Privacy Policy

This Privacy Policy governs TriLoch Solutions Limited's ("TriLoch", "we", "us") collection, use, and disclosure of personal information through your access to or use of LeadSmith Assistant and any related services, applications, or website (collectively, the "Service"). This Privacy Policy should be read alongside our Terms of Service and, where applicable, our Health Information Terms, available at https://leadsmithassist.com/terms-of-service.html and https://leadsmithassist.com/healthcare-addendum.html. It explains how we handle personal information; it is not intended to obtain any consent that Applicable Privacy Law requires to be given separately.

This Privacy Policy applies to all LeadSmith customers, whether or not you are a healthcare organisation. Where a section applies additional detail specifically because you have identified as a healthcare organisation at signup, that is noted in the section itself — otherwise, everything in this Policy applies equally to every Customer.

1. Introduction

1.1 TriLoch is committed to protecting the privacy of all individuals who provide personal information to us, including information recorded by our customers ("Customers") in LeadSmith Assistant about their own clients, patients, or contacts ("Customer Data").

1.2 TriLoch handles personal information in accordance with the Privacy Act 2020 (New Zealand) and, to the extent applicable, the Health Information Privacy Code 2020 (New Zealand), the Privacy Act 1988 (Cth), the Australian Privacy Principles, and applicable Australian state or territory health-records legislation (together, "Applicable Privacy Law").

1.3 "Personal Information" means information about an identifiable individual, as defined in the Privacy Act 2020 (NZ) and/or the Privacy Act 1988 (Cth) (AU).

1.4 "Health Information" means personal information about an identifiable individual relating to their health, disability, or health services, as defined in the Health Information Privacy Code 2020 (NZ), and/or as a category of "sensitive information" under the Privacy Act 1988 (Cth).

2. Personal Information We Collect

2.1 Directly from you

If you sign up for, or are a user on, a LeadSmith account, we collect information such as your name, business or practice name, email address, phone number, business address, and billing/payment details. We do not directly collect any special categories of information about you, such as health information, unless you provide it to us directly (for example, in a support request).

2.2 Indirectly — Customer Data

We indirectly collect personal information when a Customer uses LeadSmith Assistant to record information about someone other than themselves - typically their own clients, patients, or contacts. This can include names, contact details, appointment and opportunity records, and notes, which - where the Customer is a healthcare organisation - may include Health Information such as the type of treatment or procedure. TriLoch does not decide what Customer Data a Customer records; the Customer controls this and is responsible for having a lawful basis to collect and hold it and for taking reasonable steps to give each affected individual any collection notice required by Applicable Privacy Law, including New Zealand IPP 3A or HIPC rule 3A and Australian APP 5.

2.3 Automatically collected

We automatically collect limited technical information when you use the Service, such as IP address, device and browser type, and usage/log data, for security, troubleshooting, and service-improvement purposes.

3. How We Use Personal Information

We use the personal information we collect to:

• Provide, operate, maintain, and improve the Service;
• Bill and manage Customer accounts;
• Provide customer support and respond to enquiries;
• Maintain the security of the Service and detect or prevent fraud or misuse;
• Comply with our legal obligations.

Our use of Customer Data - personal information Customers record about their own clients or patients - is limited to providing and supporting the Service to the Customer, including generating and sending the reminders and service communications configured by the Customer. We do not use Customer Data for our own marketing, product benchmarking involving identifiable individuals, training artificial-intelligence models, or any other purpose outside providing the Service, except as described in Section 8 (De-Identified and Aggregate Data).

We will not use your personal information to send you marketing communications unless you have opted in to receive them. You can opt out at any time.

4. How We Share Personal Information

We do not sell or rent personal information. We may disclose personal information to:

• Subprocessors who provide services to us, such as cloud hosting, email delivery, payment processing, and customer support tooling, strictly for the purposes of providing the Service. A current list of subprocessors is available on request at [email protected].
• A related company of TriLoch, for the same purposes described in this Policy.
• A prospective or actual acquirer, in the event of a merger, acquisition, or sale of assets, subject to the acquirer being bound by materially equivalent privacy commitments.
• Law enforcement, regulators, or courts, where required or authorised by law.

Where we add or replace a subprocessor that will handle Customer Data, we will update the subprocessor list and, for Customers in Healthcare compliance mode, notify the Customer before the change takes effect.

Where a Customer connects a third-party application to their LeadSmith account (for example, via an API key or integration), that third party's access to Customer Data is controlled by the Customer, and use of the data by that third party is governed by the third party's own privacy policy, not this one.

5. Overseas Transfer of Information

TriLoch may store and process personal information, including Customer Data, outside New Zealand and/or Australia — for example, in the cloud hosting region used to run the Service. The current hosting region is identified in Schedule C of our Data Processing & Health Information Agreement, available on request. Where we transfer information overseas, we act solely as the Customer's processor and do not use the information for our own purposes. To the extent this involves a disclosure requiring assessment under Applicable Privacy Law (including Rule 12 of the Health Information Privacy Code 2020 or Australian Privacy Principle 8), we take reasonable steps to ensure the recipient is subject to comparable privacy protections, including through contractual commitments with our subprocessors.

6. Security of Your Information

We take reasonable steps to keep personal information secure and protected from unauthorised access, use, or disclosure, including:

• Encryption of data at rest (AES-256) and in transit (TLS 1.2+);
• Role-based access control and multi-factor authentication for administrative access;
• Audit logging of access to, and modification of, records;
• Automatic session timeout after a period of inactivity;
• Regular vulnerability scanning and security testing;
• Documented incident response and breach notification procedures;
• Workforce privacy and security training.

No method of transmission or storage is completely secure. If we become aware of a breach affecting your personal information, we will notify affected Customers without undue delay — and, for Customers in Healthcare compliance mode, within the timeframe set out in our Health Information Terms — consistent with Applicable Privacy Law.

7. Data Retention and Account Closure

We retain personal information only for as long as necessary to provide the Service or as required by law. If a Customer closes their LeadSmith account, Customer Data is deleted within a reasonable period following closure, unless we are required by law to retain it. Personal information about a Customer's own account (billing history, for example) may be retained for longer where required for legal, accounting, or dispute-resolution purposes.

8. De-Identified and Aggregate Data

We may use de-identified or aggregated information — from which identifying details have been removed — to analyse and improve the Service, for benchmarking, or for general reporting. This information will never identify, and cannot reasonably be used to re-identify, an individual.

9. Your Rights

9.1 If you are a Customer (account holder)

You can access, correct, export, or request deletion of your account information at any time through your account settings, or by contacting us at [email protected].

9.2 If your information was entered into TriLoch by a Customer (for example, you are a patient or client of a Customer)

TriLoch does not interact with you directly, however, if you wish to access or correct information a Customer holds about you in LeadSmith Assistant, please contact that Customer (business or practice) directly, as it controls that information. If you contact TriLoch directly, we will refer your request to the relevant Customer and reasonably assist the Customer in responding. Customers remain responsible for any direct notice or response required of them under Applicable Privacy Law.

10. Cookies and Similar Technologies

TriLoch uses one cookie and one small piece of browser storage, both strictly functional. We do not use analytics cookies, advertising or marketing pixels, or third-party trackers of any kind.

10.1 Session Cookie

We use a single first-party cookie, named "leadsmith_session", set entirely by TriLoch's own servers:

• Purpose: strictly functional — keeps you signed in, and remembers which organisation (tenant), role, and healthcare-compliance setting apply to your session.
• Contents: your user ID, tenant/organisation ID, role, a healthcare-organisation flag, and a last-activity timestamp. It contains no tracking or advertising data.
• Security: the cookie is HttpOnly (inaccessible to JavaScript), uses SameSite=Lax, and is transmitted only over HTTPS (Secure) in production.
• Lifetime: expires after 12 hours regardless of activity (hard cap), and earlier if inactive — after 15 minutes of inactivity for healthcare-organisation accounts, or 60 minutes of inactivity for other accounts.

10.2 Local Storage

In addition to the session cookie, TriLoch stores one item in your browser's local storage. This is not a cookie, but is included here as a similar technology:

• What: a single date value recording that you dismissed the "Tip of the Day" widget on the dashboard that day.
• Purpose: a user-interface preference only — it does not identify you and is not linked to your account, your activity, or any tracking.
• Scope: stored per browser/device only; it is not synced across devices or sent to our servers.

10.3 What We Don't Use

TriLoch does not use analytics cookies, advertising or marketing pixels, or third-party trackers. Billing is handled by Stripe, but only via redirect to Stripe's own hosted checkout page — no Stripe script or cookie runs on TriLoch's own domain, so there is nothing from Stripe to disclose as a LeadSmith cookie.

11. Children's Information

LeadSmith Assistant is a business tool intended for use by Customers and their staff, not by children. We do not knowingly collect personal information directly from children. Where Customer Data recorded by a Customer relates to a minor (for example, a patient under 18), the Customer is responsible for ensuring it has a lawful basis to collect and hold that information.

12. Changes to This Privacy Policy

We may update this Privacy Policy. When we do, we will revise the "Last updated" date below. Where a change materially affects how we handle personal information, we will notify Customers by email or within the Service at least 30 days before it takes effect, except where an earlier change is required to comply with law or to address a security risk. If Applicable Privacy Law requires a new consent or other action, we will obtain that consent or take that action before the relevant processing begins.

13. Complaints and Contact

If you have questions, concerns, or complaints about this Privacy Policy or how we handle personal information, please contact our Privacy Officer using the details below. Please describe the issue and the outcome you seek. We will acknowledge and investigate the complaint and aim to respond within 30 days, or tell you if we reasonably need more time.

TriLoch Solutions Limited

Attn: Privacy Officer

Email: [email protected]

If you are not satisfied with our response, you may complain to the New Zealand Office of the Privacy Commissioner (www.privacy.org.nz) or, for Australian matters, the Office of the Australian Information Commissioner (www.oaic.gov.au). Depending on the location and nature of Australian health information, a complaint may instead or additionally be made to the relevant NSW, Victorian, or ACT health-privacy regulator.

Version 1.1 · Last updated: 21/10/2026