Privacy Policy

1. About this policy

This policy explains how Qualia Tech Pty Ltd ("Qualia Tech", "we", "us") collects, holds, uses and discloses personal information through the AEInnerVerse web application at aeinnerverse.life (the "Service").

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

2. What the Service is not

AEInnerVerse displays heart rate variability measurements, morning check-ins and ACT practice records for clinicians and clients to review together.

4. What we do collect and hold

Account information. Your name, email address and account identifier. Sign-in is handled by our authentication provider. If you subscribe, we also hold a record of your subscription status and transaction history.

Technical information. Internet protocol (IP) address, browser type and version, device type, operating system, time zone, and pages visited within the Service. This is collected automatically through server logs and cookies.

Clinician and invited-client records. Clinician registration details include your name, account email, profession, professional registration body and number, country and practice setting. Administration checks registration details before checkout and keeps the decision and any review note. Professional registration details are emailed to administration without client information or HRV readings. Verified clinicians invite clients by name and email. A reading summary is stored only when the client or clinician explicitly saves it with the required sharing consent. Clients can withdraw sharing consent at any time. Withdrawing stops new sharing and also hides their earlier readings from the clinician. Clients can delete their own reading history even if the clinician's licence has lapsed. Revoking a client removes the clinician's access to that client's records. Deleting a client account deletes their shared records and enrolment; deleting a clinician account removes all shared records and client enrolments for that clinician, and applications and invitation links. Do not include other health information in messages to us.

We do not ask for identity-document numbers or unrelated medical records; please do not send them to us. The professional registration number is used to identify the registration for administration verification.

5. Payment information

We do not collect or store your card number, expiry date or security code. Payments are processed by a third party payment provider. Your card details are given directly to that provider and are held under their terms and their privacy policy, not ours. We receive only a confirmation of payment and a subscription status.

6. Why we collect it

We collect and use personal information to:

• create and administer your account
• display a reading back to you
• process subscription payments and issue receipts
• respond to your questions and provide support
• review clinician applications and operate clinician licensing, invitations and consented reading sharing
• keep the Service secure, detect misuse, and fix faults
• meet our obligations under Australian law

7. What we do not do

We do not sell personal information.

We do not disclose personal information to advertisers.

Live readings display your current measurement. Local baseline readings calculate your on-device personal pattern. Shared summaries, overnight imports, check-ins and ACT completion records provide the service you and your clinician choose to use. They are not used for model training.

Research functions are switched off for all accounts. They are not part of the current clinician or client workspace.

Reports contain no names, notes or client identifiers, and small cohorts and outcome groups are suppressed. Statistics describe observed timing and patterns; they do not establish that an ACT exercise caused a change. A one-question morning score is for internal learning; formal evidence requires an appropriate validated measure and approved study protocol.

8. Who we disclose it to

We disclose personal information to service providers who help us run the Service:

• our application hosting provider
• our authentication provider
• our payment provider
• our email delivery provider
• our error monitoring provider, if used

Each is given only what it needs to perform its function.

We may also disclose personal information where we are required or authorised to do so by law, or where it is necessary to prevent a serious threat to life, health or safety.

9. Overseas disclosure

Daytime live readings are not uploaded automatically, and browser baseline datasets remain in your browser. In the native mobile overnight recording mode, a client explicitly starts recording and agrees to sharing. Compact recording summaries are checkpointed in encrypted, account-scoped storage on the phone; raw beat histories are not retained. Completed recordings with sufficient usable data sync automatically to the clinician-supported workspace. Unconfirmed uploads remain on the phone for retry. Recording boundaries are selected by the client, not detected sleep stages. Gaps and interrupted recordings are identified; recording is not guaranteed after the app is force-closed or the operating system stops it.

Shared live summaries, overnight imports and mobile overnight summaries, check-ins and ACT records are stored on our hosted infrastructure and may be processed overseas. For research-enabled participants, clinician email alerts use Microsoft Outlook and include the client's name and a brief description of the overnight pattern. Optional browser alerts use the browser's push provider and contain a generic notification without client names, notes or HRV values. Already-delivered messages are not automatically removed from recipients' mailboxes or devices when consent is withdrawn.

Before enrolling real clients, Qualia Tech must confirm the actual health-data hosting location, applicable provider agreements, permitted transfers and study-specific requirements. This page does not establish that those reviews or approvals are complete.

Account information, subscription records, professional applications, client enrolments and explicitly saved shared summaries are handled by the relevant hosting, authentication and payment providers. Professional onboarding notifications are handled by our email provider. These providers may store and process information outside Australia, including in the United States and other countries. A shared reading summary is sent only when you explicitly choose to save it with the required consent.

We take reasonable steps to ensure overseas recipients handle your information consistently with the Australian Privacy Principles. You should be aware that we may not be able to enforce Australian privacy law against an overseas recipient, and that recipient may be subject to the laws of its own country.

10. Security and retention

We hold account information in access controlled systems and use encryption in transit. No system is completely secure, and we cannot guarantee that information sent to us over the internet is protected from interception.

We keep your account information for as long as your account is open. When you close your account we delete the application-held records described in section 4, except where we are required by law to keep a record, such as transaction records kept for taxation purposes. Clients can delete their saved reading summaries from the workspace without closing their account. Professional onboarding emails are separate administration records and are not automatically removed from mailboxes by account deletion; contact us about access or deletion. Optional baseline readings remain under your control in your browser and can be deleted from the HRV experience or by clearing browser data.

11. Data breaches

If we have reasonable grounds to believe a data breach is likely to result in serious harm, we will notify you and the Office of the Australian Information Commissioner in accordance with the Notifiable Data Breaches scheme.

12. Access, correction and deletion

You can delete your account from Account in the website, desktop app or mobile app. Deletion ends access immediately and stops future membership billing; it does not automatically refund past payments. It removes your login and account profile. Required financial records are retained. The local baseline on the device used for deletion is removed; the mobile app also removes its local overnight recordings, including unsynced copies. Individual local overnight copies can be deleted from the mobile Overnight screen without deleting an already shared server record. Clear local data separately on your other devices. Account-deletion instructions and an email request option are available at Account & data deletion.

You can ask us for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it. Write to the address in section 16. We will respond within 30 days. There is no charge for making a request. We will tell you in writing if we refuse a request and why.

13. Cookies

We use only the cookies necessary to keep you signed in and to keep the Service secure. We do not use advertising cookies, tracking cookies or third party analytics cookies. You can block cookies through your browser, but parts of the Service will not work if you do.

14. Children

The Service is for people aged 18 and over. We do not knowingly collect personal information from anyone under 18. If we become aware that we hold information about a person under 18, we will delete it.

15. Changes to this policy

We may update this policy. The current version is always available at aeinnerverse.life. If a change materially affects how we handle your information, we will tell you by email before it takes effect.