Back to Trust CenterReady

Compliance

How RareJourney aligns with Australian and international privacy regulations.

Current compliance status

Australian Privacy Principles (APPs)

Aligned

Privacy Act 1988 (Cth)

RareJourney's privacy practices are designed to comply with all 13 Australian Privacy Principles, including:

  • •APP 1: Open and transparent management of personal information
  • •APP 3: Collection of solicited personal information only
  • •APP 5: Notification of collection with clear privacy policy
  • •APP 6: Use and disclosure limited to primary purpose
  • •APP 8: Cross-border disclosure protections (see subprocessors)
  • •APP 11: Security of personal information (AES-256 encryption, RLS)
  • •APP 12: Access and correction rights provided
  • •APP 13: Right to anonymity (research contributions de-identified)

Notifiable Data Breaches Scheme

Procedure in place

Privacy Act 1988 (Cth), Part IIIC

RareJourney maintains a documented incident response procedure aligned with OAIC requirements. In the event of an eligible data breach, we will notify affected individuals and the OAIC as required by law. See Incident Response.

TGA Medical Device Classification

Not a medical device

Therapeutic Goods Act 1989

RareJourney does not make diagnostic or therapeutic claims and is not classified as a medical device under Australian law. The app is a health information management and support tool, not a diagnostic or treatment platform. All AI companion responses include disclaimers directing users to consult healthcare professionals.

App Store Privacy Labels

Compliant

Apple App Store & Google Play Store requirements

RareJourney's App Store privacy labels accurately reflect our data collection and use practices. Privacy nutrition labels are kept up to date with any changes to data handling practices.

In progress

Privacy and Other Legislation Amendment Act 2024

Deadline: Dec 2026

Automated decision-making transparency requirements

POLA 2024 introduces new obligations for automated decision-making (ADM) systems. While RareJourney's AI companion does not make automated decisions that have legal or significant effects on individuals, we are implementing additional transparency measures:

  • •Clear disclosure when AI is involved in information provision
  • •Explanation of AI logic and data sources used
  • •Human oversight mechanisms for AI companion responses
  • •User controls to request human review or opt out of AI features

Implementation target: Q3 2026 (ahead of December 2026 deadline)

Designed for international compliance

GDPR Readiness

When needed

General Data Protection Regulation (EU)

RareJourney's architecture is designed to support GDPR compliance when we expand to European markets:

  • •Data minimization and purpose limitation built into design
  • •Right to access, rectification, and erasure already supported
  • •Explicit consent mechanisms for data processing
  • •Data Protection Impact Assessment (DPIA) framework ready for implementation
  • •Data processing agreements with subprocessors in place

HIPAA Readiness

When needed

Health Insurance Portability and Accountability Act (US)

Our infrastructure partners support Business Associate Agreements (BAAs) and our architecture is designed to support HIPAA compliance if we expand to US healthcare partnerships:

  • •Azure OpenAI is HIPAA-eligible with BAA available
  • •Supabase on AWS supports HIPAA-compliant configurations
  • •Encryption standards exceed HIPAA requirements (AES-256, TLS 1.2+)
  • •Access controls and audit logging infrastructure in place

Planned certifications

As RareJourney grows and partners with healthcare institutions, we plan to pursue:

  • •SOC 2 Type II certification: Independent audit of security, availability, and confidentiality controls
  • •Privacy Impact Assessment (PIA): Comprehensive assessment of privacy risks and mitigation strategies
  • •Children's Online Privacy Code compliance: When registered by OAIC. Account holders must be 18+. Health information about minors is managed by their parent or legal guardian.

Our commitment to compliance

Regulatory compliance isn't a checkbox — it's an ongoing commitment to protecting your privacy and earning your trust. We:

  • ✓Monitor changes to privacy laws and update practices accordingly
  • ✓Work with legal counsel specializing in health data privacy
  • ✓Maintain transparency about what we're aligned with and what's in progress
  • ✓Respond promptly to regulatory inquiries and user concerns
Contact Privacy TeamRead Privacy Policy