Privacy Policy
Version 2.0 | Effective Date: 24 August 2026
Contents
- Who we are
- The laws that apply
- What we collect
- Why we use it, and our lawful bases
- Who we share it with
- Sending information overseas
- How long we keep it
- How we protect it
- Your rights
- Cookies
- Artificial intelligence
- Complaints
- Changes to this policy
- Contact us
Who this policy is for
This policy is for the organisations that use ScreenIT and the people who work for them: clinicians, administrators, and anyone else at a subscribing clinic, club, or team who deals with us. It explains what we do with information about you, in the course of our business relationship with your organisation.
If you are a patient, this is not your document. Information about patients in the ScreenIT platform is controlled by the healthcare organisation providing your care, not by us; we hold it on that organisation’s behalf. What we do with it is explained in the ScreenIT Patient Privacy Notice, and you should read that instead.
If you are a clinician, this policy covers you personally, not your patients. Patient information you record in the platform is your organisation’s responsibility as controller and ours as processor, governed by the data processing agreement between us, not by this policy.
1. Who we are
Your Brain Health Pty Ltd (ABN 30 664 165 913) of 283-85 Payneham Road, Royston Park SA 5070, Australia, and YBH (UK) Ltd (company number 15377435) of 2a Hollybush Close, Badminton, Gloucestershire GL9 1JJ, United Kingdom (together, “YBH”, “we”, “us”, “our”).
The YBH entity that contracts with your organisation is the controller of information about you. The two entities share information with each other where that is needed to run the business as a group. Where we determine the purposes of processing together, we do so as joint controllers; in that case you may exercise your rights against either entity, and legal@yourbrainhealth.io reaches both.
Our Privacy Officer can be reached at legal@yourbrainhealth.io.
2. The laws that apply
This policy is written to meet:
- the Privacy Act 1988 (Cth) and the Australian Privacy Principles, together with State and Territory health records legislation where it applies;
- the UK GDPR and the Data Protection Act 2018;
- the EU GDPR (Regulation (EU) 2016/679) and, as the supervisory regime for our EU processing, Irish data protection law; and
- any other law that applies to how we collect, hold, use, and disclose information about you.
3. What we collect
- Contact and identity details: name, job title, work email address, telephone number, and postal address.
- The name of your organisation and your role within it.
- Account administration records: subscription and billing details, the record of the signed clinician terms and conditions, and correspondence with us.
- Records of your use of the clinician portal, including sign-in records kept for security.
- Anything you tell us in a support request, a demonstration, or other correspondence.
We do not collect health information or other sensitive information about you in the course of our business relationship. Health information in the platform is patient information, covered by the Patient Privacy Notice and the data processing agreement.
4. Why we use it, and our lawful bases
| What we use it for | Lawful basis |
|---|---|
| Providing the platform to your organisation and administering our agreement with it | Performance of a contract, or our legitimate interest in administering our relationship with the organisation that engages you |
| Billing, collections, and financial records | Performance of a contract; compliance with a legal obligation |
| Support, training, and service communications | Our legitimate interest in supporting the service you use |
| Keeping the platform secure, including sign-in monitoring and investigating misuse | Our legitimate interest in operating a secure service |
| Product improvement and usage analysis | Our legitimate interest in improving the service, using aggregated or de-identified information wherever it will serve |
| Marketing about ScreenIT to business contacts | Our legitimate interest in promoting our service, subject to your right to opt out of any message at any time |
| Establishing, exercising, or defending legal claims, and responding to regulators | Our legitimate interest in protecting our position; compliance with a legal obligation |
Where we rely on legitimate interests we have considered the effect on you and are satisfied that our interest is not overridden by your rights. You can ask us to explain that assessment.
5. Who we share it with
We share information about you with:
- Our service providers, who process it on our instructions under written agreement: payment processing, transactional email, and the cloud, hosting and monitoring services that run the platform. We keep the current list, naming each provider and where it operates, at https://screenit.health/sub-processors/, so that it stays accurate rather than going stale in this document.
- Our professional advisers, such as lawyers and accountants, where they need it to advise us.
- Regulators, courts, and law enforcement, where we are required or permitted by law.
- A buyer or successor, if we restructure, merge, or sell part of the business, subject to the same protections.
We do not sell information about you.
6. Sending information overseas
We are an Australian and United Kingdom business serving customers in Australia, the United Kingdom, and the European Union, so information about you may be accessed from, or transferred to, a country other than your own. Our service providers listed at the page named in Section 5 include providers operating in the United States.
Where information is transferred out of the United Kingdom or the European Economic Area, we rely on the safeguards those laws require, which for us means Standard Contractual Clauses or the UK International Data Transfer Agreement. For transfers of Australian personal information, we take the steps required by Australian Privacy Principle 8 before disclosure.
7. How long we keep it
We keep information about you for as long as we need it for the purposes in Section 4, and then delete or de-identify it.
In practice this means: account and contact records are kept while your organisation’s subscription is active; clinician account records are kept while the patient assessment records they are linked to are held, because those records must remain attributable; on a clinic closing its account there is a 90-day window to support export and continuity, after which deletion is on request; and financial records are kept for the period required by tax and corporations law, currently 7 years.
The full schedule sits behind our data retention procedure and we will provide the relevant part on request.
8. How we protect it
We use technical and organisational measures appropriate to the risk, including encryption in transit and at rest, role-based access control, multi-factor authentication, security monitoring, and tested backup and recovery. Access by our people is limited to those who need it and is logged. We keep these measures under review as part of our information security management system.
9. Your rights
You may ask us to give you a copy of the information we hold about you, and to correct it if it is wrong or out of date. We will respond within one month and will tell you if we need longer because the request is complex.
If you are in the United Kingdom or the European Union you also have rights, in certain circumstances, to have information erased, to restrict or object to how we use it, to have it transferred to another provider, and to withdraw consent where we rely on it. If you are in Australia, the Australian Privacy Principles give you rights of access and correction, and rights about direct marketing.
To exercise any of these, email legal@yourbrainhealth.io. We may ask you to confirm your identity first. There are situations where a right does not apply; if that happens we will explain why.
You can opt out of marketing at any time, using the link in any message or by emailing us.
10. Cookies
The ScreenIT clinician portal uses cookies, including analytics cookies that load only if you consent. You can change or withdraw that choice at any time from Cookie preferences in your profile. What each cookie does, how long it lasts, and who sets it are set out in the ScreenIT Cookie Policy.
The patient portal sets no advertising or analytics cookies and asks for no consent; see the Patient Privacy Notice.
11. Artificial intelligence
We use AI-assisted tools in parts of our business. Where a tool involves personal information, we assess it under this policy and applicable law before it is used, and we hold the provider to a written agreement on the same terms we require of any other service provider.
We do not make decisions that significantly affect you by automated means alone. Clinical judgment in the ScreenIT platform is the healthcare provider’s, not the software’s.
12. Complaints
If you are unhappy with how we have handled information about you, email legal@yourbrainhealth.io and we will look into it and reply.
You can also complain to a regulator:
- Australia: the Office of the Australian Information Commissioner (OAIC), oaic.gov.au.
- United Kingdom: the Information Commissioner’s Office (ICO), ico.org.uk.
- European Union: the Irish Data Protection Commission (dataprotection.ie), or the supervisory authority where you live.
13. Changes to this policy
We may update this policy, for example when our practices, our technology, or the law changes. The current version is always published at screenit.health with its date shown.
If a change materially affects how we handle information about you, we will give reasonable notice by email or through the clinician portal before it takes effect. We will not rely on a change you had no opportunity to see.
14. Contact us
Your Brain Health Pty Ltd, 283-85 Payneham Road, Royston Park SA 5070, Australia (ABN 30 664 165 913).
YBH (UK) Ltd, 2a Hollybush Close, Badminton, Gloucestershire GL9 1JJ, United Kingdom (company number 15377435).
Privacy questions, requests, and complaints: legal@yourbrainhealth.io, addressed to the Privacy Officer.