Data processing agreement

This Data Processing Agreement ("DPA") forms part of the agreement between Pelvilog ("we", "us") and the clinic using our service ("you", "the Clinic"). It explains how we handle personal and health information on your behalf. It is incorporated into our Terms of Service.

Pelvilog emails your patients a personal diary link, stores the entries they make on their phone, calculates a report, and, if you ask it to, uploads that report to the patient's file in Cliniko. No AI service is involved at any step.

If your organisation needs a signed or customised version of this DPA, contact hello@pelvilog.com.

1. Our roles

You are the health agency responsible for your patients' personal and health information under the Privacy Act 2020 and the Health Information Privacy Code 2020. We act as your agent under section 11 of the Privacy Act 2020. We handle that information only to provide the Service, and only as you direct through your use of it and your account settings.

If you're an Australian clinic, you're the APP entity responsible for the information under the Australian Privacy Act 1988, and we handle it on your behalf on the same basis.

We don't use patient information for any other purpose. We don't sell it, share it for marketing, or use it to train AI models.

2. What we process

• Clinic and account information: clinic name, timezone, logo, booking link and settings, and the names, email addresses, roles and status of your staff. If you connect Cliniko, this includes your Cliniko users, copied daily so admins can invite them.
• Cliniko API key: if you connect Cliniko. Encrypted at rest and only decrypted when we call Cliniko.
• Patient details: name, email address, and optionally age, sex, weight and Cliniko patient ID.
• Diary entries: the drinks, voids, leaks, bowel motions, medication, sleep times, ratings and comments the patient logs.
• Clinician notes: notes your staff add while reviewing a diary.
• Reports: generated from the entries when a clinician views, downloads or uploads them. We don't keep separate copies of report PDFs.

When you connect Cliniko, we read patient search results and patient details at the moment a clinician sends a diary, and your list of active Cliniko users once a day. We write the report PDF, and an optional draft treatment note, to the patient's file when a clinician uploads it, or as soon as the patient finishes if you've turned on automatic upload.

3. Sub-processors

• BinaryLane (Australia): application and database hosting, and daily backups, kept for no more than 7 days. This is where diary data is held.
• Postmark (United States): email delivery. Receives the patient's email address and first name for the invitation email, plus your clinic's name, the diary type and start date. Diary entries and reports are never emailed.
• Cloudflare (global): DNS for our domains. Application traffic isn't routed through Cloudflare.
• Google Fonts (global): typefaces for the app. Patients' and staff browsers request fonts from Google, which receives their IP address but no diary data.

Report PDFs are generated by software running on our own servers, on a private network with no internet access. No third party is involved.

Cliniko is your own practice management system, not a Pelvilog sub-processor. We connect to it using the API key you provide, under your existing agreement with Cliniko.

We'll give you reasonable notice by email before adding or replacing a sub-processor that handles patient information, so you can raise any objection.

4. Where data is held

The Pelvilog application, database and backups are hosted in Australia, by an Australian-owned provider. Australian hosting is subject to the Australian Privacy Act 1988, which we consider to provide comparable safeguards to those required under the Privacy Act 2020 for information stored outside New Zealand.

The exception is email delivery. Postmark processes invitation emails in the United States, so the patient's first name and email address, your clinic name, the diary type and start date pass through the United States. So do the names and email addresses of your staff when they're invited, and of whoever signs up. Diary entries, clinical notes and reports stay in Australia.

5. Security measures

• All traffic uses HTTPS, including calls to Cliniko and Postmark.
• Patient names and email addresses, patient comments, clinician notes and your Cliniko API key are encrypted at rest at the application level.
• Each patient's diary link contains a random 40-character code. We store only a one-way hash of it. Links stop working a few days after the diary period ends, and sending a new link cancels the old one.
• Staff can only see diaries belonging to their own clinic. Only admins can change settings, manage the team, or connect or disconnect Cliniko.
• Each person has their own login. Team invitation links expire after 7 days and, like diary links, are stored only as a one-way hash. Deactivating someone signs them out straight away.
• Passwords are hashed and never stored in plain text. Sign-in and other sensitive actions are rate limited.
• Emails telling your clinicians a diary is ready, or that it couldn't be sent to Cliniko, contain a link into the app, not the patient's name or results.
• Logs of requests to Cliniko record which part of the API was called, not the data sent or received.

To be precise about the limits: other diary data, such as times, volumes, stool types, age, sex and weight, is protected by access controls rather than application-level encryption. We don't currently offer two-factor sign-in, and we don't keep a log of which staff member viewed which diary. We review and improve these measures as the Service grows.

6. Privacy breaches

If we become aware of a privacy or security breach affecting your patients' information, we'll tell you without undue delay, and within 48 hours of confirming it, with the information we have at the time.

We'll help you meet your own obligations, including notifying the Office of the Privacy Commissioner and affected patients under the Privacy Act 2020, or the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme.

7. Patient requests

If a patient asks you to access, correct or delete their information, email hello@pelvilog.com and we'll help you respond promptly. Most requests can be handled in the app: you can see every entry in a diary, and delete a diary at any time.

If a patient contacts us directly, we'll pass the request on to you rather than act on it ourselves.

8. Retention and deletion

Diaries are deleted automatically once your clinic's retention period has passed. You set that period in Settings, from 7 to 365 days, and the default is 90. It runs from when the diary was completed, or from when the patient's link expired if the diary was never completed. Deleting a diary removes its entries, the patient's details and clinician notes together.

Database backups are kept for 7 days, so deleted data can remain in a backup for up to a week.

Sign-ups that are never confirmed are deleted after 2 days. Cliniko users who leave Cliniko before being invited, and have no diaries, are removed at the next daily sync.

Clinic and account information is kept while your account is open. When you close your account, we delete your clinic's data from our systems, subject to the same 7-day backup cycle.

9. Due diligence, term and governing law

On reasonable request, we'll give you information about our security and privacy practices to help with your own compliance, including completing a security or procurement questionnaire.

This DPA applies for as long as our Terms of Service apply to you. It is governed by New Zealand law. For any questions, contact hello@pelvilog.com.

Common questions

Does Pelvilog use AI?

No. Reports are calculated with fixed formulas from the patient's entries. No diary data is sent to any AI service, and none is used to train AI models.

Where is our patient data stored?

In Australia, including backups, with an Australian-owned host. The only patient data that leaves Australia is what's needed to send the invitation email: the patient's first name and email address, your clinic name, the diary type and start date. See section 4.

How long do you keep diaries?

As long as you choose, from 7 to 365 days after the diary is completed, with 90 days as the default. After that they're deleted automatically, and backups are overwritten within 7 days. See section 8.

Is anything left on the patient's phone?

Entries are kept in the phone's browser storage until they reach our servers, so nothing is lost without signal. When the patient sends their diary, those entries are cleared. The diary also keeps a copy of its page files so it opens quickly and works offline.

What does Pelvilog do in our Cliniko account?

It searches for and reads patient details when you send a diary, and reads your list of Cliniko users so you can invite your team. It uploads the report PDF to the patient's file when you click upload, or as soon as the patient finishes if you turn on automatic upload. If you turn on treatment notes in Settings, it also creates a draft note with the key results for you to finish. It doesn't change or delete anything else.

What happens if there's a data breach?

We'll tell you without undue delay, and within 48 hours of confirming it, then help you meet your notification obligations. See section 6.

Will you tell us if you change providers?

Yes. We'll email you before adding or replacing any sub-processor that handles patient information, so you can raise an objection before the change takes effect.