Privacy Policy

01 Introduction

Routiq Pty Ltd (ABN 77 686 999 306, ACN 686 999 306) ("Routiq," "we," "our," or "us") is an Australian-registered software-as-a-service provider based at Level 2, 11 York Street, Sydney NSW 2000. We operate www.routiq.ai, the Routiq app at robyn.routiq.ai, labs.routiq.ai, docs.routiq.ai and the Routiq iPhone app.

This Privacy Policy explains how we handle personal information in accordance with the Australian Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), the Notifiable Data Breaches scheme and applicable state health-records legislation (including the Health Records Act 2001 (Vic) and the Health Records and Information Privacy Act 2002 (NSW)).

The policy is written for two audiences: clinic owners and staff who subscribe to our service, and patients of those clinics whose data we process on a clinic’s behalf. Where a clinic is our customer, this policy operates alongside the Customer Data Processing Addendum.

02 Our Role

Routiq acts as a Processor. We handle personal information on behalf of our customer clinics, who are the Controllers (the APP entities with primary accountability under the Privacy Act) for their patient records. Clinics own the relationship with their patients and remain responsible for obtaining consent to contact, for the accuracy of clinical records, and for responding to patient privacy requests under APP 12 and APP 13.

We process personal information only on the documented instructions of the customer clinic — via this policy, the Customer DPA, and the clinic’s settings inside the Routiq app.

03 Information We Collect

3.1 From clinics and their staff

• Clinic details — clinic name, timezone, locations, and subscription (one subscription, priced per location)
• Staff accounts — name, email, role and sign-in credentials (passwords are handled by our sign-in provider, Supabase)
• Billing contact and payment method (tokenised via Stripe)
• Support correspondence, and feedback staff send from the app (a rating and an optional note)

3.2 About patients, from the clinic

The clinic decides what reaches us, by connecting its practice-management system (Cliniko or PracSuite), linking its Timely or Acuity calendars and client list, or uploading a spreadsheet.

• First name, surname, mobile phone number and email address
• Date of birth (where the clinic’s system records it)
• Appointment history — practitioner, appointment type, location, date, time, status — and what the clinic has recorded as spent
• Opt-out state — whether a patient has asked to stop marketing texts
• Conversation content — the SMS messages patients send to the clinic’s Routiq number, and the replies that go back
• Calls to the clinic’s voice line — the caller’s number, the message they leave, a summary, a transcript, and a recording held by our voice provider
• Technical metadata needed to run the service — delivery receipts and timestamps

3.3 What we do NOT collect

Routiq’s integrations do not import the following categories, and our systems do not store them. When a clinic connects Cliniko, Routiq asks for a single treatment note only to check what its key can read, and does not keep it.

• Clinical notes, SOAP notes or treatment records
• Diagnoses, test results, imaging or prescriptions
• Referral letters
• Medicare numbers, DVA numbers, private-health-fund claim details
• Credit-card numbers or other payment-instrument data (billing is tokenised via Stripe)
• Healthcare identifiers from My Health Record

Patients can still mention health details in a text or a call. Those words are kept as part of the conversation, like any other message.

3.4 From visitors to our website

• If you chat with or call Robyn on our website: what you type or say and, for a call, a recording. ElevenLabs runs these conversations and keeps them until they are deleted.
• When a chat or call starts, a note to the Routiq team with the page you were on, the site that sent you there, and your city, estimated from your IP address.
• Cookies and analytics, as set out in the Cookie Policy.

04 How We Use Information

We use personal information strictly to deliver the contracted service to the customer clinic. Specifically:

• Bringing patients back — working out which patients are due back, and rebooking messages and campaigns sent on the clinic’s behalf, based on its settings and each patient’s opt-out state.
• Robyn, the AI assistant — replying to patient texts, finding times and booking, moving or cancelling appointments in the clinic’s system, answering clinic questions, taking messages on the voice line and texting callers back. Administrative, not clinical — see §11.
• Reporting to the clinic — service-usage figures and message outcomes for the clinic’s own review.
• Service operation and support — sign-in, billing, security monitoring, troubleshooting, incident response, and complying with legal or regulatory obligations that bind Routiq.

We do not sell, rent or trade personal information. We do not market to patients in our own name — outbound messages are sent on behalf of the subscribing clinic. We do not build or operate profiling systems that target individual patients for purposes unrelated to their clinic relationship.

05 Subprocessors

We engage third parties to deliver specific parts of the service. Every subprocessor that stores, processes or transmits data on our behalf is listed below, with what it does and where. If a provider is not on this list, it has not been approved to receive Routiq-held data.

This list is current as of the date at the top of this page.

06 International Data Transfers

Routiq’s database, which holds patient records and conversations, is in Australia. The database (Supabase) and the servers that read and write it (AWS) run in ap-southeast-2, Sydney. Some patient data is processed or held outside Australia by the providers below. We disclose each cross-border flow rather than minimise it.

• Anthropic — Claude API (United States) — writes Robyn’s replies, reading the conversation and the patient’s appointments, and her rebooking drafts. These direct calls outside Australia run under an approved exception to our rule of keeping patient data in Australia. Anthropic’s default 30-day retention applies. A model hosted in Sydney (Claude on Amazon Bedrock) is the backup for replies, and writes the text sent after a call.
• ElevenLabs — answers the clinic’s voice line and holds the call audio, transcripts and recordings. Calls to the voice line are recorded, and the recordings are kept until deleted. A clinic can ask us to delete them. Our configuration uses ElevenLabs’ default endpoint, with no data-residency setting. ElevenLabs also runs the chat and call with Robyn on our website, and keeps what visitors type or say there.
• Twilio — the clinic’s phone number, incoming texts, and calls on their way to the voice line. Our code uses Twilio’s US default and sets no Australian region.
• Langfuse (European Union) — a record of Robyn’s conversations, model calls and tool use, used to check her decisions, under an approved exception. Erased with the patient when a clinic asks us to erase that patient.
• TypeSafe (Jev, United States) — reads an AI-written rebooking draft before it may approve itself on autopilot. Names, links and contact details are replaced with blanks before it leaves.
• Resend (United States) — email to clinic staff. Alert emails can carry a patient’s first name with their message and Robyn’s draft reply, or a call summary. They never carry a surname, phone number or email address. Phone push alerts carry no patient details.
• Sentry (European Union) — error reports only, with personal details stripped. Session replay is off.
• PostHog (United States) — staff-side product analytics. Autocapture is off, and session recordings mask every piece of text and every input. No patient data.
• Stripe — clinic billing contact, card-on-file token, subscription state. No patient data.
• GitHub — source code, build logs, issues. No patient data.
• Discord — alerts for the Routiq team, such as a note that someone started a chat on our website, with the page, where they came from and their city. Never what was said, and no patient data.
• Cloudflare (edge-global) — serves the Routiq web app and carries its requests. Nothing is stored at rest.

Under APP 8 of the Privacy Act 1988 (Cth) the clinic Controller remains responsible for ensuring any disclosure of personal information to an overseas recipient complies with APP 8.1. The information above is intended to give the Controller what it needs to meet that obligation.

07 How Long We Keep Data

This is how long data is kept today. No scheduled deletion runs, so data stays until the clinic asks us to erase it, except where the table says otherwise.

A clinic can export its patient list as a spreadsheet from the Routiq app at any time, and can ask us to delete its data.

08 Security

Routiq does not currently hold SOC 2 Type II or ISO/IEC 27001 certification.

Technical controls include TLS in transit, application-layer AES-256-GCM encryption of practice-system API keys, database row-level security that keeps each clinic’s data apart, role-based access for clinic staff (owner, admin, staff, read only), and append-only logs of who read and changed patient records. Clinic staff sign in with a password of at least 12 characters or a one-time email link; two-factor sign-in is not offered.

To set a clinic up or help with a problem, Routiq staff with a confirmed Routiq email can open a clinic’s account as an admin for up to an hour at a time. Every visit is logged by Routiq.

To report a suspected vulnerability, email support@routiq.ai. Our responsible-disclosure policy is at /security.

09 Data Breach Notification

In the event of an eligible data breach involving personal information, we comply with the Notifiable Data Breaches (NDB) scheme under the Privacy Act 1988. This means we will:

• Promptly assess suspected breaches to determine if they are likely to result in serious harm (s 26WH assessment, within 30 days of awareness)
• Notify the Office of the Australian Information Commissioner (OAIC) and affected individuals as required (s 26WK)
• Notify affected customer clinics so they can take appropriate steps with their patients
• Take all reasonable steps to contain and remediate the breach

We’ll tell affected clinics without undue delay, as the law requires.

10 Your Rights and Choices

Under the Australian Privacy Principles you have rights including:

• Access (APP 12): request access to the personal information we hold about you
• Correction (APP 13): request correction of information that is inaccurate, out of date or incomplete
• Anonymity and pseudonymity (APP 2): deal with us anonymously or under a pseudonym where practicable
• Complaint: complain about our handling of your personal information to us, and subsequently to the OAIC

How to exercise. Email privacy@routiq.ai with the nature of your request. We acknowledge within five business days and respond within a reasonable period, generally within 30 days.

Patient rights — the clinic is the primary contact. If you are a patient of a clinic that subscribes to Routiq, your primary privacy relationship is with that clinic. Requests for access, correction, deletion or complaint should be directed to the clinic in the first instance. The clinic makes the request to us and we carry it out, including erasing you from our records and from Langfuse’s conversation records.

Stopping texts. A patient can stop marketing texts at any time by replying STOP (or STOPALL, UNSUBSCRIBE or OPT OUT), or with the unsubscribe link in a rebooking or campaign text, which asks once before it takes effect. The link appears once Routiq has set up the clinic’s link; STOP always works. Opting out stops rebooking messages and campaigns to every number the patient has. If the patient texts or calls the clinic, it can still reply, and texts about their own bookings still go. The opt-out is kept permanently. To be switched back on, the patient contacts the clinic.

If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.

11 Automated Decision-Making and AI Use

Parts of our service use AI — Anthropic’s Claude (directly, and on Amazon Bedrock in Sydney as the backup) and ElevenLabs’ voice agent. These are used for administrative functions:

• Robyn’s replies — reading inbound patient texts and answering them: booking, moving and cancelling appointments, and answering routine clinic questions.
• The voice line — answering calls and taking a message for the clinic team. It does not book, take payments or give advice. Robyn texts the caller back afterwards.
• Rebooking drafts — writing outbound rebooking messages, where the clinic has them written for each patient; otherwise the clinic’s standard wording is used.
• Campaign help — helping clinic staff choose a campaign audience and write its prompts.
• Chat on our website — answering visitors’ questions about Routiq, by text or call, from what our website says.
• Spreadsheet imports — suggesting what each column of a clinic’s spreadsheet holds, using the model hosted in Sydney.

Who presses send. When a clinic is Live, Robyn sends some messages without a person approving them first, such as replies that book an appointment or answer a simple question, and, if the clinic turns on autopilot, its rebooking messages. In Assisted mode, a person at the clinic approves every message before it sends. Clinics choose the mode in the app.

No clinical decisions are automated. Robyn is an administrative tool. She does not diagnose, triage clinically, recommend treatment, make medication decisions, or perform any AHPRA-reserved act. If a message sounds urgent, she does not reply; she holds the conversation and alerts the clinic’s team.

Customer choices. Clinics choose Test, Assisted or Live, pause Robyn in any conversation, and choose whether rebooking messages use their standard wording or are written for each patient. A description of the AI processing applied to any specific feature is available on request to privacy@routiq.ai.

12 Children's Data

Allied-health clinics routinely treat patients under 18. Where a clinic’s records include under-18 patients, that data is handled under the clinic’s consent framework and the applicable state health-records regime. Routiq does not directly market to children and does not knowingly collect personal information from a child other than via a clinic’s instruction.

13 Cookies and Tracking

We use a limited set of cookies for essential site function, security and analytics. Our website, www.routiq.ai, also loads Google Analytics and the Meta Pixel, which tell Google and Meta about visits to the site. The Cookie Policy explains how to manage your preferences.

14 Changes to This Privacy Policy

When this policy changes, we update this page and the "Last updated" date at the top.

15 Contact Us

If you have any questions about this Privacy Policy or our data practices: