Privacy Policy

1. Introduction and Scope

1.1This Privacy Policy is issued by Pillar Health Systems Pty Ltd (ACN 696 899 751), trading as REEL AI (REEL AI, we, us, our). It explains how we collect, hold, use and disclose Personal Information in accordance with the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs).

1.2This Policy applies to Personal Information we handle about: (a) representatives of our business customers and prospective customers; (b) visitors to our website at www.reelai.com.au; and (c) individuals whose information is processed through the REEL AI platform (End Users), to the extent we act in our own right.

1.3Important — End User data. Where End User Personal Information (such as call recordings, transcripts and caller details) is processed through the platform on behalf of a customer, the customer determines the purposes of that processing and is responsible for its own privacy compliance, including collection notices and consents. We process that information on the customer's instructions as described in the AI & Data Processing Policy. End Users should direct privacy enquiries about a specific business's practices to that business in the first instance.

1.4This Policy forms part of the REEL AI Terms of Service and should be read together with the AI & Data Processing, Data Retention & Deletion and Security Statement schedules to the Terms of Service.

2. Kinds of Personal Information We Collect

2.1Customer and prospect information: name, position, business email address and phone number, company name, ABN/ACN, billing address, account credentials (passwords are hashed), billing and subscription history, and communications with us (including support tickets, emails, chat and WhatsApp messages).

2.2End User information (processed via the platform): caller phone numbers, names and details provided during calls or chats, call recordings, transcripts, AI summaries, appointment details, lead qualification responses, call metadata (time, duration, outcome), and campaign or contact data uploaded by our customers (for example, CSV imports and CRM records).

2.3Website and technical information: IP address, device and browser information, pages visited, referring URLs, approximate location derived from IP address, and information collected through cookies and similar technologies as described in the cookies and tracking sections of this Policy (sections 6 to 11).

2.4Sensitive information. We do not seek to collect sensitive information (such as health information, racial or ethnic origin, or political opinions) and our services are not designed for it. Sensitive information may incidentally be captured where an End User volunteers it during a recorded call; we handle any such information only as part of the relevant record, on the customer's instructions, and otherwise in accordance with APP 3. Customers must not deliberately configure the platform to solicit sensitive information without a lawful basis and appropriate consent.

2.5Anonymity (APP 2). Where lawful and practicable, you may deal with us anonymously or using a pseudonym, for example when making general enquiries via our website. This is not practicable where we provide subscription services or respond to individual requests.

3. How We Collect Personal Information

3.1We collect Personal Information: (a) directly from you, when you register an account, request a demonstration, contact us, or interact with our website, chat, SMS, email or WhatsApp channels; (b) automatically, through the operation of the platform and our website; (c) from our customers, when they upload or connect data to the platform; and (d) from third parties, including CRM and calendar providers you connect, payment processors, publicly available sources, and marketing or analytics partners.

3.2Where a customer provides us with Personal Information about another individual (including End Users and staff), the customer must ensure it is authorised to do so and that the individual has been made aware of this Policy or an equivalent notice, as required by APP 5.

4. Purposes of Collection, Use and Disclosure (APPs 3 and 6)

4.1We collect, hold, use and disclose Personal Information for the following primary purposes:

(a)to provide, operate, secure and support the platform and services, including AI call answering, transcription, summarisation, lead qualification, appointment booking, routing, chat, SMS, email and workflow automation;

(b)to establish and administer customer accounts, process payments and manage subscriptions;

(c)to communicate with customers and prospects, including service notifications, support and account management;

(d)to monitor, maintain and improve the performance, reliability, safety and security of the platform, including fraud and abuse prevention;

(e)to develop and improve our services and AI features in accordance with the AI & Data Processing Policy, using de-identified or aggregated data wherever practicable;

(f)to conduct marketing and remarketing in accordance with section 5 of this Policy; and

(g)to comply with our legal obligations, enforce our agreements, and establish or defend legal claims.

4.2We may also use and disclose Personal Information for secondary purposes that are related (or, for sensitive information, directly related) to a primary purpose and within reasonable expectations, with consent, or as otherwise permitted or required by law, including under APP 6.2.

5. Direct Marketing, Advertising and Remarketing

5.1We may send customers and prospects marketing communications about our products and services by email, SMS or messaging platforms in accordance with APP 7 and the Spam Act 2003 (Cth). Every commercial electronic message we send will identify us and contain a functional unsubscribe facility. You may opt out at any time using that facility or by contacting privacy@reelai.com.au.

5.2We use third-party advertising and analytics services — including Google Analytics, Google Ads, Google Tag Manager, Meta (Facebook and Instagram) Pixel and advertising, LinkedIn Insight Tag and advertising, and Microsoft Advertising — for analytics, advertising attribution, conversion tracking, audience building and remarketing. These services use cookies and similar identifiers and may process data on servers located overseas. Details, including opt-out mechanisms, are set out in sections 6 to 11 of this Policy.

5.3We do not use End User call recordings or transcripts processed on behalf of customers for our own advertising purposes.

6. Cookies and Similar Technologies

6.1Cookies are small text files placed on your device by a website. "First-party" cookies are set by us; "third-party" cookies are set by other organisations whose technology we embed. Cookies may be "session" cookies (deleted when you close your browser) or "persistent" cookies (retained for a defined period). Pixels and tags are small code snippets or images that perform similar functions, including measuring page views, conversions and ad performance.

7. Categories of Tracking Technologies We Use

7.1Strictly necessary. Required for the website and platform to function, including session management, login authentication, security tokens (such as CSRF protection), load balancing and fraud prevention. These cannot be disabled through our tools without breaking core functionality.

7.2Performance and functionality. Remember your preferences (such as theme and notification settings), maintain chat continuity, and help us measure and improve reliability and page performance.

7.3Analytics. Help us understand how visitors use our properties, including pages visited, session duration, navigation paths and approximate location. We use Google Analytics and Google Tag Manager for this purpose. Where available, we enable IP truncation/masking and data-sharing restrictions.

7.4Advertising and remarketing. Support interest-based advertising, audience building, retargeting, and conversion tracking across Facebook, Instagram, Google Ads, LinkedIn and Microsoft Advertising. These technologies may record that you visited our site, the pages you viewed, and whether you completed actions such as booking a demonstration.

8. Specific Third-Party Technologies

8.1We currently deploy, or may deploy, the following third-party Tracking Technologies:

(a)Google Analytics (GA4) — website analytics and audience measurement (Google LLC, United States);

(b)Google Tag Manager — tag deployment and management (Google LLC, United States);

(c)Google Ads conversion tracking and remarketing — advertising measurement and retargeting (Google LLC, United States);

(d)Meta Pixel and Conversions API — Facebook and Instagram advertising, custom audiences, retargeting and conversion tracking (Meta Platforms, Inc., United States);

(e)LinkedIn Insight Tag — B2B campaign measurement, audience insights and retargeting (LinkedIn Corporation, United States);

(f)Microsoft Advertising (UET tag) — advertising measurement and remarketing (Microsoft Corporation, United States); and

(g)Embedded content providers — such as video hosting, chat widgets and appointment scheduling tools, which may set their own cookies when loaded.

8.2These providers act under their own privacy policies and may process data in the United States and other jurisdictions. The names, providers and durations of specific cookies change from time to time as vendors update their technologies; the categories above will remain accurate and current details are available on request to privacy@reelai.com.au.

9. Consent and Legal Basis

9.1By continuing to use our website with Tracking Technologies enabled in your browser, and, where a consent banner or preference centre is presented, by making selections within it, you consent to our use of Tracking Technologies as described in this Policy. Strictly necessary technologies are used on the basis that they are essential to deliver services you request.

9.2Where visitors are located in jurisdictions with additional cookie consent requirements (such as the EU/UK), non-essential Tracking Technologies will operate in accordance with the consent mechanisms presented to those visitors.

10. Managing and Opting Out

10.1You can manage or withdraw consent at any time by:

(a)adjusting our cookie preference centre (where displayed);

(b)using browser settings to block or delete cookies (refer to the help resources for Chrome, Safari, Edge or Firefox) — blocking strictly necessary cookies may impair site and platform functionality;

(c)opting out of Google Analytics via the Google Analytics opt-out browser add-on (tools.google.com/dlpage/gaoptout);

(d)managing Google ad personalisation at adssettings.google.com;

(e)managing Meta ad preferences within your Facebook or Instagram settings;

(f)managing LinkedIn advertising preferences within your LinkedIn settings; and

(g)using industry opt-out tools such as youradchoices.com.au (ADMA) and optout.aboutads.info.

10.2Opting out of advertising cookies does not stop advertising; it means advertising will be less relevant to you. Because opt-outs are often cookie-based, clearing cookies may require you to renew your preferences.

11. Do Not Track

11.1Some browsers transmit "Do Not Track" signals. There is no uniform industry standard for responding to these signals and, other than as described in this Policy, our properties do not currently respond to them.

12. Disclosure of Personal Information

12.1We may disclose Personal Information to:

(a)our related bodies corporate, personnel and professional advisers, on a need-to-know basis;

(b)service providers and sub-processors that support the platform, including cloud hosting, AI processing, telephony, messaging, email delivery, payment processing (payment card details are handled by our PCI DSS certified payment processor and are not stored on our systems), CRM and calendar integrations, analytics, and customer support tooling;

(c)our customers, in respect of End User information processed on their behalf;

(d)courts, regulators, law enforcement and government agencies where required or authorised by law, including under warrants, subpoenas and statutory notices; and

(e)prospective or actual acquirers of our business or assets, and their advisers, in connection with a merger, acquisition, financing or sale, subject to appropriate confidentiality obligations.

12.2We do not sell Personal Information.

13. Cross-Border Disclosure (APP 8)

13.1Permanent platform data, including call recordings and transcripts, is stored on cloud infrastructure located in Australia. However, some processing occurs overseas. In particular:

(a)United States — real-time voice AI processing and telephony carriage during active calls (including providers such as our voice AI provider, OpenAI-hosted models where applicable, and Twilio), and certain analytics, advertising and support tools (including Google, Meta, LinkedIn and Microsoft services);

(b)Other jurisdictions — locations in which our sub-processors or their support personnel operate, as identified in the AI & Data Processing Policy and Security Statement from time to time.

13.2Before disclosing Personal Information to overseas recipients, we take steps reasonable in the circumstances to ensure the recipient handles the information consistently with the APPs, including contractual data protection commitments, configuration of providers to minimise retention (for example, transient processing of call audio with prompt deletion), encryption in transit, and vendor due diligence. Where we rely on your informed consent under APP 8.2(b), we will make that clear at the time.

14. AI Processing, Voice Recordings and Transcription

14.1The platform records and processes voice calls, generates transcripts and summaries, and applies AI analysis (such as lead qualification and sentiment indicators). Call audio is processed in real time, and the resulting recordings and transcripts are stored on Australian infrastructure in accordance with the Data Retention & Deletion Policy.

14.2We train, tune and improve our AI systems only where lawful, and in accordance with the AI & Data Processing Policy. Wherever practicable we use de-identified, aggregated or synthetic data for improvement purposes, and we do not permit foundation-model providers to use customer content to train their general-purpose models except where expressly agreed.

14.3Our customers are responsible for notifying End Users that calls are recorded and processed by AI, and for obtaining any consents required under the Privacy Act and applicable State and Territory surveillance devices legislation.

15. Data Quality and Security (APPs 10 and 11)

15.1We take reasonable steps to ensure the Personal Information we hold is accurate, up to date and complete, and to protect it from misuse, interference, loss, and unauthorised access, modification or disclosure. Our measures include AES-256 encryption at rest, TLS 1.3 encryption in transit, role-based access controls, multi-factor authentication for administrative access, network and application monitoring, tenant isolation, secure software development practices and staff confidentiality obligations, as further described in the Security Statement.

15.2In the event of a data breach involving Personal Information that is likely to result in serious harm, we will comply with the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act, including notifying affected individuals and the Office of the Australian Information Commissioner (OAIC) where required, and we will notify affected customers without undue delay.

16. Retention and Destruction

16.1We retain Personal Information only for as long as it is reasonably required for the purposes described in this Policy or as required by law, after which we take reasonable steps to destroy or de-identify it in accordance with APP 11.2. Standard retention periods — including default retention of call recordings and transcripts, account records, billing records (retained for seven years for Australian tax compliance) and logs — are set out in the Data Retention & Deletion Policy.

17. Access, Correction and Deletion (APPs 12 and 13)

17.1You may request access to, or correction of, the Personal Information we hold about you by contacting privacy@reelai.com.au. We will respond within 30 days. We may decline access in the circumstances permitted by the Privacy Act, in which case we will provide written reasons and available complaint mechanisms. We do not charge for making a request and any charge for giving access will be reasonable and notified in advance.

17.2You may request deletion of your Personal Information. We will action deletion requests except where retention is required by law or for the establishment, exercise or defence of legal claims. Requests relating to End User information processed on behalf of a customer will be referred to, and actioned on the instructions of, that customer where required.

18. Complaints

18.1If you believe we have breached the APPs or mishandled your Personal Information, please contact our Privacy Officer at privacy@reelai.com.au with details of your concern. We will acknowledge your complaint promptly, investigate it, and respond within 30 days.

18.2If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or by calling 1300 363 992.

19. Changes to this Policy

19.1We may update this Policy from time to time to reflect changes in our practices, services or the law. The current version will always be published at www.reelai.com.au with its effective date, and we will notify customers of material changes by email or in-platform notice.

20. Contact — Privacy Officer

Privacy Officer

REEL AI — a trading name of Pillar Health Systems Pty Ltd (ACN 696 899 751)

Email: privacy@reelai.com.au | Web: www.reelai.com.au

Response time: within 30 days of receipt.