of personal information and describes how we collect, use, store, share, process and protect your personal information and data.
In this Privacy Policy, "Personal information" has the meaning set out in the Privacy Act 1988 (Australia). Essentially, Personal Information (or "Personal Data") is information or an opinion about a living individual who is identified or reasonably identifiable. If the data contains no identifying information, then this policy does not apply.
While the Personal Information we collect varies depending upon the nature of the services provided or used and our interactions with individuals – generally, the Personal information we may collect and retain include:
We collect Personal Information such as name, telephone number, e-mail address and social media account identity.
Such as Job applicants or suppliers of Zavy 360.
Please note that by utilising Zavy 360's platform, you are providing us with the authority to contact your patients on your behalf (for example, to send a reminder for an upcoming appointment or to complete a task).
We collect your Personal Information in a number of ways. The most common ways we collect your Personal Information are:
For patients, your Personal Information may be held as electronic records (including in the form of text, video and audio recordings of your consultations and digital images such as x-rays).
The purposes for which we use and disclose your Personal Information will depend on the circumstances in which we collect it. Whenever practical, we endeavour to inform you why we are collecting your Personal Information, how we intend to use that information and to whom we intend to disclose it at the time we collect your Personal Information. We do not sell Personal Information. We disclose it only to the service providers and in the circumstances described in sections 5 and 6. Generally, the purposes for which we collect, retain, use and disclose these Personal Information are primarily for product enhancement and user experience functions and they include:
At any time, individuals can choose to opt-out from receiving emails or notifications from us.
Information in a practice's Zavy 360 account is confidential to that practice. We do not rent, lease or sell it, and we do not make it available to anyone outside Zavy 360 except as set out in this section.
We disclose Personal Information to service providers that process it on our behalf so that we can deliver Zavy 360. These include our hosting and data centre providers in Australia; communications providers that deliver SMS, email and voice on our behalf; payment processors (see section 7); and the artificial intelligence providers described in section 6. We also disclose information to your clinician's practice and to any third party you have directed or permitted us to disclose it to (for example, referees). Where we disclose Personal Information to a service provider, we require by contract that it uses the information only to provide the service to us, protects it, and does not use it for its own purposes, and we take reasonable steps to ensure it handles the information consistently with the Australian Privacy Principles.
We may disclose Personal Information strictly permitted or required by law; in exceptional circumstances such as an emergency, or for the prevention of immediate risk of loss of life or serious harm; to various regulatory bodies and law enforcement officials and agencies to protect against fraud and for related security purposes.
If we are involved in a merger, acquisition or asset sale, your Personal Data may be transferred. We will provide notice before your Personal Data is transferred and becomes subject to a different Privacy Policy.
If you post information to public parts of our website or to our social media pages, you acknowledge that such information (including your Personal Information) may be available to be viewed by the public. You should use discretion in deciding what information you upload to such sites.
Some Zavy 360 features use artificial intelligence (AI) supplied by contracted providers. This section explains what information those features handle, where it is processed, what we keep and what you can control. Practices that enable AI Scribe are also bound by the AI Scribe Notes Supplemental Terms, and a plain-English guide is at How AI Scribe handles your data.
When a clinician uses AI Scribe, we collect and process the following information about the patient and the people present:
We use this information to deliver AI Scribe, to keep it secure, to investigate faults a practice reports, and for controlled quality review by Zavy 360 personnel who need access for that work. With a Zavy 360 administrator's approval, a small number of transcripts and their clinician-approved notes may be reused as reference examples in the instructions we send to our language model providers, so that drafts for other consultations follow the same structure; a practice may ask us not to use its transcripts this way.
We do not use consultation audio, transcripts or notes to train or fine-tune AI models, and our contracts do not permit our providers to use them for model training or model-improvement programs. Our providers retain audio and text only for the short periods needed to process it and to monitor for misuse of their services.
We do not automatically delete AI Scribe information. Stored audio, consent clips, transcripts and notes are part of the patient's health record, and remain under the practice's control while its account is active. We do not delete them at the request of a practice or a patient. They may be deleted only after the practice's account is terminated and the data export period in our Terms of Service has ended.
Our writing assistance feature (Refine) sends typed text to a contracted language model provider in the United States to correct, rewrite or summarise it. Before the text leaves Zavy 360, the names, phone numbers, email address and home address held on the patient's record, and those of their family members, are replaced with placeholders, and the user is shown the redacted text and can add further words to redact. The provider therefore does not receive those details, but other identifying content typed into the text may be sent unless the user redacts it. Our automated patient messaging features (Engage and Compose) send message content to a language model provider in the United States after the patient's name and contact details known to us, and any phone numbers or email addresses detected in the text, have been replaced with placeholders. Text processed by these features is not used to train AI models.
Practices are responsible for obtaining the consent of patients and others present before recording a consultation with AI Scribe, and must not use it where consent is refused or withdrawn. A patient may ask their practice not to use AI Scribe in their care, and the practice can record that choice in Zavy 360 so that AI Scribe checks it before recording. A patient who wants access to, or a correction of, stored audio, clips or transcripts should ask their practice, which holds the record. Patients may also contact us directly under section 11 for access to, or correction of, information we hold about them.
The AI features described in this section involve disclosing Personal Information, including health information, to service providers located in the United States. We take reasonable steps, including contractual protections, to ensure those providers handle the information consistently with the Australian Privacy Principles, and we remain accountable for that information under the Privacy Act 1988 (Cth). Practices may have their own obligations under Australian Privacy Principle 8 when they enable these features and should consider this section and the AI Scribe data page in meeting them. A current list of our AI providers and their locations is available to practices on request from info@zavy.com.
As we currently use third party payment processors, your Personal Information may be collected by such third parties directly and not by us, and will be subject to the third party's privacy policy. We have no control over, and are not responsible for third parties' collection, use and disclosure of your Personal Information.
Our team at Zavy 360 takes security of Personal Information seriously. Data is encrypted in transit and at rest, stored in tier-1 corporate grade facilities, and access is restricted and monitored.
Practice and patient records held by Zavy 360 are stored in data centres located in Australia. Some features, including the AI features in section 6 and certain communications services, send information to service providers outside Australia for processing, as described in sections 5 and 6.
We will take reasonable steps to keep any personal information we hold securely – however, no method of data storage and transmission can be deemed 100% secure and therefore we cannot make this guarantee, but we are committed to review and improve our security on a regular basis.
However, except to the extent liability cannot be excluded due to the operation of statute, we exclude all liability (including in negligence) for the consequences of any unauthorised access to, disclosure of, misuse of or loss or corruption of your Personal Information. Nothing in this policy restricts, excludes or modifies or purports to restrict, exclude or modify any statutory consumer rights under any applicable law including the Competition and Consumer Act 2010 (Cth). Please notify us immediately if you become aware of any breach of security.
Direct marketing involves communicating directly with you for the purpose of promoting goods or services to you and to provide you with special offers. We may use the Personal Information you provide to directly market to you via a range of methods including mail, telephone, and email or video. You can unsubscribe from our direct marketing, or change your contact preferences, by contacting us.
Practice and patient records held in a practice's Zavy 360 account, including clinical notes, communications and the AI Scribe information described in section 6, are retained for as long as the practice's account is active. They are the practice's records and we do not delete them on a schedule of our own, or at the request of a practice or patient. When an account is closed, the practice's data is kept available for export for the period set out in our Terms of Service and may then be permanently deleted.
Personal Information we collect for our own purposes, such as enquiries, marketing consents, billing records and job applications, is retained only for as long as is necessary for the purposes set out in this Privacy Policy.
We may also retain and use Personal Data to the extent necessary to comply with our legal obligations, resolve disputes, and enforce our legal agreements and policies.
We try to maintain your Personal Information as accurately as reasonably possible. We rely on the accuracy of Personal Information as provided to us both directly (from you) and indirectly. Please note that you may seek access to Personal Information which we hold about you by contacting us as described in section 14 of this Privacy Policy. We will provide access to that information in accordance with the Privacy Act, subject to certain exemptions which may apply. We may require that the person requesting access provide suitable identification and where permitted by law we may charge an administration fee for granting access to your Personal Information.
We encourage you to contact us if the Personal Information we hold about you is incorrect or to notify us of a change in your Personal Information (see section 14 of this Privacy Policy).
End users of our service also play an important role in keeping your data secure. You are responsible for the confidentiality of your account details and password. Your passwords protect your Personal Information and you are responsible for any activities that occur in your account or in respect of your use of the Services.
Please let us know immediately if you suspect the security of your password or account has been compromised in any manner.
As an end user, you further acknowledge that you can choose how you wish to be contacted. It is your responsibility to update our system if you do not wish to be contacted via email, a certain email address, phone number or any other relevant contact information provided in your Zavy 360 profile.
Our website may contain links to other sites. This Privacy Policy applies to our website and any Zavy 360 platforms and not any linked sites which are not operated or controlled by us. We encourage you to read the privacy policies of each website that collects your Personal Information.
We use "cookies" on our website which enable us to monitor traffic patterns and to serve you more efficiently if you revisit the site. A cookie does not identify you personally but it does identify your computer. You can set your browser to notify you when you receive a cookie and this will provide you with an opportunity to either accept or reject it in each instance.
The use of such technologies is an industry standard, helps to monitor the effectiveness of advertising and how visitors use our websites/applications. We may use such technologies to generate statistics, measure your activity, improve the usefulness of our websites/applications and to enhance the 'customer' experience.
If you prefer not to receive cookies, you can adjust your Internet browser to refuse cookies or to warn you when cookies are being used. However, our website may not function properly or optimally if cookies have been turned off.
We may periodically update this policy. We will post any changes on this page and, if the changes are material, we will provide an update through the notification in your Zavy 360 account.
If you have any feedback, question, concern or any comment about this Privacy Policy, please contact our Data Privacy Officer at info@zavy.com. When contacting us, please provide as much detail as possible in relation to your question, comment or feedback. We take your privacy and security seriously and will respond to you as soon as possible. We request that you cooperate with us during this process and provide us with any relevant information that we may need.
If you are not satisfied with the outcome of our assessment of your complaint, you may wish to contact the Office of the Australian Information Commissioner.
By choosing to visit our Website or provide information to us, you agree that any dispute over privacy or the terms contained in this Privacy Policy will be governed by Australian Law. You also agree to submit to the jurisdiction of the courts of Australia in respect of any proceedings in connection with this Privacy Policy and terms of services.
For questions about this Privacy Policy, please contact Zavy 360 support.
