Version 2026-09-08 | Effective: 8 September 2026
This Data Processing Agreement ("DPA") is entered into between:
This DPA forms part of the Terms of Service and governs the processing of personal information - including health information - that end users of your RIKO AI chat widget may share during conversations.
In this DPA, "personal information" and "health information" have the meanings given under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
Rapid Intelligence processes personal information on your behalf solely to provide the RIKO AI chat assistant service you have subscribed to. This includes:
Where your plan or pilot includes RIFT, we also process your practice billing records on your instruction - which may include health information - solely to operate RIFT for your practice: identifying unbilled, unpaid, or unclaimed amounts and sending the account reminder emails you direct, under settings and approvals you control. Section 13 of the Terms of Service and section 2.3 of the Privacy Policy describe that processing and its safeguards, and apply as part of this Agreement.
We do not use end user personal information for any purpose other than delivering the service to you.
Depending on what your end users choose to share in the chat, the information processed may include:
Where your plan or pilot includes RIFT, we also process on your behalf: patient names, client numbers, and contact details; appointment dates and attendance status; invoice, payment, and claim details including funded-plan and Medicare claim references; and practitioner names. Treatment notes, letters, and attachments are never requested.
Because you are a healthcare or allied health provider, some of this information will constitute health information under the Privacy Act 1988 - a sensitive category requiring a higher standard of care. This DPA exists to formalise the obligations that apply to that processing.
Rapid Intelligence will:
As the data controller, you are responsible for:
We engage the following sub-processors to deliver the service. By accepting this DPA you authorise their use:
We will notify you at least 14 days before engaging any new sub-processor that processes personal information. You may object within that period by contacting us at contact@rapidintelligence.com.au.
Some sub-processors (OpenAI, Resend, Stripe) are located in the United States. By accepting this DPA you acknowledge that your end users' personal information may be transferred to and processed in the United States for the purposes described above. We have contracted with these sub-processors on terms requiring appropriate data protection standards.
We recommend that your privacy notice to end users discloses that their information may be processed by AI systems operated by a US-based provider.
Conversation logs are automatically deleted 12 months after creation via a daily scheduled job. Booking records are retained for the duration of your subscription plus 90 days following termination, after which they are permanently deleted.
You may delete individual conversation records at any time from your RIKO dashboard. If you require bulk deletion of end user data (for example in response to a data subject erasure request), contact us at contact@rapidintelligence.com.au and we will action it within 30 days.
We implement the following technical and organisational measures:
A summary of our security practices is available at rapidintelligence.com.au/security.
If we become aware of a data breach that is likely to result in serious harm to your end users, we will notify you at the email address associated with your account within 30 days of becoming aware of the breach, with as much detail as we can reasonably provide at that time.
You remain responsible for assessing whether the breach triggers a mandatory notification to the Office of the Australian Information Commissioner (OAIC) or affected individuals under the Notifiable Data Breaches scheme.
Each party is responsible for compliance with its own obligations under this DPA and the Privacy Act. Our liability for any breach of this DPA is limited to the extent set out in our Terms of Service. We are not liable for any processing you carry out as data controller in breach of your obligations, including failure to obtain appropriate consent from end users.
This DPA remains in force for as long as we process personal information on your behalf under the Terms of Service. It automatically terminates when your subscription ends. Post-termination, we will retain data only as required by our standard retention policy (section 8) or applicable law, after which it is permanently deleted.
This DPA is governed by the laws of Victoria, Australia. The parties submit to the non-exclusive jurisdiction of the courts of Victoria.
This DPA is accepted by the Client through a click-wrap agreement at account creation. Click-wrap acceptance constitutes a valid and binding agreement under Australian contract law, equivalent to a written signature.
The date and version of the accepted DPA are recorded in our systems against the Client's account.