Health Privacy Statement

Shine to Success Collective Pty Ltd ABN 54 684 627 058 trading as Krew60 ("Krew60", "we", "us", "our") builds and runs The Front Office Foundation for health practices in Australia, the United States, and the United Kingdom. For health practices, the Service covers five front-office roles: Front Desk, New Patient Intake, Schedule & Recall, Reviews Manager, and Marketer ("the Service").

This statement explains how we handle patient information when the Service works for a health practice. It adds to our Privacy Policy and should be read with our Terms & Conditions, Service Agreement, and Payment Terms. Where this statement and the privacy agreement we sign with a practice (section 7) differ, the signed agreement applies.

1. Who Is Responsible for What

The practice decides why and how patient information is collected and used. The practice owns its patient information. We handle it only on the practice's behalf and on its instructions.

Country	The practice is	Krew60 is
Australia	The organisation responsible for the health information under the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), and any state health records law that applies to it	Its contracted service provider, bound by the APPs and our agreement with the practice
United States	A covered entity under HIPAA	Its business associate under HIPAA
United Kingdom	The controller under the UK GDPR and the Data Protection Act 2018	Its processor under Article 28 of the UK GDPR

The practice remains responsible for its own privacy notice to patients, its lawful basis for using their information, and the professional and advertising rules that apply to it. We help the practice set the Service up to fit them.

2. Patient Information We Handle

The Service handles only what it needs to answer, book, and follow up for the practice. Depending on the roles the practice uses, this can include:

• Contact details: name, phone number, email address, and preferred contact method
• Appointment details: the type of appointment, the practitioner, dates and times, confirmations, cancellations, and recalls
• New patient intake: the details the practice's intake forms ask for, which may include date of birth, insurance or health fund details, and the reason for the visit
• Calls and messages: call recordings, transcripts, and summaries, and SMS, email, and web chat history with the practice
• Reviews: review requests sent after a visit, and the replies we draft for the practice

The Service does not need clinical records, test results, or treatment notes to do its work, and we set it up not to ask for them. If a patient volunteers clinical details on a call or in a message, they are kept with that call or message, protected in the same way, and passed to the practice's team.

Where the Service connects to the practice's management or booking software, it reads and writes only what it needs to book, change, or confirm appointments. We confirm how it connects with the practice at onboarding.

3. How We Use Patient Information

We use patient information only to provide the Service to the practice: answering calls and messages, booking and managing appointments, sending reminders and recalls, following up new patient inquiries, requesting reviews, and supporting and fixing the Service.

We will never:

• Sell, rent, or trade patient information
• Use it to market Krew60, or anyone else, to the practice's patients
• Use it to train AI models
• Share it with another client, or combine it with another practice's data
• Give our sales team access to it

4. How the Service Talks to Patients

• It says it is AI. Every call starts by telling the caller they are speaking with an AI assistant for the practice, and that the call is recorded. We set this wording up with the practice so it meets the call recording rules where it operates.
• No clinical advice. The Service does not diagnose, advise on symptoms, medicines, or treatment, or interpret results. Clinical questions are passed to the practice's team.
• Emergencies. Anyone describing an emergency is told to hang up and call 000 (Australia), 911 (United States), or 999 (United Kingdom), and the call is flagged to the practice's team straight away.
• A person when they need one. If a patient asks to speak to someone, the Service takes their details and flags it to the practice's team straight away.
• Only what is needed. The Service asks only for the details needed to book or help the caller, and confirms identity before discussing an existing appointment.
• Reminders, not marketing. Appointment reminders, confirmations, and recalls are sent as part of the patient's care. Marketing messages are sent only to patients who have agreed to receive them, and every one includes a way to opt out.

5. Reviews and Marketing

• Review requests ask about the service (booking, staff, ease of the visit), never about treatment or results.
• Replies to public reviews never confirm that the reviewer is a patient and never mention their care.
• No patient's name, story, photo, or results is used in marketing without their written consent (in the United States, a HIPAA authorization).
• In Australia, we follow the Ahpra advertising rules, including no testimonials about clinical care in advertising.
• In the United Kingdom, we do not advertise prescription-only medicines, such as anti-wrinkle injections, in any form.
• Marketing content is practice news and general health education, and the practice approves it before it is published.

6. Who Else Handles It

The Service runs on established technology providers: the platform that holds the practice's records and messages, telephony and messaging providers, and the AI providers that power voice, transcription, and replies. They process patient information only to run the Service for the practice, under written contracts that give it the same protection as our agreement with the practice. For United States practices, this includes a business associate agreement with each provider that handles protected health information.

A practice can ask for the current list of providers that handle its patient information at any time, and we will tell the practice before we add or change one.

7. The Agreement We Sign With You

Before any patient information is handled, the practice and Krew60 sign a privacy agreement for the practice's country:

• Australia: our Health Information Handling Agreement, under the Privacy Act 1988 (Cth) and the APPs, including the state health records laws that apply to the practice
• United States: our HIPAA Business Associate Agreement (BAA)
• United Kingdom: our Data Processing Agreement under Article 28 of the UK GDPR, including the International Data Transfer Agreement

We send the agreement to the practice to read before it signs, and a copy is available at any time on request. The agreement sets out what we may do with patient information, the security we keep, how we tell the practice about a breach, the providers we use, and what happens to the data when the engagement ends.

8. International Data Transfers

Some of our technology providers store and process data in the United States and other countries where they operate. Before patient information is disclosed outside the practice's country, we take steps to make sure it is protected in a way that meets the practice's local law: for Australian practices, as required by APP 8.1; for United Kingdom practices, through the International Data Transfer Agreement, the UK Addendum to the Standard Contractual Clauses, or an adequacy decision.

9. Data Security

We take reasonable technical and organisational steps to protect patient information from misuse, interference, loss, and unauthorised access, change, or disclosure. These include:

• Encryption of patient information in transit and at rest
• Access limited to the people who need it to build, run, and support the Service, each with their own login and multi-factor authentication, and access removed as soon as it is no longer needed
• Practice control over which of its own staff can see patient information in the Service
• Confidentiality obligations for everyone at Krew60 who can access patient information
• Using established platforms that hold recognised security certifications

10. Data Breaches

If we become aware of a breach that affects a practice's patient information, we will tell the practice without delay, and within 72 hours. We will tell the practice what happened, what information was involved, and what we are doing about it, and help it meet its own obligations, including:

• Australia: assessing the breach and notifying the Office of the Australian Information Commissioner (OAIC) and affected patients under the Notifiable Data Breaches scheme
• United States: the notices required by the HIPAA Breach Notification Rule
• United Kingdom: reporting to the Information Commissioner's Office (ICO) within 72 hours where required

11. Data Retention

We keep patient information for as long as the practice uses the Service, or less if the practice asks us to. When an engagement ends, the practice has 7 days from the end date to export its data, either itself or by asking us, as set out in the Service Agreement. After that 7-day window, patient information is deleted or de-identified, unless the law requires us to keep it. Anything we must keep stays protected under this statement until it is deleted.

12. Patient Requests

Patients who want to access, correct, or delete their information should contact the practice. If a patient contacts us, we will pass the request to the practice, and we will help the practice respond within 5 business days of it asking, so it can meet the time limits that apply to it.

If a patient is not satisfied with how a complaint is handled, they can contact the Office of the Australian Information Commissioner at www.oaic.gov.au, the US Department of Health and Human Services Office for Civil Rights at hhs.gov/ocr, or the Information Commissioner's Office at ico.org.uk.

13. Changes to This Statement

We may update this statement when our Service, providers, or legal obligations change. When we do, we will update the "Last updated" date at the top of this page. If a change affects how patient information is handled, we will tell practices before it takes effect.

14. Contact Us

For questions about this statement or a practice's privacy agreement with us, contact our privacy contact:

Shine to Success Collective Pty Ltd

Trading as: Krew60

ABN: 54 684 627 058

Registered Address: Shell Cove NSW 2529, Australia

Email: [email protected]

Website: krew60.com

15. Change of Operating Company

Krew60 is currently operated by Shine to Success Collective Pty Ltd ABN 54 684 627 058. We may restructure our business in the future so that Krew60 is operated by a new or related company (the New Company). If we do:

• This statement transfers automatically to the New Company on the transfer date, together with every order, plan and agreement you have with us for Krew60. By accepting this statement, you agree to that transfer now. You do not need to sign anything new.
• From the transfer date, the New Company takes on all of our rights and obligations, and Shine to Success Collective Pty Ltd is released from obligations arising after that date.
• Your price, Service, guarantees and data protections carry across unchanged, and amounts already paid or owed are treated as paid to or owed to the New Company.
• We will email you at least 30 days before the transfer date, and list the New Company's details below.

Patient information, and every privacy agreement we have signed with a practice (the HIPAA Business Associate Agreement, the Health Information Handling Agreement or the Data Processing Agreement), transfer to the New Company on the same terms.

Current operating company	Shine to Success Collective Pty Ltd, ABN 54 684 627 058, Shell Cove NSW 2529, Australia
New operating company	None at this time
Transfer date	Not set