Privacy Policy

1. Who we are

ASATWO Pty Ltd operates Conductr. This policy explains how we handle personal information through our website, apps and operational assistance service. For privacy enquiries, access, correction, deletion or complaints, email contact@conductr.com.au.

When a provider uses Conductr with participant or staff records, that provider also has its own privacy responsibilities and privacy policy. We process connected workspace information to deliver the service to that organisation.

2. Information we collect

• Account and contact details: names, email addresses, organisation membership, account identifiers and support correspondence.
• Information you ask us to work with: chat messages, uploaded or selected files, workflow instructions and information retrieved from connected systems. This can include participant names, health or disability information, care notes, rosters, worker records, emails, contacts, invoices and financial information.
• Connection and activity information: authorisation tokens, permissions, task results, approvals, audit records, device registrations and notification tokens.
• Technical information: service logs, errors, usage records and connection details needed to operate and protect the service. Website hosting may also record IP addresses and browser or request information.

We receive information from you, your organisation, your authorised connected services and devices, and our authentication and infrastructure providers. If required information is not supplied, some features may not work.

3. How we use information

We use information to authenticate users, provide workspace access, respond to requests, retrieve relevant records, generate AI responses, carry out authorised actions, run saved workflows and schedules, deliver notifications, provide support, manage subscriptions, investigate errors and protect the service.

We do not sell personal information. We do not use connected participant records for advertising. Providing sensitive information should be limited to what is necessary and supported by your organisation’s authority and any required consent.

4. AI processing and service providers

Relevant prompts, conversation context and information returned by connected tools may be sent to our AI provider to complete your request. This may include personal or health information present in those records; Conductr does not automatically anonymise all content before AI processing.

Our current service uses OpenAI for AI processing, Clerk for authentication, Stripe for payments, subscriptions and invoices, and Convex for synchronising conversation, task and subscription information, Spaceship for hosted infrastructure, and Apple services for iPhone push notifications. Connected vendors receive information when you authorise actions through their services. The information shared depends on the task and permissions.

Authorised personnel and service providers may access information as needed for support, security, operation or legal obligations. We may also disclose information where required or authorised by law. Third-party processing, security and retention are subject to the relevant provider arrangements; this policy does not promise zero retention by every provider.

5. Overseas processing

Conductr uses international cloud services. Information may be processed or stored outside Australia, including in the United States. Locations vary with the service provider, its subprocessors and the connected services your organisation chooses. We do not promise Australian-only storage or processing.

Contact us for the available information about processing locations for your proposed deployment before connecting sensitive records. We will assess applicable privacy obligations and safeguards for overseas disclosures as part of that deployment.

6. Security and workspace access

Our safeguards include authenticated access, organisation access checks, encrypted storage for service secrets and local task records, HTTPS connections and activity logging. No system can guarantee absolute security. Tell us promptly if you suspect an information security incident.

Access can also depend on your organisation’s administration and connected-system permissions. Some integrations operate at workspace level; others are linked to individual staff members. Your organisation should confirm who can access a connection before making information available.

7. Retention and deletion

We keep information for the service, support, security and legal purposes for which it is needed. The current pilot does not enable automatic time-based deletion of conversation history by default. A workspace retention period must be agreed and configured; do not assume chat history expires automatically.

Deleting a conversation removes its associated history from the active service and synchronised conversation store once outstanding work can be safely resolved. Saved workflows, their reference information and schedules are separate records and must be removed separately. Deleting a chat does not delete records or undo actions in connected systems.

Backups, usage records, minimal deletion records and information required by law may remain for separate operational or legal retention periods. Contact us to request deletion or discuss retention and account closure. We will explain any information that must be retained and why.

8. Website storage and cookies

The website account area uses Clerk session storage to keep you signed in. Stripe hosts checkout and billing management and processes your payment details. Conductr stores the organisation’s Stripe customer and subscription identifiers and billing status; we do not store full card numbers or security codes.

The current marketing site does not embed advertising trackers or analytics cookies, and serves its fonts locally. Hosting may keep technical access logs. When you follow a sign-in, payment or external-service link, that service may use cookies or similar storage under its own policy. Our apps store session and preference information needed to operate.

9. Access, correction and privacy complaints

You can ask us to access or correct personal information we hold about you, or request deletion, by emailing contact@conductr.com.au. We may need to verify your identity and authority. If the information belongs to a provider’s records, we may coordinate with or direct you to that provider. Where a request cannot be fulfilled, we will explain the reason and available complaint options.

If you have a privacy concern, describe what happened and how you would like it resolved. We aim to respond within 30 days. If you are dissatisfied with our response, you can contact the Office of the Australian Information Commissioner, where it has jurisdiction, or another applicable privacy regulator.

10. Changes to this policy

We will update this page when our information handling changes and provide notice of material changes to active customers. The date above identifies the latest version. Contact us if you need an earlier version or an accessible copy.