Data Protection and Privacy Policy

Last updated: June 25, 2026

Applies to: Healix AI Pty Ltd (ACN 685 808 459), HEALIXAI SINGAPORE HOLDINGS PTE. LTD., and their related bodies corporate (together, the "Group").

This Data Protection and Privacy Policy ("Policy") describes how the Group ("we," "us," "our") collects, uses, discloses, stores, and protects personal data in connection with our "MammoAI" mammogram image analysis product, including our mammography reading workflows, data labelling tools, simulator, billing features, and related services ("Service"), and other interactions you have with us.

By using the Service, you acknowledge that you have read and understood this Policy. If you do not agree with this Policy, you are not authorised to use the Service.

This Policy is intended to comply with:

The Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) — to the extent they apply to the Group;
The Singapore Personal Data Protection Act 2012 (PDPA) and the guidelines of the Personal Data Protection Commission (PDPC); and
The Indonesian Law No. 27 of 2022 on Personal Data Protection (UU PDP) and its implementing regulations,

and reflects general good-practice standards for cross-border, direct-to-consumer health-adjacent technology.

In this Policy, personal data (used interchangeably with personal information) means information about an identified or reasonably identifiable individual, and sensitive personal data includes health information, including any information that reveals or could reveal an individual's health status.

1. Scope

This Policy applies to information we process through the Service, including information you provide directly, information contained in files you upload, and information generated through your use of AI-assisted reading, annotation, feedback, and reporting features.

The Service is available directly to individual consumers, who may include patients, radiologists, clinical researchers, and other professionals involved in evaluating or labelling medical imaging data, or other individuals acting in a personal capacity.

The Service is not intended for use by individuals as a consumer health application.

2. The Nature of Our Service and Your Data

Core functionality does not require personal data. The Service analyses a mammogram image to assess whether the image shows indicators of cancer. The underlying image-analysis function does not require, and is not designed to use, any personal data, demographic data, or other identifying information to produce its result. The Service does not need to know who you are in order to analyse your image.

We do collect some personal data to operate our business. Even though the Service itself doesn't need personal data to function, we collect a limited set of personal data in connection with the commercial relationship, including to create an account, process payment, provide support, comply with law, and operate and improve our business. This is described in Section 4.

Mammogram images are treated as sensitive/health data. Because an uploaded image will, in the ordinary course of the Service (logged-in account, payment, etc.), be capable of being linked to an identifiable individual, we treat the image as sensitive personal data for the purposes of how we handle it. If you use the Service without an account, your image is processed to generate a result and is not retained afterwards. If you create an account, your image is retained so that you can view your past results, until you delete it or close your account. This means the protections in Sections 7, 10, and 11 apply to image data, and the retention period differs depending on whether you have an account.

3. Information We Collect

Depending on how you use the Service, we may collect the following categories of information:

Account and identity information. When you sign in, we receive information from our authentication provider, including your name, email address, organization membership, and authentication tokens necessary to secure your session.
Medical imaging and related clinical data. If you upload mammography images or related DICOM files, we process the imaging data and associated metadata contained in those files, which may include patient identifiers, study dates, modality information, and other fields embedded in DICOM headers.
Reading, annotation, and feedback data. We collect your interactions with the Service, including recall decisions, annotations, notes, agreement or disagreement with AI outputs, comments, workflow status, and performance summary data.
Usage and technical information. We collect information about how you access and use the Service, such as pages viewed, features used, browser type, device information, IP address, timestamps, error logs, and performance diagnostics.
Payment and billing information. If you purchase credits or use billing features, payment details are processed by our payment partners. We may receive transaction identifiers, billing amounts, payment status, and limited payment metadata, but we do not store full payment card numbers on our servers.
Communications. If you contact us or if the Service sends operational emails or summary reports, we process the content of those communications and related metadata.
Local device storage. The Service may temporarily store imaging files or workflow data in your browser's local storage or IndexedDB to improve performance. This data remains on your device unless uploaded to our cloud infrastructure.

The Service is not directed to individuals under 18 years of age, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can take appropriate action.

4. How We Collect Information

We collect personal data:

Directly from you, when you create an account, make a payment, upload an image, or contact customer support;
Automatically, through your use of our app or website (e.g. device and usage data, via cookies or similar technologies); and
From third parties, such as our payment processor (confirming a transaction was completed) or app stores (e.g. anonymised install/crash data).

We do not collect personal data from public sources or data brokers in connection with the Service.

5. How We Use Information

We use information we collect to:

Provide, operate, maintain, and improve the Service;
Authenticate users and enforce access controls;
Process uploaded imaging studies and generate AI-assisted outputs;
Enable human review, labelling, simulation, reporting, and workflow management;
Store, retrieve, and display studies, annotations, and results;
Process payments and manage AI credit balances;
Monitor usage, troubleshoot issues, and protect the security of the Service;
Communicate with you about the Service, including support, operational notices and summaries;
Comply with legal obligations and enforce our Terms of Service;
Develop, evaluate, and improve our models, subject to applicable law and contractual restrictions; and
Maintain the security, integrity, and proper functioning of the Service, including fraud and abuse prevention.

Where required by applicable law, we rely on appropriate legal bases for processing, such as performance of a contract, legitimate interests, compliance with legal obligations, or your consent.

We do not use your personal data for automated decision-making that produces legal or similarly significant effects without human oversight.

6. How We Share Information

We do not sell your personal information. We may share information in the following circumstances:

Group. We may share information with other Group entities, for the purposes described in this Policy and provided the recipient is bound by legally appropriate protections and safeguards for that jurisdiction.
Service providers. We use third-party providers to help operate the Service, including authentication, cloud storage, email delivery, payment processing, analytics, and infrastructure hosting. These providers process information on our behalf under contractual safeguards.
Organisation administrators. If you access the Service through an organisation account, administrators authorized by that organization may be able to view account and usage information associated with your membership.
Legal and safety purposes. We may disclose information if we believe it is reasonably necessary to comply with law, respond to lawful requests, protect rights and safety, or investigate fraud or security issues.
Business transfers. If we are involved in a merger, acquisition, financing, reorganisation, or sale of assets, information may be transferred as part of that transaction, subject to this Policy.
Consent. We may otherwise share information to a third party with your consent.

Our Service may use providers such as Clerk for authentication, Microsoft Azure for cloud storage, Resend for email delivery, and payment processors for billing transactions.

We do not sell personal data to third parties for their own marketing purposes.

7. Health and Sensitive Data

Mammography studies and related DICOM files may contain protected health information or other sensitive personal data. You are responsible for ensuring that you have all necessary rights, permissions, consents, and legal bases to upload and process such data through the Service.

You should only upload data that you are authorized to use for the intended purpose, and you should apply appropriate de-identification or pseudonymization measures when required by your organisation, contract, or applicable law.

MammoAI and other outputs from the Service are assistive and evaluative in nature. They are not a substitute for professional medical judgment and must not be relied upon for clinical decisions.

8. Data Retention

We retain information for as long as necessary to provide the Service, fulfil the purposes described in this Policy, comply with legal obligations, resolve disputes, and enforce our agreements.

Retention periods may vary depending on the type of data, your organization's settings, contractual requirements, and whether the data is needed for ongoing evaluation, audit, or model improvement activities. When data is no longer required, we take reasonable steps to delete or de-identify it.

We may retain mammogram images uploaded, account, payment, and support data: We retain this data for as long as your account is active, and for a further period afterwards as required to comply with our legal, accounting, or regulatory obligations, after which it is securely deleted or anonymised.

Local browser storage may persist until you clear it or sign out, after which cached imaging data may be removed from your device in accordance with our application behaviour.

If you use the Service without creating an account, your image is processed to detect and remove identifying metadata and generate your result and is deleted once the result is delivered. If you create an account, your image is retained so you can access your result history, until you delete the image, delete your account, or request deletion under Section 12.

9. Security

We implement administrative, technical, and organizational measures designed to protect all information against unauthorised access, loss, misuse, alteration, or disclosure. These measures may include access controls, encrypted transport, authenticated sessions, and restricted cloud storage access.

No method of transmission or storage is completely secure. You are responsible for maintaining the confidentiality of your account credentials and for securing the devices you use to access the Service.

If we become aware of a data breach that is likely to result in serious harm, we will notify affected individuals and relevant regulators in accordance with applicable law.

10. International Data Transfers

We and our service providers may process information in countries other than the country in which you are located. Where required, we implement appropriate safeguards for cross-border transfers, such as contractual clauses or other lawful transfer mechanisms.

11. Cookies and Similar Technologies

We and our service providers use cookies, local storage, and similar technologies to maintain sessions, remember preferences, secure the Service, and understand usage patterns. You can control cookies through your browser settings, but disabling certain cookies may affect Service functionality.

12. Your Rights and Choices

Depending on your location and applicable law, you may have rights regarding your personal information, including the right to access, correct, delete, restrict, or object to certain processing, and the right to data portability or withdrawal of consent where processing is based on consent.

To exercise applicable rights, contact us using the details below. We may need to verify your identity before responding. If your account is managed by an organisation, you may need to contact your organisation administrator.

You may also have the right to lodge a complaint with a supervisory authority in your jurisdiction.

13. Changes to This Policy

We may update this Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. If changes are material, we may provide additional notice through the Service or by other reasonable means. Your continued use of the Service after an update becomes effective constitutes acceptance of the revised Policy.

14. Contact Us

If you have questions about this Policy or our data practices, please contact us at 68 Circular Road, #02-01, Singapore 049422 or by email at contact@healixai.ai.