Last updated: 15 July 2026
True Blue Review Pty Ltd ("True Blue Review", "we", "us", or "our") provides automated patient communication services to healthcare practices, including post-appointment communication and patient feedback requests.
This Privacy Policy explains how we collect, hold, use and disclose personal information when our services are used by healthcare practices and when individuals interact with us.
We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
True Blue Review acts as a service provider to healthcare practices ("Clinic").
The Clinic remains the primary holder of patient records. We process limited personal information only on behalf of the Clinic and under its instructions.
We:
We only facilitate communication initiated by the Clinic.
We collect information from Clinics including:
Through secure integrations with practice management systems or uploaded contact data, we may receive limited patient information:
We do not collect clinical notes, diagnoses, treatment information, or medical histories.
However, under Australian law, confirmation that a person attended a healthcare appointment constitutes health information.
We use personal information only to operate the service requested by the Clinic:
We do not use patient information for advertising, profiling, or independent marketing.
We do not sell or rent personal information.
We process patient information as a contracted service provider to the Clinic.
The Clinic is responsible for:
We process information only to perform the services requested by the Clinic.
We may disclose personal information only where necessary to operate the service, including to:
We do not disclose patient information to unrelated third parties.
If a Clinic connects its Google Business Profile to True Blue Review, we access Google data using Google’s official APIs, and only after the Clinic explicitly authorises it.
What we access: with the Clinic’s consent (the Google business.manage permission), we read the reviews on the Google Business Profile location(s) the Clinic connects, and — at the Clinic’s direction — post the Clinic’s approved replies to those reviews. We access only the listings the Clinic chooses to connect.
How we use it: solely to display the Clinic’s reviews in its True Blue Review dashboard and to publish the replies the Clinic approves. We never use Google data for advertising and we never sell it.
Storage & retention: we store the access and refresh tokens needed to maintain the connection, together with review content and reply history, in our secure, encrypted database. A Clinic can disconnect Google at any time in its settings, which revokes our access and deletes the stored Google tokens; review data is deleted on account closure.
Sharing: we do not share Google user data with third parties, except secure cloud-hosting subprocessors strictly necessary to run the service.
Limited Use: True Blue Review’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Some service providers (for example SMS delivery providers such as Twilio) may process personal information outside Australia, including in the United States or other jurisdictions where their infrastructure operates.
Where we disclose personal information to overseas recipients, we take reasonable steps to ensure those providers are subject to contractual obligations requiring them to protect personal information in a manner consistent with the Privacy Act 1988 (Cth).
We retain only the minimum personal information necessary to operate the service, including:
We delete or de-identify information when no longer required unless required by law.
We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure.
Measures include:
No online system is completely secure.
Patients may opt out at any time using opt-out instructions (e.g., replying "STOP").
After opting out, the number is suppressed from future messaging from that Clinic via our system.
Individuals may request access to or correction of personal information we hold.
Because we act on behalf of a Clinic, we may refer the request to the relevant Clinic.
Contact: contact@TrueBlueReview.com.au
If you believe we have mishandled personal information, contact us.
If unresolved, you may contact the Office of the Australian Information Commissioner (OAIC): https://www.oaic.gov.au
We may update this Policy periodically. The latest version will always appear on our website.
True Blue Review Pty Ltd