Skip to content

Privacy Policy

Last updated 1 November 2026

1. Who we are

Retinote is operated from Brisbane, Queensland, Australia (ABN 25 238 500 350). We build CPD tracking software for Australian optometrists. This policy explains how we handle your personal information in compliance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

If you have questions about this policy, contact us at support@retinote.com.au.

2. What information we collect

We collect the following categories of information:

  • Account:your name, title and email, and how you sign in (email and password, Google or Microsoft). Your password is handled by Google's authentication service "Firebase", and we never see it.
  • Professional details: registration number, therapeutic endorsement, state, practice type, practice name and address.
  • CPD records: activities, conferences, learning goals, reflections, notes, and files you upload (certificates, attachments, CPR certificates).
  • Retinote Learning: what you read, your quiz answers and scores, when you complete content and your confirmation that you did, your time zone, and the certificates we issue in your name (we also add these to your CPD log).
  • Retinote Learning without an account: anyone can read our public articles, take the quiz and download a certificate without signing in.
    • The name you type for a certificate is used only to make the PDF at that moment. We don't store, log or share it, and we don't ask for your email.
    • Each activity you complete is kept in a cookie in your browser (lc_pending): a signed record of the article, the date, your quiz score and answers, and the terms version you accepted, but not your name. It exists so the activity can be added to your CPD record if you subscribe in the same browser. It's our own cookie on retinote.com.au, lasts 90 days, and clearing your cookies removes it.
    • Your browser's storage also keeps your acceptance of the terms, the activity you've just completed while you get its certificate, and the public articles you've opened (only their address and when you opened them).
    • We use your IP address, in memory only, to limit how often quizzes can be submitted and certificates downloaded. We don't store it.
    • We record anonymous usage events, such as article views, quizzes started or passed, and certificate downloads.
    • If you follow a link from Retinote Learning and then sign up or subscribe, we record which link it was and how you signed up.
  • Your choices: whether you've agreed to AI assistance and the Retinote Learning terms, and when.
  • Payments: your subscription status and dates. Stripe holds your card details; we never see them.
  • Usage: pages visited, errors, device and browser, linked to a user ID. Our servers also see your IP address.

How we collect it. Mostly from you. Also from Google or Microsoft if you sign in with them, from Stripe about your payments, and from your organisation (your name and email) if it provides your access.

We do not knowingly collect information from anyone under 18.

3. How we use your information

We use your information to:

  • Provide, operate, and maintain your Retinote account.
  • Process subscription payments and manage billing.
  • Draft reflections and suggest learning goals when you ask.
  • Count how many times each Retinote Learning article is completed and its certificate downloaded without an account. These are totals only, with no personal information.
  • Add activities you completed without an account to your CPD record when you subscribe in the same browser. They become ordinary CPD records, dated when you did the work.
  • Send you account emails (email verification, password resets). Stripe sends payment receipts.
  • Improve and develop the service.
  • Comply with our legal obligations and resolve disputes.

We do not sell your personal information to third parties.

4. Who we share it with and where it's kept

We share information only with the following providers, and only to the extent necessary:

  • Microsoft Azure (Australia): hosting, database, file storage, email delivery and app monitoring.
  • Google Firebase (US): sign-in and account security. If you sign in with Google or Microsoft, they share your name and email with us.
  • Stripe (US): payments. We give Stripe your name and email to set up billing; you give your card details to Stripe directly.
  • OpenAI(US): AI writing assistance, only when you use it. OpenAI receives the activity or goal you're working on and any goals or activities linked to it. It never receives your name, email or registration number. OpenAI processes this in the United States. See our AI assistance terms.
  • LaunchDarkly (US): switches features on and off. It receives your email address and account type.
  • Google Maps (US): suggests addresses as you type in an address field. It receives what you type.

We choose providers that protect personal information and use it only to provide their service to us, subject to their own privacy policies where they act independently (for example, Stripe's fraud checks).

Where your information is kept. Your account, CPD records and files are stored in Australia (Microsoft Azure, Australia East). The providers marked (US) above may store or process your information in the United States. We take reasonable steps to make sure they handle it consistently with the Australian Privacy Principles.

Our monitoring records errors and performance against a user ID, not your name or the content of your records, and keeps it for 90 days.

Security. We encrypt your data in transit and limit who can access it. Authorised Retinote staff can view your account and records when they need to, for example to answer a support request, fix a problem or keep the service secure.

5. Data retention

We keep your information while you have an account, including after a subscription ends, so your records are there if you come back. You can delete your account at any time in Profile (or from the subscription-expired page if your subscription has ended). When you do, we immediately delete your profile, CPD records, notes, conferences, learning goals, uploaded files, Retinote Learning progress and certificates, and consent records, and we cancel your subscription. If we close your account, we delete the same information. Backup copies are deleted within 90 days. Monitoring logs, which identify you only by a user ID, are deleted after 90 days. Stripe keeps the payment records it must keep by law.

6. Your rights

Under the Australian Privacy Principles, you have the right to:

  • Access the personal information we hold about you.
  • Request correction of inaccurate or incomplete information.
  • Delete your account yourself at any time in Profile (or from the subscription-expired page if your subscription has ended).
  • Complain about a breach of your privacy rights.

To exercise any of these rights, email support@retinote.com.au. We will respond within 30 days.

If you are unsatisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

7. Cookies and tracking

See our Cookie Policy.

8. Changes to this policy

We'll tell you about important changes by email or in the app. The date at the top shows the last update.