Privacy Policy

Last updated: 15 July 2026

This Privacy Policy applies to Personal Information collected by JAVEDSHEIKH PTY LTD (ABN 54 679 727 827), trading as Qiri (we, us or our) in connection with Qiri, our pharmacy and patient platform (Qiri or the Services), including through our websites at www.qiri.ai, and any related applications, integrations, or services we operate. Qiri is a trading name of JAVEDSHEIKH PTY LTD.

Qiri is used by two main groups:

  1. pharmacists and pharmacy staff, who use Qiri as a clinical decision support tool to assist their professional practice; and
  2. patients, who may use Qiri directly or through their pharmacy to access general health information.

How we handle your information depends on which group you fall into and how you access Qiri. Where relevant, this policy distinguishes between the two. If you are a patient using the Qiri patient app, your use of the app is governed by the Patient Terms of Use, and a short collection notice is shown in the app when you sign up. This policy applies in full to both groups.

1. What information do we collect?

The Personal Information we collect depends on how you interact with Qiri. We collect only Personal Information that is reasonably necessary for our functions or activities. The categories of Personal Information we may collect and hold include:

  1. Account and authentication information, including usernames and securely stored (hashed and encrypted) passwords, and, where you choose to sign in with Apple or Google, the identity token those providers return, used to authenticate access to the Services;
  2. Contact information, including name, email address, and where relevant phone number, provided when you create an account, communicate with us, submit feedback, or otherwise interact with the Services;
  3. Professional registration information for pharmacist and pharmacy staff users, including AHPRA registration number, employer details, and role;
  4. Health information about patients, including medication history, conditions, allergies, symptoms, queries, and other health-related information entered into Qiri by a patient, or by a pharmacist on a patient's behalf. Health information is Sensitive Information under the Privacy Act 1988 (Cth) and is handled in accordance with the Australian Privacy Principles and applicable state and territory health privacy laws;
  5. Healthcare identifiers and My Health Record information, where Qiri is or becomes integrated with these systems. This may include Individual Healthcare Identifiers (IHI), Healthcare Provider Identifiers (HPI-I and HPI-O), and information accessed through the My Health Record system. We handle this information in accordance with the Healthcare Identifiers Act 2010 (Cth), the My Health Records Act 2012 (Cth), and the rules made under those Acts;
  6. Government-issued identifiers and identity documents, including Medicare card numbers and, to verify a patient's identity, identity documents such as a driver licence or passport number, which we collect from patients to verify identity, match a patient to the correct pharmacy record, and support claiming (for example under the Pharmaceutical Benefits Scheme). Consistent with Australian Privacy Principle 9, we do not adopt a government identifier as our own identifier of you, and we use and disclose it only where permitted by law. Medicare numbers and identity-document numbers are masked in our interfaces and encrypted at rest;
  7. Electronic prescription information, including electronic prescription (eScript) tokens that you load into the Qiri patient app or provide to a pharmacy, and the prescription details those tokens resolve to;
  8. Consultation information, including bookings, attendance, and consultation notes. If a consultation is conducted or recorded by audio or video through Qiri, the recording is collected only with the consent of the participants and is handled as health information;
  9. App and device information when you use the Qiri patient app, including device type, operating system, and app version. Where you grant camera access, it is used to scan prescription QR codes. App lock credentials (PIN or biometrics) are handled by your device and are not transmitted to Qiri;
  10. Usage and interaction data, including search queries, prompts, AI interactions, and other information generated through use of the Services, which may be associated with your account or device;
  11. Feedback and communications, including information you provide when contacting us, raising support requests, or submitting feedback;
  12. Payment and transaction information, including billing details and purchase and transaction history (such as consultations booked and paid for, medicines and other items purchased, and refunds). Card payments are processed by our PCI-DSS compliant payment provider, Stripe: your full card details are provided to and held by Stripe, not Qiri, including where you save a card for future payments. Qiri retains records of the transaction, such as the amount, items, time, and payment status;
  13. User content and connected data, including content you upload to the Services and data obtained through authorised third-party integrations such as pharmacy dispensing systems; and
  14. Cookies and analytics: information collected through cookies and similar technologies. Session cookies are generally anonymous, but authentication cookies used when you are logged in will identify you to our servers.

Electronic prescriptions: we handle electronic prescription (eScript) tokens, and the clinical data they resolve to, consistent with the electronic prescribing conformance requirements maintained by the Australian Digital Health Agency and the Department of Health and Aged Care. We apply rate-limited endpoint logging and replay protection to guard against token replay, unauthorised querying, and fraudulent access to prescription systems. Where the Services access a patient's Active Script List — a consolidated list of their active electronic prescriptions held in the national prescription system — we do so only with the patient's separate, explicit consent, distinct from acceptance of the Patient Terms of Use. That consent is recorded with a timestamp and version and can be withdrawn at any time.

2. Definitions

In this Privacy Policy, the terms Personal Information, Sensitive Information, and health information have the meanings given to them in the Privacy Act 1988 (Cth) (Privacy Act). Health information is a category of Sensitive Information.

Because Qiri is used in a healthcare setting, we collect Sensitive Information, including health information, where this is reasonably necessary to provide the Services. We do so with your consent, or where another exception under the Australian Privacy Principles or applicable health privacy legislation applies (for example, where collection is necessary for the provision of a health service).

3. How we collect your Personal Information

  1. We generally collect Personal Information directly from you when you create an account, enter information into Qiri, or otherwise communicate with us.
  2. If you are a patient accessing Qiri through a pharmacy, your pharmacy or pharmacist may also enter Personal Information about you into the Services on your behalf, with your consent.
  3. We may also collect Personal Information from third parties, including authorised integrations (such as pharmacy dispensing systems and government health systems), payment providers, identity verification providers, and analytics providers. Where we receive Personal Information from a third party, we handle it in accordance with this Privacy Policy and applicable law.

Anonymity and pseudonymity: you may browse our websites and make general enquiries without identifying yourself. However, because Qiri supports the supply of medicines and other clinical services, we cannot provide clinical features (such as dispensing, electronic prescriptions, consultations, or payments) to anonymous or pseudonymous users: accurate identification is necessary for patient safety and legal compliance.

4. Purpose of collection

We collect and use Personal Information for the primary purpose of providing, operating, and improving Qiri, and for related purposes you would reasonably expect, including to:

  1. create and manage user accounts and authenticate access to the Services;
  2. verify a patient's identity and match them to the correct patient record held by their pharmacy, including using name, date of birth, and Medicare card number;
  3. operate platform features, including the generation of AI outputs in response to user inputs, to assist pharmacists with decision support and to provide patients with general health information;
  4. communicate with users about service updates, support requests, and operational matters;
  5. conduct analytics, research, and service improvement activities, using de-identified or aggregated data wherever practicable and in accordance with the Office of the Australian Information Commissioner's guidance on de-identification;
  6. process payments and manage billing arrangements;
  7. comply with legal, regulatory, and professional obligations, including those applicable to pharmacists and pharmacy operators; and
  8. detect, prevent, and respond to fraud, misuse, and security incidents.

Some features of the Services make information visible between a pharmacy and its patients (for example, prescriptions a patient sends to the pharmacy, and consultation bookings). Further information is provided in the Software User Agreement, the Patient Terms of Use, and within the Services.

We may send direct marketing communications where permitted by law. We will not use your health information or other Sensitive Information for direct marketing without your express consent. You can opt out of any direct marketing at any time using the unsubscribe link in the message or by contacting us at the details in section 17.

We do not sell your Personal Information, we do not use it for third-party advertising, and we do not track you across other apps or websites. The Qiri patient app contains no third-party advertising or cross-app tracking technologies.

We do not aggregate one patient's identifiable clinical information with another patient's for secondary purposes without consent. Our clinical reasoning operates on one patient's information at a time, and the clinical data store is isolated so that one patient's record is not combined with another's to produce an output.

4.1 Withdrawing consent and closing your account

You may withdraw your consent to specific secondary uses of your Personal Information (such as analytics, research, or service improvement) at any time by contacting us at the details in section 17. Withdrawing consent for these secondary uses does not affect the core clinical services already provided to you.

You may also ask us to close and delete your account, either through the settings in the Qiri patient app or by written request. Because Qiri operates as clinical infrastructure, however, Personal Information that forms part of a health or pharmacy dispensing record cannot always be deleted immediately. Consistent with state and territory health records legislation (including the Health Records and Information Privacy Act 2002 (NSW) and the Health Records Act 2001 (Vic)), clinical records must be retained for a minimum period, generally seven years from the date of last service, until a patient who was a minor reaches 25 years of age, and, for records used in Pharmaceutical Benefits Scheme or other Commonwealth claiming, for any longer period those programs require. Information we are required to retain in this way is securely archived and kept separate from ordinary processing until it can be deleted or de-identified.

4.2 De-identification and aggregation

Where we de-identify data for statistical, research, or service-improvement purposes, we apply the De-identification Decision-Making Framework published by the Office of the Australian Information Commissioner and CSIRO's Data61, and we remove direct identifiers such as names, exact dates of birth, Medicare numbers, and contact details.

We recognise that complex clinical data, such as medication histories and consultation notes, can carry a residual risk of re-identification if combined with other datasets. For that reason we do not publicly release de-identified clinical histories: such data is confined to secure environments and protected with the same safeguards we apply to identifiable health information.

5. Qiri is decision support, not a substitute for professional advice

Qiri is designed to assist pharmacists in their professional practice and to provide patients with general health information. Any information provided to a patient through Qiri that is not provided to the patient, or authorised, by their pharmacist is general health information only and does not take into account the patient's personal health profile. AI-generated outputs are not a substitute for a personal clinical assessment by a qualified health professional. Pharmacists using Qiri retain full professional responsibility for any decision they make based on Qiri outputs. Patients should consult their pharmacist, doctor, or other qualified health professional before acting on any information provided through Qiri.

6. Artificial intelligence, model training, and automated decisions

Qiri uses large language models and proprietary machine learning to generate responses, summaries, and clinical decision support based on user inputs. Regardless of which AI providers or models Qiri uses now or in the future, the following commitments apply:

  1. No training of foundational models: patient health information, clinical prompts, medication histories, and consultation records are never used to train, fine-tune, or improve any public or shared third-party foundational AI model.
  2. Contractual restrictions on sub-processors: AI providers that process data for Qiri are contractually prohibited from retaining user prompts or outputs for their own model development or for any secondary purpose.
  3. Durable commitment: while our technical architecture may evolve, this non-training commitment is a lasting one and applies across any change of provider or model.

Where required by the Privacy Act 1988 (Cth) (including amendments introduced by the Privacy and Other Legislation Amendment Act 2024) or other applicable law, we will provide additional information about how automated decisions or AI-generated outputs are produced and how they may affect you. Qiri is configured so that meaningful human oversight is maintained for any output that supports a clinical decision affecting a patient.

7. Security and retention

We take reasonable technical and organisational measures to protect Personal Information from misuse, interference, loss, and unauthorised access or disclosure. These measures include encryption in transit and at rest, access controls, audit logging, and secure development practices.

We retain Personal Information only for as long as reasonably necessary for the purposes for which it was collected, and in any case for the periods required by Australian law. For health information, this includes any minimum retention periods under applicable state and territory health records legislation (for example, seven years from the date of last service for adult records, and until the patient reaches 25 years of age for records of minors), and any longer period required for records used in Pharmaceutical Benefits Scheme or other Commonwealth claiming, or longer where otherwise required.

For Personal Information that is not health information (such as account, billing, and usage records), we generally retain the information for the life of your account and for up to 7 years after your account is closed, to meet tax, audit, dispute resolution, and other legal obligations, after which it is deleted or de-identified.

To provide the Services, user inputs may be processed by AI services and cloud infrastructure operated by or for Qiri. This processing occurs within Australia (see section 12). Our providers are bound by contractual confidentiality, security, and data processing obligations and are not permitted to use your Personal Information to train public models.

8. Access and correction

You may request access to, or correction of, the Personal Information we hold about you in accordance with Australian Privacy Principles 12 and 13. Requests should be made in writing using the contact details in section 17. We will respond within a reasonable period and in accordance with the Privacy Act.

In limited circumstances involving health information, access may be provided through a qualified health practitioner where this is appropriate (for example, where direct access could pose a serious threat to the life, health, or safety of any person).

9. State and territory health privacy laws

In addition to the Privacy Act, the handling of health information may be regulated by state and territory laws, including:

  1. the Health Records and Information Privacy Act 2002 (NSW);
  2. the Health Records Act 2001 (Vic); and
  3. the Health Records (Privacy and Access) Act 1997 (ACT).

We comply with these laws to the extent they apply to our handling of your information.

10. Data breaches

If we suspect a data breach involving Personal Information or health information, we activate our data incident response plan and assess the incident promptly. Given the sensitivity of health information, we treat any suspected breach involving health information as a priority.

Where an incident is an eligible data breach under the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act (that is, where unauthorised access or disclosure is likely to result in serious harm), we will:

  1. complete our assessment within the 30-day period the Act allows and, where we conclude the breach is an eligible data breach, notify the Office of the Australian Information Commissioner and affected individuals as soon as practicable thereafter;
  2. where the breach originates in, or affects, a specific pharmacy's integrated dispensing system or clinical data, notify the affected pharmacy operator promptly so that mitigation and patient communication can be coordinated; and
  3. where the breach involves information drawn from or transmitted to the My Health Record system, notify the System Operator as required by section 75 of the My Health Records Act 2012 (Cth).

11. Complaints

If you have a complaint about how we have handled your Personal Information, please contact us using the details in section 17. Complaints are reviewed by an Executive of Qiri responsible for privacy compliance, and we may seek further information from you to clarify your concerns. We will acknowledge your complaint promptly and aim to provide a substantive response within 30 days.

If we agree the complaint is well founded, we will, in consultation with you, take appropriate steps to resolve the issue. If you are not satisfied with our response, you may refer the matter to the Office of the Australian Information Commissioner (www.oaic.gov.au) or, where applicable, the relevant state or territory privacy regulator.

12. Where your information is stored, and overseas transfers

Qiri stores and processes Personal Information in Australia. Our platform, databases, and AI processing operate from cloud infrastructure located in Australia (Google Cloud's Sydney region), and Qiri is currently offered to Australian pharmacies and patients only.

Healthcare Identifiers and My Health Record information are stored and processed only within Australia and are never transferred outside Australia.

Limited categories of Personal Information are handled by overseas providers in the course of providing specific features:

  1. Payments: card payments are processed by Stripe, which may process payment information in the United States and other countries in which it operates; and
  2. Messaging: where a pharmacy uses Qiri to communicate with patients by SMS or WhatsApp, those messages are carried by third-party messaging providers (including Twilio Inc. and Meta Platforms, Inc.) and may be transmitted, processed, or stored in the United States. Qiri acts as a conduit for those messages; the pharmacy is responsible for obtaining the patient's consent to be contacted on the relevant channel.

Privacy laws in these jurisdictions may differ from Australian law. Before disclosing Personal Information overseas, we take reasonable steps to ensure the recipient handles your information consistently with the Australian Privacy Principles, including by entering into data processing agreements with our sub-processors. We maintain a current list of sub-processors and the countries in which they operate, and can provide it on request.

12.1 Messaging and patient consent

Where a pharmacy uses Qiri to send patients notifications, reminders, or clinical messages by SMS or messaging apps such as WhatsApp, the pharmacy is responsible for obtaining the patient's prior consent to be contacted on that channel, whether captured in person, verbally, or through its own enrolment process. Qiri acts only as the technical conduit for those messages. The Services record and honour a patient's opt-out and channel preferences, and maintain an audit log of consent status to help pharmacies meet their professional compliance obligations.

13. GDPR and equivalent overseas privacy laws

Qiri is offered within the Australian healthcare setting, and we do not market the Services to, or monitor the behaviour of, individuals in the EU or UK. This section applies only where the General Data Protection Regulation (EU) 2016/679 (GDPR), the UK GDPR, or equivalent overseas data protection laws nonetheless apply to our processing, for example where an integrated pharmacy operator is established in, or a subsidiary of an entity established in, the EU or UK, or where processing otherwise falls within the extraterritorial scope of those laws.

In those cases, we process Personal Information only where we have a lawful basis to do so, including where processing is:

  1. necessary for the performance of a contract with you, including to provide the Services;
  2. required to comply with legal obligations;
  3. necessary for our legitimate business interests (such as operating, securing, and improving the Services), provided those interests do not override your rights;
  4. necessary for the provision of health care or treatment, with appropriate safeguards; or
  5. based on your consent, where required.

Where we act as a processor for an EU or UK-established pharmacy operator, we enter into a data processing agreement with that operator and, where data is transferred to Australia, rely on standard contractual clauses or another recognised transfer mechanism.

Subject to applicable law, you may have rights to request access to, correction or deletion of your Personal Information, to object to or restrict certain processing, to request data portability, or to withdraw consent where processing is based on consent. These rights are subject to the minimum clinical retention periods described in section 4.1. You may also lodge a complaint with a relevant supervisory authority.

Requests may be made using the contact details in section 17. We may need to verify your identity before responding.

14. Children's privacy

Qiri is not intended for unsupervised use by children under 18. Where Qiri is used in connection with a child's healthcare (for example, a parent or guardian using Qiri in relation to their child, or a pharmacist entering information about a paediatric patient), we collect and handle the child's information only with the consent of the parent, guardian, or other person with lawful authority, and in accordance with the Privacy Act and applicable health privacy laws.

If we become aware that we have collected Personal Information about a child without appropriate authority, we will take steps to delete it.

15. Pharmacy and enterprise accounts

Where you access Qiri through a pharmacy or other organisation, that organisation controls the patient Personal Information entered into Qiri through its account, and JAVEDSHEIKH PTY LTD handles that information on the organisation's instructions, in accordance with the agreement between Qiri and the organisation. Each of Qiri and the organisation is an APP entity under the Privacy Act with its own obligations in respect of that information. Where the pharmacy uses Qiri as its dispensing system of record, Qiri hosts the pharmacy's dispensing records to support the pharmacy's statutory record-keeping obligations. Requests by patients to access, correct, or delete Personal Information should be directed to the relevant pharmacy or organisation in the first instance. We will assist the organisation in responding where required.

For all other Personal Information collected through Qiri, including pharmacist user accounts, account contact details, billing information, and direct interactions between Qiri and a user, JAVEDSHEIKH PTY LTD is the controller.

16. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. Where changes are material, we will notify you through the Services (for example, on the login page or by email). The "Last updated" date at the top of this policy reflects the most recent version.

17. How to contact us about privacy

JAVEDSHEIKH PTY LTD (ABN 54 679 727 827), trading as Qiri

PO Box 344, Revesby North NSW 2212, Australia

For privacy enquiries, access or correction requests, or complaints, you can contact our Privacy Officer at:

Email: hello@qiri.ai (attention: Privacy Officer)