australian privacy addendum

1. who we are and how the law applies

Lifelong is operated by Lifelong Company, a Delaware corporation based in the United States.

We carry on business in Australia and collect personal information from individuals in Australia, so we are subject to the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), including through the Act’s extraterritorial operation.

We do not rely on the small business exemption. The Privacy Act defines a "health service" to include recording a person’s physical or psychological health for the purposes of assessing, maintaining, improving or managing their health — which is a fair description of what Lifelong does. On that basis we treat ourselves as a health service provider under s 6, the small business exemption in s 6D does not apply to us at any level of turnover, and we are bound by the APPs in full. We would not argue otherwise even if we could.

2. health information is sensitive information

Under the Privacy Act, health information is "sensitive information" and attracts the highest level of protection. Almost everything Lifelong holds about you is health information: your conditions, medications, symptoms, allergies, records, test results, wearable data, visit recordings and transcripts, and everything we derive from them.

We collect sensitive information only with your consent and only where it is reasonably necessary for our functions. Your consent must be voluntary, informed, current, specific, and given by someone with capacity — and you can withdraw it at any time.

Practically, that means: you choose to add your health information to Lifelong; you choose which devices and services to connect; you choose what to share and with whom; and you can stop, disconnect, or delete at any point.

3. app 1 — open and transparent management

This addendum and the Privacy Policy together are our APP Privacy Policy. Both are available free at trylifelong.com and in the app, and we will provide a copy in another reasonable form on request.

Our Privacy Officer is Razi Syed, contactable at privacy@trylifelong.com.

4. app 2 — anonymity and pseudonymity

Lifelong is a personal health record shared within a family. It cannot function anonymously — we need to know which person a health record belongs to, and your family needs to know it is you. This falls within the exception in APP 2.2(b): it is impracticable to deal with individuals who have not identified themselves.

You are not required to give us your real name for your display name if you prefer something else within your family. Date of birth, gender and height are asked at setup; ethnicity is optional — you can skip it.

5. app 3 and 4 — collection

We collect personal and health information as described in Privacy Policy §4. We collect only what is reasonably necessary for our functions, and we collect health information only with your consent.

Where practicable we collect information directly from you. We also collect it from your devices and connected services with your permission, from your family members where they file information about you, and by generating it ourselves.

Unsolicited information. If we receive personal information we did not solicit and could not have collected under APP 3, we will destroy or de-identify it as soon as practicable, if it is lawful and reasonable to do so.

6. app 5 — notice

This addendum, together with the Privacy Policy, is our APP 5 notice. In-app disclosures at the point of collection — permission prompts, the onboarding privacy screen, and the recording notice — supplement it.

7. app 6 — use and disclosure

We use and disclose your information for the primary purpose of providing Lifelong, and for directly related secondary purposes you would reasonably expect. We do not use or disclose health information for a secondary purpose unless you would reasonably expect it and it is directly related to the primary purpose, you have consented, or the law permits or requires it.

Full detail is in Privacy Policy §5 and §8.

8. app 7 — direct marketing

We do not use sensitive information for direct marketing. This is an absolute prohibition under APP 7.4 without your consent, and we simply do not do it.

Marketing email requires your express opt-in, and every message contains an unsubscribe facility. We comply with the Spam Act 2003 (Cth).

Service messages — security notices, billing, and health alerts you enabled — are not marketing and continue while your account is open.

9. app 8 — cross-border disclosure

This is the most important section for Australian users.

Your personal and health information is stored and processed in the United States, except where we tell you otherwise for a specific feature. Our service providers — which assist us with cloud infrastructure and hosting, AI processing (large language model, transcription, and voice providers), authentication, payments, communications, and analytics — are predominantly US-based.

Some features or integrations — for example, connections to government-operated record systems — may be required by law to keep certain data only in Australia. Where that applies, we will say so in the feature, and that data will not be transferred to the United States. From time to time we may offer optional connections to other services and record systems, including government-operated health record systems where you live. Each connection is off unless you turn it on, may have its own additional terms, and may be subject to special rules about where that data can be stored.

By using Lifelong you acknowledge and consent to your information — including your health information — being disclosed to and stored by overseas recipients in the United States, and possibly other countries where our service providers operate.

What this means: we take reasonable steps to ensure overseas recipients handle your information consistently with the APPs, and we bind them by contract. However, US law may not provide protections equivalent to the Privacy Act, you may not be able to seek redress under Australian law against an overseas recipient, and the Privacy Commissioner may have limited ability to act against them.

We tell you this plainly because APP 8.2(b) requires informed consent for this arrangement, and because you deserve to know where your family’s medical records physically sit. Your consent is also our basis for transferring health information out of New South Wales and Victoria, where the Health Records and Information Privacy Act 2002 (NSW) HPP 14 and the Health Records Act 2001 (Vic) HPP 9 each restrict transfers of health information outside the state unless, relevantly, you consent — so the same plain statement above is written to satisfy those provisions as well as APP 8.

Our position is that express informed consent under APP 8.2(b) is our primary basis, with the reasonable steps under APP 8.1 maintained as a backstop — we keep the contractual flow-downs to our providers in place regardless of consent.

10. app 10 — quality

We take reasonable steps to keep your information accurate, up to date and complete. We cannot verify the accuracy of health information you or your family provide, or of data from devices and connected services, or of information extracted automatically from your documents. See the Medical Disclaimer.

You can correct your information at any time in the app, or ask us to — see §12.

11. app 11 — security

Security measures are described in Privacy Policy §12. We take reasonable steps to protect your information from misuse, interference, loss, and unauthorised access, modification and disclosure.

Destruction and de-identification. When we no longer need information for any purpose for which it may be used or disclosed, and we are not required by law to retain it, we destroy or de-identify it. Our retention schedule is in Privacy Policy §11.

Notifiable Data Breaches. If we suffer an eligible data breach likely to result in serious harm, we will notify you and the Office of the Australian Information Commissioner as required by Part IIIC of the Privacy Act, promptly and no later than the statutory timeframe. Given that we hold health information, our threshold for treating a breach as notifiable is deliberately low.

12. app 12 and 13 — access and correction

You may request access to, and correction of, your personal information at any time.

• In the app (where available)
• By email: privacy@trylifelong.com

We do not charge for making a request and will not charge excessively for giving access. We will acknowledge within 10 business days and respond within 30 days — Australian law requires a faster response than our general 45-day timeframe, and it governs here.

If we refuse access or correction, we will give you written reasons, tell you how to complain, and — for a correction refusal — associate a statement with the information noting that you consider it inaccurate, if you ask us to.

Deletion. The Privacy Act does not contain a general right to erasure, but we give you one anyway — see Privacy Policy §13. You can delete your data and close your account at any time.

12a. children and teenagers in australia

The rules in Privacy Policy §14 apply here too: the minimum age to hold a Lifelong account is 13, anyone under 18 needs a parent or guardian’s recorded permission, and a child of any age can be the subject of a profile their parent manages — with information provided by the parent, not collected from the child.

Australia adds one thing worth stating. The Privacy Act sets no fixed age at which a person can consent for themselves. The OAIC’s approach is that an individual under 18 has capacity to consent if they have sufficient maturity to understand what is being asked, assessed individually, and that as a general rule a person aged 15 or over can be presumed to have that capacity where an individual assessment is not practicable. So in Australia, a signup by anyone under 15 also requires a parent or guardian’s permission — for us that is the same flow we already run for every under-18 account, and here it is what supplies the consent rather than merely supporting it.

Where a parent or guardian gives consent for an Australian child, they give it as that child’s representative, and the child takes over as soon as they have the capacity and the account to do so.

13. other australian laws

State and territory health records legislation. Some Australian states and territories have their own health records laws — including the Health Records and Information Privacy Act 2002 (NSW), the Health Records Act 2001 (Vic), and the Health Records (Privacy and Access) Act 1997 (ACT). Where they apply to us, we comply.

My Health Record. Lifelong does not connect to the My Health Record system, and we do not collect, hold or use My Health Record data. If you choose to download a document from My Health Record and upload it to Lifelong yourself, it becomes an ordinary document in your Lifelong record — but Lifelong itself has no connection to the system.

Unauthorised collection, use or disclosure of My Health Record information is a criminal offence under the My Health Records Act 2012 (Cth). We take this seriously and will not build any My Health Record integration without dedicated Australian legal advice.

Surveillance devices laws. Recording a private conversation is regulated separately in each state and territory, and several require the consent of all parties. See our Recording Consent Notice, which you are asked to acknowledge in the app before you first record.

Australian Consumer Law. Our services come with guarantees that cannot be excluded under the Australian Consumer Law, including the right to a replacement or refund for a major failure and compensation for reasonably foreseeable loss. Nothing in our Terms of Service limits those rights. The arbitration agreement and class action waiver in Terms of Service §20 do not apply to Australian consumers.

Therapeutic Goods Administration. Lifelong is not a medical device and is not included in the Australian Register of Therapeutic Goods. It is a general wellness and health information management product.

14. complaints

Talk to us first, if you’re willing. Email privacy@trylifelong.com with "Privacy Complaint" in the subject. We will acknowledge within 10 business days and respond within 30 days.

If you are not satisfied, you can complain to the Office of the Australian Information Commissioner:

• Online: oaic.gov.au/privacy/privacy-complaints
• Phone: 1300 363 992
• Post: GPO Box 5218, Sydney NSW 2001

You may complain to the OAIC without coming to us first, though the OAIC generally prefers that you try us.

15. contact