Legal
Privacy Policy
Last updated: July 2026
Overview
OptoGuide™ is a clinical workflow tool for Australian optometrists. This policy describes what information we collect, how we use it, who we share it with, and the safeguards in place to protect it. OptoGuide™ is designed to minimise data collection, and in particular to keep patient information off our servers.
This policy is written to meet our obligations under the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
Who we are
OptoGuide™ is operated by [LEGAL ENTITY NAME] (ABN [ABN]), [BUSINESS ADDRESS], Australia.
For any privacy question, request, or complaint, contact us at support@optoguide.com.au.
Patient data
Prescription and referral generation never sends patient details to us.
Any patient name, address, date of birth, or Medicare number you enter into a prescription or referral form is processed entirely in your browser and used only to build a document on your own device. It is never transmitted to OptoGuide™ servers or to any third-party service, and we never store it. OptoGuide™ does not create or maintain a patient record and is not a clinical record system.
Case records: read this before using the feature. The optional Case Records feature (/cases) is the one place in OptoGuide™ where clinical text you type is saved to our servers, so that your own case log persists between sessions. It deliberately has no patient name, date of birth, contact, or Medicare fields; only an optional age and sex, plus free-text clinical fields.
Because those clinical fields are free text, you must not enter anything that identifies a patient: no names, initials, dates of birth, record numbers, or identifying circumstances. Case records are visible to you, and to our administrators for support and moderation purposes. Treat the feature as de-identified teaching notes, not as a clinical record.
Practitioner responsibility. As a healthcare practitioner, you remain responsible for meeting your obligations under applicable privacy legislation, including the Australian Privacy Act 1988 and any relevant state or territory requirements, when collecting and handling patient information in your clinical practice. OptoGuide™ does not alter or limit those obligations.
Information we collect about you
The information below is about you as a practitioner, not about your patients.
Account and identity
Email address, name and title, profile photo (if you upload one or sign in with Google), and your professional role.
Professional and regulatory details
Your AHPRA registration number, PBS prescriber number, whether you hold therapeutic endorsement, your professional memberships and special interests. We collect these so that prescribing and referral features can be correctly gated and so generated documents carry accurate practitioner details. These are self-declared; we do not verify them with AHPRA or any other body.
Practice details
Practice name, address, phone, fax, provider numbers and time zone for each practice you add. Where you use address autocomplete, we also store the Google Place identifier and coordinates for that address. These populate your letterhead, referral and prescription documents, and preselect your jurisdiction in the Fitness-to-Drive workflow.
Subscription and billing
Your plan tier, subscription status, trial and renewal dates, and the Stripe customer and subscription identifiers. We never see or store your full card number.
Content you create
CPD entries and reflections, any CPD evidence files you upload, learning notes, favourites, saved practitioners from the doctors directory, case records (see above), and a non-identifying referral history recording only condition, specialty and urgency.
Security and account-sharing signals
To protect accounts and enforce our single-user licence terms, we record a general description of the devices and browsers used to sign in, the country your sign-in came from, and recent session activity. We do not store your full IP address for this purpose and we do not track your location.
How you found us
The campaign or referral link that brought you to OptoGuide™, your referral code, and who referred you if you joined through a colleague's invitation.
Support and feedback
If you use the contact form, feedback tools, or email us, we retain your name, email address and the content of your message so we can respond.
Usage analytics
We measure how OptoGuide™ is used so we can improve it. This happens in two ways.
Google Analytics: not linked to your account
We use Google Analytics for page views, navigation, and general performance and error monitoring. We deliberately do not send your account identifier to Google, so this data cannot be traced back to your OptoGuide™ account by us. We do attach coarse segments, your profession and plan tier, so we can tell which features matter to which kinds of users. Google itself receives standard web analytics data including your IP address and device information, subject to Google's privacy policy.
Our own product analytics: linked to your account
We record a limited set of product events in our own database, linked to your account, so we can understand activation, feature adoption and billing outcomes. Only an approved list of non-clinical properties can be recorded (for example: feature name, plan tier, disease or drug identifier, quiz score).
Neither pipeline records patient data or free-text clinical notes. Analytics is switched off entirely on the prescription and referral pages apart from a basic page view, and all event data is automatically screened to block anything resembling patient information.
Cookies and local storage
OptoGuide™ uses:
- Essential cookies: a secure session cookie managed by Firebase Authentication to keep you signed in.
- Analytics cookies: Google Analytics sets first-party cookies (such as
_ga) to distinguish repeat visits and sessions. - Local storage: to remember interface preferences (such as a dismissed banner), your last-used practice and prescribing preferences, and the campaign link that brought you to the site.
We do not use advertising cookies, and we do not sell or share your information with advertising networks. You can block or delete cookies in your browser settings, though the essential session cookie is required to stay signed in.
Third-party services and data processors
OptoGuide™ relies on the following providers. Each receives only the data necessary to perform its function, and none of them receive patient data from us.
Google Firebase
Authentication, database, file storage and application hosting. Holds your account, professional, practice and subscription data. Subject to Google's privacy policy.
Google Analytics
Usage measurement, as described above. Receives page and event data, IP address and device information, but not your account identifier.
Google Maps and Places
Powers practice-address autocomplete and the doctors directory search. When you type an address or search for a practitioner, that text is sent to Google to return suggestions. Do not type patient details into these fields.
Stripe
Subscription payments. Stripe receives your email address, name and payment details directly. OptoGuide™ never sees or stores your full card number. Subject to Stripe's privacy policy.
Resend
Transactional and account lifecycle email. Receives your email address and name for delivery. Subject to Resend's privacy policy.
Cloudflare Turnstile
Spam protection on our contact form. Cloudflare receives your IP address and browser signals when the form is submitted.
Google AI (Gemini)
Used only in our internal, administrator-facing content pipeline to triage published clinical literature. It does not process your account data, your clinical work, or any patient information, and it is not used to generate clinical recommendations.
Overseas disclosure
OptoGuide™ is an Australian product, but the providers listed above operate globally. Your account information is stored and processed on infrastructure located in, or accessible from, the United States and other countries in which those providers operate, principally the United States (Google, Stripe, Resend, Cloudflare) and the European Union and United Kingdom (Stripe, Cloudflare).
Before disclosing personal information to an overseas recipient we take reasonable steps, as required by Australian Privacy Principle 8, to ensure the recipient handles it consistently with the Australian Privacy Principles, including relying on each provider's contractual data-protection terms. No patient information is disclosed overseas by OptoGuide™, because patient details never leave your device.
How long we keep your information
We keep your account and the content you create for as long as your account is open. If you close your account or ask us to delete it, we delete your profile and the content you created within 30 days, other than records we are required to keep principally billing and tax records, which we retain for seven years as required by Australian law, and security logs, which we retain for up to 12 months.
Support correspondence is retained for up to two years. Aggregated analytics that can no longer be linked to you may be retained indefinitely.
Security
Your account data is protected by Firebase Authentication. Access to our database is controlled by default-deny security rules that prevent users from reading or writing other users' data, and we apply least-privilege to all database and storage access. All communication between your browser and our servers uses HTTPS. Administrative access is restricted to a small number of accounts and administrative content changes are logged.
No system is perfectly secure. If a data breach occurs that is likely to result in serious harm, we will notify affected users and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988.
Your rights
Under the Australian Privacy Act 1988 you have the right to:
- access the personal information we hold about you
- ask us to correct it if it is inaccurate, out of date or incomplete
- ask us to delete your account and associated data
- opt out of non-essential email at any time
- complain if you believe we have mishandled your information
Most of this you can do yourself from your profile page. Otherwise, contact us and we will respond within 30 days. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au.
Email preferences
We send two kinds of email. Service email, such as billing confirmations, security notices and account changes, is necessary to operate your account and cannot be switched off while your account is open. Lifecycle email, such as trial reminders and occasional product updates, carries a one-click unsubscribe link in every message, and you can opt out at any time without affecting your account.
Changes to this policy
We may update this policy as the product evolves. Material changes will be communicated to registered users by email before they take effect. The date at the top of this page shows when it was last revised.
Privacy enquiries
For privacy-related enquiries, or to request access to, correction of, or deletion of your personal information, contact us at support@optoguide.com.au or use the contact form.