Privacy Policy

PaediaStory is operated by Patches Integrated Health (ABN 30 623 115 453), 55 Salvado Road, Subiaco WA 6008. We are a health service provider, and we hold your child’s information both as their care team and as the operator of this service.

Because we handle health information, the Privacy Act 1988 (Cth) and the Australian Privacy Principles apply to us regardless of our size. The exemption that applies to small businesses does not apply to anyone who provides a health service and holds health information.

We collect this from you directly, and from your clinic when they set up your child’s profile. We do not collect Medicare numbers, health fund details or concession cards.

We collect it to prepare your child’s appointment: to give their care team a briefing before you walk in, and to give your child an illustrated story of their own. We do not use it for anything else, we do not sell it, and we do not use it for advertising.

Health information is collected with your consent. You can skip almost every question; the few that can’t be skipped are the ones the rest depend on, like what you’d most like help with. You can stop at any point and what you have already shared stays with your care team.

Your child’s care team at your clinic sees what you share. Beyond that we use the companies below to run the service. They may use what we send only to do the job we ask.

If your child’s doctor refers them to another doctor or service, the doctor can email the referral letter, and any reports you uploaded that they choose to include, to that person and to you. Only the doctor decides what goes and to whom.

Your child’s information is never used to train anyone’s AI model.

Some of the companies above hold information in the United States. Before disclosing personal information overseas we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles, as APP 8 requires. We remain accountable to you for what happens to it.

Questions are read aloud by an overseas service, and the read-aloud uses only the wording of the question, which includes your child’s first name. If you don’t want your spoken answers transcribed overseas, you can type your answers instead. The questionnaire works just as well either way.

No decision about your child is made by a computer. PaediaStory does not diagnose, does not triage, and does not decide how urgent anything is.

Which question comes next is decided by a published set of rules written by people, so the same answers always produce the same questionnaire. If an answer matches a published safety rule, the conversation pauses and shows guidance written by people.

A language model does three narrow jobs: it reads questions aloud, it turns speech into text, and it rewrites your child’s story in warmer words. It never chooses a question and never decides urgency.

From the age of twelve a young person can have their own sign-in and answer a short private section. Those answers go to their care team and to them. They are not shown to parents or carers in PaediaStory.

Where a young person is capable of making their own decisions about their health information, we deal with them directly about it.

Some questions, for example about safety at home or a parent’s own wellbeing, are marked so the answers go to the care team rather than appearing in the family’s own copy. We say why we are asking before we ask.

Families, young people, clinicians and administrators each have their own sign-in and see different things. An administrator cannot open a clinical briefing without an explicit permission. Parents sign in with a PIN that only works on their own device. Information is encrypted in transit and at rest, and every access and change is recorded.

More detail is on the security page.

If information is lost or disclosed without authority and it is likely to cause you serious harm, we will tell you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires. We will tell you what happened, what it means for you, and what to do about it.

We keep your child’s information while your family has an account with a clinic using PaediaStory, and afterwards for as long as the law requires health records to be kept. For a child, that is generally until they turn 25.

You can ask for it to be deleted sooner. Some of it may have become part of your child’s medical record, which your clinic has its own legal duties about, so ask them as well as us.

You can ask us at any time to:

• give you a copy of everything we hold about you and your child
• correct anything that is wrong or out of date
• tell you who has opened it, which we record
• stop sending you anything that is not about your appointments
• delete it, subject to section 11

We will respond within 30 days. If we refuse, we will tell you why in writing and how to challenge it.

Tell us first, through the contact form, and we will respond within 30 days.

If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au, by phone on 1300 363 992, or to the Health and Disability Services Complaints Office in Western Australia at hadsco.wa.gov.au.

If we change how any of this works we will update this page and change the date at the top. If a change affects you materially we will tell you rather than leave you to find it.