SonoTools Privacy Policy

1.About SonoTools and patient information

SonoTools is a software tool for sonographers and other healthcare professionals.

The product is designed so that patient-identifying information is not required to use the worksheet, annotation and calculation features.

We therefore ask users not to upload or enter patient-identifying information unless they are authorised to do so and the use of SonoTools is permitted by their employer, healthcare organisation and applicable law.

Patient-identifying information may include a patient's:

• name;
• date of birth;
• address;
• medical record or hospital number;
• contact details; or
• other information that identifies or could reasonably identify the patient.

Despite these controls, SonoTools accepts uploaded files and free-text annotations. As a result, patient or other health information may be included in content uploaded or created by a user.

If this occurs, we will handle that information in accordance with applicable privacy and health-records law.

Where practical and permitted by the relevant clinical workflow, users should remove or obscure patient identifiers before uploading content.

SonoTools is not intended to replace a healthcare organisation's designated clinical record system.

2.What information we collect and hold

Account information

When you create an account, we may collect:

• your name;
• your email address;
• the hospital, healthcare organisation or workplace you enter;
• your account type and subscription status; and
• information necessary to manage your account.

Content

Depending on how you use SonoTools, we may hold:

• worksheets you upload;
• images or PDF files you upload;
• annotations, drawings and text you create;
• presets;
• folders;
• saved settings;
• content placed into organisation libraries; and
• other information necessary to provide the functions you choose to use.

Content may contain health information if a user uploads or enters it.

Usage and technical information

We may collect technical and usage information such as:

• sign-in events;
• feature usage;
• calculator usage;
• categorised errors or failures; and
• information required to maintain security and diagnose technical problems.

Our feature-usage analytics are designed to record that an event occurred rather than the content of that event. They do not intentionally record worksheet titles, filenames or free-text annotations.

Payment information

If you subscribe to a paid service, payment processing is provided by our payment provider, currently Stripe.

We do not intentionally receive or store your full payment-card number.

We may receive information such as:

• payment status;
• subscription status;
• transaction identifiers;
• billing dates; and
• information necessary to manage your subscription.

3.Why we use information

We use information where reasonably necessary to:

• create and administer your account;
• provide SonoTools and its features;
• store and retrieve content you choose to save;
• provide organisation functionality;
• manage access permissions;
• process subscriptions and payments;
• send necessary service communications;
• send password-reset and account-security communications;
• send organisation invitations and administrative notices;
• diagnose and fix technical problems;
• maintain security and prevent misuse;
• understand aggregate product usage and improve SonoTools;
• comply with legal obligations; and
• establish, exercise or defend legal rights where reasonably necessary.

We do not sell personal information.

We do not use user content to train artificial intelligence models.

We do not use user content for advertising.

We do not send marketing communications unless we have a lawful basis to do so and, where required, you have provided the necessary consent or can otherwise lawfully receive them.

4.Health information

Health information receives additional protection under Victorian law.

Where health information is held by Focal Point Lab, we will handle it in accordance with applicable obligations under the Health Records Act 2001 (Vic) and other applicable laws.

We aim to minimise the amount of health information held by SonoTools by:

• not requiring patient identifiers for the core product;
• instructing users not to upload patient-identifying information unless authorised;
• limiting administrative access to user content;
• not providing an administrator "view as user" function;
• designing usage analytics so they do not intentionally capture worksheet content; and
• allowing users to delete content through available product controls.

Where we are required to collect, use, disclose, retain or provide access to health information under applicable law, we will do so in accordance with that law.

5.How we use and disclose content

We do not routinely browse or review users' worksheets.

SonoTools has deliberately been designed without a general administrator function that allows us to browse a user's personal worksheets.

Content may nevertheless be processed automatically by the systems required to provide the service.

Your content may be accessible to:

• you;
• people with whom you deliberately share content;
• authorised members of an organisation where content has been placed into an organisation's shared library;
• service providers that process information on our behalf where necessary to provide SonoTools; and
• authorised personnel where access is reasonably necessary for security, technical support, fault investigation, legal compliance or another legitimate operational purpose.

Where direct access to stored content is necessary, we will seek to limit access to what is reasonably necessary for the particular purpose.

We may disclose information where required or authorised by law, including where reasonably necessary to respond to legal proceedings, enforce our rights, protect the security of the service, or investigate suspected unlawful activity.

We do not sell or commercially trade user content.

6.Organisations

If you use SonoTools as a member of an organisation, the organisation may provide or control access to your account.

An organisation administrator may be able to:

• see that you are a member;
• see your name and email address;
• allocate or remove your organisation seat;
• manage organisation membership; and
• manage content stored in organisation shared libraries.

An organisation administrator cannot use ordinary SonoTools administrative controls to view your personal worksheets.

Content placed into an organisation's shared library may be accessible to authorised members of that organisation.

Your organisation may have its own privacy policies, information-security requirements and legal obligations concerning information it provides to or stores through SonoTools.

Where an organisation has entered into a separate agreement with Focal Point Lab, that agreement may contain additional requirements concerning privacy, security, health information, data retention, access and deletion.

7.Service providers

We use third-party service providers to operate SonoTools.

Our current core service providers include:

Our service providers may process information outside Victoria and, in some cases, outside Australia.

We take reasonable steps to select and manage service providers having regard to the privacy and security of information processed through SonoTools.

We may change service providers where reasonably necessary to operate or improve the service. Where a change materially affects how personal or health information is handled, we will update this Privacy Policy or provide other notice where required.

8.Storage and transborder handling

Our primary database and file storage are currently configured in Sydney, Australia.

This does not mean that every service involved in providing SonoTools operates exclusively within Australia.

For example, some providers have international infrastructure or may permit authorised support or engineering access from outside Australia.

Where personal or health information is handled outside Victoria or Australia, we will take reasonable steps to ensure that applicable privacy requirements continue to be addressed, including any requirements concerning disclosure or transfer of health information outside Victoria.

9.Security

We take reasonable technical and organisational measures to protect information from misuse, loss and unauthorised access, modification or disclosure.

Current controls include:

• encryption of traffic in transit;
• encryption of stored data provided by our hosting infrastructure;
• database-level access controls;
• row-level security where applicable;
• restricted administrative access;
• no general "view as user" or impersonation function;
• authentication controls provided by our authentication service; and
• server-side restrictions on the values recorded by product-usage analytics.

No internet service can guarantee absolute security.

We continually review the security of SonoTools and may introduce additional controls as the service develops.

10.Data breaches

If we become aware of a suspected or actual security incident involving personal or health information, we will assess the incident and take reasonable steps to contain, investigate and remediate it.

Where applicable law requires notification to affected individuals, regulators or other parties, we will make those notifications in accordance with the applicable requirements.

11.How long we keep information

We retain information only for as long as reasonably necessary for the purposes for which it is held, unless a longer period is required or permitted by law.

Our current retention approach is:

• User content: generally retained while the relevant account remains active, subject to organisation arrangements and applicable legal requirements.
• Account information: generally retained while the account remains active and for any additional period reasonably necessary for legal, security, dispute-resolution or record-keeping purposes.
• Usage records: content-free raw usage records are currently retained for up to 90 days and then reduced to anonymous aggregate totals where practicable.
• Payment and transaction records: retained for as long as reasonably required by applicable tax, accounting and financial record-keeping obligations.

When information is no longer required, we will take reasonable steps to delete or permanently de-identify it, subject to legal, security, backup and organisation-related requirements.

Deletion and backups

Deleting content from SonoTools may not cause every technical copy to disappear immediately from backups or disaster-recovery systems.

Where information remains in a backup, it will be subject to appropriate security controls and will be deleted or overwritten in accordance with the applicable backup lifecycle.

12.Deletion of content and accounts

You may delete eligible content through the available SonoTools controls or contact us to request deletion.

You may also request closure of your account.

Deletion may be subject to:

• legal retention requirements;
• organisation ownership or control of shared content;
• information required to establish, exercise or defend legal rights;
• security or fraud-prevention requirements; and
• technical backup and disaster-recovery processes.

Content that you have contributed to an organisation's shared library may remain with that organisation after you leave the organisation or close your individual account.

13.Access and correction

Subject to applicable law and any lawful grounds for refusal, you may request access to personal information or health information we hold about you.

You may also ask us to correct information that is inaccurate, incomplete or out of date.

Some access and correction rights for health information arise specifically under the Health Records Act 2001 (Vic).

To make an access or correction request, contact:
hello@focalpointlab.org

We may need sufficient information to verify your identity before responding.

Because SonoTools is deliberately designed without a general administrator interface for browsing user worksheets, responding to some requests involving stored content may require additional technical steps.

We will explain the process where this occurs.

We will respond to requests within the timeframe required by applicable law.

14.Complaints

If you believe that we have mishandled your personal information or health information, please contact us first:
hello@focalpointlab.org

Please provide enough information for us to understand the issue and investigate it.

We will acknowledge and investigate privacy complaints and respond within a reasonable period, having regard to the applicable legal requirements and the nature of the complaint.

If you are not satisfied with our response, you may be able to make a complaint to the relevant regulator.

For Victorian health-information privacy matters, this may include the Health Complaints Commissioner.

Where the Commonwealth Privacy Act 1988 (Cth) applies to the relevant information or activity, the Office of the Australian Information Commissioner may also have jurisdiction.

15.Children

SonoTools is intended for adults, including qualified healthcare professionals and students undertaking relevant education or training.

SonoTools is not intended for people under 18.

16.Cookies and similar technologies

SonoTools may use cookies, local storage or similar technical technologies where reasonably necessary to:

• authenticate users;
• maintain sessions;
• remember settings;
• provide security; and
• operate the service.

We do not use these technologies to sell or trade user information.

17.Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to SonoTools, our information practices, service providers, technology or applicable legal requirements.

Where a change is significant, we will provide reasonable notice through SonoTools, by email, or by another appropriate method where required.

The Last updated date at the beginning of this Privacy Policy indicates when it was most recently updated.

18.Contact