Privacy Policy

Last Updated: 25/06/2025

Introduction: SaluStory is a caregiver-first mobile health application operated by SALUSTORY PTY LTD (ABN 46 684 422 017), an Australian company. We are committed to protecting your privacy and complying with Australian privacy laws, including the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This Privacy Policy explains what personal information we collect through the SaluStory app, how we use and share it, and the choices you have. By using SaluStory, you agree to the practices described in this policy. If you do not agree, please do not use the app.

1. Information We Collect

Personal and Contact Information: When you register or contact us, we collect information such as your name, email address, and contact details. If you are a caregiver using the app for a child, we may also collect the child's first name or nickname, date of birth (or age), and other profile details needed to personalise the app. We assume you are authorised to provide any personal information about the child (as their parent, carer or legal guardian).

Child Health and Development Data: The core of SaluStory is recording health information about children in your care. This includes health logs you input, such as symptoms (e.g. fevers, coughs), medications administered (name, dosage, timing), vaccination records, developmental milestones, dietary or sleep information, and any notes on the child's well-being. You may also record diagnoses or conditions (e.g. asthma, allergies) and any observations relevant to the child's health. Health information is treated as sensitive personal information under Australian law, and we only collect it with your consent and for the purposes described in this policy.

Clinician and Sharing Information: If you choose to share data with a clinician (for example, by generating a summary or inviting a healthcare provider to view the child's logs), we may collect the clinician's name and contact information that you provide. Any data shared with a clinician is at your direction and with your consent.

Device and Technical Data: Like many apps, SaluStory automatically collects certain technical data when you use the app. This may include your device type, operating system, unique device IDs, IP address, and usage logs (such as access times and pages or features accessed). We use this data to ensure the app functions properly, to debug issues, and to analyse usage trends to improve our services. We may also use cookies or similar technologies in our web interfaces for login or support; any non-essential tracking is only deployed with your consent, in compliance with applicable laws.

Third-Party Data Sources: In general, we collect information directly from you. If we ever obtain personal data from third parties, it would only be with your consent or as required by law. For example, if in the future SaluStory integrates with wearable or other digital and smart devices or external health services at your request, we will explain the data collected from those sources at that time. This Privacy Policy will be updated to reflect any expansion in data collection.

Anonymised and De-Identified Data: We may produce aggregated or de-identified data from the personal information you provide, by removing or obfuscating identifying details. For instance, we might compile statistics on common symptoms or average ages, in a way that does not identify any individual. Such aggregated data is not personal information under the Privacy Act and may be used by us for research or product improvement.

2. How We Use Your Information

We use the collected information to provide and improve the SaluStory service. Key uses include:

• Providing the App's Core Functions: We use your and your child's information to enable you to log health events, view histories, and share updates. For example, symptom entries and medication logs are stored and organised so you can review them or show them to a clinician.
• Personalisation: Personal data helps us customise your experience, for instance, showing content relevant to your child's age or sending you reminders (e.g. medication schedules or vaccination dates) if you opt for such features.
• Communication: We may use contact information to send you account-related notifications, such as password resets, important updates to this policy or our Terms, or informational messages about new features. If you opt-in to marketing communications, we might also send newsletters or tips about using the app, but you can unsubscribe at any time.
• Sharing at Your Direction: If you choose to share health data or summaries with a healthcare provider or family member, we use the information you select to generate reports or grant access accordingly. We will only share your child's health information with third parties when you ask us to or give consent, as explained in Section 3 (Disclosure of Information) and in accordance with Australian Privacy Principle 6, which limits use and disclosure of personal information to the purposes for which it was collected or a directly related purpose (especially for sensitive health information).
• Improvement and Analytics: Internal analytics help us understand how users interact with SaluStory so we can improve functionality and user experience. For example, we might look at aggregated usage patterns to decide which new features to develop. We may also debug and monitor performance (e.g. tracking crashes or loading times) to ensure the app is reliable and secure. Where possible, we use de-identified data for these purposes.
• Legal Compliance and Safety: In certain cases, we may need to use your information to comply with legal obligations or to protect the vital interests of users. For instance, if required by law to retain certain records or if we believe in good faith that using or disclosing information is necessary to protect someone's health or safety, we will do so consistent with privacy law requirements. (Any such uses are rare and would be assessed under APP 6 and permitted situations under the Privacy Act.)

We will not use personal data in ways that are not related to the above purposes without your consent. In particular, we do not sell your personal or health information to third parties for advertising or any other purpose. Any use of your data for secondary purposes (such as research beyond improving our own services) would require either your consent or a legal obligation, in line with APP 6's limitations on use and disclosure.

3. Disclosure of Information (Sharing with Third Parties)

SaluStory respects the confidentiality of your information. We disclose personal information to third parties only in the following circumstances:

• Service Providers (Processors): We use trusted third-party companies to help us operate SaluStory. This includes our cloud hosting provider and infrastructure platform (Bubble.io on Amazon Web Services), analytics or crash reporting services, and email/SMS delivery services. These providers only receive the information necessary to perform their functions (for example, our hosting provider stores the data you enter in the app) and are contractually obligated to protect it and use it solely for our purposes. We take reasonable steps to ensure overseas recipients protect personal information in line with Australian standards and remain accountable if they mishandle data. (See Section 4 on international data storage.)
• Clinicians or Persons You Share With: We will share your data with third parties only with your direction and consent. If you choose to share a child's health log or a generated report with a doctor, health clinic, or another caregiver, we will facilitate that transfer (for example, by providing a secure link or sending an email you initiate). We will only send the specific information you have chosen to share. Once this information is disclosed at your request, the recipient (e.g. your clinician) will handle that information according to their own privacy obligations (for example, medical professionals in Australia have duties of confidentiality). SaluStory is not responsible for how a third-party recipient uses information you choose to share with them, but we recommend you only share with trusted professionals and only the information necessary.
• Legal Requirements: We may disclose personal information if required by law, regulation, or court order. For example, we might have to provide information in response to a subpoena, warrant, or if a regulator with authority (such as the Office of the Australian Information Commissioner) lawfully requests information. We will only do so after verifying the request's validity and scope. Wherever possible, we will notify you of such disclosure unless legally prohibited.
• Protection of Rights and Safety: In rare cases, we may disclose data when we believe it's necessary to prevent harm or enforce our rights. For instance, if we detect potentially fraudulent or malicious activity on the app that poses security risks, we might share relevant data with law enforcement or security consultants. Or, if needed to address disputes or enforce our Terms and Conditions, we may use relevant personal information as evidence.
• Business Transfers: If SaluStory (SALUSTORY PTY LTD) undergoes a business transaction such as a merger, acquisition by another company, or sale of all or part of its assets, user information (including personal and health data) may be transferred as part of that deal. We would ensure any successor entity continues to protect your information in line with this Privacy Policy. You will be notified via the app or email of any change in ownership or control of your personal information, and we will provide an opportunity to discontinue use of the app or delete your data if you desire.

Except for the situations above, we will not disclose your or your child's personal information to third parties without your consent. In particular, we do not share health logs or identifiable information with advertisers or social media companies. Any third-party integrations or new sharing features will be clearly explained and will require your active permission.

4. International Data Storage and Transfers

Data Location: SaluStory is powered by Bubble.io, a platform that hosts our application on Amazon Web Services (AWS) cloud servers. By default, Bubble's servers for standard (shared) plans are located in the United States. This means the personal and health information you enter into SaluStory will be stored and processed on secure AWS servers in the U.S. While the data resides outside Australia, we continue to handle it in accordance with Australian law and this Privacy Policy.

Cross-Border Protection: Whenever personal information is stored or transmitted overseas, we take steps to protect it. Under Australian Privacy Principle 8, before disclosing personal information to an overseas recipient, we must take reasonable steps to ensure that the recipient (in this case, our hosting infrastructure) will not breach the APPs in relation to that information. We have assurances through our agreement with Bubble/AWS that data is stored securely and handled confidentially. SALUSTORY PTY LTD remains accountable for protecting your personal information, even when it is stored on servers overseas. This arrangement reflects the Privacy Act's approach of allowing cloud services and international data flow while ensuring individuals' privacy is respected and safeguarded.

Security Measures in Cross-Border Context: Data transmitted between your device and our servers is encrypted in transit (using HTTPS/TLS). AWS also maintains robust physical and network security. Within our application layer, we apply access controls so that your data is accessible only by your account (and those you authorise). Our team's administrative access to the production database is strictly limited to personnel who need it to maintain the service, and governed by confidentiality obligations. (See Section 5 on Data Security for more information.) These measures help ensure that even though your data is stored in the USA, it is protected to standards comparable to if it were in Australia.

Overseas Third Parties: Besides our main cloud storage, any other third-party services that process data may also be based overseas. For example, if we use an email service it might operate via servers in the US or EU. We will list the key third-party service locations: at present, Bubble/AWS (United States) is our primary data host. We do not routinely transfer personal data to any other country. If this changes, we will update this policy and, if required, seek your consent for any new overseas disclosures. Rest assured that in all cases we remain compliant with APP 8's requirements for cross-border data protection.

5. Data Security and Retention

Security Practices: We take the security of your and your child's personal information seriously. In line with Australian Privacy Principle 11, we take reasonable steps to protect personal information from misuse, interference, and loss, as well as unauthorised access, modification, or disclosure. These steps include technical, administrative, and physical safeguards:

• The SaluStory app and database employ encryption, data in transit is encrypted via SSL/TLS, and we utilise AWS's encryption at rest for stored data.
• Access Controls: Access to personal data is restricted on a need-to-know basis. Users only see their own data (unless they choose to share it). Within our company, only authorised staff or contractors who need to support the system or assist you (for example, customer support troubleshooting a technical issue) can access user data, and even then, strictly under controls and confidentiality agreements.
• Secure Development: Our development practices include regular updates and patches to keep the app and its dependencies secure. We use Bubble.io's platform security features and follow best practices in coding to prevent common vulnerabilities.
• Monitoring and Testing: We monitor for suspicious activity on accounts and within our infrastructure. We also periodically review our security measures and may engage third-party security audits or testing. In the unlikely event of a data breach that poses a risk to you, we will notify you and the relevant authorities as required by the Notifiable Data Breaches scheme under Australian law.

While we strive to protect your information, it's important to note that no system is 100% secure. You play a role in security as well: keep your account password confidential and notify us immediately if you suspect any unauthorised access to your account. We will not ask you for your password via email or phone. If you share your device with others, consider using a device passcode or biometric lock to protect the app data.

Data Retention: We retain personal and health information for as long as your account is active and as needed to provide you with the service. This allows you to access historical health logs over time. If you decide to stop using SaluStory, you have the option to request account deletion (see Section 6, Your Rights). Upon such a request, or if we otherwise close your account due to inactivity, we will securely delete or de-identify the personal information we hold about you, except to the extent we are required to keep it for legal reasons. For example, we may need to retain certain transaction records or communications to comply with financial reporting, audits, or legal compliance. In all cases, if information is no longer needed for the purpose it was collected, we will take reasonable steps to destroy or permanently de-identify it.

Backup copies of data are kept for a limited time as part of our routine disaster recovery backups. If you request deletion, your data will be removed from our active databases promptly, and when our backups cycle, the data will be overwritten and no longer recoverable. We will inform you once your deletion request has been completed.

6. Your Rights and Choices

Australian privacy law grants you certain rights regarding your personal information, and we extend these rights to all our users:

• Access: You have the right to request access to personal information we hold about you or your child. This includes the right to receive a copy of the information. We will generally provide this in a portable format (such as a CSV export of your health logs) unless an exception applies. There is no charge for a basic request, but if a request is unusually complex, a minimal fee might be charged to cover our costs as permitted by law (we would inform you in advance).
• Correction: We aim to keep your information accurate and up-to-date. If you believe any personal information we hold is incorrect or incomplete, you have the right to request a correction. For example, if you notice a typo in your profile or an error in a health entry that you cannot fix through the app, contact us and we will correct it. If we do not agree to make a requested change (rare, and we would have a legal reason), we will let you know why and how you can append a statement of your dispute to the records.
• Deletion: You may request that we delete your personal and health information. You can do this by contacting us to delete your account. We will then remove your data from our systems, subject to any retention requirements mentioned above (such as legal obligations). We will inform you if any data must be retained and ensure it's only kept for those purposes. Once deleted, your data (including health logs) will not be recoverable. Keep in mind that if you have shared data with a clinician or another user, that third party may have their own copy of the information which we cannot erase on their behalf.
• Withdrawal of Consent: Because we handle sensitive health information, we rely on your consent to collect it. You have the right to withdraw consent for further collection or use of certain data at any time. For example, you can decline to answer optional questions or stop logging certain details. If you withdraw consent for us to use existing data (for instance, you no longer want us to hold any health logs), this is effectively a request for deletion of that data. Please note that withdrawal of consent will not affect any use of the information that has already occurred with your permission.
• Anonymity or Pseudonymity: Australian Privacy Principle 2 allows you, where practicable, to use services anonymously or under a pseudonym. Given the nature of SaluStory, a certain amount of personal information is required to provide a useful service (e.g. an account under a real email to sync data, and child health data inherently relates to an identified child). However, you may choose not to provide certain identifying details. For example, you might use only a first name or nickname for your child's profile, and you are not required to upload a photo or precise address for yourself or the child. If you wish to use the app under a pseudonym for your profile, you may do so, though for any official matters (like subscription billing) a real identity will be needed by the payment processor.
• Marketing Communications: If you have opted in to receive promotional emails or updates, you can opt out at any time. Just click the "unsubscribe" link in any email or adjust your account settings if available. Note that we will still send you essential service or account-related messages even if you opt out of marketing. We do not use your health data for marketing personalisation without consent.

To exercise any of these rights, please contact us (see Section 10 for contact details). We will respond to your request as soon as possible, typically within 30 days. For access or deletion requests, we will need to verify your identity to ensure we don't disclose or remove data from the wrong account. This may involve asking you to write to us from your registered email or provide some identifying information. These processes are in place to protect your privacy.

If you are a caregiver and have input health information about a child, these rights apply to that child's information as well (which you are managing on their behalf). As the account holder, you will make requests on behalf of the child's data.

7. Third-Party Services and Links

Service Providers: As noted, we use third-party services to support SaluStory's functionality (such as cloud hosting on AWS, provided via Bubble). We ensure any such providers are also bound to protect your data and use it only for the agreed purpose. For example, our cloud provider must maintain confidentiality and security measures, and not use your data for their own purposes. We do not allow third parties to use the personal information we share with them for marketing or any purpose other than providing services to us. In the event we introduce new providers that handle personal data, we will update this policy.

Analytics: We may use analytics tools (for instance, a service like Google Analytics for Firebase, or similar) to gather anonymous statistics about app usage. These tools might collect device identifiers and usage data. However, we configure them not to collect any names or sensitive content from your entries. Analytics data helps us improve user experience and fix technical issues. You can opt out of certain analytics by adjusting your device settings (for example, on iOS you can choose "Limit Ad Tracking" which isn't directly related to us, or on Android reset your advertising ID; however, since we do not serve ads, these settings have limited relevance for SaluStory).

Clinician Integrations: If in the future SaluStory offers any direct integration with clinician systems (for example, sending data to a clinic's electronic health records system at your request), those integrations will be covered by additional terms or consents. Currently, sharing with clinicians is done only by you choosing to export or show information.

Links to Other Sites: The app or our website may, from time to time, contain links to external websites or services that we do not operate (for example, a link to a health article or a partner's site). This Privacy Policy does not cover those external sites. We encourage you to read the privacy policies of any third-party sites or services before providing any personal information to them. We are not responsible for the privacy practices or content of sites we don't control.

8. Children's Privacy

SaluStory is intended to be used by adults (or mature teenagers) who are caregivers, to log information about children. We do not allow children under 16 to create their own accounts in the app. If you are under 18, you should only use the app with the involvement and consent of a parent or legal guardian (see our Terms and Conditions age restrictions). The personal information about children in the app is provided by the adult caregiver, with the assumption that the caregiver is authorised to do so.

We treat children's personal information with extra care. We do not use a child's data for any purpose other than providing the service to the caregiver and any explicitly authorised sharing with healthcare providers. We do not market to children, and we do not disclose a child's information to anyone unless directed by the caregiver or required by law.

If we learn that we have inadvertently collected personal information directly from a child under 16 without proper consent, we will delete that information as soon as possible. For example, if a minor (under 16) were to register on their own and input data, contrary to our policy, we would close that account and remove the data when we become aware of the situation.

Parents and guardians: If you have any concerns about data relating to your child in our app, please contact us. You can request access, correction, or deletion of your child's information at any time, as described in Section 6.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or for other operational reasons. When we make material changes (for example, if we expand what data we collect or change how we use it), we will notify users prominently, either by an in-app message, email notification, or via our website. The "Last Updated" date at the top will always indicate when the latest changes were made. We encourage you to review this Policy periodically to stay informed about how we are protecting your information.

If you continue to use SaluStory after an update to the policy takes effect, we will consider that as acceptance of the revised policy. If you do not agree with any changes, you should stop using the app and you may contact us to remove your data.

10. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or SaluStory's handling of your personal information, please contact us at:

Email: privacy@salustory.com.au (or support@salustory.com.au)

Postal Mail: SALUSTORY PTY LTD, Australia.

(We will update the mailing address on our website or contact page, https://salustory.com, once available. In the meantime, email is the fastest way to reach us.)

We will respond to your inquiries as soon as possible. If you make a complaint about privacy, we will investigate and attempt to resolve it. If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Australian Information Commissioner (OAIC). The OAIC can be contacted at 1300 363 992 or via www.oaic.gov.au. We value your trust and will do our utmost to address any issues.