Privacy Policy

MediLog Pty Ltd (ACN 699 314 666) · Effective date: 20 July 2026

About this policy

MediLog Pty Ltd (MediLog, we, us, our) provides a software platform that allows schools to record and track student health incidents and related outcomes. We take privacy seriously, and we recognise that the information handled through our platform includes health information about children, which is among the most sensitive information there is. This policy explains how we handle personal information in accordance with the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs). We handle personal information as if we are bound by the APPs, and we design our platform with the best interests of children in mind and with regard to emerging standards for the online privacy of children.

We maintain internal practices, procedures and systems designed to ensure we manage personal information in accordance with the APPs, including allocated staff responsibilities, security controls, and a process for handling privacy enquiries and complaints.

1. Who this policy applies to, and the role of your school

This policy applies to personal information we handle through the MediLog platform and our website. Our platform is provided to schools. The relevant school (your School) decides what information is recorded on the platform, controls who at the School may access it, and is responsible for its own health procedures and for the checklist content it uploads.

Because we do not deal directly with students or their parents or guardians, your School is responsible for informing students, parents and guardians about the collection of information and for obtaining any consent required (including parental consent for the handling of a child's information). We rely on the School to do this. If you are a parent, guardian or student and have questions about how your School uses MediLog, please contact your School in the first instance. You are also welcome to contact us using the details in section 18.

2. The information we collect

Through the platform, and depending on what your School records, we may collect and hold:

• student information — a student's name, year level, and details of a health incident (for example, a sporting injury, asthma episode or allergic reaction), including the outcome recorded and the date and time it was logged;
• staff account information — the name, work email address and role of School staff who use the platform, and records of their activity in the platform;
• website information — if you contact us through our website or by email, the information you provide, and basic technical information collected automatically such as your IP address and general usage data.

Sensitive information

Health incident details are health information, and therefore sensitive information, under the Privacy Act. We only handle sensitive information where it is reasonably necessary for the platform's purpose and where the School has obtained any consent required. We do not ask for, and the platform is not intended to hold, more sensitive information than is necessary to record an incident and its outcome.

3. How we collect information

We collect student and staff information when School staff enter it into the platform. We collect website information when you interact with our website or contact us. We do not collect student information directly from students or their parents or guardians, it reaches the platform through your School.

We collect personal information only by lawful and fair means. This policy, together with any collection notice, sets out the matters we are required to notify at or before the time we collect personal information; where information about students is concerned, your School provides the relevant notice to students, parents and guardians. If we receive personal information that we did not solicit, we will determine whether we could have collected it under this policy and, if we could not and the law permits, we will destroy or de-identify it as soon as practicable.

4. Anonymity and pseudonymity

Where it is lawful and practicable, you have the option of dealing with us anonymously or by using a pseudonym. Because the platform exists to record health incidents about identified students, and to give identified School staff secure access to those records, it is not practicable for the platform to be used anonymously or pseudonymously. For general enquiries to us that do not require us to identify you, you may choose not to provide your name.

5. Our website and cookies

When you visit our website, our systems (and those of our service providers) may automatically collect basic technical information, such as your IP address, device and browser type, and the pages you visit, and we may use cookies or similar technologies to enable the site to function and to understand how it is used.

You can usually control or disable cookies through your browser settings, although some parts of the site may not work properly if you do. Website information is used only to operate and improve our website; it is not linked to, or used to identify, any student health information recorded on the platform.

6. Why we collect, hold and use information, and our limited use

We collect, hold and use personal information only to:

1. provide, operate, secure and support the platform for your School;
2. enable your School to record health incidents and outcomes and to produce records and summaries for its own compliance purposes;
3. respond to enquiries and communicate with School staff about the platform; and
4. meet our legal obligations.

We do not use School data for our own purposes. We do not sell personal information. We do not use the information recorded by your School for marketing, and we do not use your School's de-identified or anonymised data for product development or any other purpose. We use the information only to provide the service to your School.

7. Direct marketing

We do not use or disclose the information your School records on the platform, including student information, for direct marketing. If we send School staff communications about the platform or our services using business contact details they have provided, we will include a means of opting out and will stop on request. We do not sell personal information, and we do not provide personal information to any third party for that party's own marketing.

8. Children's information

The platform is used by School staff to record information about children. We handle children's information consistently with the best interests of the child: we support your School in collecting only what is necessary, we do not use children's information for marketing or profiling, and we design notices and settings to be clear and appropriate. Consent for the handling of a child's information is obtained by your School from the child's parent or guardian in accordance with the School's own consent processes.

The platform is intended to be accessed only by authorised School staff; it is not directed to, or designed to be used by, children, and children do not hold accounts. We collect children's personal information only through the School and only to the extent necessary to record an incident and its outcome. We do not use children's information for profiling, behavioural advertising, or any purpose beyond providing the service to the School. In handling children's information we have regard to the best interests of the child and to emerging regulatory standards, including the Children's Online Privacy Code being developed under the Privacy Act. A parent or guardian may withdraw consent, or raise any concern about a child's information, through the School (or by contacting us), and we will work with the School to give effect to that request so far as we are able.

9. When we disclose information

We disclose personal information only as necessary to provide the service, namely:

1. Hosting

   The platform and its data are hosted with a reputable cloud infrastructure provider. Data is stored and processed in Australia. We require our hosting provider to protect the information and to handle it only for the purpose of providing hosting services to us.

2. Your School

   Information recorded by your School is available to authorised staff of that School.

3. Where required by law

   We may disclose information where we are required or authorised to do so by law.

We do not otherwise disclose the information your School records, and in particular we do not disclose it to advertisers or data brokers, or use it for any secondary commercial purpose.

10. Data location and cross-border disclosure (APP 8)

We store and process personal information in Australia. We do not transfer personal information overseas, and we require that our hosting environment does not permit access to the data from outside Australia.

11. How we keep information secure (APP 11)

We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. Consistent with current legal requirements, those steps include both technical and organisational measures, for example, access controls and authentication, encryption in transit, restriction of access to those who need it, staff practices and training, logging, and an incident-response process. Because the information includes children's health information, we apply a high standard of care. No system can be guaranteed to be completely secure, and School staff also play an important role by keeping their login credentials secure and using the platform appropriately.

12. Keeping your information accurate

We take reasonable steps to ensure the personal information we hold is accurate, up to date, complete and relevant, having regard to the purpose for which it is held. Because information on the platform is entered and controlled by your School, the School is responsible for the accuracy of what it records. If you believe information we hold is inaccurate, you may ask us to correct it (see the section on accessing and correcting your information), and we will usually deal with the request together with your School.

13. Exported data

The platform allows authorised School staff to export records as a CSV file. When data is exported, it leaves our secured environment and comes under the control of your School. From that point, the exported data is handled by your School under its own policies and obligations, and we are not responsible for the security or handling of data that has been exported from the platform.

14. How long we keep information, and destruction

We keep personal information only for as long as it is needed to provide the service, and then for any period required by law. Where MediLog is provided to your School, the information your School records is returned or made available for export to the School and then destroyed or de-identified in accordance with our agreement with your School within 90 days.

15. Accessing and correcting your information (APP 12 and APP 13)

You may ask us to access, or to correct, personal information we hold about you. Because most information on the platform is recorded and controlled by your School, we will usually direct access and correction requests to your School, or handle them with your School. We will respond to requests within a reasonable time. There is generally no charge for making a request, although we may charge a reasonable amount for access in some circumstances. If we cannot give you access or make a correction, we will tell you why.

16. Data breaches

We maintain procedures to identify and respond to data breaches. If a data breach involving personal information is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches scheme, and we will work with your School as appropriate.

We assess suspected eligible data breaches promptly, and in any event within the period required by law, and we comply with our obligations under the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act. Where a breach relates to information originating from your School, we will consult and coordinate with the School on any notification.

17. Government identifiers and automated decisions

We do not adopt, use or disclose a government-related identifier (such as a Medicare or other government number) as our own identifier for an individual, except as permitted by law, and the platform is not designed to collect such identifiers. We also do not use automated processes to make decisions that produce legal, or similarly significant, effects for individuals. If this changes, we will update this policy to explain how any such automated decision-making is used, consistent with our obligations under the Privacy Act.

18. Complaints and how to contact us

If you have a question or a complaint about how we handle personal information, please contact our privacy contact:

Privacy Contact – Paul McDonald, MediLog Pty Ltd

• Email: info@medilog.com.au
• Post: 48 Severn Crescent Rowville, VIC, 3178

We will acknowledge your complaint and respond within a reasonable time, usually within 30 days. If you are not satisfied with our response, you may complain to the OAIC (www.oaic.gov.au).

19. Changes to this policy

We may update this policy from time to time. The current version is available on our website and takes effect when published. We will indicate the effective date at the top of the policy.