Privacy Policy

Last updated: 10 July 2026. This is an early placeholder policy, written in plain language and not reviewed by a lawyer — it is not legal advice. It will be replaced with a professionally reviewed policy before Form For All handles real patient data at scale.

What we collect

If you create a profile, we store the details you choose to save so we can prefill forms for you: typically your name, email address, phone number, address, date of birth, next of kin, and — only if you add them — government identifiers such as Medicare, DVA or concession card numbers, plus any custom details you create yourself. Some clinics define details only they use (such as their patient ID for you); if you tick "save my answers", we remember those too, and prefill them only on that clinic's forms. When you submit a form to a clinic, we store that submission — including any answers you typed into clinic-specific fields (which may include health-related information such as medical history) — so the clinic can receive it. When submitting a form while signed in, you can tick "save my answers to my profile" (on by default, untick to decline) to copy your reusable answers into your saved profile for next time.

How it's used

Your profile is used only to prefill forms you choose to open. A form submission is shared only with the clinic whose form you submitted. If you join our early-access list, we store your email only to contact you about the launch. We do not sell your data or use it for advertising.

Where it's stored, and who can see it

All of your saved profile details (everything except your account email, which is your sign-in identity) and your form submissions are encrypted at rest in our database, hosted in Australia (Sydney). Connections to the site are encrypted (HTTPS). Sign-in is handled by Auth0, a US-based identity provider — your login email and credentials are processed and stored by Auth0, not in our database. Emails we send — such as submission notifications that clinics can enable (which include the details you submitted) — are delivered through Resend, a US-based email provider. Our site operators can see account email addresses and usage counts for running the service; they cannot view your saved profile details or the contents of your submissions, which stay encrypted.

Optional sharing you control

If you turn on "notify my clinics" on your profile page, then whenever you update your saved details we email the changed values to clinics you have previously submitted a form to, so they can update their records. This is off by default.

Clinic-uploaded documents

Clinics may upload a copy of their paper form so we can recreate it digitally. If automatic field detection is enabled, that uploaded document is processed by Anthropic (a US-based AI provider) to draft the digital form. Clinics are asked to upload blank forms only — these documents are meant to be templates, not patient records. A clinic's logo, if uploaded, is public branding and is shown unencrypted on that clinic's forms.

Retention and deletion

We keep your profile until you delete it. Each clinic chooses how long its submissions are kept: indefinitely, 7/30/90 days (deleted automatically after that), or not stored at all (emailed to the clinic only). From your profile page you can download a copy of everything we hold about you, and delete your account yourself — deletion removes your profile immediately; forms you already submitted stay with those clinics (under their retention settings) but are unlinked from you. You can also email us for either.

Contact

Questions or deletion requests: hello@formforall.com.au