Last updated 3 October 2026

    Privacy by design.

    Current technical information for Abe services, with unresolved policy and operator details clearly identified. This page is not a compliance certification.

    Abe AI privacy and audit — the pyramid mark amid governance icons (audit lock, ledger, identity, signature)

    Current scope and limits

    • Privacy requirements must be assessed for the actual service and information involved. This page does not certify compliance with the Privacy Act 1988.
    • APP 1.7 / 1.8 transparency rules start on 10 December 2026 where the OAIC's conditions apply. An assessment and reviewed disclosures are still required; no earlier publication date is promised.
    • The primary Supabase database is in Sydney (ap-southeast-2). That does not establish the location or retention of every hosting, email or AI-provider operation.
    • Supported workflows retain their own evidence and audit records. Universal logging of every input, output and action is not claimed.
    • Patient-specific clinical decision support is inactive. Current professional-information and governance services have their own review and access requirements.
    • No SOC 2 Type II or ISO 27001 certification is claimed. A future assessment is not a current certificate.

    Information collected

    Enquiry forms (Home, Services, Pricing, Investors)

    • Name and email (required to respond)
    • Service domain (GP / specialist / allied / dental / pharmacy / hospital / aged care / NDIS / mental health / other)
    • Organisation size, role of enquirer, free-text context
    • For investor enquiries: organisation, stage of interest, free-text question

    Current signed-in services

    • Organisation profile (service type, accreditation set, tools in use)
    • User profile (role, scope of practice)
    • Agent outputs (assessments, generated policies, Oracle answers, alerts, registers)
    • Service-specific evidence and audit records, connected-app permissions and user-selected update preferences

    Automatically collected

    • Hosting and authentication services may process IP addresses and browser/request metadata; the complete retained logging scope needs confirmation
    • Technical request and service information processed by the configured hosting and authentication providers
    • The exact provider logging and retention scope requires confirmation; no complete telemetry inventory is asserted here

    Cookies and similar technologies

    Strictly necessary

    Supabase authentication cookies and session state support sign-in. The public course finder can be used without a console account.

    Analytics settings

    Analytics availability and provider settings must be checked for the deployed service. This page does not promise a particular analytics configuration or opt-out mechanism.

    Advertising or tracking

    No advertising-tracker integration is identified in the inspected marketing-page code. This is not an audit of every provider or future deployment.

    Sign-in uses authentication cookies and session state. Browser Do Not Track support is not advertised as an implemented control.

    How information is used

    • • Respond to enquiries and operate the services you choose to use
    • • Operate the platform — agent routing, governance-document generation, regulatory monitoring
    • • Retain service-specific evidence, permissions and review records where the workflow supports them
    • • Your account settings and individual notification choices remain separate from organisation funding or payment
    • • Comply with legal and regulatory requirements

    Earlier draft commitments about selling information, secondary analytics or corpus improvement require owner and legal confirmation. They are not evidence that a secondary-use process is active.

    Data location and security scope

    The primary application database is in the Supabase Sydney region (ap-southeast-2). Separate providers may process information for hosting, authentication, email or AI generation; their complete locations and retention arrangements are not established by the database region.

    • • Access controls and database policies apply to supported services; this page does not claim every operation uses an identical check.
    • • Service-specific audit and permission records support review. Their presence is not a complete independent security assessment.
    • • Per-organisation encryption keys, a universal TLS version and Australian residency for all providers are not claimed as verified Abe controls.

    Certification and independent security assessment require separate evidence. No certification schedule, completed assessment or blanket security assurance is published here.

    Tier 2 clinical decision support, gated by design

    Abe AI does not currently make clinical decisions about individual patients. Tier 1 (governance, workforce, operations, horizon) is the only tier active today. Tier 2 (clinical decision support — pathology, radiology, medicines, deteriorating-patient detection, mental-health risk, telehealth clinical) is gated until ALL of the following are confirmed:

    • • TGA pathway (SaMD classification + ARTG inclusion or documented exemption)
    • • Clinical validation dataset
    • • Clinical governance lead sign-off protocol in the UI
    • • Professional indemnity coverage
    • • Human-in-the-loop review checkpoint

    This is an inactive development boundary, not an available clinical service or a claim that its future controls have been accepted.

    Retention — earlier draft requires confirmation

    • • Earlier proposed tier-specific periods and customer-exit archives have not been verified as enforced product behaviour. Commercial packages are not open.
    • • Applicable retention depends on the record, service, law and any signed agreement; no universal medical-record period is asserted for this professional-information product.
    • • Request the applicable retention arrangements before supplying sensitive information or entering a paid agreement.

    Third-party services

    The inspected service code includes the following integrations. Their presence does not prove every integration is active for your request, a signed processing agreement, Australian-only processing or zero retention.

    • • Supabase: database and authentication integrations. The verified Sydney location applies to the primary database, not automatically every associated service.
    • • Vercel: hosting and edge delivery for the marketing site and product front-end.
    • • AI generation: supported server-side workflows include Anthropic model integrations. Confirm the actual provider, permitted input and processing terms for a workflow; no zero-retention or patient-data routing assurance is asserted here.
    • • Resend: enquiry and email integrations can send the information provided in those messages.
    • • Stripe: payment integration code exists; complete commercial subscription onboarding remains unfinished. This is not an Abe PCI-compliance certification.

    TypeSafe / Jev: quality-checking code and diagnostic calibration exist, but the production quality-policy registry is empty. Build-review use is separate from an activated customer check; this page does not authorise new external processing.

    Your privacy rights

    You may contact Abe about access, correction and privacy concerns. The applicable rights and exceptions depend on Australian privacy law:

    • • Access the information Abe AI holds about you
    • • Correct inaccurate information
    • • Ask about deletion and retention; this is not a promise of an unconditional deletion right or an implemented deletion button
    • • Ask what export options are actually supported; universal portable export is not claimed as an APP entitlement or completed product feature
    • • Raise a privacy complaint and consult the OAIC's complaint guidance

    Read the OAIC guidance on access, correction and automated-decision transparency.

    Privacy contact

    Privacy questions, requests under the APPs, or to exercise your rights:

    Email: privacy@abeai.com.au

    Response: request acknowledgement and the expected response timeframe; no two-business-day service guarantee is asserted.

    Operator: legal entity details require owner confirmation. No completed company or ABN transfer is asserted.

    For complaints, you may also contact the Office of the Australian Information Commissioner (OAIC).

    Policy updates

    The date above records this technical-copy revision. Earlier proposed policy-update and notification provisions require owner and legal confirmation; this edit does not replace a signed agreement or claim those processes have been tested.