Skip to content

Privacy Policy

Last updated 1 November 2026

1. Who we are

Retinote is operated from Brisbane, Queensland, Australia (ABN 25 238 500 350). We build CPD tracking software for Australian optometrists. This policy explains how we handle your personal information in compliance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

If you have questions about this policy, contact us at support@retinote.com.au.

2. What information we collect

We collect the following categories of information:

  • Account:your name, title and email, and how you sign in (email and password, Google or Microsoft). Your password is handled by Google's authentication service "Firebase", and we never see it.
  • Professional details: registration number, therapeutic endorsement, state, practice type, practice name and address.
  • CPD records: activities, conferences, learning goals, reflections, notes, and files you upload (certificates, attachments, CPR certificates).
  • Payments: your subscription status and dates. Stripe holds your card details; we never see them.
  • Usage: pages visited, errors, device and browser, linked to a user ID. Our servers also see your IP address.

How we collect it. Mostly from you. Also from Google or Microsoft if you sign in with them, from Stripe about your payments, and from your organisation (your name and email) if it provides your access.

We do not knowingly collect information from anyone under 18.

3. How we use your information

We use your information to:

  • Provide, operate, and maintain your Retinote account.
  • Process subscription payments and manage billing.
  • Draft reflections and suggest learning goals when you ask.
  • Send you account emails (email verification, password resets). Stripe sends payment receipts.
  • Improve and develop the service.
  • Comply with our legal obligations and resolve disputes.

We do not sell your personal information to third parties.

4. Who we share it with and where it's kept

We share information only with the following providers, and only to the extent necessary:

  • Microsoft Azure (Australia): hosting, database, file storage, email delivery and app monitoring.
  • Google Firebase (US): sign-in and account security. If you sign in with Google or Microsoft, they share your name and email with us.
  • Stripe (US): payments. We give Stripe your name and email to set up billing; you give your card details to Stripe directly.
  • OpenAI(US): AI writing assistance, only when you use it. OpenAI receives the activity or goal you're working on and any goals or activities linked to it. It never receives your name, email or registration number. OpenAI processes this in the United States.
  • LaunchDarkly (US): switches features on and off. It receives your email address and account type.
  • Google Maps (US): suggests addresses as you type in an address field. It receives what you type.

We choose providers that protect personal information and use it only to provide their service to us, subject to their own privacy policies where they act independently (for example, Stripe's fraud checks).

Where your information is kept. Your account, CPD records and files are stored in Australia (Microsoft Azure, Australia East). The providers marked (US) above may store or process your information in the United States. We take reasonable steps to make sure they handle it consistently with the Australian Privacy Principles.

Our monitoring records errors and performance against a user ID, not your name or the content of your records, and keeps it for 90 days.

Security. We encrypt your data in transit and limit who can access it. Authorised Retinote staff can view your account and records when they need to, for example to answer a support request, fix a problem or keep the service secure.

5. Data retention

We keep your information while you have an account, including after a subscription ends, so your records are there if you come back. You can delete your account at any time in Profile (or from the subscription-expired page if your subscription has ended). When you do, we immediately delete your profile, CPD records, notes, conferences, learning goals, uploaded files, and we cancel your subscription. If we close your account, we delete the same information. Backup copies are deleted within 90 days. Monitoring logs, which identify you only by a user ID, are deleted after 90 days. Stripe keeps the payment records it must keep by law.

6. Your rights

Under the Australian Privacy Principles, you have the right to:

  • Access the personal information we hold about you.
  • Request correction of inaccurate or incomplete information.
  • Delete your account yourself at any time in Profile (or from the subscription-expired page if your subscription has ended).
  • Complain about a breach of your privacy rights.

To exercise any of these rights, email support@retinote.com.au. We will respond within 30 days.

If you are unsatisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

7. Cookies and tracking

See our Cookie Policy.

8. Changes to this policy

We'll tell you about important changes by email or in the app. The date at the top shows the last update.