Last updated: 4 October 2026 · Version 1.1
This Privacy Policy explains how Medical Software Australia (ABN 75 659 077 317) ("we", "us", "KnowNow") handles personal information when you visit knownow.com.au or use the KnowNow compliance and document-management platform. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
1. Who we are
KnowNow is a software service for general practice clinics in Australia. It is operated by Medical Software Australia, whose head office is at 45 Bulcock Street, Caloundra QLD 4551. In this policy, a "practice" is a clinic or organisation that subscribes to KnowNow, and a "user" is a person (usually a practice staff member) who has an account on a practice's KnowNow site.
2. Scope and our role
This policy covers personal information we collect about practice owners, managers and staff, visitors to our website, and people who contact us.
Practices also upload their own documents, registers and records to KnowNow. For that content, the practice decides what is uploaded and why. We hold and process it on the practice's behalf to provide the service, and the practice remains responsible for its own obligations under privacy law, including towards its patients and staff.
Please do not upload patient records. Health information is "sensitive information" under the Privacy Act and needs extra care. KnowNow is built for compliance documents such as policies, procedures, registers, training records and checklists. It is not a clinical record system. If a practice's compliance documents or registers incidentally contain health or other personal information about patients or staff (for example, in an incident register), the practice is responsible for making sure it is entitled to record that information and for keeping it to the minimum necessary. State and territory health records laws may also apply to health information that a practice uploads, and practices are responsible for giving their own collection notices to patients.
3. What we collect and how
We collect the following kinds of personal information.
- Account details: name, email address, username, phone number, postal address (where provided), role within the practice, and your password (stored only as a one-way hash).
- Security information: if you turn on two-factor authentication, your authenticator secret and recovery codes (stored encrypted), and one-time codes sent to you by email.
- Sign-in and device records: the IP addresses you sign in from, the time of your last sign-in, and session records including your IP address and browser details (user agent).
- Usage information: which pages and modules of KnowNow are viewed, by which user and clinic, and when. We use this for practice dashboards, auditing and improving the service.
- Practice content: documents, files, registers, calendar entries, notes, acknowledgements and other material that practices and their users create or upload, and a history of changes to some modules.
- Billing details: the billing contact's name, email and address, plan, subscription status and payment history. Card details are entered directly with Stripe and are never stored by KnowNow.
- Enquiries: if you use our contact form we collect your name, practice name, phone number, email address and message.
- AI assistant messages: if you use the chat assistant, the messages you type, and the page you are on, are sent to our AI service so it can respond.
We collect this information directly from you, from the practice that created your account, and automatically through your use of the service. If you do not provide the information we need, we may not be able to provide you with an account.
4. Why we collect, use and disclose it
- to create and manage accounts, authenticate users and keep the service secure;
- to provide the KnowNow service to practices, including storing and displaying their content;
- to set up subscriptions, process payments, send invoices and receipts and manage trials, renewals and cancellations;
- to send service emails, such as sign-in codes, password resets, review and task reminders, billing and renewal notices, and incident notifications that a practice has configured;
- to provide support and respond to enquiries;
- to monitor, maintain and improve the service, and to detect and prevent misuse; and
- to meet our legal obligations.
We do not sell personal information. We use or disclose it for the purposes above, for related purposes you would reasonably expect, where you consent, or where the law requires or permits it.
5. Who we share information with
Within a practice's KnowNow site, other users of that practice can see information according to the permissions the practice has set (for example, a staff list or who acknowledged a document). We also use the following service providers to run KnowNow.
| Provider | Purpose | Location |
|---|---|---|
| DigitalOcean | Cloud hosting of the application and database, and object storage (Spaces) for uploaded files | Australia (Sydney region) |
| Stripe | Payment processing, subscription billing, GST calculation and the customer portal | United States (and other countries where Stripe operates) |
| Resend | Sending service emails and notifications | United States |
| KnowNow AI assistant (ai.knownow.com.au) | Chat assistant that answers questions in the product and on this website; operated by us on our Sydney infrastructure (see section 6 about third-party AI model providers) | Australia (Sydney region) |
| Google Fonts (Google) | Delivers web fonts to your browser when you load our pages | United States |
| Content delivery networks (jsDelivr, cdnjs by Cloudflare, DataTables, Quill) | Deliver open-source scripts and styles that our pages use | Global networks, including the United States |
We may also disclose information to our professional advisers, to a successor if our business is sold, and to government or law-enforcement bodies where required or authorised by law. Service providers may only use personal information to provide their services to us.
6. Overseas disclosure (APP 8)
Some of our providers are located overseas or process data outside Australia.
- Stripe processes payment and billing details (such as billing contact name, email, address and payment method) in the United States and other countries where it operates.
- Resend delivers our emails, and so receives recipients' email addresses and the content of the messages, in the United States.
- Hosting and storage. KnowNow's own data, including accounts, practice documents, registers, the database and backups, is stored in Australia. Our application server, database and document storage (DigitalOcean Spaces) are all in DigitalOcean's Sydney region.
- Google and content delivery networks. When your browser loads our pages it fetches fonts from Google and scripts or styles from third-party content delivery networks, which therefore receive your IP address and browser details. These providers operate in the United States and other countries.
- AI assistant. The assistant is operated by us on our Sydney infrastructure (ai.knownow.com.au). Where the assistant uses a third-party AI model provider to generate responses, the content of your question may be sent to that provider, which may be located outside Australia. Please do not enter patient or other sensitive information into the assistant.
Before disclosing personal information overseas we take reasonable steps to make sure the recipient handles it consistently with the APPs, usually through contractual terms and by choosing providers with established security practices. Please do not put patient or other sensitive information into the chat assistant.
7. Storage and security
Our application, database, document storage and backups are hosted in Australia (DigitalOcean, Sydney region). We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, including:
- encrypting data in transit using HTTPS;
- storing passwords as one-way hashes, and two-factor authentication secrets and recovery codes in encrypted form;
- offering two-factor authentication (authenticator app) for user accounts;
- role-based access controls that limit what each user can see within a practice, and separating each practice's content from other practices;
- taking an encrypted database backup before each production release; and
- keeping uploaded files in private cloud storage in Australia (Sydney), served to signed-in users with the right permissions.
No system is completely secure. Please use a strong, unique password, turn on two-factor authentication, and tell us straight away if you suspect your account has been compromised.
8. Notifiable Data Breaches
If we become aware of an eligible data breach (one likely to result in serious harm), we will assess it promptly, take steps to contain it and, where required by the Notifiable Data Breaches scheme under the Privacy Act, notify affected individuals and the Office of the Australian Information Commissioner (OAIC). Where a breach affects content held for a practice, we will also notify that practice so it can meet its own obligations.
9. Retention and deletion
We keep personal information for as long as it is needed to provide the service, to meet legal, accounting and audit requirements, and to resolve disputes. A practice can remove users and content from its site. When an account is closed we will delete or de-identify the associated personal information within a reasonable time, unless we are required or permitted to keep it (for example, billing records). Information may remain in backups for a limited period after deletion.
10. Access and correction
You can ask to access or correct the personal information we hold about you. Users can update many of their own details in their account settings. For anything else, contact us using the details in section 14. We will respond within a reasonable time (usually 30 days) and may need to verify your identity first. If we refuse a request, we will tell you why and how to complain.
If your information is in content uploaded by a practice (for example, you are a patient or a staff member named in a practice document), please contact that practice first, as it controls that content. We will help the practice respond where we can.
11. Cookies and similar technologies
We use cookies that are needed for the service to work:
- a session cookie that keeps you signed in;
- a CSRF (XSRF) token cookie that protects forms and requests from forgery; and
- a "remember me" cookie if you choose to stay signed in.
Our pages load a chat assistant widget from ai.knownow.com.au, and fonts, scripts and styles from the third-party providers listed in section 5. Those providers receive your IP address and browser details and may set their own cookies. When you pay by card you are taken to Stripe, which sets its own cookies under its own privacy policy. We do not use Google Analytics or advertising cookies on the pages we control. You can block cookies in your browser, but you will not be able to sign in.
12. Emails
We send service and account messages: sign-in codes, password resets, security notices, reminders, billing and renewal notices, and product or service announcements relevant to your use of KnowNow. We do not send third-party marketing. You can ask us to stop non-essential announcements by contacting support at the address in section 14. We will still send essential service, security and billing messages.
13. Complaints
If you think we have breached the Privacy Act or the APPs, please contact us first using the details in section 14, with the details of your concern. We will acknowledge your complaint, investigate it and reply in writing, usually within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC): www.oaic.gov.au, telephone 1300 363 992.
14. Contact us
Medical Software Australia (ABN 75 659 077 317)
45 Bulcock Street, Caloundra QLD 4551, Australia
Privacy enquiries: privacy@@knownow.com.au
General support: support@@knownow.com.au
15. Changes to this policy
We may update this policy from time to time. The latest version is always on this page with its "Last updated" date. If we make a significant change we will take reasonable steps to let account holders know, for example by email or a notice in the product.