This Privacy Policy describes how InQuiry AI Letter Review ("we", "us", "our") collects, uses, and protects information when you use our Chrome extension and related services (collectively, the "Service").
We are committed to handling personal and clinical information in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Health information is treated as sensitive information under Australian law and afforded the highest standard of protection.
Summary for clinicians: InQuiry AI processes letter body text only — no patient names, dates of birth, Medicare numbers, or referring doctor details are ever transmitted to our service. Letter text passes through our Australian server and to an AI provider for processing; it is never stored, logged, or retained beyond the duration of the request.
Data Handling at a Glance
The table below summarises, for every type of data, what we collect, how we use (handle) it, where it is stored, and who it is shared with. Each item is explained in full in the sections that follow.
| Data | When collected | How it is used (handled) | Where it is stored | Shared with |
|---|
| Email & name | At sign-up | Authenticate you; manage your account | Our server (AWS Sydney) | No one |
| Password | At sign-up | Authenticate you | Our server, as a salted hash (never plaintext) | No one |
| Letter body text | When you run a review | Sent for AI review, then returned to you | Not stored — processed in transit only | OpenAI / Anthropic (USA) for processing |
| Saved templates (optional) | Only when you click "Save as Template" | Build your personal writing-style profile | Our server (AWS Sydney) | No one |
| Usage & billing (token counts, charges) | Each review and top-up | Billing and your usage history | Our server (AWS Sydney) | Stripe (payment processing) |
| Clipboard contents | Only when you open the review window via the keyboard shortcut | To auto-fill the letter you want to review | Not stored — used only at that moment | No one (only if you then run a review is the letter text sent, as above) |
| Selected / editor text on the active tab | Only when you invoke a review or the Pop-out button | Obtain the letter to review; write the approved result back into your editor | Not stored | OpenAI / Anthropic only, as part of the letter text |
| Session token & preferences | At login / in use | Keep you signed in; remember settings | Your browser's local extension storage | No one |
We do not sell your data. We do not use it for advertising, profiling, creditworthiness, or any purpose unrelated to providing the InQuiry AI letter-review service. Our collection and use of user data complies with the Chrome Web Store User Data Policy, including its Limited Use requirements.
1. Information We Collect and How We Use It
Account information: When you register, we collect your name and email address. This is used solely to authenticate you and manage your account.
Usage data: We record aggregate token counts (input and output) for each AI review you perform. This is used for billing purposes and to display your usage history. We do not record the content of any letter.
Billing information: Credit top-up payments are processed by Stripe. We receive confirmation of successful payment and the email address used at checkout. We do not store card numbers or full payment details — these are handled entirely by Stripe in accordance with PCI-DSS standards.
Letter content: When you click a review button, the body text of the currently open letter is transmitted to our server and forwarded to an AI service for processing. We do not store, log, or retain letter content beyond the duration of the request (typically under 60 seconds).
Content of the active browser tab (read on your action): When you invoke a review — using the on-page button or the keyboard shortcut — the extension reads the text you have selected, or the contents of the letter editor, on the tab you are working in. This is done solely to obtain the letter to review and, when you click "Apply", to write the approved result back into that same editor. This access occurs only when you invoke the extension, only on that one tab, and the content is not stored.
Clipboard contents (read on your action): If you open the review workspace using the keyboard shortcut, the extension reads your clipboard once, at that moment, to paste the letter you want to review into the workspace. This happens only in direct response to your action. Clipboard contents are not stored and are not transmitted anywhere except as part of a review you then choose to run.
Locally stored data: Your session token, account email, display preferences, and a cached list of your saved-template names are stored in your browser using Chrome's extension storage. This data stays on your device, is used only to operate the extension, and is not accessible to any website you visit.
How we use this information: We use the data above solely to authenticate you and operate your account, perform the AI letter reviews you request, calculate and process billing, build your optional writing-style profile, and maintain the security and reliability of the Service. We do not use it for advertising, profiling, resale, or any unrelated purpose.
2. What Letter Content Contains
InQuiry AI is architecturally designed to process letter body text only. The following information is never transmitted to InQuiry AI:
- Patient full name
- Date of birth
- Medicare or health insurance number
- Patient address
- Referring doctor details
- Any information entered in InQuiry header or patient demographic fields
Letter body text is clinical content — diagnoses, findings, medications, and management plans — which may occasionally include incidental quasi-identifiers such as a patient's approximate age or a generic first name used in dictation. This clinical content constitutes health information under the Privacy Act and is treated accordingly.
3. Data Sharing and Disclosure (AI Processing & Overseas Transfer)
We share data with only two categories of third party: (1) the AI providers below, who process your letter text, and (2) Stripe, who process top-up payments (Stripe receives the email used at checkout and the payment amount; we never see or store card details). We do not share, sell, rent, or otherwise disclose your information to any other third party, and we do not use it for advertising or profiling.
Letter content is forwarded from our Australian server to one of the following third-party AI providers for processing:
This transmission constitutes a cross-border disclosure of health information under APP 8 of the Australian Privacy Principles. By creating an account and using the Service, you acknowledge that letter body text will be transmitted to AI providers in the United States for processing.
Neither Anthropic nor OpenAI use data submitted via their API to train their AI models. Letter content is not retained by these providers beyond the duration of the processing request.
4. Data Storage and Security
Account data, usage records, and transaction history are stored on servers located in Australia (AWS ap-southeast-2, Sydney region). All data in transit is encrypted using HTTPS/TLS.
Letter content is not stored on our servers at any point. Our web server access logs record request metadata (IP address, URL path, HTTP status code) but do not capture POST body content — letter text is never written to any log file.
Session tokens are stored locally in your browser using Chrome's secure extension storage and are never accessible to web pages you visit.
5. Data Retention
Account information and transaction records are retained for as long as your account remains active and for a reasonable period thereafter for billing and audit purposes. You may request deletion of your account and associated data at any time by contacting us.
Letter content is not retained beyond the processing request duration. No letter text exists in our systems after a review is complete.
6. Clinician Obligations and Responsibility
InQuiry AI is a tool used by clinical professionals in the course of their practice. Clinicians remain responsible for:
- Ensuring their practice privacy policy covers AI-assisted letter processing
- Obtaining appropriate patient consent or authorisation for clinical correspondence to be processed using AI-assisted software
- Compliance with applicable state and territory health information legislation
- Compliance with any obligations under the My Health Records Act 2012 where relevant
By creating an account, you confirm that you have appropriate authorisation to submit letter content to third-party AI processing services, and that your practice privacy policy covers AI-assisted processing of clinical correspondence.
The following consent language is provided for clinicians to adapt for use with patients:
Suggested patient consent wording
"Your specialist correspondence may be reviewed and edited using AI-assisted software to improve clarity and structure. Only letter body text is processed — your personal details and identification information are not included. Letter content is not stored by the AI service and is not used for AI training."
7. Your Privacy Rights
Under the Australian Privacy Act, you have the right to:
- Access the personal information we hold about you
- Request correction of inaccurate information
- Request deletion of your account and personal data
- Lodge a complaint about how we handle your information
To exercise any of these rights, contact us at inquiryreviewai@gmail.com.
8. Cookies and Tracking
The InQuiry AI website does not use tracking cookies or third-party analytics. The Chrome extension uses Chrome's built-in secure local storage for session tokens — this is separate from browser cookies and is not accessible to websites.
9. Changes to This Policy
We may update this policy from time to time. Material changes will be communicated via email to registered users. Continued use of the Service after changes are posted constitutes acceptance of the updated policy. The "Last updated" date at the top of this page will always reflect the most recent revision.
10. Contact and Complaints
For privacy-related enquiries, please contact:
InQuiry AI Letter Review
Email: inquiryreviewai@gmail.com
If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.
