Privacy Policy
Tailored Clinic · Last updated 18 October 2026
This Privacy Policy explains how Roof Collective Pty Ltd (ACN 693 206 843, ABN 30 693 206 843) ("Roof Collective", "we", "us", "our") handles personal information in connection with the Tailored Clinic app (the "App") and this website. We are an Australian company and we handle personal information in accordance with the Australian Privacy Principles in the Privacy Act 1988 (Cth).
The short version
- Patients: your recovery photos, notes, symptom and pain entries, and any Apple Health data stay on your own device. We never receive them. You don't create an account.
- Clinicians: we hold your sign-in email address, your clinic's settings and the educational content you publish, so that your patients can download it with your clinic code.
- We do not sell personal information, show ads, use advertising identifiers, run analytics on you, or track you across other apps or websites.
1. Who uses the App
The App has two kinds of users:
- Patients use the App for free to read the post-operative education their surgeon or clinic has published and to keep a private recovery journal.
- Clinicians (surgeons, clinics and their authorised staff) sign in to set up and publish their clinic's procedures, documents and branding, usually under a paid subscription.
2. Patients — information that stays on your device
The information you enter or create in the App — recovery progress photos, pain and symptom entries, notes and diary content, and any Apple Health metrics the App reads — is stored only on your device. It is not sent to our servers, and we have no technical means to access or view it. If you delete the App, this information is deleted with it. If you have turned on an iCloud or computer backup of your device, a copy may be included in that backup, which is controlled by you through your Apple account.
Apple Health (HealthKit)
With your permission, the App reads step count, sleep and heart rate from Apple Health and shows them in your journal on your device. The App does not write to Apple Health. The App never sends Apple Health data to us or to any third party, never uses it for advertising or marketing, never sells it, and never uses it to diagnose, assess or monitor you. You can turn off access at any time in the iPhone Settings app under Health → Data Access & Devices.
Camera, photos and Face ID
The App asks before using your camera or photo library, and uses them only so you can add photos to your journal. If you turn on Face ID or Touch ID protection, the check happens on your device through Apple's systems; we never receive biometric data.
Sharing your own reports
You can choose to create a report of your journal and share it, for example with your surgeon. The App does this only when you ask, and it uses your device's share sheet, so you decide who receives it and how. Once you send a report, it is handled by whoever you send it to.
What we do receive from patients
When you enter a clinic code, the App sends that code to our server to download your clinic's published content. To prevent misuse (such as guessing codes), our server records the internet (IP) address the request came from for rate limiting and deletes that record within 24 hours. Our hosting provider's standard server logs, which include IP addresses, are kept for no more than 7 days for security. Neither is linked to you or to any health information.
3. Clinicians — information we hold
| Information | Why we hold it |
|---|---|
| Your email address and account identifiers | To sign you in with a one-time code and keep your clinic secure. |
| Your clinic's settings, branding, procedures and documents (including PDFs you upload) | To publish them to patients who have your clinic code. |
| Who can manage each clinic (owners and co-administrators) | To control access to your clinic. |
| A log of administrative actions (for example, deleting a clinic or an account, or changing who manages it) | Security, preventing misuse and resolving disputes. |
| Subscription status (checked on your device through Apple) | To unlock the features in your plan. Apple handles payment; we never receive your card or bank details. |
If a clinic owner adds you as a co-administrator, we receive your email address from them so we can send you a sign-in code.
Clinic content is published to patients, and anyone who has your clinic code can download it, so treat it as public. Do not include any patient's personal or health information in clinic content.
AI-assisted drafting (clinicians only)
If a clinician uses the App's AI drafting features, the text they supply (such as a procedure name and description, or the text of a document they upload) is sent through our server to xAI, the provider of the Grok AI model, which processes the text to generate the draft. The AI features are optional, available only to Clinicians, and are not connected to any patient's journal. Clinicians must not include patient information in anything they submit for AI drafting.
4. How we use and disclose information
We use personal information only to provide, secure, support and improve the App and to meet our legal obligations. We disclose it only to the service providers listed below, who process it on our behalf, or where the law requires. We do not sell, rent or trade personal information, and we do not use it for advertising.
5. Service providers and overseas disclosure
| Provider | What it does | Location |
|---|---|---|
| Supabase (on Amazon Web Services) | Database, sign-in and file storage for clinician accounts and clinic content | Sydney, Australia (database and files). Some processing may run on Supabase infrastructure outside Australia. |
| Resend | Delivers one-time sign-in codes by email | May process email outside Australia, including in Japan and the United States |
| xAI | AI drafting for clinicians (only when used) | United States |
| Apple | App distribution, subscriptions and payments, under Apple's own privacy policy | Global |
| Cloudflare | Hosting this website. The website does not use cookies for tracking or analytics; Cloudflare may log IP addresses briefly for security. | Global network |
Where information is handled outside Australia, we take reasonable steps to make sure those providers protect it in a way consistent with the Australian Privacy Principles.
6. Security
Patient journal data is not held centrally, so there is no central store of patient health information for anyone to target. Clinician data is sent over encrypted connections, stored with access controls that keep each clinic separate, and accessible only to authorised staff of the clinic and to us where needed to provide support. If a data breach is likely to cause serious harm, we will notify affected people and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.
7. Retention and deletion
- Patients: your journal stays on your device until you delete it or remove the App.
- Clinicians: you can delete your account at any time in the App. Deleting your account permanently removes your sign-in details, the clinics you own, and their documents. Your clinic will then no longer be available to patients. Copies in our provider's encrypted backups are removed within 30 days. We keep a record that an account was deleted, without your email address, for security purposes.
- Rate-limiting records are deleted within 24 hours; hosting-provider server logs within 7 days.
8. Access, correction and complaints
You can ask for access to, or correction of, personal information we hold about you by emailing us. We will respond within 30 days. If you have a privacy complaint, please contact us first and we will respond within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.
9. Children
The App is used under the direction of a healthcare provider and is not directed at children. If a patient is under 18, a parent or guardian should set up and supervise use of the App. Clinician accounts are for adults only.
10. Not a medical service
Tailored Clinic is an educational resource and personal recovery journal. It is not a medical device and does not provide medical advice, diagnosis, treatment or clinical monitoring. See our Terms of Service.
11. Changes to this policy
We may update this policy from time to time. We will change the "last updated" date above and, for significant changes, tell users in the App or on this page.
Contact us
Roof Collective Pty Ltd (ACN 693 206 843, ABN 30 693 206 843)
Queensland, Australia
Email: apps@roofcollectiveapps.com