Terms, Privacy & Content Policy

Last updated 26 July 2026

This document sets out the agreement under which practices use Hanah, the conduct expected of everyone who uses it, and how we handle your information. Section I is the contract; Section II is the content policy; Section III is the privacy policy. Clinics also accept a separate Data Processing Agreement covering our handling of clinical data on their behalf.

I. Agreement

This Section I is the contract between your practice and us for use of Hanah. Sections II and III — the content rules and the privacy policy — form part of it.

1. Parties and acceptance

Hanah is a trading name of PhysiPal Pty Ltd (ABN 61 641 678 891), registered at 826/555 Flinders St, Melbourne VIC 3000, Australia (“Hanah”, “we”, “us”).

These terms are accepted by the practice, clinic or individual practitioner that creates a Hanah workspace (“you”), and apply from the moment the workspace is created or the service is used, whichever is earlier. If you accept on behalf of an organisation, you confirm you have authority to bind it.

2. Order of precedence

Where documents conflict, the following order applies: (a) a signed written agreement between us, if any; (b) our Data Processing Agreement, for anything concerning our processing of clinical data on your behalf; (c) this Section I; (d) Sections II and III.

3. The service

We grant you a non-exclusive, non-transferable right to access and use Hanah for your practice’s internal clinical and administrative purposes, for as long as this agreement is in force and fees are paid.

You may not resell or sublicense the service, use it to build a competing product, reverse engineer it, or attempt to circumvent its access controls or usage limits. You are responsible for your users’ compliance with this agreement, for the security of their credentials, and for the accuracy of the data you enter.

We may improve, modify or discontinue individual features. Where we discontinue a feature you materially rely on, we will give you reasonable notice and, if the change materially reduces the value of the service to you, you may terminate under clause 11 and receive a pro-rata refund of prepaid fees.

4. Clinical responsibility

Hanah is an assistive tool. It does not practise medicine, does not provide clinical advice, and is not a substitute for professional judgement.

All AI-generated output — notes, summaries, letters, referrals, transcripts — is a draft. You are responsible for reviewing, correcting and approving every output before relying on it clinically, entering it in a patient record, or sending it to any third party or practice management system. Transcription and generation are imperfect and may contain errors or omissions.

You remain solely responsible for the care you provide, for your professional and regulatory obligations, for obtaining patient consent to recording before it begins, and for your own record-keeping duties. We give no warranty as to the clinical accuracy, completeness or suitability of any output.

5. Fees and billing

New workspaces include a free trial of the period stated at signup. After the trial, the service is charged per clinician seat at the price shown when you subscribe, billed in advance through our payment provider. Seat count is the number of clinicians in your workspace.

Subscriptions renew automatically for successive periods unless cancelled before the end of the current period. We will give you at least 30 days’ notice before any price increase takes effect, and you may cancel before it applies. Fees are exclusive of GST/VAT, which is added where applicable.

If payment fails we will notify you and allow a reasonable period to resolve it before suspending under clause 10.

6. Your data and intellectual property

You own the clinical data and content you put into Hanah. We claim no ownership of it and, as set out in the Data Processing Agreement, we do not train models on it.

We own Hanah — the platform, software, models, templates we supply, and all related intellectual property. Feedback you give us about the service may be used freely to improve it, without obligation to you.

You grant us only the rights needed to operate the service for you, and to comply with law.

7. Confidentiality

Each party will keep the other’s confidential information confidential, use it only to perform this agreement, and protect it with at least reasonable care. This does not apply to information that is public through no breach, independently developed, or required to be disclosed by law — in which case the disclosing party will be told where lawful to do so.

8. Warranties and disclaimers

We warrant that we will provide the service with reasonable care and skill, and in accordance with the security measures described in the Data Processing Agreement.

Beyond that warranty, and to the extent permitted by law, the service is provided “as is”. We do not warrant that it will be uninterrupted or error-free, that AI output will be accurate, or that it will meet any particular regulatory or accreditation requirement of your practice.

Nothing in this agreement excludes, restricts or modifies any consumer guarantee, right or remedy that applies to you under the Australian Consumer Law, the New Zealand Consumer Guarantees Act, or the UK Consumer Rights Act, where those laws apply and cannot lawfully be excluded.

9. Liability

Neither party is liable for indirect or consequential loss, or for loss of profit, revenue, goodwill or anticipated savings, however arising.

Each party’s total aggregate liability arising out of or in connection with this agreement is limited to the fees paid or payable by you in the 12 months preceding the first event giving rise to the claim.

Those limits do not apply to: death or personal injury caused by negligence; fraud or fraudulent misrepresentation; your obligation to pay fees; either party’s breach of the other’s intellectual property rights; a party’s indemnity obligations under clause 10; or any liability that cannot lawfully be limited.

10. Indemnities and suspension

We indemnify you against claims that your permitted use of Hanah infringes a third party’s intellectual property rights, provided you tell us promptly, let us control the defence, and do not settle without our consent.

You indemnify us against claims arising from your clinical use of the service, your content, or your breach of Section II, other than to the extent caused by our breach of this agreement.

We may suspend access where necessary to protect the service or its users — for a serious security risk, a material breach of Section II, or non-payment after notice. We will give notice before suspending unless the risk requires immediate action, and will restore access once the cause is resolved.

11. Term, termination and your data on exit

This agreement continues until terminated. Either party may terminate for convenience on 30 days’ notice, effective at the end of the current billing period. Either party may terminate immediately if the other commits a material breach that is not remedied within 30 days of written notice, or becomes insolvent.

Export before you leave. You may export your clinical data at any time during the term. On termination we will retain your data in an exportable form for 60 days so you can retrieve it, after which it is deleted or returned in accordance with the Data Processing Agreement.

Clinicians are generally required to retain clinical records for several years after the last entry. Terminating your Hanah workspace does not discharge that obligation, and we do not hold records on your behalf after deletion. Export before you terminate.

12. Changes to these terms

We may update this agreement to reflect changes in the service, our costs, or the law. Where a change is material and adverse to you, we will give at least 30 days’ notice by email or in-app, and you may terminate without penalty before it takes effect — with a pro-rata refund of prepaid fees. Continued use after that period means you accept the change. Non-material changes take effect on publication.

13. General

Neither party may assign this agreement without the other’s consent, except to a successor of its business on notice. Neither party is liable for failure caused by events beyond its reasonable control, provided it takes reasonable steps to mitigate. If any provision is unenforceable, the rest continues in force. Notices to us go to hello@hanah.health; notices to you go to your account’s registered email. This agreement, together with the documents in clause 2, is the entire agreement between us on its subject matter. Nothing here creates a partnership, agency or employment relationship.

14. Governing law

The governing law and courts are those of your region: Australia — Victoria; United Kingdom — England and Wales; New Zealand — New Zealand. Each party submits to the non-exclusive jurisdiction of those courts.

II. Content

These rules apply to all interactions within the Hanah ecosystem, including Communities, Patient Messaging, and Custom Branding.

1. Content Restrictions

Users are strictly prohibited from creating, sharing, transmitting, or displaying content that is:

• Offensive or Discriminatory: Promoting hatred, harassment, or harm.
• Medical Misinformation: Sharing health advice in Communities or the IHL Wiki that contradicts established clinical guidelines or professional standards.
• Obscene or Explicit: Sexually explicit material or content that promotes exploitation.
• Violent or Threatening: Content that incites violence or threatens physical harm.
• Branding Misuse: Using the "Customise Hanah" feature to impersonate other clinics, professionals, or entities.

2. Behavioural Restrictions

Harassment and Bullying: Zero tolerance for intimidation within patient groups or direct messaging.

Data Breach: Unauthorised access to, or alteration of, other users' clinical data or personal information.

3. Enforcement

Breach of these rules may lead to suspension or termination of access, following the notice and remedy process in clauses I.10 and I.11 — except where an immediate suspension is needed to protect patients, other users or the service. Changes to these rules are made under clause I.12.

III. Privacy

Who controls your data

Our role depends on the data in question, and this matters for who you contact about it:

• Clinical records — consultation audio, transcripts, notes, documents and patient records. Your clinic is the data controller. It decides why and how this information is processed; Hanah acts as its processor, handling the data on the clinic’s instructions and nothing more. Patients should direct requests about their clinical records to their treating clinic.
• Clinician account data — names, email addresses, sign-in credentials and workspace roles. Your clinic and Hanah are each controllers, for their own purposes.
• Service operation data — billing records, support correspondence, security and audit logs, and aggregate usage statistics. Hanah is the controller.

The terms on which we act as your clinic’s processor — our obligations, subprocessors, breach notification, audit rights, and deletion — are set out in our Data Processing Agreement, which clinics accept when they create a workspace. This Section III describes the processing for which Hanah is itself the controller, and explains to patients and clinicians how their information is handled.

1. What information do we collect?

Clinical Documentation: We collect and process health information such as SOAP notes, EPCs, referrals, discharge summaries, Body Charts, and other clinical records as provided by the user. Health information constitutes special category personal data under UK GDPR Article 9 and sensitive information under the Australian Privacy Act, and is processed with additional safeguards.

Transcription Data: We process audio to generate transcripts. Raw audio files are used only for the duration of the transcription process and are deleted immediately after transcription.

Visual Media: Videos of patients for the Recorded Exercises feature.

Sensitive Information: Health data (symptoms, injury history, and exercise progress) collected via the Diary and Patient Feed.

Device Permissions: Access to Camera/Microphone (for Telehealth and Recording) and Storage (for PDF/Report generation).

Communications Data: Email addresses and preferences for newsletters and product updates, where consent is given.

Technical and Security Data: Logs of system access, IP addresses, device information, and security events for compliance and protection purposes.

Source of Data: We may receive personal information directly from patients, or from their treating clinicians, referring practitioners, or healthcare providers acting on the patient's behalf.

2. How we process your information

We process your information only for the following Hanah functions:

AI Generation: Using AI to draft clinical documentation.

Text Analysis (IHL): Utilising a clinically tailored AI LLM to "dejargon" patient messages and identify alternative terminology to improve health literacy.

Exercise Delivery: Transmitting prescriptions via the App, Email, SMS, PDF, or print.

Operational Use: Syncing data with third party Practice Management Software (PMS) to simplify EHR obligations.

Lawful Bases for Processing (UK users)

Clinical records. Your clinic, as controller, establishes the lawful basis for processing patient information. That is ordinarily performance of a contract or the clinic’s legitimate interests under Article 6, together with Article 9(2)(h) — provision of health care by or under the responsibility of a health professional — for the health data itself. Hanah processes that information as the clinic’s processor, on its instructions, and does not establish a separate basis of its own. Where our regional infrastructure requires it, we also rely on Schedule 1 of the Data Protection Act 2018 for the health data we handle on a clinic’s behalf.

Data for which Hanah is the controller. Where we act as controller (see “Who controls your data” above), our bases are:

• Service delivery and account management: Performance of a contract (UK GDPR Article 6(1)(b))
• Marketing communications: Consent (Article 6(1)(a))
• Security, fraud prevention, and audit logging: Legitimate interests (Article 6(1)(f))
• Legal and regulatory record-keeping: Legal obligation (Article 6(1)(c))

Ambient AI transcription. Consent to being recorded is obtained from the patient by the treating clinician before recording begins. That consent is a professional and ethical requirement the clinic owes its patients; it sits alongside, and does not replace, the clinic’s lawful basis for the processing.

3. Third-party data sharing & integrations

Hanah does not sell user information. We share data only as necessary to provide the Services:

Inter-Clinic Cooperation: Sharing notes and reports with other clinicians at your direction via referral tools.

Practice Management: Syncing data to third-party EHR systems as configured by the user.

Subprocessors

We use a limited set of subprocessors to deliver our services. The subprocessors in scope differ by region, so rather than reproduce them here we maintain a current list in the Trust Centre for each production deployment. Each list names the provider, the function it performs, and where it processes data:

• Australia — subprocessors
• United Kingdom — subprocessors
• New Zealand — subprocessors

Clinical records, transcripts and files are stored within your own jurisdiction in all three regions. Where a subprocessor processes data outside your region, this is set out under International Data Transfers below.

Clinics contracting with us under our Data Processing Agreement receive advance notice of any change to the subprocessors listed for their region. A point-in-time copy of any list is available on request via hello@hanah.health.

International Data Transfers

Authentication data. Limited personal data (such as email addresses and authentication tokens) may be transferred outside the user's region for authentication. Where such transfers occur from the UK, we rely on appropriate safeguards including the UK Addendum to the Standard Contractual Clauses, supplemented by technical and organisational measures including encryption in transit and at rest.

Speech-to-text audio (Australia). Ambient audio from Australian users is transmitted to Soniox in the United States for transcription. This is a cross-border disclosure for the purposes of Australian Privacy Principle 8: we remain accountable for the recipient's handling of that information and take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles. Audio is used solely to generate the transcript and is not retained after transcription.

Speech-to-text audio (United Kingdom). Ambient audio from UK users is transcribed by Google Speech-to-Text within the United Kingdom. It is not sent to Soniox, is not transferred outside the UK, and is not retained once the transcript is produced. No restricted transfer under Chapter V of the UK GDPR arises from this processing.

New Zealand clinical data. For New Zealand users, audio and clinical text are sent to Australia for speech-to-text processing and AI drafting, then returned and stored in New Zealand. This is a cross-border disclosure for the purposes of Information Privacy Principle 12 of the Privacy Act 2020. We rely on contractual safeguards requiring the receiving subprocessors to protect the information to a standard comparable to that required under New Zealand law, together with encryption in transit and at rest.

Details of the safeguards applying to any transfer are available on request via hello@hanah.health.

4. AI & clinical responsibility (Human in the Loop)

Hanah is an AI-powered assistive platform. All AI functions are designed with a "Human in the Loop" model:

Draft Status: All AI-generated SOAP notes, referrals, and summaries are considered drafts.

Clinician Responsibility: The attending clinician assumes full legal and professional responsibility for reviewing, editing, and utilising AI outputs. Clinicians must sign off on all documentation before it is finalised or synced to an EHR.

Ambient AI Consent: Clinicians are responsible for obtaining explicit patient consent before using the Ambient AI transcription feature.

Text Analysis Accuracy: Clinicians must verify that AI-simplified language remains medically accurate and appropriate for the patient's condition.

No Solely Automated Decisions: Hanah's AI outputs are not used to make solely automated decisions about individuals. All clinical decisions are made by qualified clinicians who review and approve AI-generated content. Patients have the right to request information about how AI is used in relation to their care.

5. Data storage & security

Telehealth: Sessions are end-to-end encrypted. No unrecorded audio or video data is saved on our servers.

Storage Locations:

• Australia: Sensitive files and transcripts for Australian users are stored securely and encrypted within Australia.
• United Kingdom: Sensitive files and transcripts for UK users are stored securely and encrypted within the United Kingdom.
• New Zealand: Sensitive files and transcripts for New Zealand users are stored securely and encrypted within New Zealand. AI drafting and speech-to-text processing for New Zealand users are performed in Australia, as set out in the subprocessor table above.

Audio Deletion: Raw audio used for Ambient AI transcription is deleted immediately following the processing of the transcript.

Security Measures: We implement industry-standard technical and organisational measures including encryption in transit (TLS) and at rest, access controls, multi-factor authentication for staff, audit logging, and obfuscation techniques to protect clinical records.

Data Breach Notification: In the event of a data breach affecting personal information, we will notify affected individuals and the relevant supervisory authority — the UK Information Commissioner's Office (for UK users) or the Office of the Australian Information Commissioner (for Australian users) — within the timeframes required by applicable law.

6. Data retention

We retain personal information for the following periods:

• Patient account information: For the active life of the account, plus a reasonable period after deletion for legal and operational purposes.
• Clinical records: Minimum 7 years from the last entry for adults, in line with medico-legal record-keeping obligations. Longer retention may apply for records concerning minors.
• Raw audio (Ambient AI): Deleted immediately after transcription.
• Telehealth session content: Not retained.
• Payment and transaction records: 7 years for tax and audit purposes.
• Marketing communications data: Until consent is withdrawn.
• Customer support records: Up to 3 years.
• Audit and security logs: Up to 2 years.

Retention periods may be extended where required by law, regulation, or to handle disputes.

7. Right to be forgotten (data deletion)

Hanah respects your right to have your data erased.

Patient Account Deletion: If a patient deletes their account, all data created or personally uploaded by that patient (e.g. Diary entries, exercise recordings they initiated) will be permanently deleted from our active databases.

Clinician Account Deletion: If a clinician chooses to delete their Hanah account, all associated clinical data will be purged from Hanah's servers. It is the clinician's sole responsibility to export or backup all clinical records required for their professional record-keeping obligations (typically 7–8 years) prior to account deletion. Hanah will not maintain or host records for deleted clinician accounts.

8. Children's data

Where patients are under 18, processing of their personal and health data is undertaken with consent obtained by the treating clinician from a parent or legal guardian. Hanah does not knowingly collect personal data directly from children without appropriate authorisation by a treating clinician or guardian.

9. Cookies & website tracking

Our website uses cookies and similar technologies for essential site functionality, analytics, and (where you consent) marketing purposes. You can manage your cookie preferences via the cookie banner displayed on first visit and at any time through your browser settings. Non-essential cookies are only set with your consent.

10. Your rights (Australia & UK)

Australia: We comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. You have the right to lodge a complaint with the Office of the Australian Information Commissioner at oaic.gov.au.

United Kingdom: We comply with the UK GDPR and Data Protection Act 2018. You have the following rights in relation to your personal data:

• Right of access to your data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Right to withdraw consent (where processing is based on consent)
• Right not to be subject to solely automated decision-making
• Right to lodge a complaint with the UK Information Commissioner's Office at ico.org.uk

How to exercise your rights

If you are a patient and your request concerns your clinical records, contact your treating clinic. It is the controller for those records and is responsible for answering you. If you contact us instead, we will not respond substantively — we will tell you to contact your clinic and, where we can identify it, pass your request on without undue delay so that it can respond.

For everything else — your Hanah account, marketing preferences, or any data for which we are the controller — contact us at hello@hanah.health. We will respond within one month, as required by UK GDPR. We may need to verify your identity before processing your request to protect the security of your data.

Clinics: we assist you in responding to your patients’ requests, as set out in our Data Processing Agreement.

UK GDPR Article 27 Representative

As our operating entity is established outside the United Kingdom, we have appointed a UK Representative under Article 27 of the UK GDPR. UK users may contact our representative regarding any data protection matters:

Withdrawal of Consent: Where processing is based on consent (e.g. marketing communications, optional features, ambient AI transcription), you may withdraw consent at any time by contacting us at hello@hanah.health. Other lawful bases may continue to apply for processing necessary to deliver our services or meet legal obligations. Withdrawal of consent for certain processing activities may impact app functionality.

11. Data Protection Officer

Privacy enquiries may be sent to hello@hanah.health.

12. Updates to this policy

This policy was last updated on 26/07/2026. We may update this Section III from time to time to reflect changes in our practices, technology, legal requirements, or other factors. Material changes will be notified via the app or by email to registered users. Changes to the agreement in Section I follow the separate notice and termination process in clause I.12.

13. Contact us

For data access, updates, support or deletion requests:

Email: hello@hanah.health
Post: PhysiPal Pty Ltd, 826/555 Flinders St, Melbourne VIC 3000, Australia