The patient voice is valuable. Treat it that way.

1. Security principle

YaYfi uses the clinic, appointment, patient contact and feedback information needed to run the workflow your clinic configures. The product is designed not to import clinical treatment notes. Because appointment and feedback information can still be sensitive, access and data handling must be treated accordingly.

2. Keep the right doors closed—and the right people connected

3. Shared responsibility

YaYfi is responsible for taking reasonable steps to secure the YaYfi service and for responding to incidents within that service. The clinic remains responsible for its own systems, users, instructions, patient relationship and clinical or operational response, including:

• using unique credentials and removing access when a team member no longer needs it;
• limiting YaYfi and Cliniko permissions to authorised people;
• keeping account, sender and support contacts current;
• reviewing patient feedback through appropriate clinical and complaints procedures; and
• reporting suspicious access promptly.

The clinic leads communications and follow-up with its patients where the incident arises from the clinic’s systems, users or instructions, or where the clinic is legally responsible for that communication. YaYfi and the clinic must cooperate where an incident affects both parties. Each party remains responsible for the privacy, security, regulatory and notification obligations that legally apply to it; those obligations cannot be transferred merely by describing the service as a shared-responsibility arrangement.

4. Security concerns and incidents

Report security concerns to help@yayfi.com. Include the affected page, steps to reproduce and likely impact. Do not access, change or download data that is not yours, disrupt the service or publicly disclose a concern before YaYfi has a reasonable opportunity to investigate.

YaYfi will provide an initial response within 24 hours of receiving a security or suspected data-breach report. This is an acknowledgement and triage commitment, not a guaranteed resolution time. YaYfi will record the report, assess urgency, take reasonable containment steps, preserve relevant evidence and investigate the likely cause and impact.

Where clinic information may be affected, YaYfi will notify the clinic as soon as reasonably practicable with the information available and will provide reasonable assistance for the clinic’s response. The clinic is responsible for its own patient, practitioner and regulator communications where those obligations apply to the clinic. YaYfi remains responsible for assessing and making any notification legally required of YaYfi, including under the Notifiable Data Breaches scheme if it applies. Each party must cooperate with the other and avoid statements that could compromise the investigation or increase harm to affected people.

5. Security is maintained, not declared once

YaYfi reviews its hosting, access controls, monitoring, backups, restoration, dependency management, data deletion and incident-response arrangements as the service develops. Technical configurations and processing locations are maintained by YaYfi and shared with clinics where they matter to the service or are required by law.

No online service is risk-free. YaYfi will keep its security statements proportionate to the controls in use and will not describe the whole service as certified unless a current, appropriately scoped certification supports that statement.