Last updated: October 2026 · Governing law: Queensland, Australia
This Agreement governs our processing of personal information that your clinic enters into the Service about its staff ("Staff Personal Information"). Your clinic decides how and why that information is handled (the controller); we process it on your behalf and on your instructions (the processor).
Digital Treasure Pty Ltd (ABN 23 696 816 636, trading as clinic-admin) is the Provider. The clinic that holds the account is the Clinic.
Our measures include: encryption in transit; access controls and authentication (including two-factor authentication for administrator accounts); tenant isolation so each clinic's data is logically separated and walled off from other clinics at the database rules layer; restricted administrative access; and use of reputable infrastructure providers. We review and update these measures as the Service evolves.
You authorise us to engage sub-processors to deliver the Service. The current sub-processors, their purpose and data location are listed in our Privacy Policy, and include:
We require sub-processors to provide protections consistent with this Agreement. We will give notice of any new sub-processor and a reasonable chance to object on reasonable grounds.
Your clinic's records (staff details and operational data) are stored in Australia (Google Cloud Sydney). Some limited information is handled overseas only to deliver the Service: payment data via Stripe and recipient email addresses and message content via Resend may be processed in the United States, and technical request data passes through Cloudflare's global network. This does not include the clinic records you enter into the platform. We take reasonable steps to ensure these providers handle information consistently with the Australian Privacy Principles.
If we become aware of a data breach affecting Staff Personal Information, we will notify you without undue delay, provide the information you reasonably need, and cooperate so you can meet your obligations under the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth). We will also meet our own obligations under that scheme.
You can export Staff Personal Information at any time using the Export function in the portal. On cancellation, your clinic data is kept for 90 days so you can export it or return, after which it is permanently deleted from our live systems (usually within a further 30 days; deletions run monthly, and copies in routine backups are overwritten on the normal backup cycle). Limited account and billing records may be retained for up to 7 years to meet legal and financial obligations. On written request we will confirm deletion.
On reasonable written notice and no more than once in any 12-month period (or after a breach), we will provide information reasonably necessary to confirm our compliance with this Agreement. We may satisfy this by providing documentation rather than on-site access, to protect other clinics' data and our systems.
Liability under this Agreement is subject to the limitations in the Terms of Service. This Agreement is governed by the laws of Queensland, Australia. If there is a conflict between this Agreement and the Terms of Service about the processing of Staff Personal Information, this Agreement prevails to the extent of the conflict.