Client Portal Privacy Policy

Lab 385 Pty Ltd trading as Remedy Studio (ABN 34 666 915 519)

Last updated: 6 July 2026

This policy explains how Remedy Studio handles personal information collected through the Remedy client portal (portal.remedystudio.com.au). It applies to the portal specifically and sits alongside Remedy's general privacy policy and the Master Services Agreement. Where this policy and the MSA describe the same handling, they are intended to be read consistently.

Remedy is bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

What the portal is

The portal is a private, login-only system where Remedy clients manage their engagements with Remedy. It holds account records, project information, documents, and signed contracts for each client.

Information we collect

Through the portal, Remedy collects and stores:

• Representative contact details, including names, email addresses, phone numbers, and job titles.
• Business details, including organisation name, ABN, billing details, and business address.
• Account credentials, being the login details used to access the portal.
• Third-party access credentials, where a client provides them to Remedy to deliver a service (for example CMS, hosting, or platform logins). These are handled as sensitive access information and stored securely.
• Engagement records, including project details, correspondence, uploaded files, invoices, and service history.
• Signed contracts and signing audit data. When a document is signed through the portal, the audit trail records the signer's name, email address, IP address, user-agent (browser and device information), and the date and time of signing.
• Email delivery and open data. Emails sent from the portal (such as login links, notifications, and reports) include a delivery-tracking element that records whether and when the email is opened. Remedy uses this to confirm important communications have been received, and staff may be notified when a portal email is opened.
• Technical and usage data, including log-in activity and basic technical information needed to run and secure the portal.

How we collect it

Most information is provided directly by the client or the client's authorised representatives when setting up an account, using the portal, or signing documents. Some technical and audit data is generated automatically when the portal is used.

Why we collect it

Remedy uses portal information to:

• Manage the client relationship and deliver the agreed services.
• Provide access to project records, documents, and invoices.
• Enable electronic signing and evidence valid execution of contracts.
• Communicate with the client about their account and engagements.
• Secure the portal and detect or prevent unauthorised access.
• Meet Remedy's legal, tax, and record-keeping obligations.
• Remedy does not sell personal information and does not use it for third-party marketing.

Disclosure

Remedy may disclose portal information to subcontractors who help deliver the services (for example specialist SEO or development contractors), subject to equivalent privacy and confidentiality obligations. Remedy may also disclose information where required by law or a court order.

Remedy does not otherwise disclose portal information to third parties without the client's consent.

Storage and security

Portal data is hosted on Australian servers. Remedy applies APP-equivalent technical and organisational security measures, including access controls, encryption in transit, and restricted staff access. Access is limited to the client's authorised representatives and Remedy staff who need it.

No system is completely secure. Clients are responsible for keeping their portal login details confidential and for notifying Remedy promptly if they believe their account has been compromised.

Cookies

The portal uses only essential cookies: a session cookie that keeps you signed in and a security cookie that protects forms. It does not use analytics, advertising, or third-party tracking cookies.

Cross-border disclosure

Portal data is hosted on Australian servers. Emails sent from the portal are delivered through Postmark, a third-party email service whose infrastructure is located in the United States. The information needed to deliver those emails (names, email addresses, and message content) is processed overseas for that purpose. Beyond email delivery, standard use of the portal does not involve disclosing personal information overseas. Where a specific service requires another overseas third party, Remedy will handle that disclosure in line with the APPs.

Accessing and correcting your information

Authorised representatives can view and edit their own contact details directly within the portal at any time.

For any information that cannot be edited in the portal, clients can request access or correction by contacting Remedy using the details below. Remedy will respond within a reasonable period and, where it declines a request, will give reasons.

Account deletion

Portal account deletion is not self-service. A client can request deletion of its portal account by writing to Remedy. Remedy will action the request manually, subject to the retention terms below.

Retention

Remedy retains portal information for as long as the client relationship is active and for as long as needed afterwards to meet legal, tax, and record-keeping obligations.

On termination, portal data is dealt with under the export and deletion terms in the MSA. Signed contracts and signing audit records may be retained after other data is deleted, where required to evidence valid execution or to meet Remedy's legal obligations.

Data breach

If Remedy becomes aware of a security incident affecting portal information that may cause serious harm, it will assess the incident and, where the Notifiable Data Breaches scheme applies, notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required. Remedy will also notify the client promptly where the incident affects their data.

Complaints

A client who believes Remedy has breached the APPs can raise a complaint using the contact details below. Remedy will acknowledge and investigate the complaint and respond within a reasonable period.

If the client is not satisfied with the outcome, they can contact the OAIC at oaic.gov.au or 1300 363 992.

Changes to this policy

Remedy may update this policy from time to time. The current version is always available in the portal, with the "last updated" date shown above.