Privacy Policy

1. Who we are

The Dr Robyn AI Support Chat is operated by The Trustee for the 4 Good Unit Trust (ABN 85 145 868 031) trading as The Thompson Method (“we”, “us”, “our”), based in Queensland, Australia.

We are committed to protecting your privacy and handling your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). When you access the Service from the European Economic Area or the United Kingdom, we also handle your personal data in accordance with the GDPR and UK GDPR to the extent they apply.

Privacy Officer
Email: care@thethompsonmethod.com
Post: PO BOX 13, Rainbow Beach, QLD, Australia

2. What this policy covers

This policy applies to personal information we collect through:

• the Thompson Method / My Milk Map Dr Robyn AI Support Chat
• our email communications and customer support; and
• your participation, if you choose, in the Infant Feeding Index research program.

It should be read together with our Terms of Use.

3. The information we collect

3.1 Information you provide to us

• Account information: Your name, email address, password, country or region, and time zone.
• Chat content: The messages, questions and health information you share within chat sessions, including any feeding details, symptoms or personal circumstances you volunteer during the conversation.
• Communications: Messages you send to our support team and responses to surveys.

3.2 Health information (sensitive information)

Much of the information described above is health information, classified as sensitive information under Australian privacy law and special category data under the GDPR. We only collect your health information with your consent, and only for the purposes described in this policy. You can withdraw your consent at any time (see Section 8).

3.3 Information collected automatically

• Usage data: Features used, screens viewed, session length, and interaction events, used to improve the Service.
• Device and technical data: Device type, operating system, app version, IP address, and approximate (country/region-level) location derived from your IP address.

3.4 Payment information

Payments are processed by Stripe or Kajabi Payments. We do not store your full card number on our systems. We receive limited payment metadata (subscription status, plan type, and the last four digits of your card) needed to manage your subscription. Stripe’s handling of your data is governed by Stripe’s privacy policy.

3.5 Information we do not collect

We do not collect your precise GPS location, your contacts, or your photos unless you explicitly choose to share them with us.

4. Why we collect your information

We collect, hold and use your personal information to:

• Provide the Service: Operate your account, deliver AI chat responses, and provide educational support content.
• Process payments and manage subscriptions: Through Stripe.
• Communicate with you: Service messages, support responses, and (with your consent or as permitted by law) educational content and offers.
• Improve and secure the Service: Analytics, troubleshooting, fraud prevention and security monitoring, including human review of transcripts where required (see Section 7.2).
• Research (opt-in only): If you separately and explicitly consent, to include de-identified data in the Infant Feeding Index research program (see Section 6).
• Comply with law: Including responding to lawful requests by public authorities.

We will not use your health information for any purpose beyond those listed above without obtaining your consent first.

We do not embed advertising or marketing pixels, SDKs or trackers inside the Dr Robyn AI Support Chat, and we do not share your chat data with advertising platforms.

Purpose	Legal basis (GDPR)
Collecting and processing health data shared in chat to provide the Service	Consent
Account management, subscriptions, billing and service notifications	Contract
Customer support, security, fraud prevention, service improvement and human review of transcripts	Legitimate interests
Marketing communications	Consent
Infant Feeding Index research participation	Explicit consent (opt-in)
Record-keeping required by law (e.g. financial records)	Legal obligation

5. How the Dr Robyn AI Support Chat processes your data

Understanding how your information moves through our system is important. When you send a message in the chat:

• Your message is received by our servers hosted on Amazon Web Services (AWS) in Australia.
• Before the message is sent to the AI model, our infrastructure applies a de-identification process that strips Protected Health Information (PHI) such as identifiable names, dates of birth and contact details. The message sent to the AI model is not in identifiable form.
• The AI model is provided by Anthropic, PBC and is accessed via AWS. We hold a Business Associate Agreement (BAA) with AWS that governs the handling of health information and prohibits Anthropic from using your data to train its models.
• The AI model generates a response, which is returned to you through our servers.
• The full transcript, including your original identifiable messages as received by our servers, is retained on our AWS infrastructure while your account is active.

Each chat session is stateless: the AI model has no memory of previous sessions and cannot access your feeding profile or account data from earlier conversations.

6. The Infant Feeding Index (optional research participation)

If you choose to opt in, de-identified information from your chat interactions may contribute to the Infant Feeding Index, a research program that aggregates real-world infant feeding data to inform maternal and infant health policy and practice.

Key protections:

• Participation is strictly opt-in through a separate, clearly labelled consent. Declining has no effect on your access to the Service.
• Data contributed to the Index is de-identified before analysis. We apply safeguards to free-text fields to reduce re-identification risk.
• Aggregated findings may be shared with governments, hospitals, researchers and insurers, but never in a form that identifies you or your baby.
• You can withdraw from the program at any time via your account settings. Withdrawal stops future use of your data; analyses already completed on aggregated, de-identified data cannot be unwound.

7. Who we share information with

Recipient	Purpose	Location
Amazon Web Services (AWS)	Cloud hosting, data storage and AI infrastructure (including PHI-stripped message processing)	Australia, United States / global
Anthropic, PBC	AI language model (receives de-identified / PHI-stripped messages only; governed by BAA)	Australia, United States / global
Stripe	Payment processing	Australia, United States / global
Kajabi Payments	Payment processing	Australia, United States / global
Professional advisers	Legal, accounting and insurance, where required	Australia

We require service providers to handle your information only on our instructions and with appropriate safeguards. We may also disclose information where required by law, or in connection with a business restructure or sale (in which case this policy will continue to apply to your data).

7.1 Human access to transcripts

Chat transcripts are retained on our secure AWS infrastructure. As a routine part of our service, our team reviews chat sessions — including to confirm that the information the AI provided was accurate and appropriate. Members of our team may access transcripts to:

• review chats for accuracy, quality and safety, including checking the responses given by the AI;
• investigate a complaint or support request you have raised;
• resolve a safety concern escalated from the automated system; and
• contact you by email — at the address you signed in with — to correct information, follow up, or share additional resources where we believe you would benefit.

Access is restricted to authorised staff and is governed by confidentiality obligations.

7.2 Overseas disclosure

Some of our service providers store or process data outside Australia (see table above). Where we disclose personal information overseas, we take reasonable steps to ensure the recipient handles it consistently with the APPs. For EEA/UK users, we rely on appropriate transfer mechanisms such as Standard Contractual Clauses.

8. Your rights and choices

All users can:

• access the personal information we hold about you;
• ask us to correct inaccurate or out-of-date information;
• withdraw any consent you have given;
• unsubscribe from marketing at any time;
• request deletion of your chat transcript history; and
• delete your account and request deletion of your data.

EEA and UK users additionally have rights to data portability, restriction of processing, objection to processing, and to lodge a complaint with your local supervisory authority.

To exercise any right, use the in-app controls or email care@thethompsonmethod.com. We will respond within 30 days. We may need to verify your identity before acting on a request.

9. Data retention

• We retain your account and chat transcript data while your account is active.
• If your account remains inactive for 3 years, we will notify you and then delete or de-identify your personal information.
• If you delete your account, we delete or de-identify your personal information within 90 days, except where we are required to retain records by law (for example, financial records, which we keep for 7 years).
• Backups are purged on a rolling cycle of 90 days.
• De-identified data contributed to the Infant Feeding Index before withdrawal may be retained in aggregated form, as described in Section 6.

10. Security

We apply safeguards including:

• encryption of data in transit (TLS) and at rest;
• PHI stripping prior to transmission to the AI model;
• Business Associate Agreement with Anthropic covering the handling of health information;
• access controls and least-privilege permissions;
• network isolation of our database;
• logging, monitoring and staff confidentiality obligations.

No system is perfectly secure. If a data breach occurs that is likely to result in serious harm, we will notify you and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme.

11. Children

The Dr Robyn AI Support Chat is designed for parents and caregivers aged 18 and over. We do not knowingly allow anyone under 18 to create an account.

12. Complaints

If you have a concern about how we have handled your personal information, please contact our Privacy Officer first (details in Section 1). We will acknowledge your complaint within 7 days and aim to resolve it within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner:

Web: www.oaic.gov.au  |  Phone: 1300 363 992

13. Changes to this policy

We may update this policy from time to time. If we make material changes, particularly any change affecting how your health information is used, we will notify you in the app or by email before the change takes effect, and where required, seek your renewed consent. The current version will always be available at this page.