Innowell Privacy Policy

Last update: 7 May 2025

1. Overview

1.1. At Innowell, we care about your data and privacy and we want you to be able to know and understand how we collect, use, communicate and disclose your personal information when you access and use the Innowell Platform, including the Subscriptions and our website located at www.innowell.org.

1.2. In this policy references to 'Innowell', 'we', 'our' or 'us' means Innowell Pty Ltd (ACN 617 239 166) and ‘you’ or ‘your’ means you.

2. About this policy

2.1. This privacy policy sets out the way in which we collect, use, disclose, communicate, retain, dispose, handle or otherwise process your personal information.

2.2. We may amend or update this policy from time to time. If this happens, we will publish any updates on our website and notify you by email or by posting a notice of the changes in the platform. If you do not agree with the changes, you must cease accessing the Innowell Platform. If you continue to access or use the Innowell Platform after the changes come into effect, we will assume that you have agreed to them.

3. About the Innowell Platform

3.1. The Innowell Platform is cloud-based software for supporting mental health and wellbeing.

4. Summary of Key Points

This Policy includes the following key sections. However, you should read the entire privacy policy, as it contains important information about how we process your personal information. You may use the links below to be directed to more detailed information.

4.1. What personal information do we collect about you. We may collect personal information related to: (i) your identity (such as your name and email address); (ii) your demographic (such as your date of birth, gender, sexual orientation and socio-economic information); (iii) your contact details (such as your mailing address, telephone number and email address); (iv) your health information (such as your physical and psychological health); (v) your support persons (such as their email address and their relationship with you; (vi) your access or use of the Innowell Platform (such as technical and behavioural information); and (vii) if you are an employee, we may collect information about your employment information (such as your profession and length of service).

4.2. How we collect your personal information. We collect information either directly from you, your Administrative User, your service provider, your support person, common third parties or through the use of technology such as cookies.

4.3. How we use personal information. We use the personal information we collect to ensure the proper functioning and provision of our services, to communicate with you, to optimize your experience on the Innowell Platform, to analyze and improve our services, to provide support, to administer your employment (if you are an employee) and for other legal reasons. With your consent, we also use your personal information to coordinate your participation in healthcare research studies.

4.4. How we communicate or disclose your personal information. We may share your personal information with our subsidiaries, affiliates and service providers so they can provide services for us or on our behalf and who may use your personal information for the same purposes listed above, for legal compliance, or in connection with a business transfer.

4.5. How we keep your personal information secure. We take all reasonable steps to protect your personal information from misuse, interference and loss as well as from unauthorised access, use, modification, communication and disclosure. While we take steps to safeguard the personal information under our control, we cannot guarantee the security of any personal information, including any personal information communicated to us by electronic means (including through the Innowell Platform). It is possible that third parties may unlawfully intercept or access such information.

4.6. International Transfers. Information we collect may be transmitted, stored or transferred to/in countries other than Canada. This means that your personal information may be accessible to courts, law enforcement and national security authorities in other countries.

4.7. How you can access and correct your personal information. You may have the right to access, rectify, update, request deletion, or request a portable copy of the personal information we collect about you. You may also have the right to withdraw your consent where it is required for the collection of your personal information, subject to certain restrictions permitted or required by applicable law. You can exercise any of these rights by signing-in to the Innowell Platform to view and update your information, or by contacting our Privacy Officer at privacy@innowell.org.

4.8. How and when is your personal information deleted. We will only keep your personal information for as long as is necessary for the purposes of the Innowell Platform, or as required or permitted by law.

5. What personal information do we collect about you

5.1. We collect the following personal information from or about patients:

  • (a). Identity information. This information includes information about:
    • (i) your identity: your full name and email address;
    • (ii) your demographics: your date of birth, gender, birth location, sexual orientation, education level, socio-economic information, indigenous status, if you are part of a first nation community, ethnicity, primary language, marital status, family status, financial status, living circumstances and income; and
    • (iii) your contact details: such as street/mailing address, telephone numbers, email address and social media handles.
  • (b). Health information. This information is sensitive personal information relating to your health which may include:
    • (i) physical health information: sleep-wake cycle, height, weight, exercise levels, eating behaviours, alcohol, tobacco, and cannabis use;
    • (ii) psychological states: anxiety, social connectedness, social function, depression, suicidality, mania-like experiences, PTDS and self-harm; and
    • (iii) medical history: disability status, hospitalizations, and family history.

5.2. We collect the following personal information from or about your support persons: email address and their relationship to you.

5.3. We collect the following personal information from or about our employees:

  • (a). your identity: full name, gender, age;
  • (b). your demographics: education level, spoken language; and
  • (c). your employment information: profession, length of service and number of weekly paid hours.

5.4. We may also collect any other information you chose to share with us either directly or via your service providers or support persons.

5.5. The Innowell Platform is designed to provide services to you that are suitable for your individual needs. Because of this, the exact nature of the personal information that the Innowell Platform collects, handles or processes will differ from person to person.

6. How we collect your personal information

6.1. We collect personal information through the following ways:

  • (a). Information shared by you: The main way we collect personal information about you is when you provide it to us. We will not collect, use, process, or handle personal information of minors under the age of 14, unless the person having parental authority over the minor, tutor or guardian consents;
  • (b). Information shared by your Administrative User: If you’ve been assigned a subscription to the Innowell Platform by an organisation, your Administrative User may provide us with personal information about you;
  • (c). Information shared by your service providers and support persons: If your subscription allows for interoperability between the Innowell Platform and clinical service delivery to you, we may collect personal information about you from your clinician, support persons or our partner when they use or interact with you through the Innowell Platform;
  • (d). Information shared by common third parties: If your subscription allows for interoperability between the Innowell Platform and applications provided by third parties which both you and we have a separate commercial relationship, we may collect personal information from those third parties; and
  • (e). Information collected via cookies: We collect certain information automatically using cookies and similar technologies, including information from third parties. To learn more, please see Innowell’s Cookie Policy which includes information about how and why we use cookies and other tracking technologies, and how to opt-out of certain cookies and tracking technologies.

7. How we use personal information

7.1. Use and access to the Innowell Platform.The primary purpose for which we use your personal information is to provide you with access to, and use of, the Innowell Platform where you have a valid subscription.

7.2. Provide our services. We use your identity and health information to aid the clinical care team (such as the clinicians) to triage and onboard you into the treatment service, establishing a baseline of mental health, to help the clinicians in developing a care plan for you and to help drive the right level of support for you and to aid clinicians in their decision making.

7.3. For emergency contact. We use the information collected from your support persons in order to establish a contact point in case of emergency. To administer your employment. We use the information collected from our employees to perform administrative, accounting, payroll, insurance, social security and tax activities, including bookkeeping or the payment of salaries.

7.4. Improve our services. We use the technical and behavioural information we collect from you when you access or use the Innowell Platform in order to customise your visit to our website and the Innowell Platform based on preferences you made previously, remember the actions you take on the Innowell Platform to understand if we need to inform you (or not) of certain information about your usage each time you log-in, analyse usage trends across our user base to improve our website, the Innowell Platform and services, and inform how we can offer you new services or to make additional information available to you.

7.5. Where permitted by law or with your consent, we also use personal information for other purposes, including:

  • (a). quality assurance;
  • (b). monitoring and assessing the operation of the Innowell Platform;
  • (c). providing technology and help desk support; and
  • (d). when the use of personal information is permitted or required by law.

8. Research projects

8.1. This part summarises how do we deal with the personal information we collect or receive in connection with your use of the Innowell Platform and participation in any healthcare research studies (each a Study and collectively, Studies). To participate in any Studies, you will be presented with a consent form (Informed Consent) for the Study. By using the Innowell Platform, you consent to the collection, use, and sharing of your personal information as described in this privacy policy and as outlined in the Informed Consent. We use the term Study Team to refer to all the entities that may have access to data collected from or about you through the Innowell Platform or as part of the Studies. For all Studies, the Informed Consent will include specific information about the Study Team. The Study Team is also obligated to protect your personal information.

8.2. Your personal information, if collected through the Innowell Platform, may be used for purposes described in the Informed Consent including:

  • (a). to enroll you in the Study;
  • (b). determining your eligibility for participation in the Study;
  • (c). to conduct and support the Study;
  • (d). to develop health-related products and improvement activities;
  • (e). for other research studies, if permitted in the Informed Consent;
  • (f). to issue research findings and related reports, which will not identify you; and
  • (g). to contact you with surveys or other messages related to the Study.

9. How we communicate or disclose your personal information

9.1. We may also disclose your personal information for purposes permitted by applicable laws. These include disclosure:

  • (a). to our Study Team partners for research purposes with your consent;
  • (b). to our business partners who are providing us with professional services as part of operating the Innowell Platform but only to the extent required for them to provide their services to us. These service providers include:
    • SendGrid Inc., a company owned by Twilio Inc., with a place of business at 889 Winslow Street, Redwood City, California, 94063, that may process your name and email address in the United States for the purposes of sending you emails related to your transactions.
    • Twilio Inc., a Delaware corporation, with a place of business at 101 Spear Street, 5th Floor, San Francisco, California, 94105, United States of America, that may process your name and phone number in eastern United States for the purposes of sending you text messages related to your transactions.
  • (c). where necessary, for health and safety purposes where it is unreasonable or impractical for us to obtain your express consent;
  • (d). to Innowell's subsidiaries and affiliates so that those entities may assist us in providing our services. Each of these entities will process information in accordance with this privacy policy;
  • (e). with third parties where we have your consent to do so or as permitted by applicable laws, except as otherwise prohibited by law;
  • (f). where we are legally obligated to.

9.2. Personal Information in our possession may be accessed by different groups of employees and personnel within Innowell, but only as required in order for them to carry out their responsibilities. Such personnel may include privileged accounts for system administration and troubleshooting and employees in our Customer Support, IT and Legal teams. As a stipulation of employment, all Innowell employees are required to adhere to the Australian Privacy Act 1988. This legislation mandates the responsible handling of personal information and requires individuals to maintain strict confidentiality. All employees must ensure compliance with the Australian Privacy Act 1998, thereby safeguarding your personal information and respecting your privacy rights.

9.3. If Innowell is involved in a merger, acquisition, or asset sale (each a “transaction”), some or all of your personal information may be disclosed for the purposes of evaluating or carrying out the transaction, in accordance with any legal requirements under the applicable legislation. In such a case, the other party will be instructed to handle the personal information in the same manner as provided in this privacy policy, and you will be notified to the extent required by applicable laws.

10. How we keep your personal information secure

10.1. We take all reasonable steps to protect your personal information from misuse, interference and loss as well as from unauthorised access, modification, communication and disclosure through the following measures:

  • (a). We only store your personal information on computer systems located in Canada;
  • (b). We ensure that access to these systems is highly restricted and controlled;
  • (c). We implement organisational, physical, technical and administrative security measures;
  • (d). We use encryption to protect your data while it is at rest in the Innowell Platform;
  • (e). We use encryption to protect data communications between the Innowell Platform services and the computer systems;
  • (f). We limit access to your personal information only to staff who have a need to access your perform information to perform a specific task or function;
  • (g). Innowell employees must abide by this privacy policy and are kept up-to-date on security practices.

10.2. Although we take appropriate measures to safeguard the security of your personal information, we cannot guarantee its security. To assist in preventing unauthorised use, communication or disclosure of your personal information, you must keep confidential any sign-in information and passwords related to your subscription to the Innowell Platform.

9.3. In the event of any data breach, we will follow the specific requirements of the Privacy Act 1988, the Privacy Amendment (Notifiable Data Breaches) Act 2017 (Cth) and any other applicable law.

11. Cross-Border Transfers

11.1. Your personal information will be hosted by Innowell on servers located in Ontario, Canada.

11.2. If you are a resident of Canada, please note that your personal information may be transferred, disclosed and/or stored by entities, service providers or our subsidiaries and affiliates outside of Canada, subject to any applicable legal requirements. By accessing the Innowell Platform, you consent to the disclosure and processing of your personal information outside of Canada as described in this section. If you are a resident of Quebec, your personal data may be communicated or disclosed to entities, service providers, or our subsidiaries and affiliates located outside of Quebec.

11.3. This means that when we collect your personal information, such information will be processed in the United States and Australia, and accordingly, may be accessible to courts, law enforcement and national security authorities of that location. We will implement reasonable measures to ensure that transfers of personal information outside of Canada are adequately protected as required by applicable law.

11.4. If you have any questions or wish to obtain further written information about how we transfer or disclose your personal information outside of Canada or about our policies and practices with respect to the collection, use, communication, disclosure, processing, or storage of your personal information by entities, service providers or our subsidiaries and affiliates outside of Canada, you may contact us at privacy@innowell.org.

12. How you can access and correct your personal information

12.1. Some of your personal information that is collected by the Innowell Platform is entered directly by you and is always accessible to you when you log in to the Innowell Platform. If your contact details change, we ask that you update this information promptly.

12.2. Depending on where you are located, your rights may include the right to access, rectify, update, request deletion, or request a portable copy of the personal information we collect about you. You may also have the right to withdraw your consent where it is required for the collection of your personal information. You can access, view, manage and update your personal information details, research data sharing consent status, health domains and care options at any time. Simply sign-in to the Innowell Platform to view and update your information.

12.3. Otherwise, you may contact the Innowell Privacy Officer at privacy@innowell.org if you think that your personal information is inaccurate on the Innowell Platform or to exercise any one of the previously mentioned data protection rights as may be available to you under applicable law. Please refer to data privacy laws in your geographic location for specific rights that may be provided in addition to the general description above.

13. How and when is your personal information deleted

13.1. We will only keep your personal information for as long as is necessary for the purposes of the Innowell Platform, or as required by law. When your personal information is no longer needed for the purpose for which it was collected and you have been inactive on the platform for more than 12 months, we will take reasonable steps to erase your personal information from our records by either permanently deleting or de-identifying your personal information.

13.2. To request for your personal data to be erased – please contact the Innowell Privacy Officer at privacy@innowell.org. Please note that we may have a legal right or other obligation to maintain certain information about you, irrespective of your request for deletion.

14. Contact details

14.1. If you have any queries or complaints about our privacy policy or Innowell’s privacy practices, please contact us at:

Innowell Privacy Officer

Call: +61 2 5500 9355
Email: privacy@innowell.org
Mail: Innowell Pty Ltd, Suite 301, 309 George St, Sydney NSW 2000, Australia

14.2. We will acknowledge your requests or complaints, and respond to you within either 30 days of receipt of your request or within the delays set out by the applicable law.

14.3. If you think that we have failed to resolve a complaint satisfactorily or you still have a concern, or would like more information, you can contact the office of the applicable privacy regulator depending on where you are located:

Office of the Australian Information Commissioner

Online: https://www.oaic.gov.au
Call: 1300 363 992
Email: enquiries@oaic.gov.au
Fax: +61 2 9284 9666
Mail: Office of the Australian Information Commissioner, GPO Box 5218, Sydney NSW 2001, Australia (or GPO Box 2999, Canberra ACT 2601, Australia)

Office of the Privacy Commissioner of Canada

Online: https://www.priv.gc.ca/en/for-individuals/
Call: 1-800-282-1376
Online form: https://services.priv.gc.ca/q-s/allez-go/eng/8b62761b-7100-4016-886c-0279a78670d6
Mail: Office of the Privacy Commissioner of Canada, 30 Victoria Street, Gatineau, Quebec K1A 1H3

Office of the Information and Privacy Commissioner of Alberta

Online: https://oipc.ab.ca/forms/
Call: 1-888-878-4044
Email: generalinfo@oipc.ab.ca
Fax: 780-422-5682
Mail: Office of the Information and Privacy Commissioner of Alberta, #410, 9925 - 109 Street, Edmonton, Alberta T5K 2J8

Office of the Information and Privacy Commissioner for British Columbia

Online: https://www.oipc.bc.ca/forms/individuals/
Call: (250) 387-5629
Email: info@oipc.bc.ca
Fax: (250) 387-1696
Mail: Office of the Information and Privacy Commissioner for British Columbia, PO Box 9038 Stn. Prov. Govt., Victoria B.C. V8W 9A4

Commission d’accès à l’information (Québec)

Online: https://www.cai.gouv.qc.ca/citoyens/recours-devant-la-commission/
Call: 1 888 528-7741
Email: renseignements@cai.gouv.qc.ca
Fax: 418 529-3102
Mail: Commission d’accès à l’information, Bureau 2.36, 525 boulevard René-Lévesque Est, Québec (Québec) G1R 5S9

15. Language

Please note that both the English and French versions of this privacy policy have equal legal value. The French version of this privacy policy is accessible here.

Veuillez noter que les versions anglaise et française de cette politique de confidentialité ont la même valeur juridique. La version française de cette politique de confidentialité est accessible ici.

‍

‍