Privacy Policy

1. Information handled by EasyAyu

• Account and practice information: names, email addresses, phone numbers, login credentials, user roles and permissions, practice details, branch details and uploaded practice or invoice logos.
• Patient information: names, file numbers, contact and emergency contact details, addresses, demographic information, and optional occupation or company details entered by a practice.
• Health and treatment information: medical history, clinical notes, case sheets, assessments, diagnoses, vitals, prescriptions, appointments, admissions, treatment plans, packages and session records entered or uploaded through the service.
• Billing and operational information: invoices, charges, discounts, payment amounts, payment methods, transaction references, stock and service catalogue records. Recording a payment reference does not require you to enter a card PIN, banking password or card security code.
• Technical and support information: IP addresses and browser or device information provided with web requests, authentication and session information, security or error logs, and information you send when requesting support.

Information may be provided by you, by your healthcare practice and its authorised users, or through your use of the service. The information held for a patient depends on what their practice records.

2. Why information is used

EasyAyu uses information to create and authenticate accounts, apply practice and branch permissions, maintain patient records, manage appointments and treatments, prepare prescriptions and bills, record payments, manage inventory, provide support, protect accounts and investigate technical problems. Information may also be retained or disclosed where necessary to meet applicable legal obligations.

Practices are responsible for having an appropriate basis and any necessary consent to collect and use patient information. Using this platform does not replace the practice's responsibility to explain its own clinical and administrative handling of patient records.

3. Access and sharing

Records are available to authorised users of the relevant practice according to their assigned permissions. A practice can share patient and inventory records between its own branches. Users can print, export or share records through the available features; the practice is responsible for the recipients and handling of those copies.

Service providers supporting hosting, delivery of account verification emails and technical operation may process information needed to provide those services. Public assets such as icon fonts may be delivered by a content delivery network, which receives the technical information needed to respond to those requests. When Google sign-in is available and you choose it, Google processes the sign-in and supplies the account identity information needed to authenticate you, under Google's Privacy Policy.

Information may be disclosed in response to applicable law or a valid legal request, or where necessary to protect the service and its users. Patient health information is not offered for sale or for advertising purposes.

4. Cookies, sign-in and local storage

The website and its WebView interface use session cookies and persistent sign-in tokens to authenticate you and keep you signed in. Browser or WebView storage may also hold preferences and temporary billing drafts. These features help you resume work and avoid losing an unfinished draft.

Use Logout before leaving a shared device. Clearing browser or app data can remove local information and require you to sign in again. It does not by itself delete records stored by the practice on the server.

5. Device access and uploads

Where a feature allows you to select a file or image, the selected content is uploaded for that feature. Permission-controlled device features depend on the app version and the feature you choose; you can review or revoke Android permissions in your device settings. Revoking access may prevent the associated feature from working. Avoid uploading information unrelated to the patient's care or practice administration.

6. Security

The service uses HTTPS connections, authenticated sessions and role-based access controls to protect access to practice information. Account holders should use strong passwords, keep access credentials private and give staff only the permissions they need. No method of transmission or storage can guarantee absolute security. Contact us if you suspect unauthorised access.

7. Retention

Account and practice records are retained while needed to provide the service and for applicable healthcare, accounting, security and legal obligations. Clinical and financial retention requirements can vary by practice, record type and applicable law, so a single retention period does not apply to every record.

When a verified deletion request can be fulfilled, information that is no longer required is deleted or anonymised. Information that must be retained for legal obligations, disputes, fraud prevention or clinical recordkeeping may be retained with restricted access. Copies in backups may remain until those backups are replaced or expire. We will explain any relevant retention exception when responding to a deletion request.

9. Your choices and requests

You may request access to, correction of or deletion of your personal information, or raise a concern about its use, by contacting your practice or mail@easyayu.com. Available rights and any limits depend on applicable law and the nature of the records. We may need to verify your identity before providing or changing information.

10. Children's information

EasyAyu is intended for healthcare practices and their authorised users. Practices may record information about children as part of providing healthcare, with the necessary parent or guardian involvement and other safeguards required by applicable law.

11. Changes and contact

Updates to this policy will be posted on this page with a revised date. For questions about EasyAyu's handling of information, contact mail@easyayu.com. For questions about treatment or a practice's clinical records, contact that practice directly.