Legal
Legal · Privacy

CYORA Privacy Policy

How CYORA Pty Ltd collects, uses, discloses and protects your personal and health information, in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

Version1.19
Effective Date23 October 2026
Last Reviewed23 October 2026
Next Review Due14 July 2027

Version 1.19 change note (23 October 2026). (1) When you book a strategy call you can now choose to tell us about your health, for example a diagnosis, an operation or the medicines you take. Section 12.3 describes it: it is optional, we collect it only once you tick a box to agree, our team reads it to prepare for your call, and it is kept with your booking in Sydney, Australia and in our email, calendar and file storage (Google LLC, United States). Sections 3.7, 7.4 and 8 list it, and section 3.7 says how we ask for your consent. (2) Sections 3.7 and 12.3 describe the Dr Dan Clarity Call, a 15 minute phone call with Dr Daniel Kirkbride before you join, held by a refundable deposit: it is not recorded, he asks for your consent before you talk about your health, and his short note of the call is kept in Sydney, Australia as part of your health record (section 10). (3) Strategy and sales calls hosted by our client success team are now also recorded by Zoom's own cloud recording, video and audio, and Zoom makes its own transcript; Zoom holds them until we copy the recording to our storage in Sydney, Australia. Sections 3.7, 6.3, 7.4 and 8 say so, and section 6.3 no longer says those calls are recorded as audio only. (4) Sections 4 and 6.3 now describe the start of a recorded strategy or sales call as it runs. If you booked online, the box you ticked is your consent and the host does not ask you again; Zoom shows everyone on the call that it is being recorded; and if you tell us before or at the start of the call that you would prefer it wasn't recorded, we stop the recording and set aside anything captured. If our team booked the call for you, or your booking has no tick, the host asks at the start and we use the recording only on a clear yes. If you told us not to record your call, we do not record it. Before this version these sections said the host asks at the start of every call and switches the recorder off unless you clearly say yes. Calls recorded before this version that were booked with the box ticked, where nobody asked for the recording to stop, are used in the same way. (5) Section 6.3 now describes the opening check: the first few minutes of each recorded strategy or sales call are transcribed and read by Anthropic's Claude, with direct identifiers replaced first, only to check whether anyone asked for the recording to stop and, where the host asked, what the answer was; a no, a maybe or anything unclear holds the call for a person on our team to check, and so does a call with no ticked box where a clear yes cannot be found. Sections 7.4 and 8 add this flow to Anthropic. Sections 6.3 and 10 no longer say that a set-aside capture is never transcribed, because Zoom may have made its own transcript of it and the opening check reads its first few minutes. Section 6.3 also names getting feedback on their own calls among the things our sales AI helps our team do. (6) Section 12.3's example of a booking question now names the yes or no question about investing, which replaced the investment range on 12 October 2026. These changes concern strategy and sales calls, the optional booking health question and the Dr Dan Clarity Call, which apply to people considering our programs. They do not change how we handle the information of existing clients, so under section 14 clients are not emailed 30 days ahead and are not asked to accept this version again. Version 1.18 change note (22 October 2026). Sections 6.6 and 11 now describe the CYORA Clinical Intelligence as Dr Daniel Kirkbride's clinical IP and AI, built from his 13 years of experience in the industry, more than 20,000 one-on-one sessions and more than 15,000 hours of consulting. Before this version they said it was built on his 12 years of clinical practice, more than 3,000 clients helped, more than 10,000 hours of consulting and more than 5,000 labs reviewed. Three figures changed: the years, which now count his experience in the industry, first as a coach and then as a practitioner, rather than clinical practice; the hours; and the one-on-one sessions, which take the place of the clients figure. The labs figure is unchanged and is simply no longer part of this sentence. Section 11 no longer says the system was trained to read a blood panel the way he does, because it scores your markers against his CYORA optimal ranges, which is how it already worked. The CYORA software consent wording was updated with the same words on the same date; consents already recorded keep the exact wording the person agreed to at the time. No purpose, provider, overseas flow, retention period, collection, use or disclosure changed, so this is not treated as a material change and clients are not asked to accept this version again. Version 1.17 change note (12 October 2026). Section 7.1 no longer names an individual practitioner against training and physical capacity data; it now describes, by role, the practitioners and coaches we engage, with access limited to the data relevant to their role. No collection, purpose, provider, overseas flow or retention period changed, so this is not treated as a material change and clients are not asked to accept this version again. Version 1.16 change note (5 October 2026). CYORA's self-paced software tools are described for the first time, and one of them is described more honestly than it has been. (1) A new section 6.9 covers the CYORA Blood Decoder, the CYORA Stool Decoder, the CYORA DNA Decoder, the CYORA Training Builder, the CYORA Nutrition Builder, the CYORA Supplement Builder, the CYORA Software Bundle, the Decode App (not yet available) and the standalone Dr Dan AI: what each one collects, what leaves Australia for each one, which provider receives it, what that provider may do with it, and the fact that no practitioner reads what any of them produces. (2) It states plainly that the CYORA Blood Decoder sends your laboratory report as it is, so the name, date of birth and laboratory reference your laboratory printed on it go with it; this corrects the impression, created by describing the other tools together with it, that identifying details are removed from every tool. (3) It states that the CYORA DNA Decoder sends a genotype set which can be unique to you and may therefore still identify you, matching what that tool's own consent box says. (4) These lanes run on ordinary subscription accounts under the providers' consumer terms, not on API terms, so section 6.9 describes them on the same footing as section 6.8 and says that the provider may use content to improve its models unless the account holder has turned that setting off. That setting was confirmed switched off on CYORA's ChatGPT account and on each of CYORA's Claude accounts on 5 October 2026, and sections 6.6 and 6.9 say so and say when it was confirmed. For the period before that date we do not claim it, and the version 1.6 change note carries a dated correction to that effect. (5) Sections 6.5, 7.4 and 8 are updated to list these products, name Anthropic PBC and OpenAI, L.L.C. against the lanes each one serves as at 4 October 2026, and place every one of these lanes outside the APP 8.2(b) consent and on the accountable APP 8.1 basis. This version adds new products and new overseas flows and is a material change for anyone who uses one of these tools; a person is asked to accept it before their next use of a tool. (6) Section 6.6 is corrected on one point: the CYORA Blood Decoder's analysis has run on an ordinary subscription account since 31 August 2026, so that lane is governed by the provider's consumer terms and not by the API terms the section previously described, and this Policy no longer states that the provider does not use it to train its models. The version 1.6 change note carries a dated correction to the same effect and has otherwise been left as it was written. (7) Three disclaimers that sent you to a doctor or a health professional (in sections 6.8, 6.9 and the Bloodwork Decoder's terms of use) are rewritten: they still say plainly that a report is education, is not a diagnosis and is read by no practitioner, and they now point to a CYORA program rather than out, with a bare emergency line kept. Section 7.2 and the sections that describe who requests a blood panel are statements of fact about a disclosure or a role and are unchanged. (8) Section 6.9 opens by naming the three CYORA products with similar names (the CYORA App, CYORA Decode and its portal, and the Decode App) and saying that this Policy never uses one for another. No existing clinical care data flow, provider, purpose or retention period changed. Version 1.15 change note (5 October 2026). CYORA no longer offers the Organic Acids Test (OAT). Three lines now say so: the OAT line in the list of results we collect, and the NutriPATH and iScreen lines in the list of partner laboratories, which now describe OAT only for tests ordered before we stopped offering it in September 2026. We still hold OAT results from those earlier tests as part of your health record, for the period in section 10, and nothing about how we keep, protect or share them has changed. The iScreen line also names blood panels, so the list matches the laboratories whose reports we hold. No new collection, purpose, provider, overseas flow or retention period was added, so this is not treated as a material change and clients are not asked to accept this version again. Version 1.14 change note (4 October 2026). Four descriptive figures were corrected. Sections 6.6 and 11 now describe the CYORA Clinical Intelligence as built on Dr Daniel Kirkbride's 12 years of clinical practice, more than 3,000 clients helped, more than 10,000 hours of consulting and more than 5,000 labs reviewed, in place of the earlier "10 years of clinical practice, more than 5,000 labs reviewed and more than 2,000 hours of consulting". These are Dr Kirkbride's own first-hand figures. The CYORA Blood Decoder's consent wording was updated with the same four figures on the same date; consents already recorded keep the exact wording the person agreed to at the time. No purpose, provider, overseas flow, retention period, collection, use or disclosure changed, so this is not treated as a material change and clients are not asked to accept this version again. Version 1.13 change note (1 October 2026). When you book a strategy or sales call, the box you tick to agree to the call being recorded is now required to make the booking. Sections 4 and 6.3 are changed to say so. Recording stays your choice: the box says you agree unless you tell us otherwise, and if you tell us before or at the start of the call that you would prefer it wasn't recorded, we switch the recorder off and the call goes ahead. No purpose, provider, overseas flow or retention period changed, so this is not treated as a material change and clients are not asked to accept this version again. Version 1.12 change note (1 October 2026). Call recording is described as it now runs, and people who are considering our programs are covered for the first time. (1) Section 6.3 now describes CYORA's own call recorder: Zoom streams the audio of a call to our recorder on our own servers in Sydney, Australia (Amazon Web Services), where it is transcribed by our own software; the transcript has speaker names replaced with role labels and email addresses, phone numbers, Medicare numbers and dates removed, but not a name or detail said aloud, and is then sent to Anthropic PBC (United States) to write a summary; the routine summary runs through a Claude subscription account under Anthropic's consumer terms. For some practitioners' calls Zoom also records the video, which we copy to our storage in Sydney and then remove from Zoom. Fathom is described as being retired. (2) Sections 1, 3.7, 4, 5, 6.3, 7.1 and 12.3 now cover strategy and sales calls with people who are considering our programs, hosted by a practitioner or by our client success team: where you agree, the call is recorded for our notes, to follow up with you, and so that our sales and client success team can review our calls to improve how we run them, give feedback and train our team, and to build and improve CYORA's own sales AI, which runs on Anthropic's Claude language model (United States); the notice given when you book and again at the start of the call; the box on the booking page that you tick if you agree to the call being recorded, which is never ticked for you; and your right to say no, in which case your call goes ahead and nothing from it is transcribed, summarised, reviewed or used for our sales AI. (3) Section 6.5 lists call summaries, follow-up drafts and our sales AI. (4) Section 7.4 adds Zoom and Amazon Web Services and updates the Supabase, Google, Anthropic and Fathom rows. (5) Section 8 adds flow (f), call summaries, follow-up drafts and our sales AI, and states that everything we disclose overseas about a person who has not signed a CYORA Client Agreement is disclosed on the accountable APP 8.1 basis. (6) Section 10 states that we do not delete the content of strategy and sales calls: a call you agreed to have recorded is kept because it stays in use for those purposes, with a review at least once a year; anything captured on a call you asked us not to record and a call you ask us to take out of our sales call review area and our sales AI are set aside in a locked part of our records, are never reviewed or used for those purposes, and are kept, not deleted; strategy and sales calls recorded before we began giving this notice are placed in our sales call review area and used for our sales AI in the same way as later calls; and section 11.4 describes withdrawing consent to a call recording and asking us to take a call, including one recorded before this notice, out of our sales call review area and our sales AI. This version describes existing call recording more accurately, removes the statement that Fathom is how consultations are recorded, and adds Zoom and Amazon Web Services as providers and one overseas flow of text with direct identifiers removed (call summaries, follow-up drafts and our sales AI). The new purposes (reviewing our calls, training our team and our sales AI) apply to strategy and sales calls, including those recorded before this version, and never to a consultation. Anyone who had a strategy or sales call with us before this version can ask us to take it out of our sales call review area and our sales AI at any time (section 11.4). Because no consultation and no clinical record is affected, for active clients' care this is not treated as a material change, as with versions 1.8 and 1.9, and clients are not asked to accept this version again. Version 1.11 change note (16 September 2026). A correction for CYORA Decode: CYORA no longer arranges the blood panel. From this version a CYORA Decode client buys their own blood panel, in their own name and at their own cost, from an Australian laboratory of their choice, on a request issued by that laboratory's own doctor or by their General Practitioner, and uploads the laboratory's report to the app themselves. CYORA does not give the client's details to any blood laboratory, receives nothing from it, is not the requesting practitioner or the practitioner of record for the blood panel, and is not told of any result the laboratory flags. CYORA mentions one panel (the i-screen Platinum Health Test) as a courtesy only, has no arrangement with that laboratory about the purchase and receives no fee from it. The DNA test is unchanged: CYORA arranges and pays for it, the request is placed on the NutriPATH laboratory account of Dr Daniel Kirkbride (AHPRA registration OST0002224719), NutriPATH issues its report to that account, we give the client a copy and keep a copy in the record, and nobody at CYORA reads, interprets or monitors it. Sections 3.3 and 6.8 are changed to say so. This change removes a collection and a disclosure (we no longer send enrolment details to a blood laboratory and no longer receive a blood report from one) and adds no new collection, use, disclosure, overseas flow, provider, purpose or retention period, so it is not treated as a material change and CYORA Decode users are not asked to accept this version again. The retention of your results, the working copy of the file you upload, the AI request record and our backup copies are unchanged. Version 1.10 change note (16 September 2026). One retention period for every CYORA health record, and a correction for CYORA Decode. (1) Section 10 now states a single retention period for health and clinical records: at least seven years from the last entry in your record for an adult, and for a person under 18 when the service was provided, until they turn 25 or seven years from the last entry, whichever is later; the separate "minimum of 10 years as a conservative practice" sentence is removed, and anyone who enrolled under a longer stated minimum keeps it. (2) CYORA Decode: your blood and DNA results and the reports made from them are a health record. Deleting your account still removes them from the CYORA Decode app the same day and de-identifies your account, but they are no longer removed from our clinical records system on request; they are kept for the retention period in section 10 and then destroyed or de-identified, and the laboratory's original report is kept with them, and a raw DNA data file you upload is kept with it. Sections 6.8, 10 and 11.4 are changed to say so. Section 6.8 also now says plainly that CYORA does not monitor your Decode results and sends no notice about them, and which doctor is the requesting practitioner for your blood panel. The lifetime of the working copy of the file you upload, the AI request record and our backup copies are unchanged. (3) Section 10 corrects the basis of the financial records line (seven years under the Corporations Act 2001 (Cth) for a company's records; the ATO minimum is five years) and states the ten-year retention of signed agreements. (4) Section 6.8 now says who requests each test and who receives each report. The blood panel is requested through the laboratory's own doctor-review service, so the laboratory's reviewing doctor is the requesting practitioner for it. The DNA test is placed on the NutriPATH laboratory account of Dr Daniel Kirkbride (AHPRA registration OST0002224719), so a CYORA practitioner is named as the requesting practitioner on the DNA request and the laboratory issues its report to that account; we give you a copy and keep a copy in your record. Nobody at CYORA reads, interprets or monitors it, and no notice is sent to you about it. This corrects the earlier statement that a CYORA practitioner is not the requesting practitioner for either test. This is a material change for CYORA Decode users, who are asked to accept this version at their next sign-in. No new overseas flow, provider or purpose was added. Version 1.9 change note (15 September 2026). CYORA Decode, our self-guided program, is described for the first time, the Bloodwork Decoder wording is corrected now that the Decoder is free, and our backup copies are described. (1) A new section 6.8 describes CYORA Decode in full: the blood test PDF or raw DNA file you upload is read and scored by CYORA's own software in Sydney, Australia; only the de-identified results (marker values or genotypes with your age and sex, never your name, date of birth, contact details or the file itself) are sent to OpenAI, L.L.C. (United States), through a subscription account governed by OpenAI's consumer privacy policy, to write your educational report in the words of Dr Daniel Kirkbride (AHPRA registration OST0002224719); no practitioner reviews it. (2) Section 3.3 states that a raw DNA file you upload to CYORA Decode is genetic information and how long the file is kept. (3) Section 6.0 and section 6.4 state that the two self-serve products (sections 6.6 and 6.8) are produced without practitioner review, and section 6.5 adds CYORA Decode to the list of automated processing. (4) Section 7.4 names the CYORA Decode app in the Supabase and Vercel rows and states which OpenAI terms apply to each lane, and section 8 adds the CYORA Decode flow, item (e), on the accountable APP 8.1 basis. (5) Section 10 adds the CYORA Decode retention rule: the file you upload is removed from our working systems once your report is published or refused and from our backup vault 30 days after that, the request record our AI processing tool keeps is deleted within seven days, and your results and report are kept as your record. (6) Section 11.4 describes account deletion in the CYORA Decode app. (7) Section 6.6 and the Terms of Use are corrected: the Bloodwork Decoder has been free of charge since 14 September 2026, so the fee, refund and credit wording and the Stripe reference are removed. (8) Section 10 now describes the encrypted backup copies of our databases, where they are kept, and that a record removed from our live systems can remain inside an older backup copy; this describes an existing practice and does not change how your information is handled. One new de-identified overseas flow (CYORA Decode) is disclosed; no other provider or purpose was added and no retention period changed. Version 1.8 change note (9 September 2026). Five corrections so this Policy describes our forms as they run. (1) A new section 6.7 discloses the optional Dictate button on our forms and client portal, which sends a short voice recording to OpenAI, L.L.C. (United States) for conversion to text and keeps no copy; section 3.4, section 6.0, the OpenAI row in section 7.4 and section 8 now name this flow. (2) Sections 6.1, 6.4 and 6.5 now state that your intake answers are de-identified before they are sent to Anthropic for the intake summary, which is what our system has done since 14 July 2026 and which the earlier wording did not say; from 9 September 2026 your residential address is removed as well. (3) Section 8 now lists every overseas flow of clinical information as four numbered items in place of a sentence that said "two". (4) Section 7.4 records that the serverless functions behind forms.cyora.com.au are pinned to Sydney, Australia from 9 September 2026, like the client portal. (5) Section 4 now describes the APP 5 collection notice actually shown on the intake form from 9 September 2026 (notice version 9 September 2026), the acknowledgement required before the form opens, and the record we keep of it. One new overseas flow (dictation) is disclosed; no other provider, purpose or retention period changed. Version 1.7 change note (3 September 2026). Section 6.6 (Bloodwork Decoder) and the Terms of Use were corrected to describe the Decoder as it actually operates since 29 August 2026: payment is taken before upload, not after; the tool is for adults 18 and over and refunds a minor automatically; an unreadable file is refunded automatically; a fee paid with no upload is held as a credit rather than refunded automatically, and is refunded on request; and Decoder records expire and are deleted 90 days after consent. Section 6.6 now lists everything sent to the overseas AI providers for the analysis (the document, first name, age, sex and the optional upload answers), states plainly that the analysis is automated with no individual practitioner review, and confirms the disclosure is made on the accountable APP 8.1 basis. Section 6.5 adds the Decoder to the automated processing list ahead of the 10 December 2026 transparency obligations. Section 7.4 adds Twilio Inc and Resend Inc, which were already delivering Decoder messages and had been omitted. Section 8 corrects a citation (the consent exception is APP 8.2(b)) and confirms the Decoder sits outside that consent. No new provider of the analysis, no new purpose and no new data flow was added; the same document is processed by the same two providers for the same purpose. No clinical-care data flow changed. Version 1.6 change note. OpenAI, L.L.C. (USA) was added as a second AI language model provider for the Bloodwork Decoder analysis only (section 6.6), alongside Anthropic. The Decoder's data flow, purpose, retention and safeguards are unchanged; the same document is processed for the same purpose, and neither provider uses it to train their models. [Corrected in version 1.15, 4 October 2026: that last statement was made on the basis of the API terms that applied at the time, and for the period from 31 August 2026, when the analysis moved to an ordinary subscription account, we cannot show it. The training setting on that account was confirmed switched off on 5 October 2026. Section 6.6 now describes what actually governs that lane and states the setting and the date it was confirmed. We have left the original note as it was written rather than rewrite it.] No clinical-care data flow was changed - identifiable clinical data for CYORA clients continues to be stored and processed in Australia. Version 1.5 change note. Two overseas providers were removed because CYORA no longer uses them. Typeform (Spain/EU, clinical intake form collection) was replaced by CYORA's own intake form at forms.cyora.com.au, and DocuSeal (USA, electronic signature) was replaced by CYORA's own agreement signing platform. Both replacements run on CYORA infrastructure hosted in Sydney, Australia. This change reduces the number of overseas recipients of your personal and health information and narrows the scope of the APP 8.2(a) consent in section 7.6. No new provider, purpose or data flow was added. Version 1.4 change note. Section 6 and section 11.6 were reconciled so that AI-assisted processing is described accurately as an integral, non-severable condition of the CYORA service, rather than an opt-out feature. The standalone "opt out of AI processing by emailing support@" promise was removed, because it could not be honoured operationally and misdescribed the client's rights. The real safeguards (de-identification before any external AI language model, and Australian data residency for identifiable clinical data) are retained. This is a material change; active clients are to be notified per section 14.

On this page
  1. 1. About This Policy
  2. 2. Who We Are
  3. 3. What Personal Information We Collect
  4. 4. How We Collect Your Information
  5. 5. Why We Collect Your Information (Purposes)
  6. 6. Automated Processing and Artificial Intelligence
  7. 7. Disclosure of Your Information
  8. 8. Cross-Border Disclosure
  9. 9. Security of Your Information
  10. 10. Retention of Your Information
  11. 11. Your Rights
  12. 12. Website, Cookies, and Marketing
  13. 13. Complaints
  14. 14. Changes to This Policy
  15. Terms of Use
  16. 15. Glossary

1. About This Policy

CYORA Pty Ltd (ABN 59 649 153 935) ("CYORA", "we", "us", "our") is committed to protecting the privacy and confidentiality of your personal and health information.

This Privacy Policy explains:

  • What personal and health information we collect and why
  • How we collect, use, and disclose it
  • Who we share it with (including overseas recipients)
  • How we use artificial intelligence to process your information
  • Your rights to access, correct, withdraw consent, and complain about how your information is handled

This Policy applies to all personal information collected by CYORA Pty Ltd in connection with our health optimisation programs, the CYORA Decode app, our website, client portal, onboarding funnel and booking pages, and the strategy and sales calls we hold with people who are considering our programs.

We handle personal information in accordance with the Privacy Act 1988 (Cth), the thirteen (13) Australian Privacy Principles (APPs), and the Privacy and Other Legislation Amendment Act 2024 (Cth).

Our services are available to individuals aged 18 years and over only. We do not knowingly collect personal information from children under 18. If we become aware that information has been collected from a person under 18 without parental consent, we will delete it promptly.

We are monitoring the development of the Children's Online Privacy Code (COPC) being developed by the OAIC under the Privacy and Other Legislation Amendment Act 2024 (Cth), which is expected to be registered by 10 December 2026. We will update this Policy as required once the COPC is finalised.

2. Who We Are

CYORA Pty Ltd ABN 59 649 153 935 52/17 Great Southern Drive, Robina QLD 4226 Australia Email: support@cyora.com.au Website: cyora.com.au

Privacy Officer: Hannah King - support@cyora.com.au

Responsible Practitioner: Dr Daniel Kirkbride, Osteopath AHPRA Registration: OST0002224719 | Provider Number: 5605954W

3. What Personal Information We Collect

We collect the following categories of personal information:

3.1 Identity and Contact Information

  • Full name, date of birth, sex
  • Email address, phone number, residential address
  • Emergency contact details

3.2 Health Information (Sensitive Information)

Health information is a category of sensitive information under the Privacy Act 1988 (Cth) and is treated with additional care. We only collect health information with your explicit consent.

We collect:

  • Medical history, current medications, allergies, and supplements
  • Known diagnoses, chronic conditions, and family health history
  • Reproductive status (pregnancy, breastfeeding, contraception)
  • Mental health history and psychological wellbeing
  • Dietary restrictions, food intolerances, and eating patterns
  • Exercise history, injuries, and physical capacity
  • Sleep patterns and recovery metrics

3.3 Diagnostic and Clinical Data (Including Genetic Information)

Where you have consented to diagnostic testing as part of your program, we collect and retain:

  • Comprehensive blood test results (biomarkers, hormone panels, metabolic markers)
  • DNA / genetic SNP analysis reports - this constitutes genetic information, a distinct subcategory of sensitive information under the Privacy Act 1988 (Cth) with additional protections. Genetic information will not be used or disclosed for any purpose beyond the delivery of your clinical program without your explicit consent, and will not be used in any way that could affect your insurability or employment.
  • A blood test PDF or a raw DNA data file you upload to the CYORA Decode app, or the report NutriPATH returns for the DNA test arranged through CYORA in that program. Your blood panel in CYORA Decode is your own purchase from a laboratory of your choice, and its report reaches us only when you upload it. A raw DNA file is genetic information as above. The working copy of the file is kept only until your report is published or refused, and its backup copy for 30 days after that; a copy of the laboratory's report, or of a raw DNA data file, is kept in our clinical records archive as part of your record, and the results read from it are kept as your record (section 6.8 and section 10).
  • Microbiome / stool analysis reports
  • Body composition data (DEXA scan results)
  • Cardiorespiratory fitness data (VO2 Max test results)
  • Organic Acids Test (OAT) results, from a test ordered before we stopped offering it in September 2026 (we keep them for the period in section 10)
  • Oura ring biometric data (heart rate variability, sleep, activity)
  • CGM (Continuous Glucose Monitor) data

3.4 Program and Engagement Data

  • Onboarding form responses (clinical intake)
  • Voice recordings you choose to make with the Dictate button, which are converted to text and then discarded (section 6.7)
  • Signed client agreement and timestamp
  • Consult notes and practitioner assessments
  • Supplement protocol recommendations
  • Meal plan, nutrition blueprint, and food diary entries
  • Training plan and session recordings

3.5 Financial and Transaction Information

  • Payment amounts and transaction references (processed by Stripe; CYORA does not store full card details)
  • Invoice records

3.6 Technical and Usage Information

  • IP address and device type when accessing our portal or websites
  • Usage patterns within the CYORA client portal and public websites

3.7 Calls and Call Recordings

This applies to our clients and to people who are considering our programs.

  • The audio of calls we hold on Zoom, recorded by CYORA's own call recorder when it is switched on, and a transcript made from it (section 6.3)
  • For some of our practitioners' calls, and for strategy and sales calls hosted by our client success team, a video recording made by Zoom, with Zoom's own transcript (section 6.3)
  • A written summary of the call and, for a strategy or sales call, any draft follow-up email prepared from it
  • What you tell us on a strategy or sales call, which can include your health, goals and circumstances. Health information is sensitive information (section 3.2), and we collect it only with your consent: when you book, by the box you tick on the booking form (section 12.3), and on a strategy or sales call, by choosing to tell us after you have agreed to the call being recorded, either by the box you ticked when you booked online or by saying yes when the host asks at the start of the call
  • When you book a strategy or sales call: your name, email and mobile, your answers to the booking questions and, if you choose to give it, what you tell us about your health (section 12.3)
  • If you book a Dr Dan Clarity Call before you join (section 12.3), what you tell Dr Daniel Kirkbride (AHPRA registration OST0002224719) on that phone call, and his short note of it, which we keep in our database in Sydney, Australia (Supabase). The call is not recorded. He asks for your consent at the start of the call before you talk about your health

4. How We Collect Your Information

Collection Notice (APP 5)

At or before the point we collect your personal and health information, we notify you of:

  • CYORA Pty Ltd's identity and contact details (see Section 2)
  • Why we are collecting the information (see Section 5)
  • Whether collection is required or authorised by law
  • The main consequences of not providing the information (we may be unable to deliver your program)
  • The categories of third parties to whom we usually disclose your information (laboratory partners, overseas cloud service providers in the USA and EU - see Section 7.4)
  • That this Privacy Policy governs how we handle your information and how you can access or correct it

On our client intake form (forms.cyora.com.au/client-intake) this notice is shown on the first screen, before any question is asked, and you must read and acknowledge it before the form will open. The notice you see is collection notice version 9 September 2026. When you submit the form we record, with your answers, the time you acknowledged the notice and the versions of the notice and of this Policy that were shown to you. The same matters are also set out in our onboarding funnel and in your client agreement. In the CYORA Decode app, the same matters are set out in section 6.8 and in the acknowledgement you give when you sign in. If you have questions about what is collected and why at any step, contact support@cyora.com.au.

When you book a strategy or sales call, the booking page tells you that the call is recorded, why (for our notes, to follow up with you, and so we can review our calls to improve them, train our team and build our own sales AI), and that if you would prefer it wasn't, you can tell us before or at the start of the call and we will switch it off and carry on, with a link to this Policy. To book online, you tick a box to agree to the call being recorded unless you tell us otherwise before or at the start of the call. The box is never ticked for you. That tick is your consent, and the host does not ask you again on the call. Your confirmation email, any reschedule email and the calendar invite say the same. When the recording starts, Zoom shows everyone on the call that it is being recorded. If you tell us before or at the start of the call that you would prefer it wasn't recorded, we stop the recording, the call goes ahead, and anything captured is set aside (section 6.3). If our team booked the call for you, or your booking has no tick for another reason, the host asks you at the start of the call, and we use the recording only if you clearly say yes; anything else is held for a person on our team to check or set aside (section 6.3). If you have told us not to record your call, we do not record it, and anything captured by mistake is set aside (section 6.3).

We collect information:

  • Directly from you via our online onboarding funnel (cyora.com.au/start), our client intake form (forms.cyora.com.au), our booking pages, clinical consultations, strategy and sales calls, and communications with our team
  • From diagnostic laboratories when you consent to testing through our partner network (Australian Clinical Labs, NutriPATH, iMedical, iScreen)
  • From third-party devices you connect. For your Oura ring you sign in to Oura and approve CYORA on Oura's own page, so we never see your Oura password, and you can disconnect at any time from your CYORA portal or from your Oura account
  • From your General Practitioner or specialist only with your written consent
  • Via our own agreement signing platform when you electronically sign your client agreement

We will always tell you why we are collecting information at the point of collection. We will only collect health information with your explicit consent, except in circumstances permitted by law (such as a health emergency).

Unsolicited information: Occasionally we may receive personal information we did not request (for example, if a third party sends us your medical records without our prompting). Where we receive unsolicited personal information, we will assess whether we could have collected it lawfully under the APPs. If not, we will destroy or de-identify it as soon as practicable and, if required, notify you that this occurred.

5. Why We Collect Your Information (Purposes)

We collect and use your personal and health information to:

  1. Deliver clinical care - interpret diagnostic data, develop personalised health protocols, and provide practitioner consultations
  2. Administer your program - manage onboarding, scheduling, billing, and access to program resources
  3. Communicate with you - send protocol updates, appointment reminders, community information, and support responses
  4. Improve our programs - analyse de-identified, aggregated outcomes data to refine our clinical approaches. Once information is de-identified, it is no longer personal information and is no longer subject to this Privacy Policy.
  5. Comply with legal obligations - maintain health records as required by law, respond to legal process
  6. Protect safety - respond to urgent health disclosures that may require referral to emergency services
  7. Talk with people considering our programs - arrange and hold strategy and sales calls, keep an accurate record of what was discussed, prepare a written summary and a draft follow-up for a team member to review, follow up with you about our programs, and, where you agreed to the call being recorded, review recorded calls within our sales and client success team to improve how we run them, give feedback and train our team, and use them to build and improve CYORA's own sales AI (section 6.3). We do not sell a call, publish a call recording or use it in advertising.

We will not use your information for any purpose that is incompatible with these primary purposes without your consent.

We take reasonable steps to ensure that the personal information we use or disclose is accurate, complete, and up-to-date (APP 10).

6. Automated Processing and Artificial Intelligence

You have a right to know when AI is used to process your health information.

6.0 AI-assisted processing is an integral part of the service. CYORA delivers a personalised health and longevity service that relies on AI-assisted analysis as an integral, non-severable part of how the service works. We use AI tools to help summarise your intake, organise and score your laboratory, genetic, biomarker and wearable data, prepare pre-consultation briefs for your practitioner, and help draft your protocols. This processing is a standard and necessary component of the service you engage us to provide. It is not an optional add-on, and it cannot be separated out from the rest of the service while still delivering the service you have paid for.

Human oversight. AI assists our practitioners; it does not replace them. A qualified practitioner reviews AI-assisted outputs before they are used in a clinical decision or provided to you, except in the two self-serve products in sections 6.6 and 6.8, where the report is produced without practitioner review and is education only. We do not make solely automated decisions that have a significant effect on you without meaningful human review.

The safeguards we apply. Because your health information is sensitive, we apply strict controls whenever AI is used:

  • De-identification before any external AI language model. Before any of your information is sent to a third-party AI language model, we remove the details that identify you (such as your name, date of birth, email and other direct identifiers), so that identifiable information about you does not leave our systems for that processing. Your name is re-attached only inside our own Australian systems afterwards.
  • Australian data residency for your clinical data. Your identifiable diagnostic and clinical data (blood, DEXA, VO2, DNA, stool, OAT results) collected through your clinical care is stored and processed in Australia (Supabase, Sydney). For your clinical care, identifiable health, genetic or biomarker information is not sent overseas to a third-party AI language model for analysis, scoring, or protocol drafting. The following are exceptions, each of which processes identifiable information overseas and is separately described: our video calls, which run on Zoom (United States) and may pass through Zoom's data centres outside Australia, and, where Zoom records the video of a practitioner's call, Zoom's copy of that video until we have moved it to our storage in Sydney (section 6.3); Fathom (United States), which may still record some client consultations until our Fathom accounts are closed (section 6.3); the Dictate button on our forms and portal, which sends your voice to OpenAI (United States) for conversion to text and is described in section 6.7; and the Bloodwork Decoder tool, which uses Anthropic and/or OpenAI (United States) and is described in section 6.6. Call summaries, follow-up drafts and our sales AI (section 6.3) work from a transcript with direct identifiers removed, but words spoken on a call can still identify you, so we treat what is sent as your personal information. CYORA Decode (section 6.8) is not an exception to the de-identification rule: it sends only de-identified results (marker values or genotypes with your age and sex) to OpenAI (United States) to write your report, and the file you upload and the details that directly identify you never leave Australia. These transfers are made on the accountable-disclosure basis explained in section 8, under which CYORA remains responsible for the information as if it were CYORA's own act.
  • Purpose and access limits. For our clients' care, AI-assisted processing is used only to deliver and improve your own care; for strategy and sales calls, AI is also used for the purposes described in section 6.3. We do not sell your information, and we do not use your identifiable information to train third-party AI models. Where a provider's own terms let it use what it receives to improve its models, sections 6.3 and 6.8 say so.

Your choice. Because AI-assisted processing is an integral part of how this service is delivered, you cannot receive the service without it. You are in control of whether you engage the service: if you do not wish your information to be processed in this way, you can decline to commence or continue the service by contacting us at support@cyora.com.au, and we will discuss your options, including ending your engagement. Your consent to AI-assisted processing is given as part of your CYORA client agreement when you sign up for the service.

The specific AI tools we use, and how each is applied, are set out below.

6.1 Clinical Intake Summary

When you complete the CYORA clinical intake form, our system first removes the details that identify you and then uses Anthropic Claude (an AI language model operated by Anthropic PBC, USA) to extract a brief clinical summary from your de-identified intake responses. Before your answers leave our Australian systems, your name, email address, phone number, residential address, date of birth and Medicare number are replaced with placeholder tokens; your name is put back only inside our own systems afterwards. Free-text answers may still contain details you chose to write, such as the name of a family member or your suburb, so we do not promise that nothing in your own words could identify you. This summary (3 key items) is:

  • Presented to your assigned practitioner(s) in a Slack notification before your first consultation, so they can brief themselves on your situation
  • Appended to your client file in our practice management system

6.2 Pre-Consult Brief

Prior to a consultation, our system may use AI to compile a summary of recent activity, consult notes, and diagnostic trends to assist your practitioner.

6.3 Call Recording, Transcription and Summaries

We record many of the calls we hold on Zoom, both consultations with clients and strategy and sales calls with people who are considering our programs, using CYORA's own call recorder and, for some calls, Zoom's own cloud recording.

  • How the recording is made. When the host's Zoom account has our recorder switched on, Zoom streams the audio of the call to our recorder, which runs on servers we control in Sydney, Australia (Amazon Web Services, ap-southeast-2). No extra participant joins your call; Zoom shows everyone on the call that the meeting's content is being shared with an app. For some of our practitioners' calls, and for every strategy and sales call hosted by our client success team, Zoom's own cloud recording also records the video and audio, and Zoom makes its own transcript. Zoom shows everyone on the call that it is being recorded. After the call we copy the recording to our private storage in Sydney, Australia (Supabase) and then move Zoom's copies to Zoom's deleted items, from which Zoom removes them permanently after 30 days. If a strategy or sales call is held for a person on our team to check (see below), its recording stays in Zoom until that check is done.
  • Transcript. The audio our recorder receives is transcribed by our own speech-to-text software on our own servers in Sydney, Australia, and is not sent to any other company for transcription. Where Zoom's cloud recording is on, Zoom also makes its own transcript; we may copy it with the recording, and Zoom's copy is removed as described above.
  • Summary. To write a summary of the call for our team, our system first replaces each speaker's name with a role label (host or client) and removes email addresses, phone numbers, Medicare numbers and anything that looks like a date of birth. It does not remove a name, a place or any other detail that someone says aloud during the call, so the text can still contain details that identify you, and we treat it as your personal information. The text is sent to Anthropic PBC (United States), whose Claude language model writes the summary. The routine summary runs through a Claude subscription account governed by Anthropic's consumer terms and privacy policy. Under those terms, whether what the model receives may be used to improve Anthropic's models, and how long Anthropic keeps it (up to five years where that setting is on, and 30 days where it is off), depends on the account's model-training setting. When a team member asks our recorder to redo a summary (the same text) or to prepare a draft follow-up email after a consultation (the summary), that text is sent to Anthropic's API under its commercial terms, where it is not used for training and is deleted within 30 days. For a strategy or sales call, the draft follow-up email is prepared by our practice system from the transcript, with the name on your booking and other direct identifiers replaced first, and runs through a Claude subscription account on the same terms as the routine summary; other details said aloud are not removed.
  • Clients. With your consent given in your client agreement, your consultations may be recorded, transcribed and summarised. The recording, transcript and summary form part of your clinical record and are kept under section 10. If you do not wish a consultation to be recorded, tell your practitioner before the session begins. Consultations are not placed in our sales call review area or used for our sales AI.
  • People considering our programs. A strategy or sales call may be hosted by a practitioner or by a member of our client success team. When you book, we tell you the call is recorded, why, and that you can ask us not to record it (section 4), and you tick a box to agree to the recording unless you tell us otherwise before or at the start of the call. That tick is your consent, and the host does not ask you again on the call. When the recording starts, Zoom shows everyone on the call that it is being recorded. Recording stays your choice: if you tell us before or at the start of the call that you would prefer it wasn't recorded, the host stops the recording and the call goes ahead. If our team booked the call for you, or your booking has no tick for another reason, the host asks you at the start of the call, and we use the recording only if you clearly say yes. If you say no, the host stops the recording and anything captured is set aside; a maybe or anything unclear is held for a person on our team to check. If you have told us not to record your call, we do not record it, and anything captured by mistake is set aside. To check what was said about recording, the first few minutes of the transcript of each recorded strategy or sales call are read by Anthropic's Claude language model (United States), through a Claude subscription account on the same terms as the routine summary, with the name on your booking and other direct identifiers replaced first; other details said aloud are not removed. It looks only for whether anyone asked for the recording to stop and, where the host asked, what you answered. If it finds a no, a maybe or anything unclear, the call is held for a person on our team to check, and nothing else in it is used until they have. A call with no ticked box where a clear yes cannot be found is also held for a person on our team to check, and nothing in it is used until they have. Anything captured on a call you asked us not to record, including anything captured before the recording was stopped, is set aside in a locked part of our records with any transcript Zoom made of it, and, apart from that opening check, is never summarised, reviewed or used for our notes, follow-up, team training or sales AI. We keep it rather than delete it, as the record of how your call was handled (section 10). If you agree to the recording, we use the recording, transcript and summary for our notes, to follow up with you about our programs, for our sales and client success team to review our calls to improve how we run them, give feedback and train our team, and to build and improve CYORA's own sales AI (section 5). Strategy and sales calls recorded before this version that were booked with the box ticked, where nobody asked for the recording to stop, are used in the same way. For a strategy or sales call, any follow-up email is a draft that a team member reviews and sends; nothing about your call is sent to you automatically. How long we keep them is in section 10.
  • Reviewing strategy and sales calls, and our sales AI. Our sales and client success team reviews recorded strategy and sales calls to improve how we run them, give feedback and train our team. We also use them to build and improve CYORA's own sales AI: the AI tools our team uses to prepare for calls, draft follow-ups, get feedback on their own calls and train, which draw on what our past calls show, such as the questions people ask and what helps them decide. For that review and that AI, the transcripts and summaries of those calls are kept together in a review area in our practice system that only the team members we have authorised for that role can open (section 7.1); the providers that host and process call records, described in this section and in section 7.4, still do so. A call you did not agree to have recorded, or asked us not to record, is never placed in that review area or used for our sales AI, other than the opening check described above. Strategy and sales calls recorded before October 2026, when we began telling people about this review and this AI, are also placed in that review area and used for our sales AI, in the same way and with the same protections as later calls. If you had a strategy or sales call with us before then, you can ask us to take it out (section 11.4). Our sales AI runs on Anthropic's Claude language model (United States), through a Claude subscription account on the same terms as the routine summary, and it works from transcripts with the name on your booking and other direct identifiers replaced; other names and details said aloud are not removed. It helps our team and makes no decision about you. We do not sell a call, publish a call recording or use it in advertising. You can ask us to take your call out of that review area and our sales AI (section 11.4).
  • Fathom (being retired). Before we built our own recorder, consultations, and some strategy and sales calls, were recorded by Fathom (Fathom Video Inc, United States), which keeps its recordings, transcripts and summaries on servers in the United States. We are retiring Fathom. Until we close our Fathom accounts, Fathom may still record some client consultations, and it holds the recordings it has already made.

6.4 No Automated Clinical Decision-Making

No automated system makes clinical decisions at CYORA. AI tools are used solely as information-gathering and summarisation aids. All diagnostic interpretation, protocol design, supplement and nutrition recommendations, and clinical advice are made exclusively by AHPRA-registered practitioners on our team. No decision that significantly affects your health care is made by an automated process without practitioner review and responsibility. The two self-serve products in sections 6.6 and 6.8 are the exception: there, the report is produced without practitioner review and is education only.

Your de-identified intake answers are sent to Anthropic's API for processing on servers located in the United States (see section 6.1 for what is removed first). Anthropic's data processing is governed by its Commercial Terms of Service and Data Processing Addendum. Under those terms Anthropic does not train its models on customer content, and it deletes API inputs and outputs from its systems within 30 days.

AI-assisted intake summarisation is an integral part of the service and is not a separate feature that can be switched off while you continue with the program (see the framing at the start of this section and section 11.6). If you do not wish your information to be processed with AI assistance, contact support@cyora.com.au to discuss your options, including declining to commence or continue the service.

6.5 Automated Decision-Making Transparency (Privacy and Other Legislation Amendment Act 2024)

Under amendments introduced by the Privacy and Other Legislation Amendment Act 2024 (Cth), which take full effect in relation to automated decision-making transparency obligations on 10 December 2026, CYORA is required to describe in this Policy the types of personal information used in, and the kinds of decisions produced by or with the assistance of, automated processes.

In preparation for that deadline, we disclose that CYORA's AI-assisted systems currently process your personal and health information for the following functions:

  • Clinical intake summarisation - your de-identified intake form responses are processed by the Anthropic Claude API to generate a brief clinical summary for your practitioner

  • Pre-consultation brief - recent consultation notes, program activity, and diagnostic trends are compiled by AI tools to assist your practitioner before each consultation

  • Health scoring - your diagnostic data (blood markers, body composition, VO2, and stool analysis) is used in an automated scoring model (CYORA Performance Score) to generate an overall health score; this score is reviewed and contextualised by your practitioner before being presented to you

  • Biological age estimation - automated calculation of estimated biological age from biomarker data; reviewed and approved by a practitioner

  • Bloodwork Decoder - the blood test document, first name, age, sex and upload answers you give to the Decoder are used by the CYORA Clinical Intelligence to extract your markers, score them, estimate a biological age and write an educational brief. This output is produced without individual practitioner review. It is educational analysis only; it is not a clinical decision and it does not affect any service, price or entitlement you have with CYORA.

  • CYORA Decode - the blood test PDF or raw DNA file you upload to the CYORA Decode app is read and scored against the CYORA optimal ranges by CYORA's own software in Australia, and the de-identified results (marker values or genotypes, with your age and sex) are then used by an OpenAI language model to write an educational report in Dr Dan's words. This output is produced without individual practitioner review. It is educational analysis only; it is not a clinical decision, DNA results are never given a score, and it does not affect any service, price or entitlement you have with CYORA (section 6.8).

  • The self-paced CYORA software tools and Dr Dan AI - the laboratory report, results or answers you give a tool are read and scored by CYORA's own software in Australia, and are then used by an Anthropic or OpenAI language model to write your educational report, plan or answer. This output is produced without individual practitioner review. It is educational analysis only; it is not a clinical decision, DNA results are never given a score, and it does not affect any service, price or entitlement you have with CYORA (section 6.9).

  • Call summaries - the transcript of a recorded call, with speaker names replaced by role labels and email addresses, phone numbers, Medicare numbers and dates removed, is used by an Anthropic language model to write a summary for our team and, for a strategy or sales call, a draft follow-up email (section 6.3). A person reads the summary and the draft. It is not a decision about you, and no follow-up is sent to you without a person reviewing it. Our sales AI (section 6.3) works from the same kind of transcript to help our team prepare, follow up and train; it makes no decision about you.

For clinical care, the AI-generated output is reviewed, interpreted, and approved by an AHPRA-registered practitioner before it is used to inform any recommendation or communication to you. No automated process produces a final clinical recommendation without practitioner oversight.

We will update this section no later than 10 December 2026 to ensure full compliance with the automated decision-making transparency obligations under the Privacy and Other Legislation Amendment Act 2024 (Cth).

6.6 Bloodwork Decoder (Public Tool)

The CYORA Bloodwork Decoder (decoder.cyora.com.au, previously bloodwork-decoder.cyora.com.au) is an optional, free educational tool that is separate from our clinical care. It is for adults 18 and over. It is the one CYORA service where identifiable information you provide is analysed overseas by an automated system, so we describe it here in full so your consent is informed.

How it works, in order. Step 1, you give your first name, last name, email and mobile and tick two consents: consent to the automated analysis described below, and an acknowledgement that the report is education only. Step 2, you upload your blood test PDF and answer a few short questions: age, sex, cycle phase for women, and optionally the symptoms you have, the goals you are chasing and a line in your own words. There is no fee: the Decoder has been free of charge since 14 September 2026, and no payment details are collected.

What the analysis is. Your report is produced by the CYORA Clinical Intelligence, Dr Daniel Kirkbride's clinical IP and AI, built from his 13 years of experience in the industry, more than 20,000 one-on-one sessions and more than 15,000 hours of consulting. It extracts your markers, scores each one against the CYORA optimal ranges, estimates a biological age and writes a brief in Dr Dan's words. It is fully automated: no practitioner reviews your individual report unless you book a call. It is an educational analysis of what your results show. It is not a medical diagnosis, treatment or personal medical advice, and using it does not make you a patient of CYORA.

What goes overseas, and to whom. To produce your report, the blood test document you upload, together with your first name, age, sex and the answers you give at upload (symptoms, goals and your own words, if you give them), is processed by one or both of Anthropic PBC (the Claude platform) and OpenAI, L.L.C. (the GPT platform), whose servers are in the United States. Each provider uses your information to generate your analysis. Since 31 August 2026 this analysis has run on an ordinary ChatGPT subscription account that CYORA holds, so OpenAI's consumer terms govern what OpenAI does with what it receives, on the same footing as the lanes in section 6.9: under those terms the provider may keep a copy of the request on its systems, says it removes deleted content within 30 days unless it must keep it for security or legal reasons, and may use content to improve its models unless the account holder has turned that setting off in the account's data controls. CYORA's accounts are set so that the provider does not use what it receives to improve or train its models: that setting was confirmed switched off on CYORA's ChatGPT account and on each of CYORA's Claude accounts on 5 October 2026, and CYORA re-checks it. This disclosure is made on the accountable basis in APP 8.1: CYORA takes reasonable steps to ensure the provider handles your information consistently with the Australian Privacy Principles and CYORA remains responsible to you for it under section 16C of the Privacy Act 1988 (Cth). It is not a consent under APP 8.2(b), so your Privacy Act rights against CYORA are unchanged.

Where your information is kept. Your document, extracted results, scores, personal details and the report generated for you (including its PDF) are stored in CYORA's dedicated database in Sydney, Australia, with row-level access controls. Your report is served on a private link unique to you. To deliver and support the report we also use Twilio Inc and GoHighLevel Inc (SMS and email delivery, contact management), Resend Inc (email delivery fallback) and Google LLC (email), all listed in section 7.4. They receive your contact details and the report link; only the report itself carries your results.

How long we keep it. Your Decoder record expires 90 days after the day you consented. On expiry the private link stops working and your uploaded document, your results and your report are deleted from our systems. You can ask us to delete it sooner at any time (section 11). If you become a CYORA client before expiry, your Decoder results become part of your clinical record and are kept under section 10. Your contact details may be kept for marketing until you unsubscribe (section 12.4).

If something goes wrong. If the tool cannot read your file, no report is produced and we tell you so. If you tell us you are under 18, your report is not produced. Nothing in this section limits your rights under the Australian Consumer Law.

Analytics. We use Meta, Google Analytics and PostHog to measure how the tool is used. They receive technical and marketing signals only, such as a hashed (non-readable) email and device or campaign identifiers. They never receive your blood results, scores or report content.

6.7 Dictation (Voice To Text)

Some of our forms and the CYORA client portal offer a Dictate button beside a written answer, including the client intake form, check-ins and the weekly planner. It is optional. You can always type instead.

When you tap Dictate, your browser records your voice until you tap Stop or two minutes pass. The recording is sent through our own servers in Sydney to OpenAI, L.L.C. (USA), which converts it to text using its speech-to-text service and returns the words to the box in front of you, where you can read and edit them before anything is submitted. Nothing is saved until you submit the answer, and what is saved is the text, not your voice.

We do not keep the recording. OpenAI uses it only to produce the text, does not use it to train its models, and under its published API data controls for its transcription service keeps no copy of it for abuse monitoring. We send no name, email address or client identifier with the recording. Because it is your voice, the recording cannot be de-identified before it leaves our systems in the way our written data is (see section 6.0), and it is processed on servers in the United States. This disclosure is made on the accountable basis in APP 8.1: we take reasonable steps to ensure OpenAI handles it consistently with the Australian Privacy Principles and we remain responsible to you for it under section 16C of the Privacy Act 1988 (Cth). It is not a consent under APP 8.2(b), so your Privacy Act rights against CYORA are unchanged.

A member of our team may also use Dictate to record a note about your training technique video. The same handling applies. If you would rather your voice was never processed this way, type your answers and tell us at support@cyora.com.au.

6.8 CYORA Decode (Self-Guided Program)

CYORA Decode (decode.cyora.com.au) is a paid, self-guided testing, analysis and education program that is separate from our clinical care. It is for adults 18 and over. There are no consultations in it, and the pages in the CYORA Decode app are produced by CYORA's software without individual practitioner review, so we describe it here in full so your consent is informed.

What you give us. Your name, email, mobile, date of birth, sex and address at enrolment, so we can arrange your DNA test and set up your login; the report of your own blood panel, which you obtain yourself from an Australian laboratory of your choice and upload to the app, or a raw DNA data file you upload; the report NutriPATH returns for the DNA test arranged through CYORA; and, if you connect an Oura ring, the daily readings it records during the 30 days your connection is open. We do not give your details to any blood laboratory, and no blood laboratory sends us anything.

Who requests your tests, and who receives each report. The two tests are handled differently, and we want you to know it before you enrol. Your blood panel is not arranged by CYORA and is not part of your program fee: you buy it yourself, in your own name and at your own cost, from an Australian laboratory of your choice, and the request is issued by that laboratory's own doctor or by your General Practitioner. That practitioner, not a CYORA practitioner, is the requesting practitioner for your blood panel and receives the laboratory's report and any urgent or critical result call. CYORA is not the practitioner of record for your blood results, receives nothing from that laboratory, and is not told of any result it flags; we see your blood results only when you upload the laboratory's report to the app. CYORA mentions the i-screen Platinum Health Test as the panel that most closely matches the markers the app holds ranges for; that is a courtesy, CYORA has no arrangement with i-screen or any other laboratory about your purchase and receives no fee or commission from it, and you may use any laboratory. The DNA test is arranged and paid for by CYORA as part of your program and is requested in your own name on your instruction: we place that request with NutriPATH on the laboratory account of Dr Daniel Kirkbride (AHPRA registration OST0002224719), so a CYORA practitioner is named as the requesting practitioner on your DNA request, and NutriPATH issues its report to that account rather than to you. We give you a copy of that report, build your DNA page from it, and keep a copy in your health record. Being named on the request does not mean he, or anyone else at CYORA, reads, interprets, reviews, monitors or follows up your DNA report. Nobody at CYORA does, and we send you no notice about it.

How your report is made, in order. Step 1, CYORA's own software in Sydney, Australia checks that the file carries your name and date of birth as we hold them, reads the values or genotypes from it, and scores each blood marker against the CYORA optimal ranges (DNA results are never given a score). The app reads a blood report from any Australian laboratory whose format it can read. A file that does not carry your details, or that our software cannot read, is refused with the reason shown, and nothing is guessed. Step 2, the de-identified results only - the marker values, units and bands, or the genotypes, together with your age and sex - are sent to OpenAI, L.L.C. (United States), whose language model writes your educational report in the words and under the framework of Dr Daniel Kirkbride (AHPRA registration OST0002224719). Your name, date of birth, email, mobile, address and the file itself are never sent. Step 3, our software checks the report against the CYORA report standard and publishes it to your app. No practitioner reviews your individual report. Your app carries a standing page on where to take a result you are worried about; no practitioner reads your result, CYORA does not monitor your results, and CYORA sends no notice about them, and that is so for your DNA report as well, even though a CYORA practitioner is named as the requesting practitioner on the DNA request. For your own blood panel, the only notice you will receive about a result is any urgent or critical result process of the laboratory you chose, and it comes from that laboratory and the practitioner who requested the test for you, not from CYORA; CYORA is not told of it. A DNA report carries no urgent or critical result and there is no such process for it, so you will receive no notice about it from anyone. Managing your results is yours to do. CYORA does not read them, does not monitor them, and sends you no notice about them. If you want your results worked through with a person, that is what a CYORA coaching program is for.

Genetic information. A raw DNA file you upload is genetic information (section 3.3). The genotypes read from it are sent to OpenAI only in the de-identified form described above. Your genetic information is never used or disclosed for any other purpose, and never in a way that could affect your insurability or employment.

Overseas processing. The de-identified results are sent to OpenAI through a ChatGPT subscription account that CYORA holds, using OpenAI's Codex tool, so OpenAI's consumer privacy policy governs what OpenAI does with them. Under that policy OpenAI may keep a copy of the request on its systems, says it removes deleted content within 30 days unless it must keep it for security or legal reasons, and may use content to improve its models unless the account holder turns that off in the account's data controls. Whatever OpenAI's settings, it never receives anything that directly identifies you: your name, date of birth, email, mobile, address and the file itself stay in Australia, and we do not use your identifiable information to train any AI model (section 6.0). Because the details that directly identify you are removed before anything is sent, what leaves Australia is not, on its own, information about an identifiable person. A set of genotypes can, however, be unique to you, so we treat what is sent as if it were still your personal information and remain responsible for it: the disclosure is made on the accountable basis in APP 8.1 described in section 8, under which CYORA takes reasonable steps to ensure OpenAI handles it consistently with the Australian Privacy Principles and remains responsible to you for it under section 16C of the Privacy Act 1988 (Cth). It is not a consent under APP 8.2(b), so your Privacy Act rights against CYORA are unchanged.

Where your information is kept. Your enrolment details, your results, your scores and your reports are stored in CYORA's dedicated CYORA Decode database in Sydney, Australia, with row-level access controls. A copy of your results is also held in CYORA's clinical records system in Sydney, Australia, so that a practitioner can read them if you later enrol in a CYORA program.

How long we keep the file. The laboratory's original report is part of your health record, and a raw DNA data file you upload is kept with it: a copy is kept in our clinical records archive in Sydney, Australia for the retention period in section 10, the same way it is for a client of our clinical programs. The working copy of the blood or DNA file you upload is removed from our working systems as soon as your report is published or refused, and from our secure backup vault 30 days after that. A file that is never processed is removed 30 days after upload. The request record kept by the AI processing tool we run on our own equipment is deleted within seven days. Your results, scores and reports are kept as your record under section 10.

Deleting your account. You can delete your CYORA Decode account in the app at any time. Doing so removes your uploaded files, results, scores and reports from the CYORA Decode app the same day and de-identifies your Decode account. Your blood and DNA results, the reports made from them and the laboratory's original report are a health record, so the copy held in our clinical records system is not removed on request: it is kept for the retention period in section 10 and is then destroyed or permanently de-identified. The working copy of the file you uploaded and the AI request record are removed on the shorter timelines above whether or not you delete your account. A record removed from the app can remain inside an older encrypted backup copy, as section 10 describes. Section 11.4 describes this further.

6.9 The CYORA Software Tools (Self-Paced, No Consultations)

Alongside CYORA Decode we offer a set of self-paced software tools you can buy on their own, without any coaching program and without any consultation.

Three CYORA products have similar names and this Policy does not use one for another. The CYORA App is the app CYORA coaching clients use, described in sections 6.1 to 6.5. CYORA Decode is the self-paced program with a DNA test and a course, and the portal it is read in is called the CYORA Decode app, described in section 6.8. The Decode App is the subscription described in this section, which opens the six tools and Dr Dan AI and is not yet available. Where this Policy names one of them, it means only that one. They are for adults 18 and over. Every page each one produces is written by CYORA's software without individual practitioner review. We describe them here in full, per tool, so your consent is informed.

The tools. The CYORA Blood Decoder, the CYORA Stool Decoder and the CYORA DNA Decoder read a laboratory report you upload and write an educational report on it. The CYORA Training Builder, the CYORA Nutrition Builder and the CYORA Supplement Builder read your results and the answers you give, and write an educational plan. The CYORA Software Bundle is a single purchase of all six and is not a separate system: it opens the same six tools, each handling your information exactly as described here. The Decode App is a subscription that opens the same six tools together with Dr Dan AI; it is not yet available, and this section will describe it from the day it is. Dr Dan AI is a chat you can also buy on its own, described below.

What you give us. Your email and first name to create your account; for a decoder, the laboratory report you upload; for a builder, your results and the answers you give it, which include your age, your sex and what you tell it about your goals, your training, what you eat and what you will not take. We do not ask a tool for your Medicare number, your address or your date of birth, and a tool does not read your clinical record.

What leaves Australia, per tool, and it is not the same for all of them. CYORA's own software in Australia reads and scores your file first. What is then sent to the language model differs, and the difference matters to you:

  • The CYORA Stool Decoder, the CYORA Training Builder, the CYORA Nutrition Builder and the CYORA Supplement Builder send the de-identified results and answers only: the values, bands, and what you told the tool, with your age and sex. Your name, your email and the file itself are not sent.
  • The CYORA DNA Decoder sends your genotypes with your age and sex, and not your name, email or the file. Your genotype set can be unique to you, so what is sent may still identify you even though your name is removed. We say this on the tool as well, and you should read it as part of what you are agreeing to.
  • The CYORA Blood Decoder sends your laboratory report as it is. This tool exists to read a document nobody has transcribed, so the report's own pages go to the provider, and whatever your laboratory printed on them goes with them, which ordinarily includes your name, your date of birth and your laboratory reference. Nothing is removed first. This is the one tool where that is true, and we would rather say it plainly than let the shorter sentence above be read as covering it.
  • Dr Dan AI sends your question and the profile information the chat holds for you, with your name, email and date of birth replaced by placeholders before it leaves and put back on our own servers when the answer returns. Any other person named in the information it draws on is replaced by "another client".

Who the provider is, and why this Policy rather than the tool names it. Each tool's analysis is performed by a language model run by Anthropic PBC (United States) or OpenAI, L.L.C. (United States). Which one answers depends on the tool and can change: on 4 October 2026 the CYORA Blood Decoder's report runs on OpenAI, the CYORA Stool Decoder, the CYORA DNA Decoder and the three builders run on Anthropic, and Dr Dan AI tries OpenAI first and Anthropic if that is unavailable, so a single Dr Dan AI answer may come from either. We keep the current position in this Policy, and we update this Policy when it moves, rather than naming one provider in a consent box that would become wrong the day it changes.

What the provider may do with what it receives, per lane. This is not the same for every lane and we do not want to flatten it:

  • The Dictate button (section 6.7) runs under OpenAI's API data-processing terms for its transcription service, under which the provider does not retain what it receives to train its models.
  • Every tool in this section, and the CYORA Blood Decoder's analysis in section 6.6, runs on an ordinary subscription account that CYORA holds, so the provider's consumer terms govern what it does with what it receives, exactly as they do for the CYORA Decode report (section 6.8). Under those terms the provider may keep a copy of the request on its systems, says it removes deleted content within 30 days unless it must keep it for security or legal reasons, and may use content to improve its models unless the account holder has turned that setting off in the account's data controls. CYORA's accounts are set so that the provider does not use what it receives to improve or train its models: that setting was confirmed switched off on CYORA's ChatGPT account and on each of CYORA's Claude accounts on 5 October 2026, and CYORA re-checks it.
  • We do not use your identifiable information to train any AI model of our own (section 6.0).

The legal basis, and what you keep. These disclosures are made on the accountable basis in APP 8.1 described in section 8, under which CYORA takes reasonable steps to ensure the provider handles your information consistently with the Australian Privacy Principles and remains responsible to you for it under section 16C of the Privacy Act 1988 (Cth). They are not made under a consent given under APP 8.2(b), so your Privacy Act rights against CYORA are unchanged. The tick box you complete in a tool records that you have been told what leaves and where it goes; it does not ask you to give up a remedy.

No practitioner reads your result. There is no consultation in any of these tools, nobody at CYORA reads, interprets, monitors or follows up what a tool produces for you, and CYORA sends you no notice about it. Each report and plan is education. It is not a diagnosis, a prescription or personal medical advice, and using a tool does not make you a patient of CYORA. If you want a person to work through what a tool produced for you, that is what a CYORA coaching program is for. If you are having a medical emergency, call 000. Dr Dan AI is software built on Dr Daniel Kirkbride's method; it is not Dr Daniel Kirkbride, it is not a registered health practitioner, and nobody reads or answers your messages. None of these tools is for an emergency. In an emergency call 000.

Where your information is kept, and for how long. Your account, your uploads, your results and the reports or plans made for you are stored in CYORA's databases in Sydney, Australia with row-level access controls, and each tool can read only its own. Your results and the reports and plans made from them are a health record and are kept for the retention period in section 10. A report or plan already made for you stays readable on your account after your access to the tool ends, so that paying once does not mean losing what you paid for.

7. Disclosure of Your Information

7.1 CYORA Team Members

Your information is accessible to CYORA team members, including contractors engaged by CYORA, on a need-to-know basis:

  • Dr Daniel Kirkbride (AHPRA registration OST0002224719) - head clinician, reviews all clinical data
  • Hannah King (APD, DA APD050601) - reviews nutrition-relevant data
  • Other registered health practitioners and coaches we engage to support your program - access limited to the data relevant to their role (for example, training and physical capacity data)
  • Administrative and support staff - access limited to non-clinical administrative data
  • Our sales and client success team, who run strategy and sales calls - access to the booking details, recordings, transcripts and summaries of strategy and sales calls with people considering our programs and the contact details needed to follow up, and, for the team members we have authorised for that role, access to our sales call review area, where recorded strategy and sales calls are reviewed to improve how we run them, give feedback and train our team, and are used to build and improve our sales AI (section 6.3)

7.2 Your General Practitioner or Specialists

With your written consent, we may share a summary of your program, diagnostic findings, or protocol with your GP or treating specialists for coordinated care. We will never share your information with your GP without your explicit consent unless required by law or in a health emergency.

7.3 Diagnostic Laboratories

When you order diagnostic tests through our partner labs, the labs receive identifying information necessary to process and return your results. Partner labs include:

  • Australian Clinical Labs
  • iMedical (Sports Blood Panel)
  • NutriPATH (Microbiome, DNA; and OAT, for tests ordered before we stopped offering it in September 2026)
  • iScreen (blood panels, and OAT before we stopped offering it in September 2026)

Each partner lab operates under their own privacy obligations. We recommend reviewing their privacy policies.

7.4 Technology Service Providers

We use the following technology providers to operate our business. Providers are engaged under data processing agreements, except the lanes that run on an ordinary subscription account under a provider's consumer terms: the CYORA Decode report (section 6.8), the self-paced CYORA software tools and Dr Dan AI (section 6.9), and the call summary, follow-up draft and sales AI (section 6.3). Those lanes are described per lane in the sections named, because what a provider may do with what it receives is not the same for all of them. We disclose your information to these providers only to the extent necessary to deliver our services.

Provider Purpose Data Location Privacy Reference
Supabase Inc (USA) Database hosting for the CYORA client platform, the CYORA Decode app (section 6.8), the Bloodwork Decoder (section 6.6) and each of the self-paced software tools and Dr Dan AI, which each hold their own separate database (section 6.9); our call recordings' transcripts and summaries, including our sales call review area, and our copies of recorded call video (section 6.3); our encrypted backup vault (section 10) Sydney, Australia (ap-southeast-2) supabase.com/privacy
Stripe Inc (USA) Payment processing USA stripe.com/au/privacy
GoHighLevel Inc (USA) CRM - contact management, appointment booking USA gohighlevel.com/privacy-policy
Google LLC (USA) Google Drive document storage, Google Workspace (including our email, booking confirmations and draft follow-up emails after a call), an encrypted second copy of our database backups (section 10), and, if you choose to give it, your answer to the health question when you book a strategy call (section 12.3) USA / AU data centres policies.google.com/privacy
Anthropic PBC (USA) AI language model for intake summary, for call summaries and draft follow-up emails written from call text with direct identifiers removed, to help our team review strategy and sales calls, to run CYORA's own sales AI and the opening check of recorded strategy and sales calls (section 6.3), and for the Bloodwork Decoder analysis (section 6.6). Also, as at 4 October 2026, the analysis for the CYORA Stool Decoder, the CYORA DNA Decoder, the CYORA Training Builder, the CYORA Nutrition Builder and the CYORA Supplement Builder, and the fallback answer for Dr Dan AI (section 6.9). The routine call summary, the follow-up draft for a strategy or sales call, our sales AI (section 6.3) and every lane in section 6.9 run through a Claude subscription account under Anthropic's consumer terms USA anthropic.com/privacy
OpenAI, L.L.C. (USA) AI language model for the Bloodwork Decoder analysis (section 6.6) and for the CYORA Decode report, which receives de-identified results only (section 6.8); speech-to-text transcription of voice recordings made with the Dictate button (section 6.7). Also, as at 4 October 2026, the report written for the paid CYORA Blood Decoder, which receives the laboratory report as it is, and the first attempt at every Dr Dan AI answer (section 6.9). The CYORA Decode lane and every lane in section 6.9 run on a ChatGPT subscription account through OpenAI's Codex tool under OpenAI's consumer privacy policy, which governs whether what it receives is used to improve OpenAI's models; the Dictate lane and the Bloodwork Decoder analysis described in section 6.6 run under OpenAI's API data-processing terms, not used for training and no copy of a Dictate recording retained USA openai.com/policies/privacy-policy; openai.com/policies/business-terms
Slack Technologies (USA) Internal team communication (practitioner briefs) USA slack.com/intl/en-au/trust/privacy/privacy-policy
Twilio Inc (USA) SMS delivery for the Bloodwork Decoder and CYORA notifications USA twilio.com/en-us/legal/privacy
Resend Inc (USA) Transactional email delivery fallback for the Bloodwork Decoder USA resend.com/legal/privacy-policy
Fathom Video Inc (USA) Consultation recording, transcription, and AI summary - being retired (section 6.3) USA fathom.video/privacy
Zoom Video Communications, Inc. (USA) Video calls for consultations and for strategy and sales calls; the audio stream our own recorder receives; for some practitioners' calls and for strategy and sales calls hosted by our client success team, cloud recording of the video and audio with Zoom's own transcript, held until we copy the recording to our storage in Sydney and then moved to Zoom's deleted items and removed after 30 days, or, for a call held for a person to check, held until that check is done (section 6.3) USA and other countries where Zoom operates data centres, which may be outside Australia zoom.com/en/trust/privacy/privacy-statement
Amazon Web Services (USA) Servers that run CYORA's own call recorder and speech-to-text transcription (section 6.3) Sydney, Australia (ap-southeast-2) aws.amazon.com/privacy
Vercel Inc (USA) Application hosting and serverless processing for the client portal (app.cyora.com.au), the CYORA Decode app (decode.cyora.com.au), each of the self-paced software tools and Dr Dan AI (section 6.9), our forms (forms.cyora.com.au, including the intake form and check-ins) and our practice systems. Since 9 September 2026 the forms functions are pinned to Sydney like the rest Sydney, Australia (syd1) vercel.com/legal/privacy-policy
Meta Platforms Inc (USA) Advertising measurement, remarketing, and custom audiences (public marketing pages only) USA facebook.com/privacy/policy
Google LLC (USA) - Advertising Ad measurement, remarketing, and Customer Match (public marketing pages only) USA policies.google.com/privacy

We may disclose your information without your consent where required or authorised by law, including:

  • To AHPRA in response to a regulatory investigation of a registered practitioner
  • To a court or tribunal pursuant to a subpoena, order, or notice
  • To police or emergency services where there is an immediate threat to life
  • To the Office of the Australian Information Commissioner (OAIC) in the context of a privacy complaint

8. Cross-Border Disclosure

Your personal and health information may be transferred to, and stored or processed in, countries other than Australia, including the United States of America and the European Union. See Section 7.4 for the specific overseas providers and locations.

Before disclosing your information overseas, we take reasonable steps to ensure overseas recipients handle it in a manner consistent with the Australian Privacy Principles, including through contractual data processing agreements requiring APP-equivalent protections and, for CYORA Decode and for the self-paced software tools other than the CYORA Blood Decoder, by removing the details that identify you before anything is sent (sections 6.8 and 6.9). The CYORA Blood Decoder sends your laboratory report as it is, so the details your laboratory printed on it are not removed; section 6.9 says so plainly, and the disclosure is made on the accountable basis below.

For certain overseas providers - including Anthropic PBC, OpenAI L.L.C., Fathom Video Inc, Stripe Inc, and Slack Technologies - we also rely on your consent under APP 8.2(b) of the Privacy Act 1988 (Cth). Before giving that consent, you should be aware of the following:

  1. If you consent to overseas disclosure, APP 8 of the Privacy Act 1988 (Cth) will not apply to CYORA in relation to that disclosure.
  2. CYORA will not be accountable under the Privacy Act 1988 (Cth) if the overseas recipient mishandles your personal information after it has been disclosed.
  3. You will not be able to seek redress under the Privacy Act 1988 (Cth) against the overseas recipient for any breach of the APPs.
  4. The overseas recipient may not be subject to any privacy obligations or principles equivalent to the APPs. In particular, US federal law does not provide a privacy framework substantially similar to the APPs.
  5. You may not be able to seek redress against the overseas recipient in the overseas jurisdiction.
  6. The overseas recipient may be subject to foreign laws - including US national security, surveillance, and law enforcement laws - that could compel disclosure of your personal information to a third party without your knowledge or consent.

The Bloodwork Decoder, the Dictate button, CYORA Decode and every self-paced software tool and Dr Dan AI are not disclosed under this consent. Each is disclosed on the accountable APP 8.1 basis described in sections 6.6, 6.7, 6.8 and 6.9, under which CYORA remains responsible to you.

People who have not become clients. If you book or attend a strategy or sales call but have not signed a CYORA Client Agreement, you have not given the consent above. Everything we disclose overseas about you, for example through Zoom, our email and calendar provider, our CRM, SMS delivery, and the call summary, follow-up draft and sales AI described in section 6.3, is disclosed on the accountable APP 8.1 basis: we take reasonable steps to ensure each provider handles it consistently with the Australian Privacy Principles, and we remain responsible to you for it under section 16C of the Privacy Act 1988 (Cth).

By providing your personal information through CYORA's onboarding process and intake form, and by signing the CYORA Client Agreement, you acknowledge that you have been informed of these matters and consent to the cross-border disclosure described in Section 7.4.

Where we transfer information to overseas providers, we rely on:

  • Contractual arrangements with the provider (data processing agreements requiring APP-equivalent protections where available)
  • The provider's certification under an equivalent privacy framework (e.g. Stripe's SOC 2 Type II certification)
  • Your consent under APP 8.2(b) (with all limitations described above)

Your diagnostic and clinical lab data (blood results, DEXA, VO2, DNA, stool, OAT) is stored in Supabase on servers located in Sydney, Australia and is not transferred overseas. The information that does go overseas is limited to these flows, each described in section 6 or section 12.3:

  • (a) Calls and call recordings - the call itself runs on Zoom (United States), whose data centres may be outside Australia. The audio our recorder receives is recorded and transcribed on our own servers in Sydney, Australia. Where Zoom's cloud recording is on (some practitioners' calls, and strategy and sales calls hosted by our client success team), Zoom records the video and audio and makes its own transcript, and holds them until we copy the recording to our storage in Sydney and then removes them, or, for a call held for a person to check, until that check is done (section 6.3). Until our Fathom accounts are closed, Fathom Video Inc (United States) may still record some client consultations, identifiably, with your consent before the session (section 6.3).

  • (b) Your clinical intake summary - de-identified before it leaves Australia, to Anthropic PBC (United States) (sections 6.1 and 6.4).

  • (c) Your voice, if you use the Dictate button - a short recording that cannot be de-identified, to OpenAI, L.L.C. (United States), converted to text and not kept (section 6.7).

  • (d) The Bloodwork Decoder, if you choose to use it - the document you upload with your first name, age, sex and upload answers, to Anthropic PBC and/or OpenAI, L.L.C. (United States) (section 6.6).

  • (e) CYORA Decode, if you enrol in it - your marker values or genotypes with your age and sex, de-identified before they leave Australia, to OpenAI, L.L.C. (United States) to write your report (section 6.8; a set of genotypes can be unique to you, so we treat what is sent as if it were still your personal information and remain responsible for it). The file you upload, your name, date of birth and contact details never leave Australia.

  • (f) Call summaries, follow-up drafts and our sales AI - the transcript of a recorded call, with speaker names replaced by role labels and email addresses, phone numbers, Medicare numbers and dates removed, to Anthropic PBC (United States) to write a summary; and, for a strategy or sales call, the transcript with the name on your booking and other direct identifiers replaced, to prepare a draft follow-up email, for our team's review of our calls and for CYORA's own sales AI (section 6.3). Other names and details said aloud on the call are not removed, so we treat what is sent as your personal information and remain responsible for it. The first few minutes of the transcript of a recorded strategy or sales call are also sent, on the same basis, for the opening check (section 6.3).

  • (g) Your answer to the optional health question when you book a strategy call - held in our email, calendar and file storage, Google LLC (United States) (section 12.3).

Aside from these clearly identified flows, your identifiable diagnostic and clinical records remain resident in Australia.

9. Security of Your Information

We take reasonable steps to protect your personal and health information from misuse, interference, loss, and unauthorised access, modification, or disclosure.

Our security measures include:

  • Data encrypted at rest (AES-256) and in transit (TLS 1.2+)
  • Role-based access controls - practitioner data access is scoped to relevant records only
  • Signed URLs for document access (time-limited, not publicly accessible)
  • Two-factor authentication for practitioner portal access
  • Regular security reviews

We use Supabase as our primary database, which maintains SOC 2 Type II certification and ISO 27001 compliance.

No security system is impenetrable. In the event of a data breach affecting your information, we will notify you and the OAIC as required under the Notifiable Data Breaches (NDB) scheme in Part IIIC of the Privacy Act 1988 (Cth). We will notify affected individuals and the OAIC as soon as practicable once we have reasonable grounds to believe an eligible data breach has occurred. Our internal policy requires initial assessment within 30 days of becoming aware of a suspected breach; notification will occur promptly upon confirmation.

10. Retention of Your Information

We retain your personal and health information for:

  • Health and clinical records - at least 7 years from the date of the last entry in your record (your last consultation, or the last result or note added to your file). This is the minimum period set by the health records laws of New South Wales, Victoria and the Australian Capital Territory and recommended by Australian professional indemnity insurers for every private health practice; Queensland sets no shorter period, and the Privacy Act 1988 (Cth) requires us to destroy or de-identify your information once it is no longer needed and no longer required to be kept. Records of a person who was under 18 when the service was provided are kept until they turn 25 or for 7 years from the last entry, whichever is later. We do not destroy a record while a complaint, claim or dispute about it is open or reasonably expected. If you enrolled before 16 September 2026 under a version of this Policy or a signed agreement that stated a longer minimum, that longer minimum still applies to your record.
  • Financial records - 7 years after the transaction is completed, as the Corporations Act 2001 (Cth) requires of a company (the Australian Taxation Office's own minimum is 5 years)
  • Onboarding and agreement records - at least 7 years from the end of your program; a signed agreement and its signing record are kept for 10 years
  • Dr Dan Clarity Call notes - Dr Daniel Kirkbride's short note of a Dr Dan Clarity Call is part of your health record and is kept for the period for health and clinical records above
  • CYORA Decode - the working copy of the blood or DNA file you upload is removed from our working systems when your report is published or refused and from our backup vault 30 days later, and the request record kept by our AI processing tool is deleted within seven days (section 6.8). Your blood and DNA results, your scores, the reports made from them and the laboratory's original report are a health record. They are kept in our clinical records system for the retention period for health and clinical records in this section, even if you delete your account or ask us to remove them, and are then destroyed or permanently de-identified. Deleting your account removes them from the CYORA Decode app the same day and de-identifies your Decode account (section 11.4)
  • Strategy and sales calls - we do not delete the content of strategy and sales calls. If you agreed to the call being recorded, we keep the recording, transcript and summary, including the copies in our sales call review area, because they stay in use for the purposes in section 6.3: the record of what we discussed with you and our follow-up, reviewing our calls to improve them, giving feedback and training our team, and building and improving CYORA's own sales AI. Strategy and sales calls recorded before we began telling people about our call review and our sales AI are kept on the same basis (section 6.3). That review, that training and our sales AI all work from the whole library of our past calls, so each call stays in use for as long as they do, and we do not set an end date. At least once a year we review the call records we hold, to confirm that each one is still held for these purposes and that only the team members we have authorised can open them. Two kinds of call record are set aside in a locked part of our records instead, and are kept, not deleted: anything captured on a call you asked us not to record, including before the recording was switched off, with any transcript Zoom made of it, which apart from the opening check is never summarised, reviewed or used for those purposes (section 6.3); and a call you ask us to take out of our sales call review area and our sales AI (section 11.4), which is not reviewed or used again. We keep these as the record of how the call was handled and of the choice that was made, and we open one only if we need it to answer a question, complaint or claim about that call, or where the law requires it. If you become a CYORA client, your strategy or sales call record is kept on the same basis, and any copy that becomes part of your client record is also part of your health record and is kept for the period for health and clinical records above. You can ask for access to a call record we hold about you (section 11.1)
  • Marketing communications - until you unsubscribe or withdraw consent

Backup copies. Each night we take an encrypted backup of our clinical records system and client platform databases. Each backup is encrypted before it leaves our equipment and is kept in our backup vault in Sydney, Australia (Supabase, section 7.4), with a second encrypted copy kept for a shorter period in our Google Workspace storage (Google LLC, section 7.4). Backup copies are kept for recovery purposes only: they are not opened or read in the ordinary course of business and are restored only to recover from a loss of data or a system failure. When a record is removed from our live systems, including when a CYORA Decode account is deleted, the same record can remain inside older encrypted backup copies. We do not currently remove individual records from backup copies.

After the applicable retention period, your information will be securely destroyed or permanently de-identified in accordance with our internal data destruction procedures. Strategy and sales call records have no retention end date and are kept as described above.

11. Your Rights

Under the Privacy Act 1988 (Cth) and the APPs, you have the following rights:

11.1 Access

You have the right to request access to personal information we hold about you. We will respond within 30 days. We may charge a reasonable fee for large or complex requests. We may decline access in limited circumstances permitted by law (e.g. where access would pose a serious threat to health or safety).

11.2 Correction

If you believe information we hold is inaccurate, incomplete, or out of date, you may request correction. We will respond within 30 days and correct the information or note your request in the record if we decline.

11.3 Anonymity

Where practicable, you may interact with us anonymously or under a pseudonym. However, we are unable to deliver clinical services without knowing who you are - anonymity is not compatible with program participation.

You may withdraw your consent to our collection, use, or disclosure of your personal information at any time by contacting support@cyora.com.au. Please note:

  • Withdrawal of consent does not affect the lawfulness of any processing carried out prior to withdrawal
  • Where consent is required for the delivery of clinical services, withdrawal of consent may mean we are unable to continue delivering your program
  • AI-assisted processing is an integral part of the service and is addressed separately in section 11.6; it cannot be withdrawn while you continue to use the service. Your other, genuinely severable consents (such as direct marketing under section 11.5) can be withdrawn and will be honoured
  • Withdrawal of consent does not remove our obligation to retain clinical records for the minimum periods required by law (see Section 10)
  • If you withdraw your consent to the recording of a strategy or sales call after the call, or you had a strategy or sales call with us that was recorded before we began telling people about our call review and our sales AI, whether or not you have become a client, email support@cyora.com.au. Within 30 days we take that call out of our sales call review area and stop using it for our sales AI, and we set it aside in a locked part of our records, where it is not reviewed or used again. We keep it rather than delete it (section 10); any copy in your client record is kept for the period in section 10. Lessons our team has already drawn from many calls, which do not identify you, are not removed
  • In the CYORA Decode app you can delete your account yourself at any time. Your uploaded files, results, scores and reports are removed from the CYORA Decode app the same day and your Decode account is de-identified. Your results and reports are a health record and stay in our clinical records system for the retention period in Section 10, then are destroyed or de-identified; withdrawing consent does not shorten that period. You keep your rights of access and correction (sections 11.1 and 11.2) for the whole period. Older encrypted backup copies are described in Section 10 (section 6.8)

11.5 Opt Out of Direct Marketing

You may opt out of direct marketing communications at any time by:

We will process opt-outs within 5 business days, in accordance with the Privacy Act 1988 (Cth) and the Spam Act 2003 (Cth). Opting out of marketing does not affect program-related communications (appointment reminders, protocol updates, billing).

11.6 AI-Assisted Processing

AI-assisted processing is an integral, non-severable part of the CYORA service (see Section 6). It is not a separate feature you can switch off while continuing to use the service. If you do not wish your information to be processed with AI assistance, your choice is to decline to commence or continue the service; contact support@cyora.com.au and we will help you with that. The safeguards in Section 6 (de-identification before any external AI language model, and Australian data residency for your identifiable clinical data) apply throughout.

To exercise any right, contact us at support@cyora.com.au.

12. Website, Cookies, and Marketing

12.1 Cookies and Similar Technologies

When you visit our public websites (cyora.com.au and our landing pages) and our client portals (command-centre.cyora.com.au, app.cyora.com.au, decode.cyora.com.au), we and our providers use cookies and similar technologies to keep you signed in, remember your preferences, and measure website performance.

Cookie / Technology Where Purpose Retention
Supabase session cookie Client portals Maintains your authenticated session Session
Vercel analytics All CYORA sites Anonymous performance analytics (page views, load times), no personal data collected 30 days

We do not use advertising cookies, tracking pixels, or remarketing tags inside our client portals, our onboarding funnel, or your health records. Any marketing measurement described below applies only to our public marketing pages.

12.2 Advertising, Remarketing, and Audiences

We advertise our programs on Meta (Facebook and Instagram) and Google. Where we run these campaigns, we may:

  • use a Meta Pixel and a Google tag on our public marketing pages to measure which ads lead to enquiries;
  • show remarketing ads to people who have visited our public website;
  • create audiences by securely uploading a hashed (irreversibly encoded) version of an email address or phone number to Meta Custom Audiences or Google Customer Match, so we can reach or exclude similar people.

We do not upload your health information for advertising, and we do not use health data to target ads. These features involve disclosure of personal information to Meta Platforms Inc and Google LLC, which process data in the United States. See Section 8 (Cross-Border Disclosure) for what that means for you. You can opt out at any time (Section 12.4) and can control ad personalisation directly in your Meta and Google account settings.

We do not sell your personal information to advertisers or anyone else.

12.3 Enquiries, Bookings and Strategy Calls

When you submit an enquiry through our website, a landing page, or a lead form on Meta or Google, we collect the contact details you provide in order to respond to you and tell you about our programs. We collect this with your consent and handle it under this Policy.

When you book a strategy or sales call through our booking pages, we collect your name, email and mobile and your answers to the booking questions (such as your goals, and whether you are willing and able to invest) to arrange the call, confirm and remind you of it by email and SMS, and prepare for it. How the call is recorded and used, including our review of calls to improve them and train our team and our sales AI, is described in section 6.3, and how long a recording is kept is in section 10.

You can also choose to tell us about your health when you book, for example a diagnosis, an operation or the medicines you take. It is optional: you can book without answering, and if you answer, we collect it only once you tick the box to agree. We use it to prepare for your call. Our sales and client success team (section 7.1) reads it before your call. It is kept with your booking in our database in Sydney, Australia (Supabase), and in our email, calendar and file storage (Google LLC, United States). The answer itself is never put into our CRM, our advertising or Slack. It is health information, and we handle it as section 3.2 describes. If you are not yet a client, anything held overseas is disclosed on the accountable APP 8.1 basis in section 8, and we remain responsible to you for it.

If, before you join, you pay the refundable deposit for a Dr Dan Clarity Call, a 15 minute phone call with Dr Daniel Kirkbride, we collect your name, email and mobile, and your payment details through Stripe (section 3.5), to take and refund the deposit and to arrange the call. What you tell him on the call, and his short note of it, are described in section 3.7.

12.4 Marketing Communications and Opt-Out

We send marketing communications by email, and by SMS where you have opted in, only where you have consented or where permitted under the Spam Act 2003 (Cth). Every marketing message identifies CYORA and includes a functional unsubscribe, or the option to reply STOP for SMS. We action opt-outs within 5 business days. Opting out of marketing does not affect program-related messages (appointment reminders, protocol updates, billing).

13. Complaints

If you have a complaint about the way we handle your personal information, we encourage you to contact us first:

Privacy Officer: Hannah King Email: support@cyora.com.au Response time: We will acknowledge your complaint within 5 business days and respond fully within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the:

Office of the Australian Information Commissioner (OAIC) Website: oaic.gov.au/privacy/privacy-complaints Phone: 1300 363 992 Post: GPO Box 5218, Sydney NSW 2001

Under the Privacy and Other Legislation Amendment Act 2024 (Cth), the OAIC also has enhanced enforcement powers including the ability to issue compliance notices and infringement notices. Additionally, individuals now have the right to bring a direct action in the Federal Court for serious invasions of privacy without first going through the OAIC complaint process.

You may also raise a complaint about the conduct of a registered practitioner with AHPRA: Website: ahpra.gov.au/Notifications Phone: 1300 419 495

14. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated to active clients via email at least 30 days before they take effect.

The current version of this Policy is always available at www.cyora.com.au/privacy-policy.

Terms of Use

These Terms of Use apply to the CYORA Bloodwork Decoder and the other online tools on our websites, whether free or paid. By using them, you agree to these terms. The CYORA Decode app is governed by your CYORA Decode agreement, and section 6.8 of this Policy describes how it handles your information.

Educational purpose only. The Bloodwork Decoder provides general educational information based on the results you upload. It is not medical advice, not a diagnosis, not treatment and not a consultation, and using it does not create a practitioner-patient relationship. No practitioner reads your report: it is Dr Dan's own method applied to the numbers you uploaded, for your own information. If you want a person to work through it with you, that is what a CYORA program is for. If you are having a medical emergency, call 000.

Automated analysis. Your report is produced by the CYORA Clinical Intelligence, Dr Daniel Kirkbride's clinical IP and AI, built from his 13 years of experience in the industry, more than 20,000 one-on-one sessions and more than 15,000 hours of consulting. It scores your markers against the CYORA optimal ranges, which are the narrower ranges Dr Dan uses in his own practice and are not a diagnostic standard, estimates a biological age, and writes a brief in his words. No practitioner reviews your individual report unless you book a call. Automated analysis can contain errors or omissions, including misread values from a poor quality file, and CYORA does not warrant that any report is complete or accurate for your individual circumstances. Your report is education. Take it to your own doctor, and never stop, start or change a medication or treatment because of it.

Adults only. The Decoder is for people aged 18 and over. If you tell us you are under 18, or your document shows you are, we will not produce a report.

Your responsibility. You confirm that the information and documents you upload are your own, or that you are authorised to submit them, and are accurate. Do not submit another person's health information without their consent.

No fee. The Decoder has been free of charge since 14 September 2026 and no payment details are collected. If we cannot read your file, or we cannot deliver your report, no report is produced and we tell you so. Anyone who paid the earlier fee and is owed a refund or holds a credit keeps every right they had; write to support@cyora.com.au. Nothing in this paragraph limits your rights under the Australian Consumer Law, including the consumer guarantees, which cannot be excluded.

Your report expires. Your private report link and your Decoder record expire 90 days after the day you consented, and your uploaded document, results and report are then deleted. Save or print your report before then if you want to keep it. You can run a new decode after expiry.

Liability. To the maximum extent permitted by law, and subject to the Australian Consumer Law, CYORA Pty Ltd is not liable for any loss or damage arising from your use of, or reliance on, a report generated by the tool. Nothing in these terms excludes any rights or consumer guarantees you have under the Australian Consumer Law that cannot lawfully be excluded.

Privacy. Your information is handled in accordance with this Privacy Policy, including the Bloodwork Decoder disclosure in section 6.6.

Intellectual property. The CYORA tools, reports, scoring methodology, reference ranges, and branding are the property of CYORA Pty Ltd and may not be copied, scraped, or resold.

Practitioner. The Decoder is published by CYORA Pty Ltd (ABN 59 649 153 935). Dr Daniel Kirkbride (AHPRA registration OST0002224719) designed the CYORA Clinical Intelligence and the optimal ranges it uses. Using the Decoder does not make you his patient or create a practitioner-patient relationship with CYORA.

15. Glossary

APP - Australian Privacy Principle (one of 13 principles under the Privacy Act 1988 (Cth)) AHPRA - Australian Health Practitioner Regulation Agency Genetic Information - information about an individual's genetic makeup, including DNA and SNP analysis results; a specific subcategory of sensitive information under the Privacy Act 1988 (Cth) Health Information - information or opinion about the health, disability status, or health services received by an individual (a form of sensitive information under the Privacy Act) NDB Scheme - Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988 (Cth) OAIC - Office of the Australian Information Commissioner Sensitive Information - a subcategory of personal information afforded higher protection under the APPs, including health information, genetic information, and biometric data Spam Act - Spam Act 2003 (Cth), governing commercial electronic messages

This Privacy Policy was prepared having regard to the Privacy Act 1988 (Cth), the Australian Privacy Principles, the Privacy and Other Legislation Amendment Act 2024 (Cth), applicable state and territory health records legislation, OAIC APP Guidelines (including Chapter 8 v1.3, October 2025), and AHPRA guidance on the use of artificial intelligence in healthcare (August 2024). It will be updated no later than 10 December 2026 to reflect automated decision-making transparency obligations and the Children's Online Privacy Code, and following any further Privacy Act reform legislation.

CYORA Pty Ltd · ABN 59 649 153 935 · support@cyora.com.au · www.cyora.com.au/privacy-policy