Privacy policy

Who we are

Curo Health is run by Nathaniel Giabardo, based in Melbourne, Victoria. This policy explains how we handle personal information through this website and when we work with clinics. We follow the Australian Privacy Principles in the Privacy Act 1988 (Cth) as if they apply to us in full, and, for health information about Victorians, the Health Privacy Principles in the Health Records Act 2001 (Vic).

This website

This site does not use cookies, tracking pixels or advertising tools. We count visits with Vercel Web Analytics, which does not use cookies and does not identify you.

If you click a booking button, the booking calendar is provided by Calendly. Calendly may set its own cookies and collects the details you enter (such as your name, email and clinic name) under its own privacy policy. We receive those details so we can hold the call.

If you email us, we keep your email so we can reply.

Clinic data, including patient information

We only access a clinic’s systems when the clinic asks us to and gives us access. Access is read-only wherever the system allows it, and limited to the fields the work needs. We never ask for payment details.

Before any work starts, we agree in writing with the clinic: what data we access, why, where it is processed and stored, who can see it, how long it is kept, and how it is deleted. Where data is processed depends on the clinic’s booking system and the tools agreed, so we confirm this per clinic rather than promise it here.

We do not sell personal information, use it for advertising, or use patient information to train AI models. We do not contact patients except with wording the clinic has approved, on the clinic’s behalf.

The clinic remains responsible for its patient records. We act on its instructions and help it meet its own privacy obligations.

Keeping it secure

We collect the minimum we need, use accounts protected by strong passwords and two-factor authentication, use demo data rather than real records when testing, and delete clinic data when the work ends or when the clinic asks, unless the law requires us to keep it.

If we become aware of a data breach that is likely to cause serious harm, we will tell the affected clinic straight away and help it meet its obligations under the Notifiable Data Breaches scheme.

Access, correction and complaints

You can ask what personal information we hold about you, ask us to correct it, or ask us to delete it. If you are a patient, please contact your clinic first, as it controls your record; we will help it respond.

If you have a concern, contact us and we will respond within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au) or, for health information in Victoria, the Health Complaints Commissioner (hcc.vic.gov.au).

Contact

Questions about privacy: hello@curohealth.com.au .