This Privacy Policy explains how Fresh Trading Pty Ltd ACN 624 936 081 (ABN 52 624 936 081) of 28 Richards Ave, Surry Hills NSW 2010 (trading as Fresh Clinics, and referred to as “we”, “us”, “our”) handles Personal Information in connection with our provision of the Claro clinical platform (“Claro”). It is the privacy policy that applies to Claro.
If you are a Patient of a clinic that uses Claro, your clinic is the entity that collects your health information and is responsible for explaining to you how it is collected, used, and disclosed. Your clinic’s privacy policy is the primary policy that applies to you. This policy describes how Claro itself handles your information on your clinic’s behalf and gives you visibility into the platform that supports your clinic.
This policy applies to:
We comply with the Privacy Act 1988 (Cth), the Australian Privacy Principles, the Health Records and Information Privacy Act 2002 (NSW), and the equivalent state and territory health records and privacy legislation that applies to us.
The Personal Information we collect depends on your relationship with Claro.
When you visit our websites or interact with our marketing materials, we may collect:
When your organisation subscribes to Claro, and when you become an Authorised User, we collect:
When a clinic uses Claro to deliver care, the clinic collects Patient Personal Information (including health information) and that information is Processed through Claro. We act on the clinic’s behalf as a contracted service provider. The categories of Patient Personal Information Processed through Claro include:
The collection of this information is the responsibility of your clinic. Your clinic is best placed to explain why a particular item is collected and what would happen if you did not provide it.
We may incidentally Process Personal Information about individuals who are not Patients, Authorised Users, or visitors — for example, an emergency contact named in a Patient record, or a family member or carer mentioned in a clinical note. We Process this information to the extent necessary to support the relevant Patient’s care, in accordance with the clinic’s instructions.
We collect Personal Information to:
To provide the Claro platform to our customer clinics and to their Authorised Users, including:
To provide the AI Features described in section 4, including the disclosure of Personal Information to specialist AI service providers for the purpose of transcription and AI note generation. AI Features are intended to be used only where the relevant clinic has obtained the Patient’s consent for them; obtaining and recording that consent is the clinic’s responsibility (see section 4).
To bill and collect payments, manage accounts, respond to inquiries, deliver onboarding and training, and otherwise administer the Master Subscription Agreement we have with the clinic.
To respond to inquiries from prospective customers, send marketing communications (where you have opted in or where we are otherwise lawfully entitled to do so), and arrange demonstrations of Claro.
To respond to lawful requests by regulators, courts, and law-enforcement authorities, and to comply with our obligations under tax, employment, and other applicable laws.
To analyse the use of Claro, troubleshoot problems, prevent fraud and abuse, secure our infrastructure, and develop new features and improvements. Where we use Patient Personal Information for these purposes, we do so on a de-identified or aggregated basis (in accordance with the OAIC’s De-identification Decision-Making Framework). We do not use Customer Data, Patient Data, Practitioner inputs, consultation audio, transcripts, or AI-generated clinical content to train, develop, fine-tune, or improve any artificial-intelligence or machine-learning model — whether a third party’s general-purpose model or one of our own. The only data we use for product analytics is aggregate usage metrics (such as counts, timings, and error rates) that contain no health information and no clinical content.
Claro includes AI Features that record audio of clinical consultations, transcribe the audio, and generate draft clinical notes. AI Features may also draft letters, investigation orders (including pathology and imaging request drafts), treatment-plan item drafts, summaries, and suggestions to support clinical workflow, and may extract structured information (such as treatment areas mentioned in the consultation) and suggest labels. All of these AI Features are processed through the same safeguards described in this section, and patient identifiers held in the record are not sent to the language-model provider.
Claro is a clinical documentation and workflow-support tool. It is intended to transcribe, summarise, structure, and draft documentation from information stated or provided by the practitioner, or otherwise present in the patient record, and (where a feature is designed to do so) to draw the practitioner’s attention to information recorded in the patient record or to matters the practitioner may wish to confirm. Claro is not designed or intended to generate, and must not be used to obtain, a diagnosis, differential diagnosis, or treatment recommendation that the practitioner has not independently formed. Every AI-generated output is a draft or decision-support prompt for the practitioner to review, verify, edit, accept, or reject; the practitioner exercises independent clinical judgement and is solely responsible for all clinical decisions. Claro is not intended to function as a medical device.
The third-party providers of these artificial-intelligence services (speech-to-text transcription and large-language-model text generation) are our AI Service Providers. They are engaged as Subprocessors and are identified in our Subprocessor List published at https://claro.clinic/legal/subprocessor-list, which we update from time to time in accordance with the Data Processing Agreement. Processing by the AI Service Providers may occur in Australia or the United States.
When AI Features are used:
Each AI Service Provider Processes Personal Information on terms that we have approved and that satisfy the requirements of the Privacy Act 1988 (Cth) for cross-border disclosure. No patient data, consultation audio, transcript, or generated clinical content is used to train, develop, or improve any AI model — whether a third party’s model or one of our own. We do not authorise any AI Service Provider to retain or use this information for any such purpose, and we do not use it for any such purpose ourselves.
The decision to use AI Features in any particular consultation, and the consent obtained from the Patient for their use, is the responsibility of the clinic. We provide the clinic with template materials (a Patient Information Sheet and a Patient Consent Addendum) to help the clinic obtain informed consent.
You can find more detail in our Patient Information Sheet — AI Recording and Transcription, available from your clinic.
Claro uses automated processing to generate draft clinical documentation and suggestions, which a practitioner then reviews, edits, and approves. Claro does not make automated decisions that produce legal or similarly significant effects about a patient without a practitioner’s involvement: a registered health practitioner remains responsible for, and makes, the clinical decisions about a patient’s care. (This statement is provided in anticipation of the automated-decision-making transparency requirements commencing under the Privacy Act 1988 (Cth) on 10 December 2026.)
We disclose Personal Information only as described in this policy and only to the extent necessary for the purposes listed in section 3.
For Patient Personal Information, the customer clinic is the entity that collects and controls the information. The clinic and its Authorised Users may access Personal Information about Patients in accordance with their roles and the clinic’s clinical workflows. Other clinics in the same network of orgs may have access to a Patient where the Patient is referred between them, in accordance with the clinic’s screening or referral arrangements.
Authorised Users of a clinic see Personal Information of that clinic’s Patients in accordance with their assigned role and the clinic’s data isolation rules. We do not allow Authorised Users to see Patient information held for other clinics outside the network and referral arrangements approved by the clinics.
We engage third-party service providers to support the delivery of Claro. We refer to these as Subprocessors. They include providers of:
A list of our current Subprocessors is available at https://claro.clinic/legal/subprocessor-list. We update the list when our Subprocessors change.
We may disclose Personal Information to regulators (such as the Australian Health Practitioner Regulation Agency, the Australian Digital Health Agency, the Office of the Australian Information Commissioner, the Therapeutic Goods Administration, state health and poisons authorities, and the operators of state real-time prescription monitoring schemes) and to courts and law-enforcement authorities where we are required or permitted to do so by Applicable Law.
We do not voluntarily disclose Personal Information to overseas regulators or law-enforcement authorities except where required by Australian Applicable Law or with the customer clinic’s prior written consent.
We may disclose Personal Information to our professional advisers (lawyers, accountants, auditors, and consultants) and to our insurers and brokers, in each case for the purpose of obtaining advice or insurance and on terms that protect the confidentiality of the Personal Information.
If we sell, transfer, or restructure all or part of our business, we may disclose Personal Information to a buyer, transferee, or successor as part of that transaction, on terms that require the buyer to handle the Personal Information consistent with this policy.
We may disclose Personal Information for any other purpose where you have consented to that disclosure.
Some of our Subprocessors are located outside Australia. The principal locations at which Subprocessors Process Personal Information through Claro are:
When we disclose Personal Information to an overseas Subprocessor, we comply with Australian Privacy Principle 8 by:
We may rely on consent in some circumstances. Where consent is required (for example, where APP 8.2(b) consent is sought), the customer clinic obtains the relevant consent from the Patient using the template materials we provide or its own equivalent materials.
We take reasonable steps to protect Personal Information from misuse, interference, loss, unauthorised access, modification, or disclosure. Our technical and organisational security measures include:
A more detailed description of our technical and organisational measures is set out in the Data Processing Agreement that we provide to customer clinics.
No security measure is perfect. If we become aware that Personal Information has been compromised, we will respond in accordance with the Notifiable Data Breaches scheme and will notify affected individuals where required.
We retain Personal Information only for as long as is necessary for the purposes for which it was collected, and in accordance with the Master Subscription Agreement and Applicable Law.
In particular:
We may retain de-identified or aggregated information indefinitely.
You have a right to seek access to, and to seek correction of, the Personal Information we hold about you, in accordance with Australian Privacy Principles 12 and 13 and any applicable state health-records access regime.
If you are a Patient of a customer clinic, please direct your request in the first instance to your clinic. We will assist your clinic to respond.
If you are an Authorised User, customer, or visitor, you can submit a request to us at the contact details in section 12. We will respond within 30 days, or such other period as is reasonable in the circumstances.
We may charge a reasonable fee for access requests where permitted by law. We will not charge for the request itself.
If we decline to provide access or to make a correction, we will give you reasons in writing.
If you have a complaint about how we have handled your Personal Information, you can contact us at the details in section 12.
We will:
If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (oaic.gov.au) or to the relevant state privacy or health information authority.
We use cookies and similar technologies on our websites for purposes including:
You can disable cookies in your browser, but some features of our websites may not function correctly without them.
We use a limited number of analytics services (for example, basic web analytics that do not combine with health information) to understand site usage. We do not use analytics services on the authenticated parts of Claro that contain Patient information.
You can contact us about this policy or about your Personal Information at:
Privacy Officer, Fresh Trading Pty Ltd Email: [email protected] Postal: 28 Richards Ave, Surry Hills NSW 2010 Phone: 1300 375 646
For Patients, please contact your clinic in the first instance.
We may update this policy from time to time. The current version is always available at https://claro.clinic/privacy. Material changes will be notified through Claro and (where you are a customer or Authorised User) by email to your nominated contact address.
The version date at the top of the policy will reflect the most recent update.