Privacy Policy

Who we are

Haylo Health Pty Ltd (ABN 59 697 017 208) operates the Haylo marketplace, which connects patients with same-day allied health appointments at participating clinics in Melbourne. References to "we", "us", or "our" in this policy mean Haylo Health Pty Ltd.

What we collect

When you create an account, book an appointment, or interact with clinics through Haylo, we collect:

• Identity details: name, email, mobile number and date of birth (we need a date of birth for every booking). If you book for someone else: their name, date of birth, relationship to you and, if you give it, their phone number.
• Booking metadata: clinic, practitioner, appointment time, price, discount applied, and who is paying for the appointment if you tell us (for example NDIS, DVA or WorkCover).
• Payment details: a card on file held securely by Stripe (we never see or store full card numbers).
• Device data: IP address and browser type, used to keep your account safe.
• What you search for: the words you type into the search box, and whether we found you an appointment. We keep this to learn which services people need that we don't yet offer, so we know which clinics to invite next. It is stored on its own, in Australia, with no name, no account, no location and no IP address attached — nothing that could connect a search back to you. Words only a handful of people have ever searched for are deleted within 45 days, and usually much sooner.

We never ask a clinic's practice management system for clinical notes, diagnoses, treatment plans or medical files. To file your booking, we search the clinic's patient records for your existing file, using your name, date of birth and email, and read your past and upcoming appointments at that clinic to tell whether you've been before. We also see whether you attended an appointment booked through Haylo, and any note the clinic's staff add to it. If you book for someone else, the note on that appointment in the clinic's system gives your name, your relationship to them, your mobile and your email. If the clinic has no file for them, the new file holds only their own details, unless they're your child or another under-18 in your care, when you're also their emergency contact. These are the main categories of personal information Haylo collects. We also collect what you provide when you contact support, and your name and email if you sign in with Google or Apple.

How we use your information

• To confirm your booking with the clinic and send reminders.
• To charge a fee only in the cases set out in our Terms: a late cancellation, a missed appointment, or a clinic having to cancel because the appointment wasn't one you could book.
• To understand and improve how the marketplace works.
• To meet our legal obligations, prevent fraud, and respond to lawful requests.

Who we share it with

We share your details only when needed to deliver the service: the clinic you book with, our payment processor (Stripe), our email and SMS providers (for booking confirmations), and our hosting and security infrastructure. We do not sell or rent your information to advertisers.

Sending information overseas

Some of our service providers — our payment (Stripe), email and SMS providers, our error-monitoring service (Sentry, in Germany), and the messaging tool our small team uses for system alerts (Slack) — store or process information on servers outside Australia. Error monitoring receives technical reports when something breaks; we configure it not to send your name, your search terms or your location. Where we disclose information overseas, we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles.

How long we keep it

We keep personal information only as long as we need it to provide the service and meet our legal obligations. When it is no longer needed, we delete or de-identify it.

If we suspend or remove your account for fraud, safety, or non-payment reasons, we may retain a hashed record of identifiers associated with that account (such as your email address and phone number) after deletion, for as long as reasonably necessary, to detect and prevent repeat fraud or abuse.

How we protect it

We protect your information with encryption in transit, access controls, and limits on who can see what. Card details are held by Stripe, not on our servers. No system is perfectly secure, but we take reasonable steps to guard against misuse, loss, and unauthorised access.

If a data breach happens that is likely to cause you serious harm, we will tell you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires. We assess any suspected breach as quickly as we can, and within 30 days at the outside.

The laws that apply to us

Because your appointment records say something about your health, they are health information. That means two sets of rules apply to us, not one.

The Health Records Act 2001 (Vic) and its Health Privacy Principles apply to any organisation that handles health information about Victorians. There is no small-business exemption, so these bind us regardless of our size. We also handle your information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

Your rights

Under the Australian Privacy Principles, you can ask us to access, correct, export, or delete the personal information we hold about you. Email privacy@haylohealth.com.au and we'll respond within 30 days.

Contact us

If you have a question or concern about this policy, email privacy@haylohealth.com.au. If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner, or — for a complaint about health information — to the Health Complaints Commissioner in Victoria, who oversees the Health Records Act.