Privacy Policy

1. About This Policy

This privacy policy explains how Exora Health Pty Ltd (ABN 16 690 025 462) (“exora”, “we”, “us”, “our”) collects, uses, stores, discloses and protects personal information when you visit our marketing website at exora.au or use the exora platform, being our mobile app and our web app at app.exora.au (together, the “Service”).

exora is a personal health data platform that helps you organise your medical records using artificial intelligence. You upload your medical documents, and our AI extracts and structures the health information for your personal use.

Who this policy applies to. This policy applies to everyone whose personal information we hold. That includes account holders, the people whose health records are kept in a profile, healthcare providers and other people you share records with, visitors to our website, people whose personal information appears in a document that a user uploads, people who send an email to a user’s exora email address, and people a user adds to a trip who do not have an exora profile. Section 2 explains how we handle information about people who are not exora users.

Where exora is operated from. exora is operated from Australia by an Australian company, and health records are stored in Australia. The Service is available in other countries. We apply the standard set out in this policy to every user, wherever they are located. Section 14 sets out what this means if you are outside Australia.

We are bound by the Australian Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs). Health information is classified as sensitive information under the Act, and we treat it with additional care.

exora is not a medical device, healthcare provider, or clinical decision support system. Information provided by exora, including AI-generated summaries and structured health records, is for your personal reference only and does not constitute medical advice, diagnosis, or treatment. Always consult a qualified healthcare professional for medical decisions.

Terms used in this policy. The first three carry the same meaning as in our Terms of Service.

• Health Data means medical documents you upload, the clinical information our AI extracts from them (conditions, medications, allergies, vital signs, lab results, procedures, immunisations), and any related data stored in your exora account.
• AI Processing means the use of artificial intelligence to extract, structure, organise, and summarise information from your uploaded documents to write your Health Stories, and to power the AI chat assistant. In this policy it also covers the real-time voice assistant described in Section 9.
• Profile means a health record identity within your account. You may have a profile for yourself and profiles for dependents you manage. Several settings described in this policy apply to a profile rather than to an account.
• Account means the sign-in belonging to a single person, identified by an email address or phone number. One account may hold more than one profile.
• Verified healthcare provider means a user whose professional registration exora has verified, and who therefore has access to provider features. Section 8 sets out what records a verified healthcare provider retains.

2. What We Collect

Account information: Your name, email address or phone number, date of birth, and optional fields such as biological sex and gender identity. Your PIN is stored as a secure hash only. We never see or store the PIN itself. If you verify your identity through ConnectID, we receive your verified legal name and date of birth from your bank.

Health information: Medical documents you upload (PDFs, images, scans) and the clinical data our AI extracts from them, including conditions, medications, allergies, vital signs, laboratory results, procedures, and immunisation records. This is sensitive information under the Privacy Act and is only collected with your express consent.

Appointment recordings (exora scribe): If you choose to record a healthcare appointment, we capture the audio of that consultation and use it to generate a text transcript and a summary, and to extract health information into your record in the same way as an uploaded document. The recording is stored in Australia. A recording you make yourself is visible only to you and to anyone you choose to share it with. Where a verified healthcare provider recorded the consult, they also keep their own copy of it in their own file - see Section 8. Recording laws differ between states and countries, and obtaining the consent of everyone present before you record is your responsibility - see our Terms of Service. Where a verified healthcare provider records a consult with you through exora, obtaining your consent is theirs.

A consult a healthcare provider sends you: When a healthcare provider records a consult through exora and sends it to you, we hold the contact detail it is sent to: a mobile number or email address the provider enters, or that you enter yourself on the page you reach by scanning their QR code. We also hold the name and, if one is given, the date of birth entered with it. We use these only to deliver that consult to you and to make sure only you can receive it: a verification code sent to that number or address, the link to the consult, and at most two reminders if you have not yet received it. This applies whether or not you already have an exora account. These details are kept as part of the provider’s record of the consult (see Section 8).

Fitness and wellness data (only if you connect a health app or wearable): If you choose to connect one, we collect the measurements it holds for you: steps, distance travelled, calories burned, resting and average heart rate, heart rate variability, blood oxygen, weight, body fat percentage, sleep sessions and their stages, and recorded workouts. You connect it yourself, you grant the permissions in your device’s own health app, and you can disconnect at any time. Section 3 lists which apps and devices this covers.

We store summaries, not raw sensor streams. Your device records these measurements continuously, often many readings a minute. We keep one row per day, one per workout and one per sleep session, and we discard the underlying samples. We do this deliberately: the daily picture is what is useful in a health record, while the continuous stream is both far more revealing about your movements and of no added benefit to you here.

Travel plans (only if you plan a trip): If you plan a trip, we keep what you tell us about it: a name for the trip, the places you are going and in what order, which are only stopovers, your travel dates, where the trip starts, which of your profiles are travelling, the kind of trip if you mention it (for example a cruise, or a pilgrimage such as Hajj, which can indicate religious belief), and whether you have marked your travel clinic visit as booked. This is only what you enter; travel planning does not use your device’s location. We also keep a record of each change you make to a trip so that you can undo it. Each traveller’s list is put together on your device from that traveller’s immunisation records and from travel health advice published by governments. When you open one of those sources, its website opens and receives your visit as any website would; we do not send it your trip or your records. If you share a trip’s plan with someone, Section 5 explains what they see. Section 5 also explains what someone sees when you show them your Health Summary.

Travel documents (only if you add them to a trip): You can add a booking confirmation, e-ticket, boarding pass, itinerary, visa, or a screenshot of a booking to a trip, in chat or on the trip’s page, so that exora can fill the trip in for you. We store the files you add, privately and in Australia. Our AI reads them for what the trip needs and nothing else: the places and dates, where the trip starts, the first names of the people travelling (to match them to your profiles), and what kind of document each file is. It never takes out booking references, ticket, passport or frequent-flyer numbers, seats, prices, payment details, or addresses. Travel documents are not health records and are not added to your health record. A passport or ID page, or a file that is not about travel, is deleted as soon as it has been read. If a file is a vaccination record, we do not keep it with the trip: we offer to add it to your health records, and it is processed as a medical document only if you choose that; otherwise it is deleted within 24 hours. Travel documents can be seen only by the account that owns the trip, even where a traveller’s profile is shared with someone else, and they are not included in anything you share from exora. A travel document will often name other people travelling with you; we use their first names only to work out who is on the trip.

Emails sent to your exora email address (only if one is sent to it): Each account that has finished setup has its own exora email address, ending in id.exora.au. When an email arrives there, whether you forwarded it or someone such as your clinic sent it directly, we keep it for you: who it is from, the address it was sent to, its subject, when it arrived, its text and its attachments, and a picture of the first page of each attachment so that you can see what it is. We also record whether the sender’s email service confirmed that the email really came from them, and whether you have opened, archived or deleted each email. Nothing from an email goes into anyone’s health record until you choose to add it, and the AI that processes documents does not see an email until then, except as described in the next two paragraphs. If you block a sender, we keep their email address so that we can stop their emails reaching you. Emails often name other people; what we say below about information about other people applies to them too.

Before you add an attachment: To show you what an attachment is, our AI reads its first page if the sender’s email service confirmed who sent it. It works out what kind of document it is (for example a pathology result or a letter), its date, and the patient’s name and date of birth printed on it. We match that name to your profiles on our own servers and keep only three things: the kind of document, its date, and which of your profiles it seems to be about. The page’s text, and the name and date of birth printed on it, are not kept. This uses the same services that read an uploaded document (Google Cloud Vision for the text where the file does not carry its own, and our AI model providers, Section 6). The text of the email itself is not sent to an AI provider unless you add it to your records, or it comes from a sender whose documents you chose to add automatically (next paragraph). Attachments are first checked for viruses on our own servers in Sydney, Australia. An infected file, or a type of file we do not accept, is not kept.

Senders whose documents you choose to add automatically (only if you turn it on): For a sender whose email you have already added something from, you can choose to have what that sender emails you added to your record without being asked each time. We then keep that sender’s email address on your account until you turn this off. When the sender’s email service confirmed who sent an email, our AI reads the first page of each attachment that passed the virus check, and the text of the email itself. An attachment is added automatically if our AI judges it to be a health document other than a bill, and the email’s text is added if our AI judges that it records health information (rather than, for example, a covering note or a booking). For the email’s text we keep only what kind of writing it is and which of your profiles it seems to be about. If the name and date of birth on it match exactly one profile on your account, it is added for that profile. If it does not name anyone clearly, it is added without a profile and filed the way an upload with no profile chosen is: to the profile it clearly belongs to, or, where that is not clear, it waits in the app for you to choose who it is for. Anything else, such as a document naming someone who is not on your account, waits for you as usual, and we tell you why. Once added, it is processed like any document you upload. We record that it was added automatically, and we tell you each time. You can undo an automatic add, which deletes the document as described in Section 8, and you can turn this off at any time.

Information about other people: A document you upload will often contain personal information about people other than the profile it relates to: the name of your general practitioner or specialist, a person recorded as your next of kin, or a relative whose condition appears in a family history. Our AI reads the whole document, so this information is processed, and some of it is stored as part of your health record: which practitioner an appointment was with, for example, or a family history entry. We collect it because it appears in a document you have chosen to upload, and we use it only to organise and display your own record. We do not create an exora account or an independent record for those people, and we do not contact them. If you believe you are named in a document another person has uploaded and you wish to know what we hold, contact us at hello@exora.au. We will handle your request in the same way as a request from an account holder under Section 10.

People travelling with you who are not exora users: You can add someone without an exora profile to a trip, such as a friend or relative. For that person we keep only a first name and an age, and only on that trip. It is not a profile or a health record, we do not create an account for them, and we do not contact them. They are shown the general list for anyone travelling to those places. Please add someone only if they know you are planning the trip with them. Their details are deleted when you remove them from the trip, delete the trip, or delete your account.

Chat data: Messages you send to our AI health assistant and photos you share in chat for analysis. Photos shared in chat are stored on our servers alongside your chat history and are deleted when you delete the chat session or your account.

Voice-to-text input (chat composer mic): When you tap the microphone in the chat composer, your speech is converted to text. Where your device supports on-device speech recognition, this happens entirely on your phone and the audio never leaves the device. Where it does not, including older devices and the web app, the clip is uploaded and transcribed by Google Speech-to-Text in Singapore. Where a clip exceeds 60 seconds, which that service cannot process in a single request, it is transcribed by OpenAI instead. In every case the audio is transcribed and discarded immediately; we do not retain voice clips on our servers.

AI voice conversations (AI Assistant): When you opt in to AI voice conversations in Settings -> AI Assistant and explicitly accept the consent dialog the first time you use it, you can hold a spoken conversation with our AI assistant. Your microphone audio is streamed in real time to Google’s Gemini Live AI service for the duration of the conversation. We record the conversation (both your side and the assistant’s) as an audio file stored securely with your chat history so you can play it back; only you can access it. We also keep structured session metadata and the text transcript of the conversation (see Section 8). See Section 9 for the full description of how this works.

Device information: A unique identifier generated by the app (not a hardware device ID), your device name, platform (iOS or Android), app version, and push notification token if you enable notifications.

Location information (optional): If you grant location permission, we use your device’s approximate location to improve two features: suggesting nearby places when you add an appointment, and giving the AI health assistant city-level context. We use approximate (coarse) location only, never precise location, and only at the moment you use these features. We do not track you and we do not build a location history. You can decline location access and both features still work without it.

Marketing contact information: If you submit any form on our website (contact form, blog “follow along” signup, family-history-request, future EOI surfaces), we capture your email address, the form submitted, and limited submission metadata (page URL, UTM parameters, country and locale at submission, IP address, and the exact consent copy you saw). This is stored in our Sydney-hosted Supabase database (see Section 6) and used as described in Section 4.

Diagnostics and product analytics: Crash reports and a record of which features you use, so we can find bugs and understand which parts of exora are useful. These carry your account identifier only, not your name, email address or IP address, and never the contents of your health records. See Section 12 for exactly what is and is not collected.

Billing information (only if you become a paying member): We store your membership status, billing interval, and current billing period, together with the reference identifiers our payment processor gives us for your customer and subscription records. We also keep a history of your membership: each payment (its amount, its currency, and any discount or promotional code used), any failed payment or refund, and changes such as moving between monthly and annual billing or scheduling a cancellation. If you cancel and pick a reason from the list our payment processor shows you, we keep that reason; we do not keep anything you type in its comment box. We do not collect or store your card number, and we do not store your billing address; Stripe holds both.

Optional questions about how you found exora: When you set up your account we may ask how you heard about exora and what brings you to it, and after you become a member, what made you decide to join. Every question can be skipped, and the answers are picked from a fixed list rather than typed. We keep your answers with your account and use them only to understand how people find and use exora and to decide what to improve. We do not share them with anyone outside exora, and they are deleted when you delete your account.

What we do not collect: Contacts, browsing history, advertising identifiers, biometric data (Face ID and Touch ID are processed entirely on your device), or precise (GPS-level) location. We also never see or store your card details: if you become a paying member, your card is entered directly into Stripe, our payment processor (see Section 5).

3. How We Collect It

Directly from you: When you create an account, set up profiles, upload documents, send chat messages, take photos, use voice input, plan a trip, or add travel documents to one.

From emails sent to your exora email address: When you forward an email to it, or someone sends one there. Section 2 describes what we keep and what happens before you add anything.

Automatically from your device: Device identifiers, platform information, and push notification tokens are collected when you use the app.

From your documents via AI processing: When you upload a medical document, our AI reads it and extracts structured health information. This processing is initiated by you and serves the primary purpose of organising your health data.

From identity verification providers: If you choose to verify your identity, ConnectID returns your verified name and date of birth from your bank. This only happens when you initiate the process.

From a health app or wearable you connect: If you connect a health app or wearable, exora reads the fitness and wellness data described in Section 2 from it. You start each connection yourself, you grant the permissions in your device’s own health app, and you can disconnect at any time in Settings.

• In use today: Apple Health (iOS) and Health Connect (Android). The data is read on your device by the exora app and stored in your exora account in Australia. Neither Apple nor Google receives anything from us.
• We may also enable: a direct Garmin connection. We name it here in advance, for the same reason and in the same way as the AI providers in Section 5: it reads the same categories of data already described in Section 2, so switching it on is not a change to what we collect and will not require fresh notice under Section 13. Naming it here does not mean it is available yet. It differs in one respect - it would authorise exora to fetch your data from Garmin’s servers rather than reading it from your phone - and Garmin would then be added to the provider list in Section 5.

From other external health data sources: In future, we may enable you to connect exora to sources that hold clinical records rather than fitness measurements, such as government health records or pathology providers. Those are a different category of information, and we will update this policy before launching any such integration.

4. Why We Use It

We collect your information to provide you with a personal, AI-powered health data platform. Specifically:

• Providing the service: Storing, organising, and displaying your health records; processing your documents with AI; writing your Health Stories; powering the AI health assistant
• Account management: Authentication, device management, push notifications (with your permission)
• Sharing: Enabling you to share your health data with people and healthcare providers you choose
• Travel planning: Putting together each traveller’s list for a trip from official travel health advice and their immunisation records, and keeping the trip up to date as you change it, including from travel documents you add
• Receiving emails for you: Keeping emails sent to your exora email address until you deal with them, showing you what each attachment is, adding what you choose to your record, and adding documents automatically from senders you choose
• Delivering consults: Sending you a consult that a healthcare provider has shared with you, with the verification code and reminders described in Section 2
• Identity verification: Verifying your identity when you choose to use ConnectID
• Service improvement: Using aggregated, de-identified usage patterns and crash reports to fix problems and improve the platform (we do not use individual health data for this purpose: see Section 12)
• Marketing communications: Building a list of people who have submitted a form expressing interest in exora, so we can send product updates and the occasional newsletter. Every marketing email includes a one-click unsubscribe link. You can revoke at any time at exora.au/unsubscribe (use the link from any email we have sent you) or by emailing hello@exora.au.
• Legal compliance: Meeting our obligations under Australian law

What we do not use your data for: Advertising, sale to third parties, data mining, or commercial profiling. We do not use your health data to train AI models, and our AI providers do not train their models on it. If we ever wished to use de-identified data to improve our own systems, we would ask for your separate, explicit consent first (see Section 9). We do not send marketing messages unless you explicitly opt in.

When you upload a medical document, or add a file or an email’s text from your exora email address, you consent to its processing by our AI systems to extract, structure, and organise your health data. When you choose to have a sender’s documents added automatically, you consent in the same way to the processing of each document that sender’s emails bring, and of the text of those emails, until you turn it off. We also send necessary service communications (authentication codes, security alerts, policy updates, and messages delivering a consult a healthcare provider has shared with you) via email or SMS. These are not marketing.

5. Who We Share It With

People you choose: You control who sees your health data. You can share specific records with family members, carers, or healthcare providers through exora’s sharing features. You choose the permission level and can revoke access at any time. All sharing actions are logged.

Showing your Health Summary (only if you choose to): You can show the Health Summary of a profile your account owns to someone who does not have an exora account, such as a doctor, in two ways: with someone who is with you, by swapping a code and approving them after you see the name they typed; or by sending them a link yourself, from your own phone or computer. You choose which parts of the Health Summary they see. They can read it but not download it. Sharing in person lasts 15 minutes unless you add more time. A link works for the time you choose, up to 30 days, stops after ten openings, and each opening lasts up to an hour. We ask the reader for their name and, if they like, where they work; we show you what they typed, but we do not check it. We record when they read it, which parts they opened, and their IP address, so that you can see who looked and so that we can investigate misuse. You can end it at any time, which also ends anyone reading at that moment. If the reader then creates an exora account, they keep read-only access to the parts you showed only if you agreed to that before approving them; otherwise you receive a request, which you can accept or decline. If the reader gives us their email address, we use it only to send them an invitation to create an account. Anyone who has a link can open it, so send it only to people you mean to.

Sharing a trip plan (only if you choose to): You can share a trip’s plan by sending a link yourself, from your own phone or computer, or by showing it to someone with you using a code that you approve. The person reading it does not need an exora account. They see the trip (its name, places and dates) and the plan for each traveller you choose: that traveller’s name, their date of birth, the vaccinations on their record, and the official travel health advice set against them. If you choose, you can also add the Health Summary of any of those travellers, for example for a doctor or travel clinic: their allergies, conditions, medicines and immunisations, which the reader can read but not download, and which ends when the share ends. Nothing else from anyone’s health record is included, and your travel documents never are. You can only include profiles your account owns. Anyone else on the trip appears only as a number of other travellers, never by name. We ask the reader for their name and, if they like, where they work; we show you what they typed, but we do not check it. We record when the plan was opened and the reader’s IP address, so that you can see who looked and so that we can investigate misuse. A link works for the time you choose, up to 30 days, and stops after ten openings; sharing in person lasts 15 minutes unless you add more time. You can turn either off at any time, which also ends anyone reading at that moment. Anyone who has the link can open it, so send it only to people you mean to.

Service providers we currently use: These are the providers operating exora today, and what each one receives:

• Supabase - database and file storage (data hosted in Sydney, Australia)
• Google Cloud Platform - infrastructure (worker compute, storage in Sydney, Australia)
• Google Maps Platform (Places) - powers nearby-place suggestions when you add an appointment; receives your approximate location and search text only when you use that feature
• AI model providers: Google (Gemini, through Google Cloud) and Anthropic (Claude) - AI processing of your health information: reading the documents you upload, the first page of an attachment sent to your exora email address, and the text of an email from a sender whose documents you chose to add automatically (see Section 2), answering your questions in chat (including photos you share there), and writing your Health Stories. Section 6 sets out what they receive, where they process it, and how long each may keep it
• Google AI Studio (Gemini Live API) - AI inference for real-time AI voice conversations (Beta). This is a different Google product from the Google Cloud AI service above. Audio is streamed to Google’s global infrastructure (currently US-based for the model we use); the Cloud Data Processing Addendum that covers our Gemini Enterprise usage does not extend here. Use is gated behind explicit per-profile opt-in and informed consent (see Section 9). We are evaluating migration of this flow to Vertex AI Sydney once Google publishes the live-audio model variant there; this policy will be updated when that happens.
• Google Speech-to-Text (Singapore) - converts a dictated voice clip to text when your device cannot do it locally. Receives the audio clip only, and only for that request
• Google Cloud Vision (global) - reads the text in documents you upload (OCR), and in the first page of an attachment sent to your exora email address where the file does not carry its own text. Receives the page images of the document, only to return its text. Runs on Google’s global infrastructure, not in Sydney
• Google Cloud Text-to-Speech (global) - reads an AI answer aloud when you tap Read aloud. Receives the text of that answer only, and only for that request
• OpenAI - two narrow uses only: generating the mathematical representations we use to match your clinical terms to standard medical codes, and transcribing a dictated voice clip in the small number of cases the paths above cannot handle. It does not process your chat messages and it does not receive your documents
• Sentry (European Union) - crash and error reporting inside the app. Receives your account identifier, the error, and where in the app it happened. Never health information (see Section 12)
• PostHog (European Union) - product analytics inside the app. Receives your account identifier and which features are used. Never health information, and screen recording is switched off (see Section 12)
• Vercel - hosts our marketing website and API routes (stateless transit layer for app data; app data is stored in Australia). Also provides cookieless aggregate analytics for the marketing website (see Section 12)
• Cloudflare Turnstile - checks that a sign-up or sign-in comes from a person rather than an automated program. Receives technical information about your browser or device, including your IP address, for that check only. Never health information
• Mailgun (European Union) - receives emails sent to exora email addresses (ending in id.exora.au) and passes each one straight to us in Sydney, Australia. It is set not to keep a copy of the email. It keeps a delivery record (the sender, the address it was sent to, the subject and the time) for 1 day, and nothing else from the email. It never receives your exora records
• Migadu (European Union) - hosts our own email inbox, so it receives any message you send to hello@exora.au or another exora.au address. Mail to your personal exora email address (ending in id.exora.au) does not go to Migadu
• ConnectID - identity verification (Australia only)
• Expo - push notification delivery routing
• Resend - email delivery for sign-in codes, messages delivering a consult a healthcare provider has shared with you, and marketing emails (receives your email address and the message; never your health records)
• Twilio - SMS delivery for sign-in codes and messages delivering a consult a healthcare provider has shared with you (receives your phone number and the message text; never your health records)
• Stripe - payment processing for paid memberships. Receives your email address and your exora account identifier, so that it can manage your subscription and send you receipts. You enter your card and billing details directly into Stripe, including the billing address it needs to calculate GST; exora never sees or stores either. It never receives health data.

How we choose between AI providers. exora is designed so that either of the AI model providers above (Google and Anthropic) can do any of the AI tasks described in this policy. We move work between them, and between their models, based on quality, reliability and cost, without first amending this policy, because each of them is bound by the terms set out in Section 6. Adding a new AI company, giving OpenAI more than its two narrow uses, sending AI providers a kind of information this policy does not already describe, or allowing a provider to keep information for longer than Section 6 states, is a material change: we would update this policy and give you at least 14 days notice under Section 13.

Moving processing away from a third party, for example by running a model on our own infrastructure, reduces who receives your data rather than extending it, and does not require advance notice.

Message delivery providers (Resend, Twilio) receive your email address or phone number and the text of the message, never your health records. A message delivering a consult does not contain the consult itself. A text message says only that an exora link is ready or gives a verification code. An email may name the healthcare provider who shared the consult, which indicates that you consulted them.

Who cannot access your data: Other exora users (unless you share with them), advertisers, data brokers, insurance companies, or employers.

Access by exora staff: A small number of authorised exora personnel can access your records where necessary to run the service: for example, to provide support, investigate a problem, protect safety, or maintain the platform. This access is limited to those who need it, is recorded in an audit log, and is subject to confidentiality obligations. We do not access your health information for any other purpose.

We may disclose your personal information if required by law or legal process (such as a court order). If we receive a legal request for your data, we will notify you before disclosing it unless we are legally prohibited from doing so.

If exora is sold, merges, or closes. exora may one day be acquired, merge with another company, or cease trading. If that happens, personal information held in the Service may transfer to the new owner as part of the business. The following applies.

We will tell you before your information is transferred, and give you at least 30 days to export your records or delete your account first.

The acquirer is bound by this policy as it stands at the time of the transfer. If it later wishes to change how your information is handled, it must give you notice under Section 13, and you may leave with your data.

We will not sell your health records as a separate asset. Health data transfers only together with the Service that holds it, and only to an owner continuing to operate that Service. We will not sell, licence or transfer health records to a data broker, an advertising business, an insurer, or any buyer acquiring them for their own use rather than to run exora.

If exora becomes insolvent, an external administrator’s powers are set by law and may exceed what we can promise here. We would seek to give you notice and an export window, and would put the commitment above to the administrator, but we cannot guarantee an administrator’s decisions. We say so plainly because a promise that depends on our continued solvency is worth less than one that does not, and you are entitled to know which this is.

6. Where Your Data Is Stored and Processed

Stored in Australia. Your health records, documents, and account data are stored in Sydney, Australia, using Supabase (on AWS ap-southeast-2) and Google Cloud Platform (australia-southeast1).

AI processing happens overseas. The AI models exora uses are not offered in Australian data centres through the services we use, so when our AI reads your documents, answers your questions or writes your Health Stories, that content is sent to the AI provider and processed outside Australia. This applies to every AI request, including matching your clinical terms to standard medical codes. Each provider routes requests through its global infrastructure, so processing may take place in any country where it operates, including the United States, Europe and Asia. Your records themselves stay stored in Australia.

What AI providers receive. Only what a task needs: the document being read, your question and the parts of your health record looked up to answer it, or the records that make up the Health Story being written, with your first name, age and sex. They return the result to us and do not keep it except as set out below.

Where each AI provider processes, and how long it may keep what it receives:

• Google (Gemini, through Google Cloud), under our signed Cloud Data Processing Addendum: processed on Google’s global infrastructure. Nothing is kept after the request completes, and server-side caching is switched off, with one exception: where Google’s automated safety classifiers flag a request, Google may log it for a limited period for review by authorised staff. We applied to Google on 2 August 2026 for an exemption, and will update this policy with the outcome.
• Anthropic (Claude), under its commercial terms: processed on Anthropic’s global infrastructure. Kept for up to 30 days for safety and abuse monitoring, and up to 2 years if its automated safety systems flag it. When Health Stories are written in bulk (for example in a scheduled update), Anthropic also holds each request and the story it returns for up to 29 days, in the United States, so that we can collect them. We have requested zero data retention.
• OpenAI (medical-code matching and some voice transcription only), under its commercial terms: processed in the United States. Kept for up to 30 days for safety and abuse monitoring. We have requested zero data retention.

No AI provider uses your information to train its models.

Other services that run overseas. Reading the text of an uploaded document (Google Cloud Vision) and reading an answer aloud (Google Cloud Text-to-Speech) run on Google’s global infrastructure, under our Cloud Data Processing Addendum. Voice dictation your device cannot transcribe itself goes to Google Speech-to-Text in Singapore, or to OpenAI for a clip over 60 seconds. Real-time voice conversations (Beta) use Google AI Studio’s Gemini Live API on US-based infrastructure, under different terms described below and in Section 9. Crash reporting (Sentry) and product analytics (PostHog) are hosted in the European Union. Emails sent to your exora email address pass through Mailgun in the European Union on their way to us, and are stored in Australia.

• Google AI Studio - Gemini Live API (voice conversations only): Real-time audio is streamed from our Sydney proxy server to Google’s global Gemini Live endpoint, which currently routes to US-based infrastructure for the audio model we use. As of this policy version, this flow is not covered by our Cloud Data Processing Addendum with Google. We use a paid AI Studio account, under which Google’s terms state that submitted prompts and responses are not used to improve or train its products. On the free tier they may be. Live API sessions carry a documented default retention of up to 24 hours. You can disable voice for any profile in Settings -> AI Assistant.

We rely on signed contractual protections (Cloud Data Processing Addendum with Google; commercial terms with Anthropic and OpenAI; data processing terms with Sentry and PostHog) as our safeguard under APP 8 of the Privacy Act. For Mailgun, we rely on its data processing terms, which form part of its terms of service. If a provider breaches the APPs in handling your data, exora remains accountable under section 16C of the Privacy Act.

Our API routes are hosted on Vercel, which may process requests through servers in multiple regions during transit. All data is stored in Australia; Vercel acts as a stateless transit layer only.

Vercel, which hosts our marketing website and provides its Web Analytics (see Section 12), is a US company and may process that website analytics data outside Australia, including in the United States, under its data processing terms.

All infrastructure providers maintain standard operational logs (including IP addresses and request metadata) for security monitoring and debugging, subject to their own retention policies.

7. How We Protect Your Information

We employ the following measures to protect your information:

• Encryption: All data is encrypted in transit (TLS) and at rest by our infrastructure providers
• Access controls: Row-Level Security on all clinical database tables ensures other users cannot access your data. Authorised staff and back-end systems access it only through controlled, audited pathways (see “Access by exora staff” in Section 5)
• User-isolated storage: Each user’s documents are stored in their own folder
• Authentication: Sign-in uses one-time codes sent to your email address or phone. We do not use passwords and do not store any
• Biometric unlock: Face ID and Touch ID are processed on your device; biometric data never leaves your device
• Session security: Authentication tokens are rotated on every use
• Audit logging: Changes to your health data, and staff access to your records, are recorded in an audit log
• Infrastructure certification: Our database provider (Supabase) maintains SOC 2 Type II certification

No system is completely secure. If we ever experience a data breach affecting your personal information, we will notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

8. How Long We Keep It

While your account is active: Your health data, documents, and chat history are retained for as long as your account exists. You can delete individual records at any time.

When you delete your account: All data is removed from live systems immediately and becomes inaccessible. Your account enters a 30-day recovery window during which you can reactivate by signing back in. After 30 days, an automated process permanently deletes all your data, including health records, documents, processing data, chat history, and storage files. Backup copies are removed within the periods set out under Backup retention below. Security logs are not removed when your account is deleted: each entry is kept for 12 months from when it was made, then deleted automatically (see Security logs below).

What survives deletion: Audit log entries are retained for at least 7 years after account deletion for compliance purposes. These logs contain user identifiers, timestamps, records of data changes, and records of administrative access to accounts. They are not anonymised. Aggregated processing metrics (which do not contain health data) are also retained. We also keep a record of which version of this policy and of our Terms of Service you accepted, and when, as evidence of that agreement; it contains no health information.

Records kept by your healthcare providers: When a verified healthcare provider you connect with records a consult, uploads a document, or writes a note for you on exora, exora retains a copy of that item on the provider’s behalf, as part of the provider’s own record of the care they provided. Healthcare providers are legally required to keep such records. Where the provider recorded the consult, their copy includes the audio of that recording, for consults recorded from 31 October 2026 onwards; your own copy of that audio is still deleted 30 days after the recording (see Appointment recordings below), and the provider’s copy goes when they delete it or when they close their exora account. A provider’s copy contains only the items that provider authored, recorded or uploaded, never your wider health record, and captures your name and date of birth as at the time it was created. It is retained even if you revoke the provider’s access, delete the item from your own record, or delete your exora account. If the provider sent the consult to you by text, email or QR code, the mobile number or email address it was sent to, and the name and date of birth entered with it, are kept as part of that copy. To request removal of a provider’s copy, contact that provider directly. Family members and other non-provider contacts do not retain copies. exora retains these copies as a convenience to providers and is not the provider’s system of record; providers remain responsible for meeting their own record-keeping obligations.

Records of who you shared with: When you give a verified healthcare provider access to your record, exora keeps a record of that access on the provider’s behalf: your name, your date of birth, and the dates their access started and ended. This forms part of the provider’s own record of who they treated and when they were able to see your information. This record contains nothing else - no health information, no documents, and no part of your wider record. In the provider’s app it appears as an inactive entry showing your name, your date of birth and those dates, with a button to ask you for access again. You can decline, and you can block a provider from asking you at all. It is retained even if you revoke that provider’s access or delete your exora account. Where a provider holds a record of access but has never created anything for you, you can ask us to remove it and we will. Where they have created something, that item is part of their own clinical record and you should contact them directly, as described above.

An identity check you carried out for someone else: If you vouched for another person’s identity on exora, that vouch belongs to their verification record, not yours, and it stays with them if you delete your exora account. It keeps your name and, where you vouched as a registered practitioner, your profession and registration number, because that is what gives the check its weight. Removing it would quietly downgrade another person’s verified status because you left. It holds no health information, and we do delete what we captured about you at the time of the check, including your device and network details.

Backup retention: Automated database backups are kept for 7 days on a rolling basis. Uploaded documents, and the files that belong to them, are also copied each night to an encrypted backup held in Sydney, Australia, on Google Cloud, so they can be restored if something goes wrong. Audio recordings are never included in any backup. When you delete a document, or when your account is permanently deleted at the end of its 30-day recovery window, its backup copies are removed within 17 days of the file leaving our live storage.

Security logs: From 23 October 2026, we keep a record of the requests made to our servers, in an encrypted archive in Sydney, Australia, on Google Cloud: when each request was made, the IP address and country it came from, the type of device or browser and the app version, your account identifier, which record or action it involved, and whether it succeeded. From 30 October 2026, our database in Sydney, Australia also records each time someone opens health records: when, which account opened them, whose records they were, and what kind of record it was. Neither record ever contains your health information - not the contents of your records, the names of your documents, or what you searched for. We use them only for security: to detect and investigate misuse, fraud and data breaches, and to tell you whether your records were accessed if something goes wrong. Because these are the security record of who accessed what, they are not removed when you delete a record or your account. Each entry is deleted automatically 12 months after it was made.

Website measurement: the records of visits to our marketing website described in Section 12 are deleted automatically 25 months after the visit, and those flagged as automated programs after 90 days. The daily random value used to count visitors is deleted the day after it is created. Where a new account came from (Section 12) is kept with the account and deleted when the account is deleted.

AI provider retention: How long each AI provider may keep what it receives is set out in the table in Section 6.

Appointment recordings: Your copy of the audio is deleted automatically 30 days after the appointment is recorded. While it is still available the app shows you the date it will go, and you can download a copy to keep or delete it sooner yourself. Deleting your copy does not remove a provider’s own copy of a consult they recorded - see Records kept by your healthcare providers above. The transcript, the summary, and any health information extracted from the recording are part of your health record and are kept for as long as your account exists.

Fitness and wellness data: Kept for as long as your account exists. Disconnecting a health app or wearable stops any further data being collected; the daily summaries, workouts and sleep sessions already in your record remain part of that record, and are deleted when you delete the profile they belong to or your account.

Travel plans: Kept until you delete the trip or your account. The record of changes to a trip, and any traveller without an exora profile, are kept with the trip and deleted with it. A trip is also deleted if every profile travelling on it is deleted and no one else is on it.

Shared Health Summaries and trip plans: A link you create stops working when its time runs out, after ten openings, or when you turn it off. The record of who read a Health Summary or trip plan you shared, and when, is kept so that you can see it, until the profile it is filed under or your account is deleted.

Travel documents: Kept with their trip until you delete them, the trip, or your account. A file you add that is not saved to a trip is deleted within 24 hours. About a week after a trip ends, the app asks you once whether to keep that trip’s documents or delete them. Deleted travel documents are permanently removed from storage, usually within a day.

Emails sent to your exora email address: An email waits until you add something from it, archive it or delete it, and we remind you if it is still waiting 7 and 30 days after it arrived. If the sender’s email service did not confirm who sent it, an email still waiting 90 days after it arrived is removed, and we tell you at least 7 days before. Once you have added something from an email, the email, including its text, stays as the record of where that document came from (who sent it and when) until you delete it. If you archive an email, it is kept with its text and all of its attachments, whether or not you have added anything from it, until you delete it; we do not remind you about an archived email, and it is not removed after 90 days. An email you delete, one removed after 90 days, or one from a sender you block, is deleted with its attachments 30 days after it is removed, and until then you can restore one you deleted. Deleting an email does not delete any document you have already added from it. An attachment you chose not to add is also deleted 30 days after you dealt with the email it came with, unless you archived that email. The picture of an attachment’s first page is deleted once you add it, because the document has its own. A blocked sender’s email address is kept until you unblock them, and the address of a sender whose documents you chose to add automatically is kept until you turn that off. Undoing an automatic add deletes the document in the same way as deleting any document, and the email waits for you again. All of these are deleted with your account. Backup copies are removed as set out under Backup retention.

Local device data: Voice recordings stored on your device are automatically deleted after 7 days. Cached session data is cleared when you sign out.

AI voice conversations: When you have a real-time voice conversation with the AI assistant, we keep three things: (1) an audio recording of the conversation (both your side and the assistant’s) stored securely with your chat history so you can replay it, accessible only to you; (2) session metadata (start time, end time, reason for ending, the volume of data transferred, and any error states) in our audit log, for security and abuse-detection purposes; and (3) the text transcript in your chat history. The recording and transcript follow your chat history: if you delete the conversation, they are deleted too (after the 30-day recovery window), and they are removed when you delete your account. We currently retain voice recordings indefinitely while we improve our voice transcription. We will review this retention period and amend this policy accordingly. Audio is never used to train AI models.

Marketing contact information: Retained for as long as you remain subscribed. When you unsubscribe (one-click via any marketing email or at exora.au/unsubscribe), we keep the row marked as unsubscribed so we have proof of your consent revocation and so we never accidentally re-subscribe you. To request full deletion of the row itself, email hello@exora.au; we will action it within 30 days.

9. Artificial Intelligence

What our AI does. When you upload a medical document, our AI reads the full content of that document, including any names, dates and other personal details it contains, to identify health information (conditions, medications, allergies, vital signs, lab results, procedures, immunisations) and organise it into your structured health record. Our AI writes your Health Stories: a plain-language account of each part of your health, built from your records and kept up to date as they change. When an attachment is sent to your exora email address from a sender we can confirm, our AI reads its first page to tell you what it is, and for a sender whose documents you chose to add automatically it also reads the email’s text, as described in Section 2; nothing from it enters your record until you add it, unless you chose to have that sender’s documents added automatically. Our AI chat assistant can answer questions about your health data. You can also send photos for AI analysis and use voice input that is transcribed by AI. When you plan or change a trip in chat, our AI reads what you write, and the trip as it stands, to fill in the trip (where, when and who is going) for you to check and confirm; nothing is saved or changed until you do. When you add travel documents to a trip, a separate AI reader used only for travel reads them in the same way, taking out only what Section 2 describes; the chat assistant itself does not see them, and they are not processed as medical documents unless you choose to add a vaccination record to your health records. The travel list itself is not written by AI: it relays what governments publish for your destinations and sets it against your records. It is not medical advice, and you should go through it with your doctor or a travel clinic.

AI providers. We use AI models from Google and Anthropic, and may move any task between them based on quality, reliability and cost; OpenAI is used only to match your clinical terms to standard medical codes and as a fallback for voice transcription. Document scanning (OCR) uses Google Cloud Vision, and voice dictation is transcribed on your device where possible. Section 5 lists every provider, and Section 6 sets out where each processes your information and how long it may keep it.

Your data and AI training. Your health data is not used to train AI models. Our AI providers process your data solely to return results to you, under their commercial API terms. Providers may keep data only for the limited periods set out in Section 6. We do not currently use your data to train or improve exora’s own AI systems. In future, we may offer you the opportunity to contribute de-identified data to improve our systems. Any such use would require your separate, explicit consent.

AI accuracy. AI-extracted information may contain errors, omissions, or misinterpretations. Data quality indicators shown in the app reflect processing confidence and do not constitute clinical validation. Medical codes are AI-assigned and have not been verified by a healthcare professional. Always verify important health information with your healthcare provider and against your original documents.

No automated decisions. Our AI organises and summarises your health information. It does not make medical decisions, diagnoses, or treatment recommendations. No automated decisions are made by our systems that affect your legal rights or interests. Using exora does not create a doctor-patient or healthcare provider relationship.

Emergencies. The exora app is not designed for medical emergencies. If you are experiencing a medical emergency, call 000 (Australia) or your local emergency number immediately.

AI voice conversations (Beta). A separate Beta feature lets you hold a real-time spoken conversation with our AI assistant about a specific profile’s health records. This is structurally different from the voice-to-text chat input (where a single clip is transcribed and discarded). Here, your microphone audio is streamed continuously, the AI’s spoken response is streamed back, and the conversation can include multiple back-and-forth turns.

How the connection works. Your device establishes an authenticated connection to our server in Sydney, which holds our credentials for the Google service so that they are never present on your device. Your microphone audio passes through that server to Google’s Gemini Live API, and the assistant’s response audio returns by the same route. We retain session metadata (start time, duration, reason for ending, and the volume of data transferred) and the text transcript for audit and abuse-detection purposes. We also record the conversation, both sides, as an audio file stored with your chat history so that you can replay it; only you can access that recording. Section 8 sets out how long each of these is kept.

Per-profile opt-in. Voice conversations are OFF by default for every profile. To enable them, the profile owner navigates to Settings -> AI Assistant and toggles “AI voice conversations” on. The setting follows the profile, not the account holder. If you share a profile with someone else, voice availability on that profile is the owner’s choice.

Informed consent before first use. The first time you actually start a voice conversation for a profile, you will see a consent dialog summarising what data is sent, where it is processed, what is retained, and that you can withdraw the feature at any time in Settings. You must tap “I understand and consent” before any audio leaves your device. Acceptance is recorded with a timestamp.

Withdrawing voice access. Toggle the feature off in Settings -> AI Assistant at any time. Existing session logs, transcripts, and voice recordings remain in your audit log and chat history under your control (you can delete individual chat sessions, which deletes their recordings too). Disabling voice does not delete past records; we recommend reviewing the relevant section of this policy for our retention details.

Region of processing. As of this policy version, real-time voice conversations are processed by Google’s Gemini Live API in their global infrastructure, currently routing to US-based servers for the audio model we use. We are evaluating migration to Vertex AI in Sydney once the live-audio model is published in the Australian region. This policy will be updated when that change occurs.

Why this is treated differently from text chat. Our other AI processing runs under the terms in Section 6, including our Cloud Data Processing Addendum with Google. That addendum does not extend to the Gemini Live API on Google AI Studio. We have made the live-voice feature available in Beta while we evaluate the data residency and contractual options available to us. The per-profile opt-in, the consent dialog and the audit logging exist so that your choice to use it is an informed one.

The voice assistant is not a medical professional. Everything in this section also applies to voice: the AI organises and summarises your information; it does not provide medical advice, diagnoses, or treatment recommendations. Do not rely on the voice assistant in a medical emergency. Call 000, or your local emergency number, instead.

10. Your Rights

Under the Australian Privacy Principles, you have the right to:

Access your data. You can view all your health data in the app. To request a full copy of your personal information, contact us at hello@exora.au. We will respond within 30 days.

Correct your data. You can edit your profile information in the app. For AI-extracted health records, you can add notes, delete inaccurate records, or re-upload corrected documents. If you believe any other information we hold is inaccurate, contact us and we will correct it.

Delete your data. You can delete individual records in the app, or delete your entire account from Settings. Account deletion removes all your data (see Section 8 for details).

Control sharing. You choose who to share your health data with, what to share, and for how long. You can revoke access at any time.

Withdraw consent. Consent for AI processing is given each time you upload a document, start a chat, or connect a device, so you withdraw it by not doing those things. Emails sent to your exora email address are the exception: you start them by giving someone the address, and an attachment from a confirmed sender is read as Section 2 describes before you add it. To stop that, stop giving out the address, or block the sender. The only standing permission is one you switch on yourself: having a sender’s documents added automatically. You withdraw it by turning it off for that sender, which takes effect for the next email they send. Routine updates continue on records you have already added: a medication is marked finished once its prescribed course has ended, and duplicate visits are merged. To stop that as well, delete the data. Because holding your records is itself processing under privacy law, we cannot keep your records and not process them - so deleting your data, a profile, or your account is what ends processing completely.

Deal with us anonymously or by pseudonym. You may deal with us anonymously or under a pseudonym for general enquiries. This is not possible where we need to identify you in order to provide the Service, such as where you hold an account containing health records, or where the law requires us to identify you.

Complain. See Section 15.

How to make a request. The remainder of this section explains how to exercise the rights above. Send any request to hello@exora.au. Before acting on a request concerning an account, we will take reasonable steps to confirm that you are the account holder. This protects you against someone else obtaining or deleting your records. We do not charge a fee for access, correction or deletion. Where you ask for a copy of your personal information, we provide it in a commonly used, machine-readable format.

When we may refuse a request. We may decline a request where the law permits or requires us to do so: for example, where granting access would have an unreasonable impact on another person’s privacy, where the request is frivolous or vexatious, or where the information relates to an anticipated legal proceeding. If we refuse a request, we will tell you why in writing and explain how to complain.

If you are outside Australia. The law where you live may give you rights in addition to, or different from, those set out above. Section 14 explains how we handle those requests.

11. Children and Young People

exora requires a minimum age of 14 to create an independent account in Australia. This aligns with the age at which individuals gain control of their own My Health Record.

Outside Australia, the minimum age to create an independent account is 14, or a higher age where the law of the country you live in requires one.

Parents and guardians can manage health records for children of any age through dependent profiles on their account. The parent or guardian declares their authority when creating a dependent profile and controls all data and sharing for that profile.

We do not knowingly allow children below the minimum age for their region to create independent accounts. If we discover an account was created by someone under the minimum age, we will work with the child’s parent or guardian to resolve the situation, which may include closing the account or migrating data to a parent-managed dependent profile.

12. Cookies and Tracking

We do not use advertising cookies, tracking pixels, or cross-site tracking.

Our web app uses essential cookies only for authentication and session management. These are necessary for the app to function and do not track you across other websites.

Our marketing website sets two preference cookies, which remember the language and country you are shown so the site opens in the right version next time. They contain only that choice, are kept for up to a year, and are not used to identify or track you.

Marketing website analytics. Our marketing website at exora.au uses Vercel Web Analytics and Speed Insights to measure aggregate visitor traffic and page performance. These tools are cookieless and do not identify you individually. They collect: the page URL visited, the referring website, your approximate country (derived from your IP address, which is then discarded and not stored), device type, browser, operating system, and Core Web Vitals performance metrics. The data is aggregated and used solely to understand how our marketing site performs and to improve it. Vercel acts as our data processor.

Our own website measurement. We also measure our marketing website ourselves, without cookies, and store the results in our database in Sydney, Australia. For each visit we record the page visited, the referring website’s domain, any campaign tags in the link you followed, your approximate country, your device type, browser and operating system, the website’s language, whether you scrolled or interacted with the page, and which of our buttons and links you tap (for example, to sign up or to download the app). To count how many different visitors we have without identifying anyone, we combine your IP address and browser details with a random value that changes every day and is then deleted, so a visit cannot be linked to you or to your other visits on another day. Your IP address is never stored. Visits from automated programs are flagged so they can be left out of our figures. These visit records are never linked to an exora account.

Where a new account came from. While you browse our website, your browser keeps a short note of that visit for as long as the tab is open: the first page you landed on, the domain of the website that sent you there, any campaign tags in the link you followed, and up to five other pages you read. The note contains no identifier. If you then follow a link into the exora app, or install the app from Google Play, and create a new account, the app sends the note once, after you have finished setting up your account, and we store it with your account so we can understand which pages and websites lead people to exora. We do not record your other visits or pages you read on other days. Accounts that already exist are never given this information.

In-app crash reporting and product analytics. Inside the exora apps we use two tools: Sentry for crash and error reporting, and PostHog for product analytics. Both are hosted in the European Union rather than the United States. Both are configured to collect substantially less than their default settings allow, because those defaults are not appropriate for a health application.

What they receive: your account identifier, which features and controls you use, and, when something goes wrong, the technical details of the error and where in the app it occurred.

What they do not receive: your name, email address or IP address; any part of your health records; the contents of your documents, chat messages or search terms. Specifically, and because these are the settings that would otherwise capture patient information:

• Session replay is switched off. This feature records on-screen content, which in a health application would include health information.
• Autocapture is switched off. This feature automatically records taps and the text visible on screen.
• Performance tracing is switched off, so we do not sample the network requests the app makes.
• Error reports are stripped of request contents, cookies, headers and diagnostic messages before they are sent.

We use this information to identify crashes and to understand which parts of exora are used. It is not used for advertising, is never sold or shared with third parties, and is not used to train AI models. If you would like your analytics and crash data deleted, email hello@exora.au.

13. Changes to This Policy

We may update this policy to reflect changes in our practices or legal requirements.

Material changes (changes to what data we collect, how we use it, or who we share it with, other than a new optional feature described below): We will give you at least 14 days advance notice via in-app notification and/or email before the changes take effect.

New optional features: When we add a feature that collects or uses information only if you choose to use it, we may update this policy to describe it when the feature becomes available, without advance notice. Nothing changes for information you have already given us, and nothing is collected until you use the feature. If you do not agree, you can simply not use it.

Minor changes (clarifications, formatting, correcting errors): We may update the policy without advance notice.

The date at the top of this policy indicates when it was last updated. Previous versions are available on request by contacting hello@exora.au. Continued use of exora after changes take effect constitutes acceptance of the updated policy. If you do not agree with the changes, you may delete your account before they take effect.

14. Users Outside Australia

exora is operated from Australia and is designed principally for Australian users. Our apps are available in other countries, and this section explains what that means for you.

Your information is held in Australia. If you use exora from outside Australia, your personal information is transferred to and stored in Australia and is handled under Australian law. Section 6 sets out where processing occurs, including the AI processing that takes place outside Australia for all users.

The standard we apply. We apply the Australian Privacy Principles to every user regardless of location. We do not operate a lower standard for users outside Australia.

The law where you live may give you additional rights. Privacy law in your country may give you rights that the Australian Privacy Principles do not, such as rights to data portability, to restrict processing, or to object to processing. Where the law requires us to honour such a request, we will do so. Contact us at hello@exora.au and tell us where you are located, so that we can identify which law applies to your request.

The language of this policy. This policy is written in English. We publish translations in other languages for your convenience, and we work to keep them accurate. If a translation differs from the English version, the English version applies. This does not limit any right you have under the law where you live to receive information in your own language.

Complaints from outside Australia. You may complain to us first under Section 15. You may also be able to complain to the privacy regulator where you live:

• European Economic Area: the supervisory authority for your country. A list is maintained by the European Data Protection Board at edpb.europa.eu
• United Kingdom: the Information Commissioner’s Office, ico.org.uk
• New Zealand: the Office of the Privacy Commissioner, privacy.org.nz
• Canada: the Office of the Privacy Commissioner of Canada, priv.gc.ca, or your provincial privacy commissioner
• Brazil: the Autoridade Nacional de Proteção de Dados, gov.br/anpd
• Elsewhere: contact us and we will tell you which regulator, if any, oversees our handling of your information in your country

15. Complaints

If you have a concern about how we handle your personal information:

Step 1 - Contact us. Email our Privacy Officer at hello@exora.au. We will acknowledge your complaint within 5 business days.

Step 2 - Investigation. We will investigate your complaint and provide a substantive response within 30 days. If we need more time, we will let you know.

Step 3 - Escalation. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC). If you are outside Australia, Section 14 also lists the privacy regulator for your country. The OAIC’s contact details are:

• Website: www.oaic.gov.au
• Phone: 1300 363 992
• Online complaint form: www.oaic.gov.au/privacy/privacy-complaints
• Post: GPO Box 5288, Sydney NSW 2001

16. Contact Us

Exora Health Pty Ltd
ABN 16 690 025 462

Privacy Officer: hello@exora.au

For questions about this privacy policy, how we handle your data, or to exercise any of your rights, contact us at the email address above.

Governing law. This privacy policy is governed by the laws of Australia. Nothing in this policy limits any right you have under the law of the country where you live that cannot be excluded by agreement.

See also our Terms of Service for the rules governing your use of exora.