Privacy Policy

1. What we collect

Consult notes and chats

What you type or paste into MBS Desk, your answers to its questions, and its replies. Enter de-identified information only (see our Terms of Use). If you enter something that identifies a patient, it will reach us and our AI providers, so please check before you send.

Practice profile

If you fill in the practice profile (for example, your practice’s location category, how you bill, and whether you have a practice nurse), it’s kept in your browser and sent with each chat so that results fit your practice.

Chat logs

We log each chat: what was sent, what MBS Desk replied, your practice profile, when it happened, and which version of MBS Desk answered. Chats are stored against random ids for your browser and for the consult, not against your name, email address, or IP address. When a chat looks like it contains a patient identifier, such as a Medicare number or a date of birth, we keep only the kind of reply it got and the items it showed, not its text.

Feedback

What you write in the Feedback form, and your name if you choose to give it. Feedback is stored with your browser’s random id and the consult on screen, so we can see what it’s about. If you give your name, it can be linked to the chats logged from your browser.

Account details

If you create an account: your name and email address, and anything else you choose to give us, such as your practice’s name. You sign in with Google, which shares your name, email address, and profile picture with us, or with a code we email you.

For each browser you’re signed in on, we keep when it was last used, its IP address, and the kind of browser and device, so you stay signed in and we can spot misuse. To stop people guessing sign-in codes, we count sign-in requests from each IP address.

If you subscribe, we keep your plan, whether it’s paid up, and when it renews or ends, with your account. Your chats aren’t linked to your account.

Payment details

If you pay for a plan, Stripe collects your card details, and we don’t see or store your full card number. Stripe shares with us your name, email address, and billing address; the type, last four digits, and expiry date of your card; and your payment history.

Messages

Emails and other messages you send us.

Technical information

Like any website, our hosting provider handles your IP address and basic details of your device and browser to deliver pages and protect MBS Desk from misuse, and may keep them for a short time in its logs. We don’t store your IP address with your chats.

2. Cookies and browser storage

We don’t use advertising or analytics cookies, and we don’t track you across other websites.

MBS Desk saves a few things in your browser’s local storage so they’re there next time: your light or dark setting, your chat layout, your practice profile, the name you last gave with feedback, and the random id for your browser. They stay on your device until you clear them. Your practice profile and the random id are sent to us with each chat, and your name only when you send feedback.

If you sign in, we use essential cookies to keep you signed in.

3. How we use it

• To run MBS Desk: reading what you enter, working out which items may apply, and writing replies.
• To improve MBS Desk: we review logged chats and feedback, with help from AI tools, to find and fix mistakes and to build test cases.
• To manage accounts and paid plans, and to take payments.
• To answer your messages and help you.
• To send service emails, such as receipts and notices about changes to our terms.
• To send news and tips by email, but only if you’ve agreed. Every one has a link to unsubscribe.
• To keep MBS Desk secure and prevent misuse.
• To meet our legal obligations, and to establish, exercise, or defend legal claims.

We don’t sell personal information, and we don’t use it for advertising.

4. AI and automated decisions

MBS Desk uses computer programs, including AI models, to read what you enter and to suggest which MBS items it may fit. As the Privacy Act asks, here’s what that involves:

• The information used: what you enter, which should be de-identified and so shouldn’t be personal information about a patient, and your practice profile.
• Decisions made by a computer program alone: none about you or your patients. The one automatic decision is Stripe’s fraud check when you pay, which can decline a payment.
• Decisions a program helps with: MBS Desk’s suggestions help you decide which items to claim. That decision is yours, and it can affect what Medicare and the patient pay.

If your practice’s privacy policy describes the software it uses, it can draw on this section.

5. Who we share it with

We share personal information with the providers that help us run MBS Desk, and only as much as each one needs. They handle it under their own terms and data protection commitments:

• cloud hosting and database providers, which run MBS Desk and store its data in Sydney;
• AI model providers, which read what you enter and help write replies;
• our payment provider, Stripe, which processes payments for paid plans;
• our sign-in provider, if you create an account; and
• our email provider, which carries emails between you and us.

We may also share information with our professional advisers, such as lawyers and accountants; with anyone who takes over MBS Desk, who must then handle it under this policy; and where the law requires or allows it, for example with a court, regulator, or law enforcement agency.

We don’t share your information with Medicare, Services Australia, or the Professional Services Review unless the law requires us to.

6. Information sent overseas

MBS Desk runs in Sydney, and our database is there. To answer you, what you enter is sent to our AI providers, which process it in the United States. Our other providers are based overseas too, mainly in the United States, and may access or store information there or in other countries where they operate.

We choose providers that commit to protecting the information they handle for us, and that don’t use what you enter to train their AI models.

7. Keeping it secure

We protect information with encryption, in transit and at rest, and with access controls, and we keep what you write out of our system logs. Access to logged chats is limited to the people who run MBS Desk. No system is perfectly secure, though, which is one more reason to enter de-identified notes only.

If a data breach is likely to cause serious harm to anyone, we’ll tell the people affected and, where the law requires, the Office of the Australian Information Commissioner (OAIC).

8. How long we keep it

We keep chat logs and feedback for as long as they help us improve MBS Desk, then delete them. We keep account details while your account is open, and payment records for as long as tax law requires (generally five years). When we no longer need information, we delete it or de-identify it.

9. Your choices and rights

You can use the MBS Desk tool without telling us who you are. Some features, such as paid plans, need an account.

You can ask us for a copy of the personal information we hold about you, or ask us to correct or delete it, by emailing admin@mbsdesk.com.au. We’ll reply within 30 days. We may need to confirm who you are first, and if the law lets or requires us to refuse a request, we’ll tell you why.

Because chats are stored against a random id rather than your name, we may only be able to find yours if you tell us roughly when you used MBS Desk and what you entered.

You can unsubscribe from marketing emails at any time, using the link in each one.

Clearing your browser’s storage for this site removes your practice profile and settings, and gives your browser a new random id.

10. Questions and complaints

If you have a question or a complaint about how we handle personal information, email admin@mbsdesk.com.au. We’ll respond within 30 days. If you’re not satisfied with our response, you can contact the OAIC at oaic.gov.au or on 1300 363 992.

11. Children

MBS Desk is for professionals. It isn’t meant for anyone under 18, and we don’t knowingly collect personal information from children.

12. Changes to this policy

We may update this policy as MBS Desk changes. We’ll post the new version here with a new date, and if a change is significant, we’ll tell account holders by email.

13. Contact us

MBS Desk. Email: admin@mbsdesk.com.au.