1. About This Policy

SUNIX Computer Consultants Pty Ltd (ABN 14 002 825 907) trading as SUNIX (we, us, our), provides practice management software (Software) to optical and eyecare businesses that licence our Software (Subscribing Businesses).

Subscribing Businesses use our Software to collect, store, use and disclose the personal information of their customers and patients (End Customers), and otherwise manage their practices.

We are bound by, and committed to complying with, the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs). This Privacy Policy explains how we handle personal information, including our role in relation to End Customer data, and how individuals can contact us about the personal information we hold.

2. Our Role in Relation to Personal Information

It is important to understand the distinction between SUNIX’s role and the role of our Subscribing Businesses:

• Subscribing Businesses are responsible for the personal information they collect from and about their End Customers. They are the APP entities responsible for their own privacy obligations under the Privacy Act, including obtaining any consents required.
• SUNIX holds End Customer personal information on behalf of Subscribing Businesses within the meaning of the Privacy Act, but does not collect that information for its own purposes. We host and store End Customer personal information within our Software platform, but we do not own, control, or independently use that information. We only access End Customer data for the limited purposes of system administration and providing technical support to the relevant Subscribing Business.

SUNIX’s own data collection is limited to the basic business contact details of Subscribing Business personnel and our other business contacts (see Section 4 below).

3. What Is Personal Information?

Personal information is information about an identified individual, or an individual who is reasonably identifiable, such as a name, contact details, health information or transaction records.

Sensitive information (including health information) is a subset of personal information that is subject to additional protections under the Privacy Act. End Customer data stored in our Software may include sensitive information such as eye health records, clinical notes, and
Medicare or private health insurance details.

Subscribing Businesses are responsible for ensuring that their collection and handling of sensitive information complies with APP 3 and the Privacy Act. SUNIX does not independently collect sensitive information.

4. Information We Collect Directly

The personal information we collect in our own capacity is limited to:

• Subscribing Business personnel: names, job titles, email addresses, phone numbers, and records of our business dealings.
• Other business contacts: names and contact details of individuals we interact with in the course of our business, such as suppliers and partners.

We collect this information directly from those individuals in the course of our business dealings, through our website, or through communications with us.

5. Information Held on Behalf of Subscribing Businesses

Subscribing Businesses upload and store their End Customer data in our Software. This data typically includes:

• End Customer names and contact details
• Information relating to eye health, clinical assessments and treatment records
• Details of services provided and associated transactions
• Medicare and private health insurance reimbursement records

This information is collected, managed and controlled by the Subscribing Business – not by SUNIX. We host this data on behalf of Subscribing Businesses and do not use it for any independent purpose.

6. How We Use Personal Information

6.1 Subscribing Business and business contact information

We use the personal information of Subscribing Business personnel and our other business contacts for the following purposes:

• to provide, administer and support our Software and services
• to communicate with Subscribing Businesses about their licence, technical support and product updates
• to provide information about our products and services that may be of interest
• any purpose required or permitted by law
• any purpose disclosed to the individual to which they have consented
• any purpose that individuals would otherwise reasonably expect
• to otherwise conduct our business

6.2 End Customer information

We do not use End Customer personal information for any purpose other than:

• hosting and storing the information within our Software on behalf of the Subscribing Business
• system administration, maintenance and technical support for the Subscribing Business
• when specifically requested by a Subscribing Business in respect of their own data

7. Disclosure of Personal Information

7.1 End Customer information

We do not access End Customer personal information except for the limited purposes of system administration and technical support. We do not disclose End Customer information to any third party except to our authorised contractors on a confidential basis, where necessary for system administration or technical support.

We never use, disclose, sell or rent End Customer personal information for marketing, business development or any other purpose.

7.2 Subscribing Business and business contact information

We may disclose personal information of Subscribing Business personnel and our other business contacts to:

• our service providers, including IT service providers, hosting providers and insurers
• our professional advisers, including lawyers, accountants and auditors
• government, regulatory and law enforcement authorities, as required by law

8. Cross-Border Disclosure

All personal information held in our Software is stored on servers located within Australia and is accessed only by SUNIX personnel and authorised contractors.

9. Data Retention and Destruction

9.1 End Customer information

End Customer data is retained in our Software for as long as the relevant Subscribing Business maintains an active licence. Subscribing Businesses may request deletion of specific records in accordance with their own data retention policies and obligations.

Upon termination of a Subscribing Business’s licence, we will:

• provide the Subscribing Business with a reasonable opportunity to extract or transfer their data
• securely delete or de-identify all End Customer data within 90 days of the termination date, unless retention is required by law

For data stored on the locally hosted SUNIX Vision product, data retention and destruction is managed by the Subscribing Business, as the data resides on their own systems.

9.2 Business contact information

We retain the personal information of Subscribing Business personnel and our other business contacts for as long as reasonably necessary for our business relationship and any associated legal obligations. When no longer required, we take reasonable steps to destroy or de-identify this information in accordance with APP 11.2.

10. Security of Personal Information

We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification and disclosure, including:

• SUNIX Vision NEXT Generation (cloud-hosted) & SUNIX eVue (cloud-hosted): End Customer data collected through the SUNIX eVue system is stored on secure third-party servers located within Australia. We apply technical and organisational security measures including encryption at rest and in transit, role-based access controls, logging and monitoring, and regular security assessments.
• SUNIX Vision Elite (locally hosted): Data stored on the SUNIX Vision Elite system is hosted on the Subscribing Business’s own infrastructure. While we design our Software with security in mind, the security of locally hosted data is ultimately the responsibility of the Subscribing Business. We recommend that Subscribing Businesses implement appropriate physical and technical security controls to protect their data.

Our employees and authorised contractors are required to treat all personal information held by us as confidential.

11. Notifiable Data Breaches

We are committed to complying with the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act.

If we become aware of a data breach that is likely to result in serious harm to any individuals whose personal information is involved, we will:

• take immediate steps to contain the breach and mitigate any potential harm
• assess whether the breach is likely to result in serious harm to affected individuals
• notify affected Subscribing Businesses as soon as practicable so they can take appropriate action in relation to their End Customers
• where required, notify the Office of the Australian Information Commissioner (OAIC) and affected individuals in accordance with the Privacy Act

We maintain a Data Breach Response Plan that sets out our procedures for identifying, managing and responding to data breaches.

12. Direct Marketing

We may use the personal information of Subscribing Business personnel and our other business contacts, including their contact details, to provide them with information about our products and services that may be of interest to them. Individuals may opt out of receiving marketing communications at any time by contacting us using the details in Section 16. All commercial electronic messages sent by us comply with the Spam Act 2003 (Cth), including
functional unsubscribe facilities.

We do not use End Customer personal information for marketing or business development
purposes, and neither do our business associates.

13. Cookies and Analytics

Our website and/or Software may use cookies, analytics tools or similar tracking technologies to improve functionality and user experience. These technologies may collect de-identified usage data such as browser type, pages visited and session duration.

14. Accessing and Correcting Personal Information

14.1 Subscribing Business personnel and business contacts

If you wish to access or correct the personal information we hold about you, you may contact us using the details in Section 16. We will respond to your request within a reasonable period.

If we refuse access or decline to make a correction, we will provide you with a written notice explaining our reasons and the relevant provisions of the Privacy Act.

We may charge a reasonable fee for providing access to personal information, to cover the cost of retrieval and provision.

14.2 End Customers

If you are an End Customer whose personal information is stored in our Software, your data is managed by the relevant Subscribing Business. Please contact the Subscribing Business directly to make any access or correction requests. We will assist Subscribing Businesses to respond to such requests where reasonably required.

15. Subscribing Business Obligations

Subscribing Businesses that use our Software to collect, store and manage End Customer personal information are responsible for:

• complying with the Privacy Act and the APPs in relation to their collection, use and disclosure of End Customer personal information
• obtaining all necessary consents from End Customers, including any consents required for the collection of sensitive information (such as health information) under APP 3
• maintaining their own privacy policy that accurately describes their data handling practices
• ensuring appropriate security measures are in place for locally hosted SUNIX Vision installations

SUNIX provides guidance to Subscribing Businesses on their privacy obligations through our licence terms and supporting documentation.

16. Questions and Complaints

If you have any questions, concerns or complaints about the way in which we have handled your personal information, or if you believe we have not complied with our obligations under the Privacy Act, please contact us:

SUNIX Computer Consultants Pty Ltd
Level 34, 1 Denison Street, North Sydney, NSW 2060 Australia
T: +61 (2) 8719 8988
E: support@sunixvision.com.au

We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days. If we are unable to resolve your complaint to your satisfaction, you may also lodge a complaint with the Office of the Australian Information Commissioner:

Office of the Australian Information Commissioner (OAIC)
Phone: 1300 363 992
Email: enquiries@oaic.gov.au
Website: www.oaic.gov.au

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Where we make material changes to this Policy, we will take reasonable steps to notify Subscribing Businesses, including by publishing the updated Policy on our website and, where practicable, by direct communication.

Our most up-to-date Privacy Policy is available on our website. We encourage you to review this Policy periodically.