Skip to content

Privacy Policy

Last updated: October 2026

1. Introduction

Octavise ("we", "our", or "us") is a trading name of Harry Lowther (ABN 45 250 348 525). Octavise operates the analytics dashboard platform accessible at octavise.com.au. This Privacy Policy explains how we collect, use, store, and protect information when you use our services. By using Octavise, you agree to the terms of this Privacy Policy.

2. Information We Collect

We collect the following types of information: Account information: When you register for Octavise, we collect your name, your practice's name, your email address, a contact phone number, the practice management system you use, and the credentials necessary to create and manage your account. If you sign up using a referral code, we record which practice referred you. When you connect your systems, we also store the access credentials you provide for them (in encrypted form), the names and identifiers of the advertising accounts and Facebook Pages you connect, and the settings you enter in Octavise, such as the figures used in your dashboard and your tracking links. Billing information: Payments are processed by Stripe. We store the Stripe customer and subscription identifiers needed to manage your plan, together with a record of the plan you selected. Your card details are entered directly into Stripe's secure checkout and never pass through or are stored on Octavise systems. Stripe also collects your billing address at checkout; Octavise does not store it. Practice management data: With your explicit authorisation, Octavise connects to your practice management system (such as Nookal or Cliniko) and reads appointment, invoice, patient, practitioner and location records in order to produce business metrics including appointment counts, revenue totals, patient counts, cancellation rates, and practitioner performance summaries. Most of what we keep is aggregated totals. Where a patient needs to be recognised over time, we keep a one-way hashed identifier for that patient, together with the dates of their visits and the amounts invoiced, so that your dashboard can report new and returning patients and what patients go on to spend. Patients' email addresses and phone numbers are converted into one-way hashed fingerprints, in the same way as lead form data, so that leads and advertising clicks can be matched to bookings; the readable values are not kept. A patient's date of birth is used only to count patients by age band and is not stored. Practitioner names and location names are stored so that your dashboard can report by practitioner and location. Advertising platform data: With your explicit authorisation, Octavise connects to your advertising accounts (such as Meta Ads and Google Ads) and retrieves campaign performance metrics including ad spend, impressions, clicks, conversions and conversion actions reported by the platform (for example, bookings recorded by your own Meta Pixel), and cost per result. Lead form data: With your explicit authorisation, Octavise receives lead form submissions from your connected advertising platforms (such as Meta Lead Ads and Google lead form extensions). When you connect a Facebook Page, Octavise also imports the lead form submissions Meta still holds for that Page from the preceding 120 days, and handles them identically. A submitted lead's contact details (email address and phone number) are converted at the moment of receipt into one-way hashed fingerprints, and the readable values are not kept; Octavise stores the fingerprints, the campaign, ad and form the lead came from, the advertising platform's own reference for the lead, any advertising click identifier supplied with it, the submission time, and the last few digits of the phone number. Octavise does not store, display, or log a lead's full readable email address or phone number. The fingerprints are used solely to match leads and enquiries to bookings recorded in your practice management system, so that your dashboard can report which advertising produces actual appointments. Advertising click and booking data: If you use Octavise tracking links (on our book.octavise.link domain) in your advertising, or install the Octavise booking-page tag on your website or online booking page, we collect information needed to connect an ad click to a resulting booking. For each visit that arrives carrying an advertising click identifier, we record that identifier (supplied by the advertising platform, such as Google or Meta), randomly generated identifiers for the visit, the IP address and time of the click, which of your tracking links was used, and, where your advertising is set up to pass them, the campaign, ad set and ad the click came from. Visitors who arrive without an advertising click identifier are simply redirected; nothing is recorded. When a visitor who arrived through a tracking link, or from an ad carrying an advertising click identifier (directly or by way of your website), opens your online booking page, the booking-page tag lets us know the page was reached; for a visitor arriving from an ad, it records the click at that point, with the same details listed above. When the visitor completes an online booking, the tag tells us that the booking was completed, together with a reference to the booking, which we convert at receipt into a one-way hashed form, and the IP address the booking was submitted from; where the booking page provides contact details, they are converted at receipt in the same way as lead form data. Where your practice management system records the IP address an online booking was made from, we also read that IP address for the same purpose. Where the tag is installed on your own website rather than the booking page, it sends nothing to Octavise; it only carries forward to the booking page either the random identifier or, where the visitor arrived from an ad, the advertising click identifier and campaign details that were already in the page address. Cookies and browser storage: We use a small number of cookies and similar browser storage. Our tracking links and booking-page tag store a randomly generated identifier, or, where the visitor arrived from an ad, the advertising click identifier and campaign details, in the visitor's browser so that a booking can be connected to the advertising click that led to it; these identifiers contain no personal details and remain in use for between 30 days and two years, depending on where they are set. If you arrive at our website through a referral link, a cookie records the referral for up to 90 days. During signup, our website remembers your email address for that session, and keeps a marker in your browser if you reached us through one of our advertising pages. Logging in to Octavise uses strictly necessary session cookies. Website analytics cookies on our public pages are described in Section 5. Technical and security data: When you or a visitor interact with our public endpoints, the request's IP address is used, in a protected one-way form, to apply rate limits and prevent abuse. We do not keep a log of readable IP addresses for this purpose. Correspondence: Our contact page opens your own email application; we receive whatever you choose to send us, and we keep support correspondence for as long as needed to resolve your enquiry. Enquiry and marketing information: If you ask to book a call on our website, we collect your email address and, if you choose to give them, your business name, your role, the advertising platforms you use, your practice management system and your mobile number. We use these to follow up about your call and to prepare for it. If you tick the box to receive Octavise updates, we also keep a record of that consent and when you gave it, and we may email you about Octavise; you can unsubscribe at any time. We only send marketing emails to people who ticked that box. You can ask us to access or delete this information at any time. We do not store patient names, email addresses, phone numbers, full dates of birth, addresses, clinical notes, or individual clinical records in the Octavise dashboard, with one exception: the referral source your practice has recorded for a patient. Where that is the name of a person (for example, a referring practitioner or an existing patient), the dashboard stores and shows it as recorded, so that you can see how many patients each referrer has sent you. Practice management data is processed to produce aggregated business metrics, and where patient continuity is required for reporting, Octavise uses pseudonymised or hashed identifiers rather than direct patient identifiers. Where Octavise processes contact details from lead forms or booking pages, or matches leads and clicks to bookings, it does so using one-way hashed identifiers as described above; readable contact details are not retained. Hashed identifiers and IP addresses may still constitute personal information under the Privacy Act 1988, and this policy applies to them accordingly.

3. How We Use Your Information

We use the information we collect to: • Provide and operate the Octavise dashboard service • Display aggregated business performance metrics in your dashboard • Match advertising leads and clicks to bookings so your dashboard can report which advertising produces appointments • Generate insights and analysis based on your aggregated data • Process payments and manage your subscription • Operate our referral program where you take part in it • Maintain, secure, and improve the platform, including rate limiting and abuse prevention • Communicate with you about your account and our services • Follow up enquiries about booking a call, and, only where you ticked the box, send you Octavise updates • Comply with legal obligations We do not sell your data to third parties. We do not use your data for advertising purposes. We do not send practice management data, patient information, or booking outcomes back to any advertising platform. Where a public authority lawfully requires us to disclose information, we disclose only the specific records required, and we notify the affected practice unless the law prohibits it. Because patient contact details are held only in one-way hashed form, we do not hold a readable phone number or email address to disclose.

4. Data Storage and Security

Your data is stored in Australia (Sydney region) on established cloud infrastructure. We implement the following security measures: • Each client's data is isolated at the database level and is inaccessible to other clients • All data is encrypted at rest and in transit using HTTPS/TLS • API credentials and secrets are stored encrypted and never exposed to the browser • Access to your dashboard requires authenticated login • We maintain read-only access to connected systems: we never modify, delete, or write data back to your practice management system or advertising accounts, other than subscribing to (and, on disconnection, unsubscribing from) a Facebook Page's lead notifications as described in Section 5 If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

5. Third-Party Services

Octavise works with the following categories of third-party service to provide its functionality: • Practice management systems (Nookal, Cliniko): We access these using API credentials you provide, and use selected records only where required to produce aggregated dashboard metrics. • Meta: We access your advertising data using an access token that you create in your own Meta Business account and provide to us, and retrieve campaign performance metrics. Where you connect your Facebook Page for lead capture, you authorise this through Meta's own login (OAuth 2.0); connecting the Page subscribes Octavise to that Page's lead notifications and imports the Page's existing lead submissions from the preceding 120 days, all processed as described in Section 2; Octavise makes no other change to your Page and does not post, message, or manage content. • Google Ads: We access your advertising data using OAuth 2.0 authorisation for the Google Ads API, used only to retrieve campaign performance metrics (see Section 6). Where you choose to connect Google lead form extensions, submissions are delivered to Octavise by webhook and processed as described in Section 2; this is separate from the Google Ads API. • Stripe: Our payment processor. Subscription checkout and billing management take place on Stripe-hosted pages; Stripe handles your card details under its own privacy policy. • Cloud infrastructure: Our database and application hosting are provided by established cloud providers operating Australian-region infrastructure, with your data stored in Sydney. • Email: Account and security emails (such as email confirmation, password reset and password change notices) are sent by the authentication service that forms part of our cloud infrastructure. They are required to operate your account and cannot be unsubscribed from. Other service emails (a weekly performance summary for your own practice, which you can unsubscribe from at any time, and notices about our referral program where you take part in it) are delivered through a separate email delivery provider. • Website analytics (Google Analytics, Meta Pixel, Microsoft Clarity): Used on our public pages and on our sign-in, sign-up and account setup pages. These record page visits, referring source, and, in the case of Microsoft Clarity, recordings of how visitors move through those pages, with text entered into forms masked before any recording is stored. Our Meta Pixel is used to measure and improve Octavise's own advertising to practices. • Embedded content (YouTube, Google Calendar): Our advertising offer page includes a video hosted by YouTube, which loads only if you choose to play it. Our call booking page uses a Google Calendar booking form; the details you enter there are submitted to Google and used by us to arrange the call. These website analytics tools are deliberately restricted. They do not run on the Octavise dashboard, your account settings, or any administration screen. No practice management data, patient information, or clinic performance data is ever sent to them. Overseas disclosure: Your dashboard data is stored and processed in Australia. Some of our service providers are headquartered overseas: website analytics data from our public pages (Google, Meta, Microsoft), payment information processed by Stripe, and the emails we send you may be handled in the United States. Those emails contain your email address and, depending on the email, account details such as your name and practice name; the weekly performance summary also contains headline figures for your own practice such as revenue, advertising spend and new patient numbers. No patient-related information is disclosed to overseas recipients, and no practice management data or clinic performance data is disclosed to them other than the summary figures in that weekly email. Each third-party service is governed by its own privacy policy and terms of service.

7. Data Retention

We use different retention periods depending on the type of information, reflecting how long each type remains necessary for the purpose it was collected for. Aggregated snapshot data (dashboard metrics such as appointment counts, revenue totals, and campaign performance) is retained for as long as your account is active, to enable historical trend analysis in your dashboard. Hashed lead fingerprints and other lead matching identifiers (described in Section 2) are retained for as long as your account is active, whether or not the lead results in a matched booking. We keep them to protect the integrity of your advertising records: the advertising platform's reference for a lead prevents the same lead from being recorded twice, and the fingerprints allow a recorded match between a lead and a booking to be checked. They are held only in the one-way hashed or reference form described in Section 2; a lead's readable email address and phone number are never retained. Advertising click and booking identifiers (click identifiers, IP addresses, hashed booking references and hashed contact details described in Section 2) are retained on the same basis: for as long as your account is active, whether or not a match was found. We keep them to protect the integrity of your advertising records, so that a recorded match between an advertising click and a booking can be checked. The randomly generated identifiers contain no personal details and are retained on the same basis. Hashed patient contact details derived from your practice management system are retained for as long as your account is active, because each new lead and advertising click is matched against them. A separate hashed patient identifier used to count new and returning patients is also kept while your account is active. What happens when an account is closed is described below. Verified records confirming that a specific booking resulted from a specific lead or advertising click are retained for as long as your account is active, so your dashboard can continue reporting historical advertising performance over time. These records hold hashed identifiers and campaign details only, never contact details. Where your practice management system provides it, we also keep a per-patient record of appointments attended and amounts invoiced each day, held only under a one-way hashed identifier, so your dashboard can report what new patients go on to spend over time. It is kept while your account is active. Cancelling your subscription does not by itself close your account: your data is kept so that you can return. To close your account, contact us at https://octavise.com.au/contact. Once your account is closed, your data is retained for a 90-day grace period (allowing you to reactivate), after which we will delete it or de-identify it, including the hashed identifiers, verified records and per-patient records described above and your personal account information, unless we are required to retain it for legal or regulatory purposes. Billing and transaction records are retained for the period required by Australian tax law (generally five years). You may request erasure of your account data at any time by contacting us at https://octavise.com.au/contact. Requests about an individual patient's record should be made to the practice, which holds the patient relationship; we will assist the practice where we can.

8. Your Rights

Under the Australian Privacy Act 1988 and the Australian Privacy Principles, you have the right to: • Access the personal information we hold about you • Request correction of inaccurate or incomplete information • Request deletion of your personal information • Complain to us directly about how we have handled your personal information; we will acknowledge your complaint and respond within 30 days • Lodge a complaint with the Office of the Australian Information Commissioner (OAIC) if you believe we have breached the Privacy Act or are not satisfied with our response To exercise any of these rights, please contact us at https://octavise.com.au/contact. If you are a patient of a practice that uses Octavise, please contact your practice: it holds your records and the relationship with you. We do not hold names or readable contact details, so we generally cannot identify you from our records alone; your practice can, and we will assist it where we can.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a revised date and by sending a notification to your registered email address. Your continued use of Octavise after any changes constitutes your acceptance of the updated policy.

10. Contact Us

Octavise is a trading name of Harry Lowther (ABN 45 250 348 525). Email: hello@octavise.com.au Support: support@octavise.com.au Contact: https://octavise.com.au/contact Website: https://octavise.com.au

Also see Terms of Service