Privacy policy
DeskDuo is practice management software for Australian allied health clinics. It is provided by Shaun Rees Chiropractic Pty Ltd, ABN 72 683 001 372 ("DeskDuo", "we", "us"). This policy explains how we handle personal information, including health information, under the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
Who this covers
Clinics use DeskDuo to run their practice. When a clinic stores information about its patients in DeskDuo, the clinic decides what is collected and why, and the clinic's own privacy policy applies to its patients. We hold and process that information for the clinic, to provide the service. This policy also covers information about clinic staff who use DeskDuo, and people who contact us.
What we hold
- Clinic and staff details: names, email addresses, phone numbers, business details (ABN, address), login and security records.
- Patient information entered by clinics: contact details, appointments, invoices and payments, forms, treatment notes and other health information.
- Messages: texts, emails and Facebook Messenger and Instagram messages between a clinic and its patients, and the details needed to deliver them (phone numbers, Facebook and Instagram sender IDs).
- Facebook and Instagram connection details: when a clinic connects its Facebook Page, we keep the Page's id and name, any linked Instagram account id, and a Page access token, which we store encrypted. We use these only to receive and send that clinic's messages.
- Usage and technical records: logs of activity in the app, which we keep for security and to fix problems. We don't put patient details in our logs.
How we use it
We use personal information to provide DeskDuo to clinics: storing records, sending appointment reminders and messages the clinic asks us to send, taking payments, keeping the service secure, and supporting clinics. We don't sell personal information and we don't use patient information for advertising.
Artificial intelligence
Some DeskDuo features use AI to help clinics, such as drafting replies to messages, summarising, and writing notes from dictation. These features use Claude, provided by Anthropic PBC. When a clinic uses them, the text needed for the task is sent to Anthropic to produce the result. This means AI features send message content to Anthropic for processing, which may happen outside Australia. Under its commercial terms, Anthropic doesn't use this data to train its models. Clinics choose whether AI replies are off, drafts for staff to approve, or automatic.
Where it is stored
DeskDuo's database and files are stored in Sydney, Australia (DigitalOcean, Sydney region). Some service providers we use are based overseas, mainly in the United States:
- Anthropic (AI features)
- Telnyx (text messages and phone numbers)
- Meta Platforms (Facebook Messenger and Instagram messages, when a clinic connects them)
- Stripe (card payments)
- Google (email delivery)
We take reasonable steps so these providers handle information consistently with the APPs, and we share only what each one needs to do its job.
Security
Information is encrypted in transit and at rest. Secrets such as access tokens are encrypted again inside the database. Each clinic's records are kept separate from every other clinic's. Staff logins use two step sign in, and access is limited by role.
How long we keep it
We keep clinic records while the clinic uses DeskDuo and as long as health records laws require afterwards (in Victoria, generally 7 years after the last visit, or until a child turns 25). When a clinic leaves, we return or delete its data as agreed with the clinic. When a clinic disconnects Facebook or Instagram, we delete the stored access token straight away.
Access and correction
Patients should contact their clinic first, as the clinic controls their records. Anyone can ask us for access to, or correction of, information we hold about them by emailing info@deskduo.com.au. We'll respond within 30 days.
Data breaches
If there is a data breach likely to cause serious harm, we will tell the affected clinics and, where required, the people affected and the Office of the Australian Information Commissioner, under the Notifiable Data Breaches scheme.
Complaints
Please email info@deskduo.com.au with any concern. If you aren't satisfied with our answer, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
Contact
Shaun Rees Chiropractic Pty Ltd, 50 Primrose St, Altona North VIC 3025, info@deskduo.com.au.