Privacy Policy

1. Who we are

Rapid Intelligence Systems is the trading name of Cooper Lee Chochovski, an Australian sole trader.

ABN: 92 318 977 973
Registered address: 12 Fortuna Ave, Balwyn North 3104, Victoria, Australia
Contact: contact@rapidintelligence.com.au

2. What personal information we collect

2.1 Business customers (clients)

When you create an account or subscribe to the Platform, we collect:

• Your name and business name
• Business website URL
• Email address and hashed password (we cannot read your password)
• Billing details - processed by Stripe; we do not store card numbers
• IP address and browser/device information at account creation
• Social media and advertising platform OAuth tokens and account identifiers, if you connect accounts via RISE (access tokens are stored encrypted)

2.2 End users (your customers)

When a visitor uses a RIKO widget embedded on your website, we may collect:

• Chat messages sent to and received from the AI assistant
• Any personal information the visitor voluntarily provides in the chat (e.g. name, email, or phone number)
• Session identifiers to maintain conversation continuity within a single visit
• Approximate timestamp of the conversation

We do not create persistent accounts or profiles for end users. We do not knowingly collect end user data beyond what is provided in the course of the conversation.

2.3 Practice billing records (RIFT clients)

If you use RIFT, you connect or provide data from your practice management system (for example, Zanda or Cliniko). On your instruction we process:

• Patient names, client numbers, email addresses, and phone numbers
• Appointment dates and attendance status (attended, cancelled, did not attend)
• Invoice, payment, and Medicare/funding claim records, including amounts owing
• Funded plan and session pack balances
• Practitioner names and billing patterns

Because this data reveals that a person attends your practice, it may constitute health information under the Privacy Act 1988 (Cth). We process it exclusively to operate RIFT for your practice - identifying billing gaps and sending the account reminders you direct - and never for any other purpose. Patient contact details are stored only for patients connected to an item on your recovery list, and are removed when no longer needed (see section 8). This data is never used to train AI models and, with the exception of email delivery via Resend (section 4), is not transmitted outside our Australian-hosted infrastructure. Our error monitoring (Sentry, section 4) is not connected to RIFT at all, so this data is never included in an error report.

2.4 Website visitors

When you visit our website, we collect standard web server logs including IP address, browser type, pages visited, and referral source. This is used solely for security monitoring and aggregate analytics.

2.5 Website content (client-provided)

During Platform setup, we crawl and index the publicly accessible pages of your website to build the RIKO knowledge base. This content is stored on our servers and used exclusively to operate your AI assistant.

3. How we use personal information

We use the information we collect to:

• Create and manage your account and provide the Platform services
• Generate and maintain the RIKO knowledge base from your website content
• Generate content drafts, images, and content suggestions for you when you use RISE, including suggestions based on aggregated question themes from your own RIKO conversations (shown only to you and never published without your approval)
• Analyse your practice billing records to identify unbilled, unpaid, or unclaimed amounts, and send account reminder emails to your patients in your practice's name, under settings and approvals you control, when you use RIFT
• Process payments and manage your subscription via Stripe
• Send transactional emails (account setup, billing receipts, service notices)
• Respond to support requests and account enquiries
• Monitor platform security and investigate suspected breaches or misuse
• Improve the Platform using aggregated, non-identifiable usage data
• Comply with our legal obligations

We do not sell personal information to third parties. We do not use end user chat data to train AI models.

4. Third-party services and sub-processors

We share data with the following third parties solely to operate the Platform:

• OpenAI - chat messages and content submitted for AI features (including RISE post, image, and ad generation) are transmitted to OpenAI's API. OpenAI does not use API-submitted data to train models by default. RIFT's AI rewording feature sends only your email template wording (with placeholder fields) to OpenAI - patient names, amounts, and other practice billing data are never transmitted to OpenAI.
• DigitalOcean - cloud hosting, database, and encrypted backup infrastructure, located in Sydney, Australia.
• Sentry - error monitoring for the RIKO platform only. When a technical fault occurs, an error report is transmitted to Sentry so we can diagnose and fix it. Sentry is deliberately configured to exclude the contents of messages, the values of local variables, and authentication headers, so chat conversations and personal information are not carried in an error report. Sentry is not connected to RIFT, so practice billing records are never sent to it. Sentry processes this data outside Australia.
• Meta (Facebook/Instagram), LinkedIn, and Google - when using RISE, post and ad content, campaign settings, and analytics data are transmitted to and from these platforms via their official APIs. Ad campaigns are created on your own advertising accounts. These platforms operate under their own privacy policies. We do not transmit RIKO widget conversation data to these platforms.
• Stripe - payment processing. Card details are entered directly into Stripe's interface and are not accessible to us.
• Resend - email delivery. This covers our own transactional emails and, for RIFT clients, the account reminder emails sent to your patients in your practice's name - for those, the patient's name, email address, and the account details in the email body pass through Resend for delivery, as with any email provider.
• Zanda and Cliniko (practice management systems) - for RIFT clients, we receive data from your Zanda or Cliniko account on your authority; we do not send your data back to them. Your practice management system is your own system operating under its own agreement with you, not a sub-processor of ours.
• Google Analytics (Google LLC) - website analytics. Collects anonymised usage data (pages visited, session duration, referral source) via cookies on our marketing website. IP addresses are anonymised. Data is processed by Google in accordance with their privacy policy. Google does not receive any Platform conversation data or personal information collected through the RIKO widget.

We do not permit sub-processors to use your data for their own commercial purposes beyond what is necessary to provide their services to us.

5. Client responsibilities regarding personal information

If you are a business client, you are the data controller in respect of any personal information collected from your end users through the RIKO widget. You are responsible for:

• Ensuring you have a lawful basis to collect and process your end users' personal information
• Providing your end users with a privacy notice disclosing the use of an AI chat assistant
• Ensuring compliance with all applicable privacy laws in the jurisdictions in which you operate
• Not configuring the Platform to collect sensitive information without explicit end user consent and appropriate safeguards

Sensitive information includes health information, financial account details, government identifiers (e.g. Medicare numbers, Tax File Numbers), biometric data, criminal history, and any other category defined as sensitive under the Privacy Act 1988 (Cth) or applicable state health privacy legislation.

You must not use the Platform in a manner that requires us to process sensitive information on your behalf unless you have first obtained our written agreement and demonstrated appropriate safeguards are in place. We reserve the right to suspend or terminate your account if we identify sensitive information is being processed in breach of this requirement.

RIFT is the deliberate exception: it is designed to process your practice billing records, which may include health information, under the safeguards described in section 2.3 and in section 13 of our Terms of Service. Your RIFT subscription constitutes our written agreement to that processing. You remain responsible for your own privacy obligations to your patients, including disclosing in your practice's privacy notice that a third-party service assists with billing administration, and for ensuring you are entitled to contact each patient about their account.

We are not responsible for any privacy obligations arising from your use of the Platform to collect your customers' personal information.

6. Regulated industries

If you operate in a regulated industry (including healthcare, legal, financial services, or childcare), you are solely responsible for ensuring your use of the Platform complies with all applicable industry-specific privacy and confidentiality obligations, including:

• The Privacy Act 1988 (Cth) and applicable state health records legislation (including the Health Records Act 2001 (Vic)) for healthcare providers
• Professional secrecy and confidentiality obligations under your industry's governing legislation or codes
• Any obligations arising from government or regulatory body contracts or funding agreements

We make no representation that the Platform is compliant with any specific industry regulation. You should seek independent legal advice before deploying the Platform in a regulated context.

7. Cookies and tracking

The Platform dashboard uses a single authentication cookie (ri_token) to maintain your logged-in session. This cookie is HttpOnly, Secure, and SameSite=Lax. The same cookie signs you in to RIKO, RISE and RIFT, which is what allows a single login to work across all three products.

The RIKO widget uses browser session storage to maintain conversation context within a single page visit. Session storage is cleared when the browser tab is closed. No persistent cookies are set on your visitors' browsers.

We use Google Analytics 4 on our marketing website to understand how visitors find and use the site. Google Analytics sets cookies to collect anonymised data including pages visited, time on site, and referral source. IP anonymisation is enabled. No Platform data, conversation content, or personal information entered into the RIKO widget is shared with Google Analytics. You can opt out of Google Analytics tracking using the Google Analytics Opt-out Browser Add-on.

8. Data retention

• Conversation logs: retained for up to 12 months, then deleted or anonymised
• Account data: retained for the duration of your subscription and 90 days after cancellation
• Crawled website content: updated on demand and deleted when your account is closed
• RIFT patient contact details: held only while the patient has an item on your recovery list, and removed automatically when they no longer do
• RIFT resolved items and sent-email records: retained for up to 24 months (the sent-email record is your audit trail of what was sent, to whom, and who approved it), then deleted
• Billing records: retained for 7 years as required by Australian taxation law
• Web server logs: retained for 90 days for security monitoring

9. Security

We take reasonable technical and organisational measures to protect personal information, including:

• Encrypted data storage and HTTPS-only connections
• Bcrypt password hashing (we cannot read your password in any form)
• JWT authentication tokens stored in HttpOnly cookies
• Tenant-isolated database architecture (each client's data is logically separated)
• Restricted access to production systems on a need-to-know basis

Authorised Rapid Intelligence Systems personnel may access your account and its contents - including logging in to your account - where reasonably necessary to provide support, investigate or resolve technical issues, maintain the security and integrity of the Platform, or comply with a legal obligation. Such access is limited to what is reasonably necessary for the relevant purpose and is restricted to personnel on a need-to-know basis.

If you believe there has been a security incident affecting your data, contact us immediately at contact@rapidintelligence.com.au.

10. Your rights

If you are in Australia or the European Economic Area, you have the right to:

• Request access to the personal information we hold about you
• Request correction of inaccurate or incomplete information
• Request deletion of your personal information (subject to legal retention obligations)
• Object to or restrict certain processing activities
• Receive a portable copy of your data in a structured, machine-readable format
• Lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au

To exercise any of these rights, email contact@rapidintelligence.com.au. We will respond within 30 days.

11. Children

The Platform is intended for use by businesses and is not directed at individuals under 16 years of age. We do not knowingly collect personal information from children.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will notify active account holders of material changes by email at least 14 days before they take effect. Continued use of the Platform after the effective date constitutes acceptance.

13. Contact

For privacy questions or requests: contact@rapidintelligence.com.au
Post: 12 Fortuna Ave, Balwyn North 3104, Victoria, Australia