Privacy Policy

Who we are

Haylo Health Pty Ltd (ABN 59 697 017 208) operates the Haylo marketplace, which connects patients with same-day allied health appointments at participating clinics in Melbourne. References to "we", "us", or "our" in this policy mean Haylo Health Pty Ltd.

What we collect

When you create an account, book an appointment, or interact with clinics through Haylo, we collect:

• Identity details: name, email, phone, date of birth (where required by the clinic).
• Booking metadata: clinic, practitioner, appointment time, price, and discount applied.
• Payment details: a card on file held securely by Stripe (we never see or store full card numbers).
• Device data: IP address and browser type, used to keep your account safe.

We do not access clinical notes, diagnoses, treatment plans, medical files, or health records — those stay in the clinic's practice management system. These are the main categories of personal information Haylo collects. We also collect what you provide when you contact support, and your name and email if you sign in with Google or Apple.

How we use your information

• To confirm your booking with the clinic and send reminders.
• To charge a no-show or late-cancel fee if the clinic's policy applies, and only in those cases.
• To understand and improve how the marketplace works.
• To meet our legal obligations, prevent fraud, and respond to lawful requests.

Who we share it with

We share your details only when needed to deliver the service: the clinic you book with, our payment processor (Stripe), our email and SMS providers (for booking confirmations), and our hosting and security infrastructure. We do not sell or rent your information to advertisers.

Sending information overseas

Some of our service providers — including our payment (Stripe), email, and SMS providers — store or process information on servers outside Australia, including in the United States. Where we disclose information overseas, we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles.

How long we keep it

We keep personal information only as long as we need it to provide the service and meet our legal obligations. When it is no longer needed, we delete or de-identify it.

If we suspend or remove your account for fraud, safety, or non-payment reasons, we may retain a hashed record of identifiers associated with that account (such as your email address and phone number) after deletion, for as long as reasonably necessary, to detect and prevent repeat fraud or abuse.

How we protect it

We protect your information with encryption in transit, access controls, and limits on who can see what. Card details are held by Stripe, not on our servers. No system is perfectly secure, but we take reasonable steps to guard against misuse, loss, and unauthorised access.

Your rights

Under the Australian Privacy Principles, you can ask us to access, correct, export, or delete the personal information we hold about you. Email privacy@haylohealth.com.au and we'll respond within 30 days.

Contact us

If you have a question or concern about this policy, email privacy@haylohealth.com.au. If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner.