1. Scope and roles
This policy covers the YaYfi website, clinic dashboard, Cliniko connection, patient feedback pages, SMS workflow, support and billing functions. It does not replace a clinic’s own privacy policy.
The clinic decides why patients are contacted, which appointments are included and how feedback is used. Patients should contact the clinic about care, an appointment or the clinic’s decision to send a request. YaYfi handles information to provide the configured service and for account administration, billing, security, support and legal purposes. For patient information, YaYfi acts only as a service provider to the clinic and its practitioners and handles that information on the clinic’s instructions. YaYfi does not use patient information for an independent purpose.
The clinic is responsible for configuring lawful workflows, keeping its patient notices accurate, managing user access, monitoring delivery events and opt-outs, reviewing feedback, and handling clinical, complaint, privacy and safety follow-up. YaYfi’s automation does not replace those clinic responsibilities.
An account user acknowledges this policy when creating an account. This policy explains information handling; it is not a waiver of privacy rights and does not replace any consent or other legal basis required for a particular collection, use or disclosure.
2. Information YaYfi may handle
- Clinic and account information: names, work email, phone, clinic details, users, roles, ABN, address and support communications.
- Connected Cliniko information: clinic, location, practitioner, patient contact, appointment type, appointment timing and status needed for the selected workflow.
- Patient feedback: ratings, written comments, submission time and the relevant appointment or practitioner context where available.
- Messaging information: recipient number, message content, send time, segment usage, delivery status and opt-out information.
- Billing information: plan, subscription, invoices, SMS credits and payment-provider identifiers. Card entry and payment processing are handled through Stripe rather than a YaYfi card-entry form.
- Technical and service-analytics information: IP address, device or browser data, authentication, feature use, page interaction, performance, security and error information generated when the service is used. YaYfi may introduce additional analytics in future where reasonably needed to understand and improve the service. Any non-essential cookies or third-party analytics will be described and managed as required before they are activated.
An allied-health appointment and free-text feedback may reveal health information even where treatment notes are not imported. Patients should avoid including information they do not want the clinic to receive and should use the clinic’s urgent-care process where needed.
3. How information is used
- connect the clinic and synchronise selected Cliniko records;
- apply clinic-configured eligibility, timing and contact-frequency rules;
- send and record patient feedback requests and opt-outs;
- present feedback, delivery and reputation information to authorised clinic users;
- operate accounts, trials, subscriptions, SMS credits, invoices and support;
- secure the service, investigate misuse and meet legal obligations; and
- understand and improve service reliability and usability using appropriately limited data.
The clinic determines how practitioner-linked feedback and PXI results are used. Authorised clinic users should interpret them as patient-experience information and not as proof of clinical quality, safety, practitioner competence, cause or treatment outcomes, or as the sole basis for a clinical, employment or disciplinary decision.
4. Website enquiries and optional marketing
When a person requests a clinic fit call, YaYfi collects the name, role, work email, clinic name, preferred contact method, any supplied phone number, clinic size, Cliniko status and enquiry details. The form sends those details to knockknock@yayfi.com so YaYfi can respond, arrange the requested conversation, keep a record of the enquiry and follow up about the products or services discussed.
Marketing permission is optional and separate from the enquiry. If a person selects the marketing box, YaYfi may use the supplied contact details to send occasional news, product updates and offers about YaYfi and related products and services offered by YaYfi. The consent record may include the wording accepted, date, time and technical submission information needed to demonstrate the choice.
Marketing communications must identify the sender and provide a simple unsubscribe method. YaYfi will stop marketing to a person who unsubscribes or withdraws consent. Enquiry information is kept only while reasonably needed to respond, manage the business relationship, meet legal obligations and resolve disputes. Marketing contact details and consent evidence may be retained until consent is withdrawn or the information is no longer needed for that purpose.
This consent does not authorise unrelated third parties or separately operated affiliate companies to market their own products. Any such disclosure or joint marketing requires the relevant organisation to be identified and an appropriate notice or permission before the information is shared.
6. Storage, security and retention
YaYfi’s application uses authenticated accounts and role or permission checks for protected dashboard functions. Passwords are hashed, and payment checkout is delegated to Stripe. See Security for more about access controls, shared responsibilities and incident reporting.
YaYfi retains information only while it is required to provide, support and secure the service or to meet applicable legal obligations. If a clinic deletes a patient or instructs YaYfi to delete that patient’s information, YaYfi removes the data relating to that patient from its active systems and instructs relevant service providers to do the same.
Where information remains temporarily in a protected backup that cannot be edited safely, it will not be returned to ordinary active use and will be removed as the backup is overwritten or expires. If a backup must be restored for disaster recovery, the deletion instruction must be reapplied so the patient’s information is not returned to active use.
7. Access, correction, marketing choices and complaints
A clinic user or patient may ask for access to or correction of personal information held by YaYfi. Some patient requests may need to be handled with the clinic because the clinic controls the appointment and feedback context. YaYfi may need to verify identity before responding.
A person can unsubscribe using the link or instructions in a marketing message, or email help@yayfi.com to withdraw marketing consent. Withdrawing marketing consent does not prevent YaYfi from responding to a current enquiry or sending necessary service communications.
Privacy complaints should describe the concern, the clinic involved and the preferred outcome. YaYfi will provide an initial response within 24 hours of receiving a privacy complaint and will investigate and provide further updates as reasonably required. If a complaint is not resolved, the individual may have a right to contact the Office of the Australian Information Commissioner or another regulator with jurisdiction.
8. Contact
Privacy, access, correction, complaint and marketing-choice requests can be sent to help@yayfi.com. Do not email urgent clinical concerns or highly sensitive health details; contact the clinic directly instead.