Last updated: 19 October 2026
This Privacy Policy explains how Emlyn SNR Pty Ltd ACN 699 413 397 (Emlyn, we, us, our) collects, holds, uses and discloses Personal Information and Sensitive Information in connection with the Emlyn platform, any website we operate and related services (Platform).
The Platform is an AI-supported administrative assistant designed for individual general practitioners (GPs). It assists GPs with administrative and documentation tasks, including preparing draft correspondence, reports, referrals, forms and other materials based on information provided by, or made available to the Platform by, the GP.
We handle Personal Information in accordance with the Privacy Act 1988 (Cth) (Privacy Act), the Australian Privacy Principles (APPs) and other applicable privacy and health information laws, including, where applicable, the Health Records Act 2001 (Vic) (HRA) and Health Privacy Principles (HPPs), the Health Records and Information Privacy Act 2002 (NSW) (HRIP Act), and the Health Records (Privacy and Access) Act 1997 (ACT) (ACT HRA).
This Privacy Policy describes our general information-handling practices. We may also provide a collection notice at or before the time we collect particular information. Any collection notice should be read together with this Privacy Policy.
Where applicable law requires consent for our collection, use or disclosure of Sensitive Information, that consent may be obtained through the Platform or another appropriate process, or by the relevant GP or practice where they are responsible for obtaining the patient’s consent or authority. This Privacy Policy does not itself operate as consent to every collection, use or disclosure described in it.
This Privacy Policy applies to GPs who use the Platform, website visitors, prospective users and other people who interact with us.
Where lawful and practicable, you may interact with us anonymously or using a pseudonym. However, to create and administer a Platform account, provide account-based functionality and respond to account-specific requests, we may need information that identifies you or distinguishes your account. If you do not provide information we reasonably request, we may be unable to provide some or all Platform functionality.
We may update this Privacy Policy from time to time to reflect changes to the Platform, our information-handling practices, legal requirements or business operations. The updated version will be published on or through the Platform and will take effect from the date stated in it. Where appropriate, we may also notify users of material changes through the Platform or by email.
To the extent we collect, hold or use health information to which applicable health information laws apply, including the HRA, HRIP Act or ACT HRA, this Privacy Policy forms part of our documented approach to managing that health information. We manage that information in accordance with the applicable privacy or health privacy principles and our related internal privacy and information-handling procedures.
On request, we will take reasonable steps, where required by applicable law, to let an individual know in general terms the kinds of health information we hold about them, the main purposes for which we hold that information, and how we collect, hold, use and disclose it.
You may request access to, or correction of, health information we hold about you using the process described under “Accessing and correcting your information” below. A copy of this Privacy Policy is available on request. Any additional rights or procedures under applicable State or Territory health information laws will be handled in accordance with those laws.
Personal Information has the meaning given in the Privacy Act and includes information or an opinion about an identified individual, or an individual who is reasonably identifiable.
Sensitive Information has the meaning given in the Privacy Act and includes certain information about an individual, including health information. Information processed through the Platform may include health information or other Sensitive Information about patients or other individuals where a GP chooses to provide or make that information available through the Platform.
The kinds of Personal Information and Sensitive Information we may collect, hold or process include:
We do not seek to collect precise geolocation data through the Platform unless it is reasonably necessary for a feature and appropriate notice is provided.
Where we operate a public website or introduce additional functionality, we may also collect information ordinarily associated with those services, such as browser, device, log, analytics or similar usage information. We will provide any additional notice or controls required by applicable law.
We may collect or process Sensitive Information where it is reasonably necessary for our functions or activities and with consent, unless another exception under the Privacy Act or applicable law permits or requires the collection. This may include health information contained in documents, correspondence, forms or other material a GP chooses to process through the Platform.
Where consent is required for the collection, use or disclosure of Sensitive Information, that consent may be obtained by us through the Platform or another appropriate process, or by the relevant GP or practice where they are responsible for obtaining the patient’s consent or authority.
If you provide Personal Information or Sensitive Information about another person, including a patient, you must only do so where it is reasonably necessary, you are authorised or otherwise permitted by law to do so, and any required notices or consents have been obtained. Participating GPs and practices remain responsible for ensuring that their own privacy statements, collection notices, consent processes and other authorities permit the relevant use of the Platform and the provision or processing of patient or other third-party information through it.
We collect Personal Information and Sensitive Information by lawful and fair means, including:
We collect, hold, use and disclose Personal Information and Sensitive Information to:
We use and disclose Personal Information for the purpose for which it was collected, for related purposes that would reasonably be expected, with consent, or where otherwise permitted or required by law. We may also use aggregated or de-identified information to operate, analyse, improve or develop the Platform where permitted by law.
The Platform may use third-party artificial intelligence and technology service providers to generate requested outputs. For supported patient-information workflows, the Platform may apply de-identification controls before information is transmitted for further processing. These controls are intended to minimise the identifiable patient information made available to Emlyn-controlled infrastructure and external AI providers. The information flow and de-identification controls may differ depending on the Platform function or connected service. For connected email and calendar content, Emlyn’s de-identification controls are designed to remove identifying details as that content enters the Platform, before it is stored, so that only the resulting de-identified copy is processed by the AI. The email connector does not ingest email attachments. Additional information may be provided in the relevant connector notice.
The Platform is designed to support GPs with administrative and documentation tasks. It does not replace the GP's professional or clinical judgment. GPs remain responsible for the information they provide, any clinical decisions, and reviewing, completing and determining whether and how to use outputs generated through the Platform. Removing direct identifiers does not necessarily mean information is anonymous in all circumstances, including where an individual remains reasonably identifiable from the surrounding information.
Where you choose to connect an email, calendar, file-storage, task, reminder or other supported account, the Platform may access and process information available through that account to the extent reasonably necessary to provide the requested functionality. You must only connect an account that you are authorised to access and connect to the Platform. The Platform is intended to connect to an individual GP's personal or individually controlled account, rather than a practice clinical mailbox, and a practice or organisational clinical mailbox must not be connected where the Platform prohibits or blocks that connection. Information flows and de-identification controls may differ between Platform functions and connected services. Additional connector-specific notices or consent disclosures may apply. Where available, connected email and calendar functionality may include reading information from Gmail or Microsoft accounts, preparing email drafts and reading or creating calendar events, subject to the permissions and functionality made available through the relevant connector.
The Platform uses artificial intelligence and automated processing to assist with administrative tasks and generate drafts, summaries and other outputs. The Platform is not designed to independently make clinical or professional decisions about patients. Practitioners remain responsible for reviewing outputs and making any clinical, professional or other decision arising from their use of the Platform.
We may send operational communications about your account, security, subscriptions, changes to the Platform or our legal documents, and other matters reasonably necessary to provide or administer the Platform. You may not be able to opt out of those communications while you continue to use the Platform.
We may use Personal Information for direct marketing where permitted by law. You may opt out at any time using the unsubscribe mechanism in the relevant communication or by contacting us. We do not use Sensitive Information for direct marketing unless permitted by law and, where required, with consent.
We may disclose Personal Information and, where necessary, Sensitive Information to third parties who assist us to operate, administer, secure, improve or support the Platform, including:
We take reasonable steps to require service providers to handle information consistently with applicable privacy, confidentiality and security obligations. We may otherwise disclose Personal Information or Sensitive Information with consent, for the primary purpose for which it was collected, for a related purpose that would reasonably be expected, or where otherwise permitted or required by law.
We do not sell Personal Information or Sensitive Information, share Personal Information for cross-context behavioural advertising, or use or disclose Sensitive Information for targeted advertising or profiling unrelated to providing the Platform. This does not prevent disclosures made in accordance with our Privacy Policy where reasonably necessary to operate, secure or support the Platform, or as otherwise permitted or required by law.
Primary Platform data, AI processing and backups are hosted and processed in Australia. Some service providers or support functions may nevertheless process or access limited Personal Information outside Australia depending on their infrastructure and services.
Based on our current provider arrangements, those overseas locations may include:
Where a GP chooses to connect a Google or Microsoft account, information associated with that connected account may also be handled by Google or Microsoft in accordance with the GP’s arrangements with those providers and their applicable terms and privacy practices.
We take reasonable steps to limit overseas processing to what is reasonably necessary for the relevant service and to require our service providers to handle Personal Information consistently with applicable privacy, confidentiality and security obligations.
Our provider arrangements and processing locations may change from time to time. We will update this Privacy Policy where required to reflect any material change to the countries in which Personal Information is likely to be disclosed or accessed.
We may store Personal Information and Sensitive Information in electronic systems, databases, cloud infrastructure, backups and device-local or browser storage used to operate the Platform.
We take reasonable steps to protect information from misuse, interference, loss and unauthorised access, modification or disclosure. These measures may include access controls, authentication, encryption, de-identification controls, logging, backups, confidentiality obligations and service-provider controls appropriate to the nature and sensitivity of the information. Authorised technical personnel may access GP memory information or logs with the GP's consent where reasonably necessary for support or troubleshooting, subject to applicable access controls and logging.
No method of electronic transmission or storage is completely secure, and we do not guarantee absolute security. We assess and respond to actual or suspected data breaches in accordance with applicable law, including the Notifiable Data Breaches scheme where it applies.
We retain Personal Information and Sensitive Information for as long as reasonably necessary for the purposes for which it was collected, including to provide, administer and protect the Platform, resolve complaints or disputes, comply with legal, regulatory or contractual obligations and protect our lawful interests.
Patient information processed through the Platform is not intended to be retained by Emlyn in identifiable form beyond what is reasonably necessary to perform the requested task. GP account, administrative preference, memory, log, security and support information may be retained while the account remains active and for any further period reasonably necessary for legal, security, backup, dispute or compliance purposes.
If you close your account, we will take reasonable steps to delete Personal Information associated with the account when it is no longer required, including relevant information held in active systems, logs, caches and backups, subject to applicable law and any information we are required or permitted to retain for legal, security, recovery, dispute or compliance purposes. We may retain de-identified or aggregated information where it no longer reasonably identifies an individual.
When we no longer require Personal Information, we will take reasonable steps to destroy or de-identify it, unless we are required or authorised by law to retain it.
You may request access to Personal Information we hold about you and ask us to correct it if you believe it is inaccurate, out of date, incomplete, irrelevant or misleading.
We will respond within a reasonable period and in accordance with applicable law. We will not charge a fee for making a request, although we may charge a reasonable fee for giving access where permitted by law. In some cases, we may refuse access or correction, or provide access in a particular way, where permitted by law. If we refuse a request, we will provide reasons where required by law.
The Platform may provide direct controls to access, edit, export or delete certain account information and GP administrative information. Requests relating to information not available through those controls should be made using the contact details below. Because patient information is not intended to be retained by Emlyn in identifiable form, we may not be able to identify or locate information relating to a particular patient; in those circumstances, the relevant patient may need to contact their treating GP or practice.
If you have a question about this Privacy Policy, wish to request access to or correction of Personal Information, or wish to make a complaint about our privacy practices, please contact:
Attention: Privacy Officer
Email: privacy@emlyn.ai
We will acknowledge and investigate a complaint as soon as practicable. If we agree that a complaint is well founded, we will take reasonable steps to address the issue and, where appropriate, consult with you about the steps we propose to take.
If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):
Website: www.oaic.gov.au | Telephone: 1300 363 992