How we collect, hold, use and disclose personal information across every Program and Offering we operate.
AI Institute is a program and brand operated by Ulleo Holdings Pty Ltd, ABN 84 661 335 173.
1.1 AI Institute is a program and brand operated by Ulleo Holdings Pty Ltd, ABN 84 661 335 173. This policy explains how Ulleo Holdings Pty Ltd collects, holds, uses and discloses personal information across every Program and Offering we operate. In this policy, we, us and our mean Ulleo Holdings Pty Ltd.
1.2 We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) where they apply.
1.3 A collection notice shown when you purchase, enquire or provide information gives more specific information about that collection, including anything specific to the relevant Program or Offering. This policy describes our general information-handling practices.
2.1 You may make a general enquiry without identifying yourself, or by using a pseudonym, where it is practicable for us to respond that way.
2.2 We need accurate identifying information where it is impracticable to deal with you anonymously, including to: process payment or issue a tax invoice; enrol you and secure your account; verify eligibility for a professional cohort; record attendance, completion or CPD; investigate an account, security or legal issue; or respond to an access or correction request about your information.
3.1 Depending on how you deal with us, we may collect:
3.2 Payment card details are processed by Stripe or the payment provider presented at checkout. We do not store your full card number. If you choose a buy-now-pay-later provider, that provider separately collects and handles information under its own privacy policy and terms.
3.3 Membership of a professional or trade association is sensitive information under the Privacy Act. We collect professional-association membership information with your express consent where it is reasonably necessary for CPD or professional-development administration or reporting for the Offering you purchased.
3.4 Where a Program's Rider identifies a category of sensitive operational information that must not be shared with us (for example, patient health information for a healthcare Program), we do not ask for it and participants must not provide it. We also do not ask for medical evidence to consider an exceptional refund request.
3.5 If information described in clause 3.4, or other unexpected personal information, reaches us, we will promptly assess it and take reasonable steps to restrict access and securely delete or de-identify it where lawful and practicable. We may retain a limited incident record where reasonably required for security, legal or compliance purposes.
4.1 We usually collect personal information directly from you when you: visit our website or submit a form; purchase, activate a practice-funded seat or create an account; attend or complete a Session or assessment; communicate with us; or consent to marketing or CPD reporting.
4.2 We may collect your name, business email and role from a practice, group or employer that buys a seat for you. The purchaser must tell you before giving us those details. We collect any sensitive professional-association membership information directly from you unless another lawful basis applies.
4.3 Where a Program has a Distribution Partner, we may receive contact or campaign information from it where that information was collected and disclosed lawfully for the relevant Program purpose.
4.4 We collect some online information automatically through cookies, pixels, logs, tracking links and similar technology. Our Cookie and Tracking Notice explains the technology in use and the choices available to you.
5.1 We handle personal information where reasonably necessary to: respond to enquiries and assess eligibility; process orders, payments, refunds and tax invoices; create and secure accounts; deliver, support and improve Programs and Offerings; record Sessions and provide cohort access; verify attendance, completion and assessment; administer, report and audit CPD; communicate service, safety and schedule information; attribute purchases and suppress marketing for a purchased Offering; manage complaints, incidents, fraud, misuse and legal claims; comply with law, accreditation requirements and accounting obligations; analyse performance using aggregated or de-identified information; and send optional marketing where we have the required consent or other lawful basis.
5.2 If we use information for another purpose, we will do so only where you consent, would reasonably expect it and the law permits it, or another legal basis applies.
Distribution Partners and CPD or professional accreditation
6.1 Where a Program has a Distribution Partner, we may disclose your name, email address and phone number to that partner to: determine whether its campaign led to the purchase; and suppress further marketing of that Offering to you after purchase.
6.2 Under our agreement with a Distribution Partner, it must not add a purchaser disclosed by us to its own marketing audience or database, except to suppress marketing to that person.
6.3 A Distribution Partner may provide us with irreversibly hashed identifiers from a relevant campaign audience so an attribution can be checked without us receiving that audience list in plain form.
6.4 Where an Offering is presented as accredited or seeking accreditation by a professional or accrediting body, we treat an in-progress application as pending until written approval is received. If approved, we may collect and use the professional membership or registration details and assessment-completion information reasonably required to administer and report eligible CPD and may disclose that information to the relevant accrediting body.
6.5 The completion requirement for an accredited Offering is the requirement stated in its Offering Schedule. Where it is submission of an assessment, no passing score or separate evidence of live attendance, recording views or course completion is required unless the Offering Schedule states otherwise. We may record assessment responses so the correct answer can be shown after an incorrect response. We will not disclose individual assessment answers to a purchaser or Distribution Partner unless the participant consents or the law requires it. An accrediting body may retain, review or audit CPD records as permitted by its standards.
Purchasers, participants and service providers
6.6 If a practice, group or employer paid for your seat, we may tell it whether the seat was activated and whether you completed the Offering. We do not provide your individual assessment answers or results unless you consent or the law requires it.
6.7 Other enrolled participants may see information you choose to share in a Session, recording, chat, forum or group activity.
6.8 We disclose information to service providers that help us operate, including: learning and video-conferencing platforms; website hosting, cloud storage and security providers; Stripe and any other payment method selected at checkout; customer relationship management, email and support systems; analytics and campaign-attribution providers; and professional advisers, auditors and insurers. These providers may use information only to provide the relevant service or as otherwise permitted by law and their contract with us.
Other disclosures
6.9 We may provide a Distribution Partner with de-identified or pseudonymous conversion information reasonably required to validate and pay a referral fee. We do not provide participant contact details for the partner's own marketing unless the participant separately agrees or another lawful basis applies.
6.10 We may disclose information: where you consent; where required or authorised by law, court or regulator; to investigate or protect against fraud, security threats, serious misconduct or harm; in connection with a proposed or completed sale, restructure or transfer of our business, subject to appropriate confidentiality and privacy protections; or as otherwise permitted by the Privacy Act.
6.11 We do not sell personal information.
7.1 We seek express, recorded consent before collecting professional-association membership information unless an exception under law applies.
7.2 The consent request will explain what information is collected, why it is needed, and who receives it. Marketing consent is separate and optional.
7.3 You may withdraw consent for future handling by contacting us. Withdrawal does not undo an earlier lawful disclosure and may mean we cannot report CPD or provide a feature that requires the information. We will explain the practical effect before acting on the withdrawal where possible.
8.1 Our own learning and in-house CRM systems are intended to store data in Australia. Gmail is used for email and Stripe processes payments. Hosting and video providers are not yet selected. These providers may process information or permit support access outside Australia depending on the service, account plan, settings and subprocessors.
8.2 We will not state that all personal information remains in Australia unless that is substantiated for every relevant provider and configuration.
8.3 A participant may also join a live Session from overseas. If you choose to appear, speak or post in that Session, your contribution may be seen by that participant.
8.4 Where APP 8 applies, we take reasonable steps to ensure an overseas recipient does not breach the APPs in relation to the information, unless an exception under the Privacy Act applies. The applicable collection notice provides any additional relevant detail.
9.1 We send operational messages needed to provide a Program or Offering, such as payment confirmations, access instructions, schedule changes, safety information and completion notices. These are not optional marketing messages.
9.2 We send email or SMS marketing where we have consent or another basis permitted by the Spam Act and Privacy Act. A one-off enquiry or purchase is not, by itself, treated as an unlimited marketing consent.
9.3 You can unsubscribe using the facility in a marketing message or by contacting us. We do not charge for an unsubscribe request and will action it within five working days for electronic marketing.
9.4 You may ask us to identify the source of personal information used for direct marketing, subject to lawful exceptions.
10.1 We use cookies and similar technology to operate and secure the website, remember choices, understand use, measure campaigns and attribute purchases.
10.2 Our Cookie and Tracking Notice identifies the current tools, purposes, providers, retention settings and available controls.
10.3 You may be able to block or delete cookies through your browser or use a consent control presented on our site. Blocking essential cookies may affect website or account functions.
11.1 We take reasonable technical and organisational steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure.
11.2 Access is limited to people and providers who reasonably need it for their role. We review access, vendor arrangements and security controls as appropriate to the information and risk.
11.3 If an eligible data breach is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.
12.1 We keep personal information only for as long as reasonably needed for the purpose for which it was collected or as required by law, accreditation standards, dispute-management or legitimate business-record obligations.
12.2 CPD and participation records are kept for the period required by the relevant accredited provider and accrediting body. Financial and contract records are kept for applicable statutory periods.
12.3 When information is no longer required, we take reasonable steps to destroy or de-identify it, subject to lawful retention, backup and security constraints.
13.1 You may ask for access to personal information we hold about you or ask us to correct it by contacting the Privacy Officer.
13.2 We will verify identity where reasonably necessary and usually respond within 30 days.
13.3 We may refuse or limit access only where the Privacy Act permits. If we do, we will generally give written reasons and explain available complaint options.
14.1 Send a privacy complaint to support@ai-institute.com.au. Please explain the concern and any outcome you seek.
14.2 We will acknowledge the complaint within five business days and aim to respond within 30 days.
14.3 Our Complaints Policy explains our general complaint and internal-review process.
14.4 If you are not satisfied after giving us a reasonable opportunity to respond, you may contact the Office of the Australian Information Commissioner at oaic.gov.au or 1300 363 992.
15.1 We may update this policy when our practices, providers or legal obligations change. The current version and effective date will be published on our website.
15.2 Privacy Officer: support@ai-institute.com.au | +61 3 9961 4365
15.3 Address: Ulleo Holdings Pty Ltd, ABN 84 661 335 173, 2/123 Erskine Street, Middle Park VIC 3206.