Privacy Policy

1. Who we are

ISLA LABS PTY LTD operates ASTON (astonax.com). In this policy, we, us and our means ISLA LABS PTY LTD. We are based in New South Wales, Australia.

ASTON is a digital screening platform. It is not a diagnostic instrument and it is not a substitute for clinical assessment. This policy explains how we handle personal information, including health information about children, under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Health information is sensitive information.

This policy applies to clinicians, clinic staff, school staff, parents and carers, teachers who complete a form, and young people who complete a youth form.

2. Who controls children's information

The clinician who owns the case is the controller of the screening record. They decide why the case exists, who is invited, how long it is kept, and when it is archived or deleted. They are responsible for consent, professional confidentiality, and the health-records duties that apply to their practice (including any state or territory health records law).

ASTON is the processor. We store and process case data on the clinician's instructions so forms can be completed and a screening report can be produced. ASTON staff access a case only when the clinician asks us to, or where the law requires it. That access is logged.

School users are contributors. A school may suggest a screening and later see pathway status (for example that forms are in progress or that the clinic has reviewed). Schools do not see scores, reports, or questionnaire answers. They cannot archive or delete cases.

If a parent, carer or young person contacts ASTON about a case, we refer that request to the controlling clinician and assist them. We do not change or delete a child's record on a parent request alone.

3. Children and young people

ASTON is built around children and young people. A typical case includes a child's name, date of birth, sex, school, and answers from adults (and sometimes the young person) about observed behaviour. That is health and sensitive information.

• Children do not create ASTON accounts. There is no child login.
• We do not market to children. We do not use children's information for advertising or profiling for ads.
• We do not sell, rent or trade information about children.
• A youth self-report is only offered where the child is 12 or older. That form is usually sent to the parent to open or forward. We do not text young people.
• Form emails and reminders may include the child's name so the right form is completed. They do not include scores or clinical conclusions.
• We do not put a child's name, school and clinical language in SMS. ASTON does not send SMS.
• Mandatory reporting, safeguarding and clinical follow-up remain the clinician's (and where relevant the school's) duties. ASTON does not report to child-protection agencies on its own.

On the school pathway, a parent or carer must consent and choose a clinic before a case is created. On a clinician-started case, the clinician is responsible for having a lawful basis and appropriate consent before inviting informants.

4. What we collect

4.1 Professional accounts

Name, email, hashed password, profession, registration number and body, registration expiry date, practice details, organisation (school or clinic), role in that organisation, and credits or subscription status. School staff are marked as school accounts. We send a sign-in code to email after the password is accepted.

4.2 Information about the child

As entered by the clinician, school or parent:

• Name
• Date of birth (used for age and whether a youth form is offered)
• Sex
• School name, suburb and state, and a link to a registered school organisation when one exists
• Optional notes on a school referral
• If the clinician connects Cliniko: a Cliniko patient id and display name used to start the case

4.3 Informants

Parent or carer email, optional second parent email, teacher email or a teacher link sent via the parent, and questionnaire responses (parent, teacher, youth). Pre-assessment answers and free text may also be stored. We generate a screening report from completed forms.

4.4 Payments

Stripe processes card payments. We store that a purchase occurred, credits added, and amounts. We do not store full card numbers.

4.5 Technical and audit information

IP address, browser and device details, session times, essential cookies, and audit events (for example case created, report opened, export taken, case deleted). Email send logs record that a message was sent, not the child's questionnaire answers.

5. How we use information

• To run the screening: create the case, send links, collect answers, produce the report.
• To operate accounts, credits, clinic inboxes and school dashboards.
• To send transactional email (consent, invitations, reminders, login codes, payment, registration expiry, ready-for-review).
• To protect the service (ownership checks, login codes, audit logs).
• To meet legal duties, including a notifiable data breach if one occurs.

We do not use identifiable case data for research or instrument work unless the clinician has recorded secondary-use consent on that case. That consent is off by default. ASTON never turns it on.

6. Who can see what

• Owning clinician — the full case, answers, report, exports and archive or delete actions.
• Clinic colleagues invited to that clinic — inbox and cases for that clinic, not school-only accounts.
• School staff — status only on cases linked to their school. No scores. No report.
• Parent, teacher, youth — only the form they were sent, until the link expires or is submitted. They do not get a login to browse other cases.
• ASTON staff — only on the clinician's request or as required by law. Logged.

Another clinician cannot open, export or delete a case they do not own.

7. Emails and form links

Parents do not need an ASTON account. Access is by a unique link. Parent, teacher and youth links expire 30 days after they are issued, or when that form is submitted. Expiry ends access to the form. It does not delete the case.

We may email reminders if consent is not opened (day 3 and day 7) or if a form is not finished (day 7, and again about 7 days before the link expires). We stop after those reminders.

Login codes go to the professional's email and expire in 10 minutes. We do not put form links, passwords or scores in SMS.

8. Sharing and processors

We do not sell, rent or trade personal information. We use processors to run the service:

• Vercel — hosts the application.
• MongoDB — stores application data.
• Resend — sends email.
• Stripe — processes payments.
• Cliniko — only if a clinician connects their own Cliniko account. We then receive the patient details they choose to launch from.

We may disclose information if the law requires it, to protect people from serious harm, or in a business transfer (with notice to clinicians).

9. Overseas disclosure

Some processors operate outside Australia (for example application hosting and email). When that happens, information may be stored or processed overseas. We take reasonable steps so those processors handle information consistently with this policy and the APPs, including contractual terms where we can. We do not claim that every copy of every record stays only on Australian soil.

10. Security

We protect information with HTTPS/TLS in transit, hashed passwords, an email sign-in code after password, case-ownership checks, and audit logs. Form links are unguessable tokens with a 30-day life.

ASTON is not end-to-end encrypted. The service must read case data to score forms and produce a report. A clinician who is signed in can see their cases. That is required for the product to work.

No internet service is perfectly secure. If you believe an account or a link has been misused, email support@astonax.com.

11. How long we keep records

Cases are kept by default. Archive hides a case from the working lists. The data remains. The clinician can restore it.

Each case is retained for seven years from creation or until the child turns 25, whichever is later. At that point the case is flagged for review. It is not destroyed automatically. The clinician chooses to keep it, export it, or delete it.

Delete is an explicit clinician action after archive, with a two-step warning. It is not available to school users. If secondary-use consent is not recorded, the identifiable case, answers, scores and report are removed. If that consent is recorded, we keep only an anonymised research row: a hashed case id, item answers, age band, sex, informant type and dates. Names, emails and the report are not kept.

Deletion does not remove copies the clinician already downloaded, or status a school already saw. A short audit entry remains (who, when, case id, whether an export was taken).

You can close your account from Profile → Account & Security (password plus the word CLOSE). Export first if you need a copy. Cases assigned to another active teammate stay with them. Other cases you created are deleted under the same delete rules. If you were the last member of a school or clinic listing, that listing is removed. Your login is deleted. Email support@astonax.comif you need help.

12. Your rights

Under the Australian Privacy Principles you may request access, correction, or deletion of personal information, and you may complain. How you do that depends on who you are:

• Clinicians and school staff — use your profile and case tools, or email support@astonax.com.
• Parents, carers and young people — contact the clinician who holds the case. If you contact us, we pass it on and help them.

A clinician can export one case (PDF and raw CSV) or every case on the account. Exports are logged.

Cookies: we use essential cookies for sign-in and security. We do not use advertising or third-party tracking cookies.

You may complain to us at support@astonax.com. You may also complain to the Office of the Australian Information Commissioner.

13. Data breaches

If we become aware of a data breach that is likely to cause serious harm, we will assess it under the Notifiable Data Breaches scheme and notify affected individuals and the OAIC where required. Clinicians remain responsible for incidents in their own practice systems (for example a downloaded PDF left on an unlocked computer).

14. Changes

We may update this policy. The date at the top will change. We will notify clinicians of material changes by email or a notice in the service.

15. Contact