• We collect what you choose to share, including information about your child, to run AutismX's features.
• Your Journal and Therapy Notes are private to you. If a Therapy Note is flagged for a safety concern, a moderator may see a short excerpt.
• Some features send your content, as written, to AI and voice typing providers.
• We do not sell your personal information, and we do not use it to train AI models.
• Our main database is hosted in Australia; some providers process information overseas, mainly in the United States.
• You can access, correct and delete your information, and complain to the OAIC if you are unhappy with how we handle it.

This Privacy Policy explains how MIGXGROUP PTY LTD (ABN 88 701 041 358), trading as AutismX (we, us, our), collects, holds, uses and discloses personal information through autismx.org and related apps and services (the Platform). We comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Please read it with our Terms of Service.

Personal information means information or an opinion about an identified person, or a person who is reasonably identifiable. Sensitive information includes health information, such as a child's diagnosis, development, therapy or wellbeing, and receives extra protection under the Privacy Act.

Accounts are held by adults: parents, carers, guardians and family members of autistic children. We do not knowingly collect information directly from children. Information about a child is provided by the adult account holder, or by providers the account holder has approved to send notes to Therapy Notes.

Providing information is your choice, but some features will not work without it. Health information, including Child Information, is collected only with your consent, which you give by choosing to enter it. Health information in Therapy Notes is collected only after you agree to a specific consent step when you set up Therapy Notes. We do not store your IP address in visit records.

We collect most information directly from you when you register, use features, post, message or contact us. We also collect some information:

• from providers who send notes to your Therapy Notes address, after you approve them as senders;
• from other members, if they mention you in a post, message or event; and
• automatically, when you use the Platform, through our hosting network, cookies, browser storage and analytics.

We use Child Information only to provide the features you choose to use, to keep the Platform safe, and as required by law. We do not use it for advertising, do not sell it, and do not use it to train AI models. Child Information in your Journal and Therapy Notes is visible only to you, except that if a Therapy Note is flagged for a safety concern, a moderator may see a short excerpt. It becomes visible to others only if you choose to share it in Community, Our Story, messages, group chats or events. Full Community posts and replies are visible only to signed in members.

Please do not share information that identifies another family's child without their parent or guardian's permission. If you believe information about your child has been shared without your permission, contact us and we will act promptly.

We use personal information for the purpose we collected it, and for related purposes you would reasonably expect, including to:

• create and manage your account and verify your identity;
• provide Community, Our Story, Journal, Therapy Notes, messaging, group chats, events, notifications and Resources;
• moderate Content to detect safety concerns such as crisis language, abuse disclosure and grooming;
• respond to reports, complaints and requests;
• send account, security and service emails, and onboarding and product emails you can unsubscribe from at any time;
• understand how the Platform is used, using aggregated information where practical, so we can improve it; and
• comply with the law and protect the safety of members and children.

We only use or disclose sensitive information for a purpose directly related to why you gave it to us, with your consent, or where the law permits or requires.

Some features use artificial intelligence. The following is sent, as written, to AI service providers:

• Community posts, replies and messages, for moderation and tag suggestions;
• emails sent to Therapy Notes, for a safety check and a relevance check, done together;
• keywords, your family story and mood, for the Our Story helper and motto;
• voice recordings, to turn them into text, which is then tidied by AI.

This content is not de identified before it is sent. Our primary AI provider's business terms do not allow it to train its models on this content. Its retention periods depend on its terms. Voice typing sends audio and text through an AI gateway provider to separate transcription and text tidying models; the gateway's and its underlying providers' retention terms are subject to that provider's terms. We do not use your personal information to train any AI model.

We do not sell or rent personal information. We share it only:

• with other members, to the extent you choose to share through Community, Our Story, messages, group chats or events;
• with service providers who help us run the Platform, including hosting, database and file storage, email delivery, analytics, AI and voice typing, virus checking, place search and push notification services, who may use it only to provide their services to us;
• with professional advisers such as lawyers, accountants and insurers;
• with police, emergency services, child protection or other authorities where we reasonably believe it is necessary to prevent a serious threat to someone's life, health or safety, or where required or authorised by law;
• with a new owner of the Platform if the business is sold or restructured, who must continue to protect it under this policy; or
• with your consent.

Our main database and file storage are hosted in Australia. Our website is delivered through a global hosting network. Some service providers store or process information overseas, mainly in the United States, including for email delivery, AI and voice typing, virus checking and analytics. Inbound Therapy Notes emails are received through our email provider's servers in Japan, and that provider keeps copies of the emails it processes in the United States for about 30 days, plus short-term backups. Place search providers operate internationally, including in Germany. Embedded videos are provided from the United States. We take reasonable steps, including relying on providers' contractual commitments, to make sure overseas recipients handle personal information consistently with the Australian Privacy Principles.

We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, change or disclosure, including:

• encryption in transit and at rest;
• database rules that limit who can read and change each type of information;
• an email code before changing your password or deleting your account;
• checking passwords against known data breaches, without sending your password, and blocking temporary email addresses;
• limits and lockouts on repeated sign in and code attempts;
• checking Therapy Notes attachments against a database of known malware, and inspecting PDFs for hidden code; and
• automated privacy tests and alerts for unusual activity.

No system is completely secure, so please use a strong password and keep your login details private.

We keep personal information only as long as we need it for the purposes in this policy, or as the law requires. When you delete your account, we delete your account, your Content, your Journal, your Therapy Notes and the files you uploaded from the live Platform straight away, and they can no longer be seen or recovered by you or other members. Copies that remain in our database backups, which are kept for 7 days, and copies held by our email provider are removed automatically within 37 days. Some service providers, such as AI services, may keep data for longer under their own terms, as described in section 7. Messages you sent remain in other members' conversations so they keep their own record, and those conversations show that you have left AutismX. You are removed from any group chats.

We keep a small number of records after deletion:

• moderation and safety records, such as reports, moderation decisions and copies of flagged content, to protect members and respond to safety concerns;
• a record of which version of our Terms you accepted and when, to resolve any disputes; and
• email and Therapy Notes delivery logs with your email address and account link removed, so they cannot be connected to you.

Moderation, safety and Terms records are deleted 7 years after your account is deleted, and delivery logs after 2 years.

You can:

• access and correct most of your information in your account, or ask us to do it;
• ask for a copy of your personal information, which we will provide in a commonly used format;
• delete individual Content, or delete your account;
• set Our Story to private, and use a display name;
• post anonymously in Community;
• turn off push notifications and unsubscribe from onboarding and product emails, while still receiving essential account and safety emails; and
• withdraw consent to us handling health information you have given, though some features may then stop working.

We will respond to requests within 30 days. If we refuse a request, we will explain why in writing.

We use Google Analytics to understand how the Platform is used, which sets its own cookies. We also use one cookie to remember how the menu is displayed. We do not use advertising or retargeting cookies in our own code. Google signals and ad personalisation are turned off for our Google Analytics.

The Platform also stores some information in your browser, such as your sign in session, theme, recent searches, unsent drafts, and your progress in some checklists and features. You can clear this in your browser settings, and block cookies, but some features may not work.

If a data breach is likely to result in serious harm to you, we will notify you and the OAIC as required by the Notifiable Data Breaches scheme, and tell you what happened, what information was involved and what you can do. We aim to assess any suspected breach as quickly as possible, and within 30 days of becoming aware of it.

If you have a question or complaint about privacy, contact us at support@autismx.org. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

We may update this policy when our practices, the Platform or the law change. For significant changes, we will give you at least 14 days notice by email and in the Platform before they take effect. Previous versions are available on request.

MIGXGROUP PTY LTD, trading as AutismX

support@autismx.org

Suite 17, 89 to 97 Jones Street, Ultimo, NSW 2007