1. About this policy
This Privacy Policy explains how One Health Connect Pty Ltd (ABN 73 663 429 427) ("One Health Connect", "we", "us", "our") handles personal information, including health information, when you use the YourScan mobile app on iOS and the YourScan web portal (together, the "App").
We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where it applies, we also comply with the Health Records and Information Privacy Act 2002 (NSW) and equivalent health privacy laws in other states and territories.
Who we are
One Health Connect is an Australian healthcare technology company based in Parramatta, Sydney. We build and operate Clarity Suite, a set of radiology software products used by medical imaging practices and hospitals. YourScan is the patient portal within Clarity Suite.
Our role and your imaging provider's role
YourScan lets you see imaging results, reports and images held by the radiology practice or hospital that performed your scan (your "Imaging Provider"). It is important to understand who is responsible for what:
- Your Imaging Provider collects your health information when you are referred, booked and scanned. It decides what results and reports are released to you and when. It remains responsible for your clinical record under its own privacy policy.
- One Health Connect hosts and operates the App and the systems behind it on behalf of your Imaging Provider. When we handle your clinical records, we do so as a service provider to your Imaging Provider and only for the purposes set out in this policy and our agreement with them.
- One Health Connect is also directly responsible for information about your App account and your use of the App, such as your login details, device information and support requests.
This policy covers both roles. You should also read your Imaging Provider's privacy policy, which applies to the records it holds.
This policy does not apply to third party websites or services that the App links to.
2. Information we collect
We only collect information that is reasonably necessary to provide the App and the services of your Imaging Provider. Health information is "sensitive information" under the Privacy Act, and we treat it with a higher level of protection.
| Category | Examples | Where it comes from | Required? |
|---|---|---|---|
| Identity and contact details | Full name, date of birth, sex, mobile number, and your email and postal address where your Imaging Provider holds them | You and your Imaging Provider | Yes |
| Identifiers used to match your records | Your patient ID or medical record number at your Imaging Provider | Your Imaging Provider | Yes, to link your account to your records |
| Health information | Imaging studies and images, radiology reports, examination type and date, referring doctor, clinical notes on the request, results status, imaging history | Your Imaging Provider | Yes, this is the core of the App |
| Messages and documents | Messages you send to or receive from your Imaging Provider, and files you upload such as referrals, previous reports or photos of documents | You and your Imaging Provider | Only if you use these features |
| Sharing records | The reports or images you share, who you shared them with (such as their name, email address or mobile number) and when | You | Only if you share |
| Account and security information | Mobile number used to sign in, password (stored encrypted), SMS one time codes, consent and acceptance records, account settings | You and the App | Yes |
| Device and technical information | Device model, operating system version, app version, language, time zone, IP address, and a notification token if you allow notifications on your device | Your device, automatically | Yes, to deliver the App securely |
| Usage and audit information | Sign in and sign out times, features used, and audit logs of which records were accessed or shared | The App, automatically | Yes, for security |
| Support information | Details you give us when you contact support, and our replies | You | Only if you contact us |
Information we do not collect
- We do not collect your precise or approximate location.
- We do not access your contacts, calendar, microphone or Apple Health.
- We do not use Face ID or Touch ID, and we do not collect any biometric information.
- We do not collect Medicare or DVA numbers.
- We do not collect payment card details.
- The App does not contain advertising, analytics or tracking tools.
If you use the App for someone else
A parent, guardian or authorised representative may use the App to access the records of a child or another person they are legally entitled to act for, where the Imaging Provider allows it. In that case we also collect information about you as the representative and your relationship to the patient.
3. How we collect information and device permissions
Your YourScan account and login details are set up before you use the App, by your Imaging Provider or through the YourScan web portal. You cannot create an account in the App. The App is only used to sign in to your existing account.
Most of your health information reaches the App directly from your Imaging Provider's radiology and hospital systems once a result is released. You give us other information when you sign in, update your profile, send a message, upload a document or contact support. Technical and usage information is collected automatically when you use the App.
You can choose not to give us some information, or to use the App anonymously or under a pseudonym. Because the App shows your own medical records, we cannot verify your identity or link your records if you do that, so you will not be able to use the App. You can still get your results directly from your Imaging Provider or your referring doctor.
Device permissions
The App only asks for a permission when you use the feature that needs it. You can turn any permission off at any time in your device settings.
| Permission | Why we ask | If you say no |
|---|---|---|
| Notifications | To tell you in the App when a result, report or message is ready | The App still works, and you still receive SMS notifications |
| Camera | To photograph a referral or document you choose to upload | You can upload a saved file instead |
| Photos or files | To attach a document or image you choose to upload, or to save a report to your device | You cannot attach or save files |
We also send SMS messages to your mobile number for sign in codes and to tell you a new result is available. Notifications and SMS messages are kept deliberately general (for example, "You have a new result in YourScan"). We do not include clinical details in them.
4. How we use information
We use your information only for the purpose it was collected for, for directly related purposes you would reasonably expect, or where the law allows or requires it. Specifically, we use it to:
- Verify your identity when you sign in and link your account to the correct records at your Imaging Provider.
- Show you your results, reports, images and imaging history.
- Send you notifications about new results, messages and bookings.
- Let you exchange messages and documents with your Imaging Provider, and share your reports and images with people you choose.
- Keep the App secure, including detecting and preventing unauthorised access, fraud and misuse, and keeping audit logs of who accessed which records.
- Provide support, answer questions and handle complaints.
- Diagnose faults, monitor performance and improve the reliability and usability of the App.
- Send you essential service messages, such as security alerts or changes to our Terms or this policy.
- Meet our legal, regulatory and contractual obligations, including record keeping and responding to lawful requests.
What we do not do
- We do not sell or rent your personal information.
- We do not use your health information for advertising or marketing, and the App shows no advertising.
- We do not track you across other companies' apps or websites, and we do not share data with data brokers.
- We do not use your health information to train artificial intelligence models without your separate express consent.
- We do not make automated decisions about your care. Clinical decisions are made by your doctors and your Imaging Provider.
We may use information that has been de-identified so it can no longer reasonably identify you, for example aggregate counts of how often a feature is used, to plan and improve our services.
5. Who we share information with
We only disclose your personal information to the following people and organisations, and only as much as they need:
- Your Imaging Provider, including its radiologists, clinical and administrative staff, so it can provide your care and respond to your messages and documents.
- People you choose to share with. If you use a sharing feature to send a report or images to a doctor, specialist or another person, we send it to the recipient you nominate. You are responsible for choosing the right recipient.
- Your authorised representative, such as a parent or guardian, where the law and your Imaging Provider allow it.
- Service providers who help us run the App, such as our data centre provider and our SMS providers, Notifyre and TNZ, which send your sign in codes and result notifications by text message. They may only use the information to provide their service to us, and they are bound by confidentiality and security obligations.
- Our professional advisers, such as lawyers, auditors and insurers, under a duty of confidentiality.
- A buyer or successor if our business or assets are sold or restructured, on the condition that they keep protecting your information in line with this policy.
- Government bodies, courts and regulators where we are required or authorised by law, or where we reasonably believe it is necessary to lessen or prevent a serious threat to someone's life, health or safety.
Our SMS providers receive only your mobile number and the text of each message, which is kept general. They do not receive your results or reports.
Where your information is stored
We store all App data, including your health information, images and reports, on our own servers in a secure data centre located in Australia. We do not send your personal information overseas.
Our SMS providers also process your mobile number and SMS messages in Australia. If this ever changes, we will take reasonable steps under APP 8 to make sure any overseas provider handles your information in a way consistent with the Australian Privacy Principles, and we will update this policy.
6. How we protect information
We take reasonable technical and organisational steps to protect your information from misuse, interference, loss, and unauthorised access, change or disclosure. These include:
- Encryption of data in transit (TLS 1.2 or higher) and at rest.
- Identity verification before an account is linked to any records, and an SMS one time code sent to your mobile each time you sign in.
- Automatic sign out after a period of inactivity.
- Role based access controls, so our staff can only access personal information where needed for their job, and full audit logs of access to clinical records.
- Our own servers in a secure, access controlled data centre in Australia, with regular backups, security testing and monitoring.
- Confidentiality obligations and privacy training for our staff and contractors.
No system is completely secure. You can help protect your account by keeping your device locked, using a strong and unique password, not sharing your login details, and signing out on shared devices. Screenshots or files you save from the App to your device are outside our control once saved.
Data breaches
We comply with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act. If a data breach is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner (OAIC) as required, and we will work with your Imaging Provider on any breach involving its records.
7. How long we keep information and closing your account
We keep your information only while your Imaging Provider uses YourScan, and no longer than the health records retention period. This covers everything we hold for the App: your clinical records, account and profile information, messages, uploaded documents, sharing records, audit logs and support requests.
| Situation | What happens to your information |
|---|---|
| Your Imaging Provider keeps using YourScan | We keep it until the retention period ends, then securely delete it. For an adult this is 7 years after the last service. For a child it is until they turn 25. |
| Your Imaging Provider stops using YourScan | We give your Imaging Provider a copy of its records if it asks for one, then permanently delete them from our systems. Your Imaging Provider continues to hold its own records under its privacy policy. |
Closing your YourScan account does not shorten these periods, because the information forms part of your Imaging Provider's health record. While we hold your information, it stays protected in the ways described in section 6.
How to close your account
To close your YourScan account, contact us at support@scanaptics.zohodesk.com.au from the mobile number or email linked to your account. Once we verify your identity, we will close your account so it can no longer be used to sign in or view records. Your information is then kept as set out above. You can still get your results directly from your Imaging Provider.
8. Your rights and choices
Access and correction
You can ask for access to the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading. Contact us using the details in section 9. We will respond within 30 days and we will not charge you for making a request.
Requests about your clinical records, such as correcting a report or getting a full copy of your imaging, are handled by your Imaging Provider because it controls those records. If you send such a request to us, we will pass it on to your Imaging Provider and let you know.
If we refuse a request, we will tell you why in writing and how to complain. You can also update your contact details and preferences directly in the App at any time.
Your choices
- Turn notifications on or off in the App or in your device settings.
- Withdraw a device permission at any time in your device settings.
- Stop using the App and ask us to close your account (see section 7).
- Opt out of any non essential communications using the unsubscribe link or by contacting us. Essential service and security messages cannot be switched off while you have an account.
Children
The App is not directed at children. A person under 18 may only have their own account if their Imaging Provider allows it and it is appropriate under the law, for example a mature minor able to make their own health decisions. Otherwise a parent, guardian or authorised representative manages access on the child's behalf. If we learn that we have collected information from a child without appropriate authority, we will close the account and restrict access to that information.
9. Complaints, changes and contact
Making a complaint
If you have a concern about how we have handled your personal information, please contact our Privacy Officer first so we can try to fix it. Tell us what happened and how you would like it resolved. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days.
If you are not satisfied with our response, you can complain to:
- Office of the Australian Information Commissioner (OAIC): oaic.gov.au, phone 1300 363 992.
- Information and Privacy Commission NSW, for complaints about health information under NSW law: ipc.nsw.gov.au, phone 1800 472 679.
Complaints about your clinical care or the content of a report should go to your Imaging Provider.
Changes to this policy
We may update this policy from time to time, for example when we add features or when the law changes. We will post the updated policy in the App and at onehealthconnect.com.au/yourscan/privacy with a new effective date. If a change materially affects how we handle your information, we will tell you in the App or by email before it takes effect.
Contact us
Privacy Officer, One Health Connect Pty Ltd (ABN 73 663 429 427)
87 Marsden Street, Parramatta NSW 2150, Australia
Email: support@scanaptics.zohodesk.com.au
Effective date: 1 October 2026