Privacy Policy

Open Book Clinical is a clinical decision-support platform operated by Auburn Health Pty Ltd (trading as Open Book Clinical). We help AHPRA-registered allied health professionals find evidence-based answers from trusted clinical sources including Cochrane, PubMed, and Australian clinical guidelines.

This Privacy Policy explains how we handle personal information — including health information — that we collect from clinicians, students, and organisations who use our platform. It covers our website at openbook-clinical.vercel.app and all associated services.

By creating an account or using our services, you agree to the collection and use of information as described in this policy.

We collect the following categories of personal information:

Search queries you submit may constitute health information under the Privacy Act 1988 (Cth) if they relate to the health of an identifiable individual. We treat all search query text as potentially sensitive and apply the same protections as other health information.

What we do with query text: Queries are transmitted to our AI processing pipeline to generate responses. Query text is stored in our database for up to 90 days to enable your search history feature, after which it is automatically and permanently deleted (see Section 7 — Data Retention).

What we do not do: We do not use query text to build profiles of individual patients. We do not sell or disclose query text to third parties except as required to operate the service (see Section 5). We do not use query text for advertising.

Your AHPRA number and registration details are stored solely to power the compliance tracking features of your account and are never shared with AHPRA or any third party without your explicit consent.

We use personal information we collect to:

• Provide, operate, and improve the Open Book Clinical platform
• Return AI-generated clinical evidence summaries in response to your queries
• Manage your account, subscription, and billing
• Track CPD hours and AHPRA registration renewal dates at your request
• Send transactional emails (account confirmation, password reset, subscription receipts)
• Send product update and engagement emails (you may opt out at any time)
• Detect and prevent fraud, abuse, and security incidents
• Comply with our legal obligations under Australian law

We do not use your information to make automated decisions with legal or significant effects without human review. Our platform provides decision support — clinical decisions remain entirely with the treating clinician.

We share personal information with the following third-party providers, each of whom processes data only as necessary to provide their service:

Where providers are located outside Australia, we take reasonable steps to ensure they are subject to substantially similar privacy protections, consistent with APP 8.

We do not sell personal information to third parties. We do not share personal information with advertisers. We do not share information with AHPRA, Medicare, or any government body except where compelled by law.

We retain personal information only for as long as necessary for the purposes set out in this policy or as required by law:

Search query history is deleted automatically by a scheduled process that runs every 24 hours. You can also delete individual searches manually from your search history at any time.

We implement the following technical and organisational measures to protect your information:

• All data in transit is encrypted via TLS 1.2+
• Data at rest is encrypted by our database provider (Supabase/AWS)
• Row-level security policies ensure each user can only access their own data
• Passwords are hashed using bcrypt — we never store plaintext passwords
• Payment card data is never transmitted to or stored on our servers
• Production API keys and secrets are stored as environment variables, never in source code
• Access to production systems is restricted to authorised personnel only

No system is completely secure. If you have reason to believe your account has been compromised, please contact us immediately at privacy@openbook-health.com.

Under the Australian Privacy Principles, you have the right to:

To exercise any of these rights, email us at privacy@openbook-health.com. We will respond within 30 days. Identity verification may be required before we can action requests.

We use strictly necessary cookies to maintain your authenticated session. These are set by Supabase Auth and are required for the platform to function. We do not use advertising cookies, third-party tracking cookies, or analytics cookies that identify individual users.

We use aggregate, anonymised analytics to understand platform usage. This data does not identify individual users and is not shared with third parties.

By using our platform, you consent to the use of strictly necessary cookies. If you disable cookies, you will not be able to log in.

We are subject to the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988 (Cth). If we become aware of a data breach that is likely to result in serious harm to any affected individual, we will:

• Contain the breach and assess its likely impact
• Notify the Office of the Australian Information Commissioner (OAIC) as soon as practicable, and no later than 30 days after becoming aware
• Notify affected individuals directly where required
• Take steps to prevent a recurrence

If you become aware of a potential security vulnerability or breach involving our platform, please disclose it responsibly to privacy@openbook-health.com.

We may update this Privacy Policy from time to time. When we do, we will update the effective date at the top of this page and, for material changes, notify you by email. Your continued use of the platform after a change constitutes acceptance of the revised policy.

Previous versions of this policy are available on request.

For privacy inquiries, access requests, correction requests, or complaints:

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC).