1. Who controls what
For information about your clients, you control it and we process it for you. You decide what's collected and why; we hold and handle it on your instructions. If the GDPR or UK GDPR applies to you, you are the controller and we are the processor.
2. What the processing covers
| Item | Detail |
|---|---|
| Subject matter | Providing the Kairo booking, payments and messaging service |
| Duration | As long as your agreement runs, plus the retention period after it ends |
| Purpose | Storing, organising, retrieving and sending client records so you can run bookings, take payment and message clients |
| Types of data | Name, email, phone, appointment history, invoices and payments, and service notes — which may include health information such as allergies and patch tests |
| Whose data | Your clients, and your staff who use the system |
3. What we commit to
- We process client data only on your instructions — using the service is such an instruction — unless the law requires otherwise, in which case we'll tell you first if we're allowed to.
- We keep it confidential, and anyone with access is under a duty of confidence.
- We maintain the measures in the Security Overview.
- We don't use client data for our own purposes, for advertising, or to train models.
4. Sub-processors
You authorise the providers listed in Sub-processors. Each is bound by obligations no less protective than these. We'll give you at least 14 days' notice before adding or replacing one where that's practical, and you can object on reasonable data-protection grounds; if we can't resolve it you can end the agreement. We stay responsible for how they perform.
5. Helping you meet your obligations
If a client asks to access, correct, export or delete their record, you can do most of it yourself in the app. Where you can't, we'll help within 14 days at no charge. We'll also give you reasonable help with privacy assessments and regulator enquiries.
6. Breach notification
If we become aware of a security breach affecting your client data we'll tell you as soon as practicable — normally within 72 hours of confirming it — with what we know, what we're doing, and what we suggest you do. Whether to notify the individuals and the regulator remains your call, and we'll support it.
7. Return and deletion
When the agreement ends we make an export available for 60 days, then delete your data within a further 30 days — except copies sitting in backups, which go as those backups rotate within 90 days, and anything we're required to keep by law.
8. Audit
On reasonable written notice, and no more than once a year unless there's been a breach, we'll give you the information reasonably needed to show we're meeting this addendum.
9. Overseas transfers
Where client data goes outside Australia we do it consistently with APP 8, and where the GDPR applies, on the basis of the European Commission's Standard Contractual Clauses, which are incorporated by reference.