This is the archived copy of version 2026-10-27.1. It does not change. The current version is at /privacy/health-information.
Version 2026-10-27.1 · Effective: 29 October 2026
This addendum supplements the Sumext Privacy Policy. It explains how Sumext, based in the United Arab Emirates (contact: support@sumext.com), handles patient information that appears on contractor invoices. It applies to organisations that switch on contractor invoice review features after an owner accepts the Data Processing Addendum and this addendum in the app.
Why we handle this information
Clinics use Sumext to check contractor invoices before paying them. An invoice can link a patient's name to a treatment, so we treat it as health information. We use only what is needed to check service dates, agreed prices, totals, possible duplicate bills and, where switched on, appointment matches. We do not need clinical notes, diagnoses, dates of birth, addresses or Medicare numbers. Sumext does not provide clinical care or tax advice.
Who can see it
The clinic controls who has access. In normal review, Sumext shows initials and a protected token instead of the patient's full name. An authorised owner or admin can reveal one name when needed to check a line; we log who did it, when, and for which invoice line, without storing the name in the log. The full name remains in the original invoice, which is kept in private storage. Contractors cannot see other contractors' invoices or the clinic's appointment list. Sumext staff access this information only when necessary for support, security or an incident, and that access is logged.
Patient names, original invoice files that contain patient information, and patient descriptions are not sent to the clinic's accounting software (such as Xero). A person reviews and approves every invoice before it is posted.
Service providers and overseas processing
Our providers and their locations are listed in the Processing and Retention Schedule. In summary: our main database and application run in Tokyo, Japan. Invoice text is processed by our AI provider, Anthropic, to read invoice lines before names are replaced with tokens; Anthropic may process data in the United States and other countries. Encrypted backups are stored with Google. Email and SMS notifications do not include patient information. This information may therefore be processed outside Australia, and the clinic is responsible for giving its patients any notice required for this.
Keeping and deleting information
Source invoices and appointment matching records are kept while the clinic uses these features, and returned or deleted within 30 days after it stops or asks us to, unless the law requires otherwise. The clinic can ask for a shorter period. Name-free audit records are kept for 12 months. Deleting data in the app does not immediately remove it from encrypted backups; backups expire on the timetable in the schedule. The clinic keeps its own legally required financial and health records in its own systems; Sumext is not a clinical records archive.
We do not sell patient information, use it for marketing, or use it to train AI models.
Access, correction and complaints
Patients should contact their clinic to access or correct their information. You can also contact us at support@sumext.com. We help clinics respond to verified requests. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
If something goes wrong
If we suspect information has been lost, accessed or disclosed without authorisation, we act to contain it and investigate. We notify the affected clinic without undue delay, aiming to send an initial notice within 24 hours, and work with the clinic on any notices required to patients or regulators.