PracSuite Privacy Policy
Last Updated: 31 July 2026
This Privacy Policy is published by Smartsoft Pty Ltd ACN 008 110 558 (Smartsoft, We, Our, Us). It explains how all Personal Information is collected, held, used and disclosed by Smartsoft in connection with the provision of PracSuite. This Privacy Policy should be read together with the PracSuite Terms of Service (Terms of Service), in particular clauses 7 and 8 of those terms.
If you do not understand this Privacy Policy or have any questions, please contact Our Privacy Officer using the details in clause 15.
Summary
We collect Personal Information to provide PracSuite and related services. We hold Client Data on behalf of Subscribers, who are responsible for obtaining their Clients’ consent. Some information is disclosed to third-party service providers, including overseas. We take reasonable steps to keep Personal Information and Client Data secure. You may access or correct your Personal Information and Client Data, or make a complaint, by contacting Our Privacy Officer (clause 15).
1. Background
(a) Smartsoft takes all reasonable steps to implement processes and procedures for the responsible management of Personal Information and Client Data.
(b) We have implemented this Privacy Policy in accordance with the APPs contained in the Privacy Act 1988 (Cth) to be open and transparent about how We collect, hold, disclose and use Personal Information and Client Data, including in respect of Subscribers, End Users, Clients and others.
(c) This Privacy Policy is a statement of Smartsoft’s privacy practices.
(d) In respect of Client Data, Smartsoft acts as a data processor on the instructions of the Subscriber. The Subscriber, as the entity with the direct relationship with its Clients, is responsible for its own privacy compliance obligations. Smartsoft is not responsible for its Subscribers’ collection, use or disclosure of Client Data in connection with the Subscriber’s use of PracSuite.
2. Definitions
In this Privacy Policy, the following terms have the meanings given below.
APPs means the Australian Privacy Principles contained in Schedule 1 of the Privacy Act.
Client means a client, customer or patient of the Subscriber whose Client Data is added to PracSuite by an End User.
Client Data means Personal Information (including Sensitive Information) of a Client which is entered into PracSuite by the Subscriber or its End Users and used, accessed or disclosed in the course of providing health services to that Client.
End User means a person authorised by the Subscriber to access and use PracSuite.
Personal Information has the meaning given by the Privacy Act.
Privacy Act means the Privacy Act 1988 (Cth), as amended or replaced from time to time.
Privacy Laws mean all applicable mandatory privacy laws which regulate the disclosure, use and collection of personal information, including State and Territory health records laws and the Privacy Act.
Sensitive Information has the meaning given by the Privacy Act.
Subscriber means any person, company, partnership or other trading entity that uses PracSuite.
Third-Party Developer means any person or entity other than the Subscriber or its End Users who access or seeks to access the application programming interface made available by Smartsoft that enables programmatic access to PracSuite functionality and associated data including Client Data.
Website means the website located at www.pracsuite.com.
3. Collection
3.1 Collection of Personal Information about Subscribers, End Users and Third Party Developers
(a) We collect Personal Information when Subscribers, End Users and Third-Party Developers interact with Us online, over the phone, by email, in person or through other means of communication.
(b) The type of Personal Information We collect includes:
(i) names, dates of birth and gender;
(ii) contact details including addresses, telephone numbers, email addresses;
(iii) details about your usage and interaction with PracSuite including practice identification details, information about your computer operating systems and servers, End User access levels and patient numbers;
(iv) details about your education and employment, including qualifications, employer names and job titles;
(v) registration and other details required for interaction with government services, such as systems for healthcare providers, identity verification and authentication systems (including healthcare identifier, registration and provider numbers);
(vi) information relating to the type, volume, and financial aspects of the services you provide and the outcomes of those services; and
(vii) any additional information provided to Us as We reasonably require to provide PracSuite and related services.
(c) When We have telephone conversations with End Users and Third-Party Developers, including those regarding sales, help desk and service requests, We may make audio recordings for quality and training purposes.
(d) Some Subscribers provide payment details including credit and debit card details and bank account information. Where We process regular payments, We store this financial data securely.
(e) Personal Information will be collected directly from information provided to Us by Subscribers and their End Users.
3.2 Collection of Client Data
(a) We only collect Client Data indirectly, through the Subscriber or its End Users entering Client Data into PracSuite. The Subscriber and its End Users are responsible for obtaining the Client's consent to the collection and use of their Client Data. Subscribers may refer to clause 7 of the Terms of Service for the Subscriber's obligations in this regard. As We do not obtain Client Data directly from Clients, Clients should raise any queries in relation to the collection and use of Client Data with their associated Subscriber in the first instance.
(b) The type of Client Data held on behalf of a Subscriber varies depending upon the relevant Subscriber’s and their End Users’ particular usage of PracSuite. The Client Data that may be held on behalf of a Subscriber includes:
(i) names, dates of birth and gender;
(ii) contact details including addresses, telephone numbers, email addresses; and
(iii) other health information and Sensitive Information provided by or on behalf of the Client to the Subscriber and its End Users for the purposes of recording, storing, managing, accessing or communicating the Client’s health and Sensitive Information, including Medicare information, medical history, diagnoses, treatment plans, medications, test results, and information related to health services received by the Client.
3.3 Device Information and Cookies
(a) When you visit Our Website, We may collect certain information about your device, including details about your web browser, IP address, time zone, and cookies installed on your device.
(b) We collect device information using cookies, log files, and web beacons. Cookies are required for PracSuite to function. End Users must enable cookies for PracSuite to operate correctly. If you are an End User, cookies will collect information about how you access and use PracSuite and that information will be associated with your username and other Personal Information.
(c) We use Google Analytics to analyse usage of Our Website. Cookie-generated information about your use of the Website (including your IP address) may be transmitted to and stored by Google on servers outside Australia. You may opt out of Google Analytics by using the opt-out service provided by Google or by disabling cookies in your browser, however doing so may affect your ability to use certain features.
(d) We do not alter Our data collection practices when We see a Do Not Track signal from your browser.
4. Consent
By agreeing to the Terms of Service, the Subscriber and each End User acknowledge that their Personal Information may be collected, held, used and disclosed by Smartsoft for the purpose of providing PracSuite and related services described in this Privacy Policy.
By using Our Website, you consent to the processing of data about you by Google in the manner described in Google's Privacy Policy and for the purposes set out in clause 3.3 above.
5. Use and Disclosure of Personal Information
5.1 General Use
We hold, use and share Personal Information collected as part of Our business operations, primarily in connection with providing PracSuite and related services. Personal Information may be used for the following purposes:
(a) informing you about Our services;
(b) providing you with the services requested;
(c) managing your account and administering Our relationship with you;
(d) operating, improving and optimising our Website, our products and our services as well as Subscriber and End User experience;
(e) dealing with requests, enquiries or complaints;
(f) providing access to PracSuite and the members' area of Our Website;
(g) notifying you via SMS or email about billing information and notifications issued by PracSuite on the Subscriber's instructions, consistent with clause 9 of the Terms of Service;
(h) marketing Our services (see clause 5.2);
(i) providing your Personal Information to Our contractors, agents and service providers only to the extent necessary to provide services to you or to facilitate the operation of Our business; and
(j) providing your Personal Information to Our professional advisers only as necessary for them to advise Us in respect of Our business or in connection with a dispute involving you.
We will not use your Personal Information or Client Data for purposes other than as described in this Privacy Policy or any other agreement We have with you, unless you consent to that use, or We are expressly permitted to do so under the Privacy Act or other applicable law, including where such use or disclosure is required pursuant to a court order, is reasonably necessary for the activities of an enforcement body, or is required to prevent a serious threat to the life, health or safety of any individual or to public health or safety.
5.2 Direct Marketing
Where you have elected to receive marketing communications, We may use your contact details to send those communications. To opt out, you may contact Us using the details in clause 15 or select the "unsubscribe" link in any such communication.
5.3 External Disclosures and Offshore Transfers
Personal Information (including Client Data) entered into PracSuite may be disclosed to, stored by or used by third parties as part of the functionality, integrations and background operations of PracSuite. These disclosures are referred to as External Disclosures in the Terms of Service and are recorded in the Annexure to the Terms of Service.
Certain External Disclosures are to third parties located outside Australia, including in Canada, Ireland, Netherlands, New Zealand, Singapore, United Kingdom, the United States and other international locations as identified in the Annexure to the Terms of Service. By accepting the Terms of Service and acknowledging the Annexure to those terms, the Subscriber consents to the External Disclosures identified in the Annexure on behalf of itself and its End Users. The Subscribers are responsible for obtaining the consent of their Clients to the abovementioned disclosures.
Smartsoft takes reasonable steps to ensure that overseas recipients handle Personal Information in a manner consistent with the Privacy Laws. Where Smartsoft has obtained the Subscriber’s informed consent to a specific overseas disclosure, Smartsoft’s residual accountability under the Privacy Act is limited accordingly.
Subscribers may also be subject to State and Territory health privacy legislation in addition to the Privacy Act, including but not limited to the Health Records Act 2001 (Vic), the Health Records and Information Privacy Act 2002 (NSW) and the Health Records (Privacy and Access) Act 1997 (ACT). Subscribers are solely responsible for ensuring their own compliance, and that of their End Users, with any applicable State or Territory health privacy laws in connection with their use of PracSuite.
5.4 AI Processing
Where the Subscriber has enabled PracSuite AI (clause 10 of the Terms of Service), Client Data may be processed by third-party AI providers including Anthropic, Amazon Web Services and OpenAI. These providers are referred to as Background Disclosures in the Annexure to the Terms of Service. The Subscriber is responsible for ensuring appropriate Client consent is obtained before enabling AI processing of Client Data.
For the avoidance of doubt, our agreement with Subscribers is that PracSuite and PracSuite AI are not to be used for the purpose of automated decision-making.
5.5 API Access
Where API access is enabled (clause 20 of the Terms of Service), Personal Information and Client Data may be accessed by Third-Party Developers authorised by the Subscriber. All API access to Personal Information and Client Data is subject to the Privacy Laws and any privacy and data protection obligations contained in Our agreement with the Subscriber. The Subscriber is responsible for ensuring that any Third-Party Developer it authorises handles Personal Information and Client Data in accordance with Privacy Laws and the scope of the Subscriber API Key issued in accordance with Our agreement with the Subscriber.
6. Client Data
(a) Collection: As outlined in clause 3.2 above, we only collect Client Data indirectly through the Subscriber or its End Users entering it into PracSuite. The Subscriber is responsible for obtaining the Client's consent to the collection, holding and use of their Client Data via PracSuite. See clause 7.3 of the Terms of Service for the Subscriber's consent obligations.
(b) Holding, Use and Disclosure: While We hold Client Data via PracSuite on behalf of Subscribers, the use and disclosure of Client Data is made by the Subscriber and its End Users in the course of their operation of PracSuite. We process Client Data as part of the functionality of PracSuite. The Subscriber is responsible for obtaining Client consent to the disclosures and uses it makes of Client Data.
(c) Sensitive Information: We do not directly collect Sensitive Information from Clients. From time to time, where We are asked to provide support by a Subscriber or End User and access to Sensitive Information is reasonably necessary to provide that support, We may access that information on the authorisation of the Subscriber or End User. We will only use Sensitive Information accessed in this way for the purpose of providing the requested support and will not use or disclose it for any other purpose.
(d) Offshore Transfers: PracSuite enables Subscribers and End Users to disclose Client Data to overseas entities as part of its functionality and integrations. These are identified in the Annexure to the Terms of Service. If you are a Client, We recommend you obtain and review the Subscriber's privacy policy regarding potential disclosure of your Client Data.
(e) Subscriber Privacy Policies: The Terms of Service require Subscribers to obtain Client consent for the collection, holding, disclosure and use of Client Data in connection with PracSuite. Clients should obtain and review the Subscriber's privacy policy.
(f) Minors: Where a Client is a minor, the Subscriber is responsible for obtaining consent to the collection, holding, use and disclosure of the minor’s Client Data from a parent or guardian, or otherwise in accordance with applicable law.
7. Accessing and Correcting Your Information
(a) Upon your request and after satisfying Ourselves of your identity, We will provide access to the Personal Information and/or Client Data We hold about you, except in certain prescribed circumstances. These include where giving access would pose a serious threat to health or safety, would be unlawful, would have an unreasonable impact on the privacy of other individuals, or as otherwise permitted under the Privacy Act.
(b) We take reasonable steps to ensure the Personal Information We collect, use and disclose is accurate, complete and up-to-date. You have a right to correct inaccurate information at any time by contacting Us using the details in clause 15.
(c) Subscribers are required to take reasonable steps to ensure that Client Data collected, used and disclosed via PracSuite is accurate, complete and up-to-date. Clients have a right to correct information at any time and should do so by contacting the relevant Subscriber in accordance with its privacy policy in the first instance.
(d) If You become aware that information We hold about You is no longer accurate, complete or up-to-date, please contact Us promptly.
(e) Clients who become aware that information We hold about you is no longer accurate, complete or up-to-date should contact the relevant Subscriber in accordance with its privacy policy in the first instance.
8. Storage of Personal Information, Sensitive Information and Client Data
We take commercially reasonable steps to protect Personal Information and Sensitive Information and Client Data held by Us from misuse, loss and unauthorised access, modification or disclosure, including by:
(a) maintaining and keeping Our systems up to date;
(b) using secure servers protected from unauthorised access, modification or disclosure;
(c) encrypting data at rest and in transit using SSL encryption;
(d) where possible, using two-factor authentication and encouraging Subscribers and their End Users to enable this feature;
(e) implementing IP barring features and geographic access restrictions to protect against cybersecurity threats;
(f) providing time-barring features to assist Subscribers in guarding against unauthorised out-of-hours access;
(g) relying on reputable service providers and entering into written agreements that include confidentiality and privacy compliance obligations; and
(h) limiting collection of Personal Information, Sensitive Information and Client Data to what We reasonably require.
9. Notifiable Data Breaches
Smartsoft is subject to the Notifiable Data Breaches scheme under the Privacy Act. The obligations of Smartsoft and the Subscriber in respect of data breach notification are set out in clause 8.4 of the Terms of Service.
If We identify that an eligible data breach has occurred or is suspected, We will take the steps required under the Privacy Act. Where an eligible data breach is likely to result in serious harm, this includes notifying the affected individuals and the Office of the Australian Information Commissioner as soon as practicable, in accordance with the timeframes prescribed by the Privacy Act. Where a data breach involves data shared between or mutually held by Smartsoft and a Subscriber, We will work with the Subscriber to assess and respond to the breach in accordance with clause 8.4 of the Terms of Service.
10. Data Retention
(a) If We hold Personal Information and do not need it for any purpose, We will take reasonable steps to destroy or de-identify that information in accordance with the Privacy Act, unless We are prevented from doing so by law.
(b) Retention periods vary depending on the type of information and the applicable laws. Under Australian law, certain records must be retained for specified periods. For example, financial records must generally be retained for 7 years after the completion of the relevant transactions, and health and clinical records are subject to retention periods under applicable health records legislation.
(c) Subscribers may have independent legal obligations to retain Personal Information and/or Client Data held in PracSuite, including patient and clinical records, financial and billing records, Medicare and health fund records and employment records. See clause 16.6(d) of the Terms of Service for the data extraction process following termination.
(d) You may request in writing that We remove your Personal Information. Where permitted, We will do so in accordance with the Privacy Act and Our agreement with the relevant Subscriber. Where We receive an erasure request, We will issue corresponding erasure requests to Our integration partners wherever possible.
11. De-Identified Data
From time to time, Smartsoft may use data derived from the use of PracSuite for the purpose of improving PracSuite, understanding how it is used, and developing new features and functionality. Any data used for these purposes will be de-identified and aggregated so that it cannot be used to identify any individual, Subscriber or Client.
De-identified data will not be sold, licensed or distributed to third parties, except where Smartsoft is required to do so by law or by order of a court or regulatory authority of competent jurisdiction.
12. Anonymity and Use of Pseudonyms
Individuals have the right under the Privacy Laws to request anonymity or to use a pseudonym. However, we may not be able to provide you with information about Our services or the use of Our help desk, if you choose to do so. You are required to provide true and accurate details when requesting services or engaging with Our help desk.
We reserve the right to verify your identity for the purpose of attending to your request to access and/or correct Personal Information and Client Data, or as part of Our process relating to complaints. If you do not verify your identity for this purpose, We may not be able to provide you with access and/or attend to the correction.
13. Spam and SMS Obligations
Smartsoft complies with the Spam Act 2003 (Cth) in connection with its own communications. Subscribers are responsible for their own compliance with the Spam Act 2003 (Cth) and the Do Not Call Register Act 2006 (Cth) when using SMS and email functionality within PracSuite. See clause 9 of the Terms of Service for Subscriber spam obligations and clause 21.6 for SMS Credit spam compliance.
14. Complaints Procedure
Smartsoft is a customer service-oriented business. If you believe We have breached this Privacy Policy, or the Privacy Act, you may make a complaint by contacting Our Privacy Officer using the details in clause 15. We will endeavour to investigate and resolve your complaint within 14 days of receipt. If We believe it will take longer, We will inform you.
If We do not resolve Your complaint to Your satisfaction, You may make a complaint to the Office of the Australian Information Commissioner:
Office of the Australian Information Commissioner
GPO Box 5288, Sydney NSW 2001
Telephone: 1300 363 992 (within Australia)
Telephone: +61 2 9942 4099 (outside Australia)
Website: https://www.oaic.gov.au
15. Contacting Us
For more information about Our privacy practices, to request access to your Personal Information, or to make a complaint, please contact Our Privacy Officer:
Privacy Officer
Smartsoft Pty Ltd ACN 008 110 558
107 Flinders Street, Adelaide SA 5000, Australia
Email: privacy@smartsoft.com.au
16. Amendments
This Privacy Policy may be updated from time to time. Any update will be made in accordance with clause 19.10 of the Terms of Service, which requires Smartsoft to give the Subscriber at least 30 days written notice of any variation. The current version of this Privacy Policy is published on Our Website at www.pracsuite.com/privacy. By continuing to use PracSuite following the expiry of any notice period, You accept the updated Privacy Policy.