Privacy policy

This policy applies to personal information handled by Terva through our websites, dashboards, voice and messaging services, integrations and related support activities. In this policy, “Terva”, “we”, “us” and “our” mean Terva Pty Ltd (ABN 29 693 513 898), the operator of the Terva service.

Healthcare practices use Terva to assist with administrative communications, including answering calls, taking messages, managing enquiries, scheduling and follow-up workflows. A practice determines how Terva is configured for its patients and is also responsible for its own privacy notices and handling of patient information.

We handle personal information in line with the Privacy Act 1988 (Cth), the Australian Privacy Principles and other privacy and health-information obligations that apply to our activities.

The information we handle depends on the Terva services being used.

• Practice and user information: names, work contact details, roles, account identifiers, authentication information, practice locations, business settings, support requests and billing or commercial records.
• Patient, caller and contact information: names, telephone numbers, email addresses, dates of birth or other identity details when needed, appointment information, communication preferences and practice-management system identifiers.
• Health and sensitive information: information a person shares during a call or message about symptoms, treatment, care needs, appointment reasons or other health circumstances. We aim to limit this information to what is reasonably necessary for the administrative service requested.
• Communications: live call audio processed to provide the service, call transcripts, SMS messages, summaries, booking requests, transfers and follow-up outcomes. During a call, contracted communications, speech and AI providers process live audio so the receptionist can understand and respond. Section 9 explains what we keep.
• Technical and usage information: IP address, device and browser information, timestamps, authentication events, service logs, diagnostic data, cookies or similar technologies, and records of actions performed in Terva.
• Enquiry and marketing information: information provided when someone requests a demonstration, contacts us or subscribes to communications, and the names, roles and work contact details of practice owners and managers we may contact about Terva.

We do not intentionally collect payment-card details through patient conversations. Please do not provide passwords, complete payment-card numbers or other credentials to a Terva agent.

We may collect personal information:

• directly from a caller, patient, practice user or website visitor;
• from a healthcare practice that has engaged us and instructed us to provide a service;
• from systems a practice connects to Terva, such as its practice-management, scheduling, telephony, messaging or lead-management systems;
• from authorised representatives and integration partners;
• from public business listings, such as practice websites and online maps, and from business contact-data providers, when we look for practice owners and managers to contact about Terva; and
• automatically when someone uses our websites, dashboards or communications services.

If you provide us with information about another person, you should have authority to do so and, where required, make them aware of this policy.

We collect, hold, use and disclose personal information to:

• provide, configure and support the Terva service;
• answer and route calls, exchange messages, take administrative information and assist with scheduling or follow-up workflows;
• interact with connected practice systems under the practice’s instructions;
• authenticate users and enforce account and practice access controls;
• maintain service quality, security, reliability and audit records;
• investigate faults, suspected misuse, security events and complaints;
• communicate with practices about their accounts and our services, including contacting practice owners and managers about Terva;
• meet legal, regulatory, insurance and contractual obligations; and
• review service reliability and performance using aggregated or de-identified information where practical.

We do not sell personal information. We do not use health information for our own direct marketing without consent. Where Terva sends practice-authorised reminders or follow-up communications, recipients can use the stated opt-out method, such as replying STOP to an SMS. The practice is responsible for ensuring it has the authority and any consent required to instruct Terva to send the communication.

Terva uses AI services to understand and respond to speech and messages, transcribe conversations, identify administrative requests and prepare summaries for practice staff. Depending on the practice’s configuration, these services may process contact details, conversation content, appointment information and limited health information needed to handle the request.

AI training and model improvement. Terva does not use identifiable patient information or call content to train its own AI models. OpenAI’s API terms say it does not use API content to train its models unless the customer opts in. Other speech and AI providers handle training and model improvement under their own terms.

Third-party AI services. Contracted speech and AI providers may process call audio and text as needed to provide, support and protect the receptionist service. Some providers may retain limited content or service data under their terms for security, abuse prevention, support or legal requirements. Terva seeks to limit this handling through provider terms and, where available, account settings.

A practice using Terva must tell callers at the start of the call that they are speaking with an AI receptionist. A caller can ask for practice staff to contact them instead. The practice remains responsible for explaining how it handles patient information and any clinic-specific retention period or alternative contact pathway.

Terva provides administrative support. It is not a medical practitioner and does not diagnose conditions, provide clinical advice or replace an emergency service. It tells callers to hang up and call 000 in an emergency.

Practice settings and system permissions limit what Terva can do. Terva checks bookings against the connected practice system before confirming them, and routes or hands over enquiries under practice rules. It does not decide clinical treatment or eligibility for care. Authorised staff can review calls, messages and outcomes.

We may disclose personal information to:

• the healthcare practice responsible for the relevant service and its authorised staff;
• connected practice-management, scheduling, messaging, telephony and other systems selected by the practice;
• technology providers that supply cloud hosting, communications, AI, speech processing, authentication, monitoring, analytics and support services;
• professional advisers, insurers and auditors under confidentiality duties;
• government agencies, courts, regulators or law-enforcement bodies where required or authorised by law; and
• a prospective purchaser or successor in connection with a proposed business transaction, subject to appropriate confidentiality and privacy protections.

Not every provider receives information for every workflow. We seek to limit each provider to the information reasonably necessary for its function and review material provider changes before use. Information may also be exchanged with Core Practice or another practice-management system chosen and authorised by the relevant practice. A practice can ask us for the current list of providers we use.

Terva’s primary application and database infrastructure is hosted in Australia. Some of our providers may process personal information outside Australia, including in the United States. Their support personnel may also access information from other countries when needed to provide or secure their services.

Before using an overseas provider to handle personal information, we take steps appropriate to the circumstances to assess its privacy and security practices and use contractual, technical and organisational controls intended to protect the information. Overseas recipients may be subject to foreign laws, including lawful government-access requirements.

We use technical and organisational safeguards designed to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. Depending on the system, these safeguards include:

• encryption in transit using current industry-standard protocols;
• named user accounts, role-based access and administrative access controls;
• tenant and practice access boundaries;
• managed secret storage and restricted access to credentials;
• authenticated integration and webhook requests;
• logging, audit records, monitoring and incident-response procedures;
• software testing, dependency maintenance and controlled deployments.

No system can be guaranteed completely secure. If you believe personal information or credentials may have been compromised, contact us promptly using the details below.

We keep personal information only as long as we need it to provide the service, keep security and audit records, or meet legal obligations. How long depends on the type of information and the practice’s instructions.

Live audio. Terva’s standard voice service processes live audio during the call but does not create or retain a replayable call audio recording.

Transcripts and structured records. A written transcript may be retained for as long as reasonably needed so authorised practice staff can review and act on a caller’s request. Summaries, messages, appointment details and other administrative records may be retained separately by Terva, the healthcare practice or a connected practice system. These records are not call audio and may have different retention requirements.

How long we keep call records. We keep call transcripts, caller details, requests and our copies of staff notification emails for as long as the practice needs them. A practice can ask us to delete any of them at any time, and we will, subject to the limits below. Once content is deleted, the time, length and status of each call stay, without the content, for billing and service records.

A healthcare practice may ask Terva to delete a transcript or other service record when it is no longer needed. We apply the practice’s instruction where the service supports it, subject to legal, security, backup and existing-claim requirements. A practice that promises callers a fixed retention period or no transcript retention should tell us first, so we can agree how and when its records are deleted.

When personal information is no longer required, we take reasonable steps to delete it or de-identify it, unless an Australian law or court or tribunal order requires its retention. Deletion includes active systems under our control. Residual copies may remain in access-controlled backups or provider security logs until their documented expiry cycles complete.

A practice may request export or deletion of its service data when its agreement ends, subject to applicable legal and operational requirements. Individuals may also contact the relevant healthcare practice or Terva about information relating to them.

You may ask for access to personal information we hold about you or ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading. We may need to verify your identity and consult the relevant practice before responding. In some circumstances the law permits or requires us to refuse access; if that occurs, we will explain the reason where we can and the available complaint options.

You may opt out of Terva marketing communications using the unsubscribe method in the message or by contacting us. For patient reminders or practice communications, contact the practice or use the opt-out method included in the communication. Operational and service messages may still be sent where necessary.

If you do not want to continue with an AI receptionist, you may ask for a staff callback or another alternative offered by the healthcare practice. The available alternative and any effect on how quickly the practice can respond will depend on the practice’s arrangements.

Our website may use cookies or similar technologies for essential functionality, analytics, performance and security. Browser settings can be used to restrict cookies, although doing so may affect some functionality.

On our public marketing website, we may use Google Ads conversion measurement to understand which advertisements lead to demo bookings, sign-ups and subscriptions. When you arrive from an advertisement, we keep its click identifier in a first-party cookie for up to 90 days so a later sign-up, demo booking or subscription can be matched to it. If you book a demo, we keep the click identifier with the email address you booked with for up to 95 days, so a later subscription can be reported. Google receives only the click identifier, the conversion name, its time and value, the public page address and a randomly generated reference. We do not send names, email addresses, phone numbers, booking form answers or patient information to Google. The Google tag is not installed in the Terva practice dashboard. Advertising personalisation and enhanced conversions are disabled for this measurement.

If you believe we have mishandled personal information, please send a written complaint to the Privacy Contact below. Include enough information for us to understand the concern, but do not send unnecessary health information or credentials by email.

We will acknowledge the complaint, investigate it and aim to provide a response within 30 days. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au/privacy/privacy-complaints. Other state or territory health-complaint bodies may also have jurisdiction.

We maintain procedures for assessing suspected data breaches. Where required, we will notify affected organisations, individuals and the relevant regulator in accordance with the Notifiable Data Breaches scheme and other applicable law.

Contact us to ask a privacy question, request access or correction, make a complaint, request this policy in another accessible form, or report a suspected privacy or security issue.

We may update this policy when our services, providers or legal obligations change. We will publish the current version on this page. We may contact affected practices directly if a change materially affects their service.