Clear information about how we handle website data.

1. About this policy

This policy explains how Podium IT Pty Ltd (Podium IT, we, us or our) handles personal information collected through podiumit.com.au, including contact forms, the IT Readiness Check and related secure report delivery. It does not replace any separate privacy, confidentiality, support or service terms that apply to managed clients.

2. Information we collect

Depending on how you use the website, we may collect:

• your name, work email address, phone number and organisation;
• your practice or business type, postcode, organisation size, current support arrangement and software selections;
• the content of an enquiry, selected service, urgency and the page from which it was submitted;
• answers and scores generated through the IT Readiness Check, including identified priorities and whether a review was requested;
• your confirmations of authority, report consent and optional research consent;
• limited technical and security information such as browser type, user agent, source page, approximate location, a one-way hash derived from an IP address, form timing and anti-bot verification results; and
• aggregate website usage information such as pages viewed, referral source, device category, general location and engagement.

3. How we collect information

We collect information directly when you complete a form, request a report, contact us or correspond with us. We also receive limited technical information automatically through website hosting, security controls, Google Analytics and embedded media. If an authorised person completes an assessment for an organisation, we receive the information from that person on the organisation’s behalf.

4. Why we use information

We use website information to:

• respond to enquiries and arrange an appropriate next step;
• generate, secure and deliver an IT readiness report;
• contact an organisation when it requests a complimentary review;
• operate, troubleshoot and protect the website, including preventing spam, automated abuse and unauthorised report access;
• understand aggregate website and search performance;
• maintain reasonable business and security records; and
• produce de-identified aggregate research only where separate optional research consent was provided.

5. IT Readiness Check and secure reports

The assessment asks about organisational technology controls; it is not intended to collect patient or clinical information. Its score and recommendations are generated automatically from the selected answers using Podium IT’s published readiness framework. The result is guidance, not a compliance certification, credit decision, insurance decision or determination of eligibility for a service.

A report is delivered through a private, non-indexable link. The separate access code is sent by SMS. Links expire after 14 days, repeated incorrect access-code attempts are restricted, and the assessment record and report are scheduled for deletion after 90 days.

6. Optional de-identified research

Research participation is optional and separate from consent to receive a report. Choosing not to participate does not affect the report or any Podium IT service. When research consent is provided, selected answers and score totals are added to aggregate counts without the organisation name, contact details, exact postcode, individual report or free-text configuration notes.

Consent receipts are scheduled for deletion after 90 days. De-identified aggregate totals may be retained for trend analysis and publication. Podium IT will suppress small groups and describe the cohort, sample size and limitations. We will not describe a managed-client sample as representative of all Melbourne healthcare organisations.

7. Analytics, cookies and page measurement

The website uses Google Analytics to understand aggregate traffic, including pages visited, referral source, broad location, device and engagement. Google Analytics may use cookies or similar identifiers according to Google’s own terms and privacy practices. Podium IT does not receive visitor IP addresses through its Google Analytics reports.

Live visitor analytics record full IP addresses, approximate countries, random tab session identifiers, referring website or search engine, public page paths and accepted form submission events with timestamps. Records are visible only to authorised staff for 24 hours and deleted by hourly cleanup within 25 hours. Form contents, keystrokes, query strings and screen recordings are not collected. The tracker respects Do Not Track and Global Privacy Control. We also maintain a simple first-party page counter that stores daily totals by page and does not create an individual browsing profile. You can restrict analytics cookies through your browser or privacy tools, although essential security controls may still operate.

8. Security and abuse prevention

Forms are transmitted over HTTPS, validated on the server and protected by controls including rate limiting, honeypot fields and Cloudflare Turnstile. Website records are stored in access-controlled infrastructure. Access is limited to authorised personnel and systems that need the information for the purposes described in this policy.

No internet service can be guaranteed completely secure. Please do not use website forms to submit patient or health information, passwords, one-time codes, private keys, payment-card details, detailed vulnerability information or other security credentials. We will arrange an appropriate secure channel when sensitive technical information is required.

9. Service providers and disclosures

We may disclose information to service providers where necessary to operate the website and deliver a requested service. These currently include Cloudflare for website hosting, database and object storage, security checks, email delivery and video streaming; Twilio for SMS delivery; and Google for website analytics. Providers may process information in Australia or other countries where they or their infrastructure operate.

We may also disclose information where required by law, to protect people or systems, to investigate misuse, or with your authority. We do not sell personal information or provide readiness-assessment contact details to data brokers.

10. Retention

Some records may be retained longer where reasonably required for an active client relationship, dispute, security investigation, insurance, accounting or legal obligation. When information is no longer required, we take reasonable steps to delete it or de-identify it.

11. Access, correction and deletion requests

You may ask what personal information we hold about you, request correction, or ask us to delete information that is no longer required. We may need to verify your identity and authority before acting. Some requests may be limited where retention is required by law or an active contractual, security or dispute-related obligation.

12. Privacy questions and complaints

Contact Podium IT at info@podiumit.com.au, call (03) 8578 3077, or write to Office 125, Ground Floor, 470 St Kilda Road, Melbourne VIC 3004. Please provide enough information for us to understand the request without including passwords, patient information or unnecessary sensitive material.

We will review privacy concerns and respond within a reasonable period. If you are not satisfied with our response, you may be able to contact the Office of the Australian Information Commissioner.

13. Other websites and policy changes

The website links to third-party services and source material that have their own privacy practices. We are not responsible for how an unrelated website handles information. We may update this policy when website functions, providers or legal requirements change. The current version and update date will remain available on this page.

Read more about the Healthcare IT Readiness Standard or the research method.