Privacy Policy

The personal information we collect depends on how you interact with Khin.

We may collect personal information such as your contact details, information you provide when engaging with us or using our services, and technical information needed to operate, secure and improve our website and platform. We do not currently use cookies or similar tracking technologies on our website.

Where a client engages Khin to configure or operate a workflow, this may also mean we handle personal information relating to that client's own customers, employees or other individuals, limited to what is reasonably necessary for the relevant workflow.

Some Khin clients may operate in industries with additional regulatory requirements. Where sensitive information is involved, clients remain responsible for their own legal obligations, including any consents they must obtain. Khin's services support administrative and operational activities and are not intended to replace regulated professional judgment.

There is an important distinction between information Khin collects for its own business and information we handle while providing services to a client.

When Khin receives or accesses personal information through a client's systems, we generally handle that information for the purpose of providing the services requested by that client.

This may include:

• configuring integrations;
• processing and routing enquiries;
• enabling communications;
• supporting appointments, bookings, orders or transactions;
• updating connected systems;
• monitoring workflows;
• troubleshooting issues;
• generating agreed operational reporting; and
• improving the client's configured service.

We do not treat information contained in a client's customer, employee, supplier, patient or other business records as Khin's own marketing database.

We do not sell personal information contained in client systems.

We do not use identifiable information from a client's customers or other individuals for unrelated marketing.

Where a person interacts with a business using a Khin-enabled workflow, that business's privacy policy may also apply. Questions about that business's underlying collection or use of personal information should generally be directed to that business.

Nothing in this Privacy Policy removes or reduces a client's own obligations under applicable privacy, consumer, employment, health, professional or other laws.

We may collect personal information directly from you, from a client that has engaged Khin, through software or systems a client authorises us to connect to, from service providers acting on our behalf, or as otherwise authorised or required by law.

Where it is reasonable and practicable, we collect personal information directly from the individual concerned.

We use personal information to provide and manage our services, respond to enquiries, support and communicate with clients and authorised users, meet our legal, billing and security obligations, and send business communications or marketing.

We seek to use personal information only for the purpose for which it was collected, a related purpose that would reasonably be expected, with consent, or where another use is authorised or required by law.

Khin uses and integrates artificial intelligence and automated systems as part of some services, for example to help classify or route enquiries, prepare draft responses, or support scheduling and order workflows.

Where appropriate to the risk of a workflow, we may apply safeguards such as human review, approval steps and access controls. We seek to design workflows so that automated systems only receive information reasonably necessary for the task being performed.

Where a workflow operates in a regulated or higher-risk environment, we may impose additional safeguards or human oversight.

Khin's services are not intended to automate decisions that require regulated professional judgment unless a specific lawful and appropriately governed arrangement has been agreed.

If Khin uses personal information in connection with automated decision-making that could reasonably be expected to significantly affect an individual's rights or interests, we will provide any additional transparency required by applicable law.

Khin continually improves its implementation methods, templates, integrations, workflows, prompts, checklists and operating processes.

We may use lessons and generalised knowledge obtained through providing services to improve Khin's methods and reusable technology.

This does not mean that personal information belonging to one client becomes part of another client's system.

Where possible, reusable materials are derived from:

• general workflow patterns;
• technical approaches;
• configuration methods;
• de-identified information; and
• general operational knowledge.

We do not use identifiable information from a client's customers, employees, patients, suppliers or other individuals to train a general-purpose AI model for unrelated purposes unless this has been expressly agreed, is lawful and any required notice or consent has been obtained.

Khin may provide clients with reporting about the performance and outcomes of workflows we operate, such as response times, completed workflows or estimated business outcomes attributable to the service.

Where possible, operational reporting uses aggregated or de-identified information rather than unnecessary identifiable personal information.

We may develop case studies, benchmarks or examples based on work performed for clients.

We seek to remove or aggregate personal information before using operational information for broader benchmarking, research or service improvement where identification is not necessary.

We may disclose personal information where reasonably necessary to operate our business or provide our services, including to service and technology providers who support our platform, professional advisers, a Khin client where information relates to services provided for that client, and regulators or authorities where required by law. We may also disclose information as part of a corporate transaction, subject to appropriate confidentiality and privacy protections.

We do not sell personal information.

Where third-party technology forms part of a client's configured solution, the privacy terms of those providers may also apply.

Khin's services are designed to work with software our clients already use and with selected third-party services.

A client's Khin implementation may therefore involve personal information moving between multiple authorised systems.

Where a client connects Instagram or Facebook Messenger to Khin, we access the customer's name, platform identifier and message content solely to enable that business to view and respond to its own conversations, consistent with the relevant platform's terms.

Before implementing material integrations involving personal information, we consider factors such as what information is required, where it will flow, and the security and residency implications, proportionate to the workflow.

The particular systems used may differ between clients.

Clients should not assume that every third-party provider used in one Khin implementation is used in every other implementation.

Khin considers data residency when selecting technology providers, but does not guarantee that all personal information will remain physically within Australia, as some providers may involve infrastructure located overseas.

Where information may be disclosed to an overseas provider, we take reasonable steps to assess the sensitivity of the information and the provider's security and privacy practices.

Clients with specific residency requirements should document these as part of the agreed solution.

Khin takes reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification and disclosure, including access controls, encryption where appropriate, and monitoring proportionate to the sensitivity of the information involved.

No internet-connected system can be guaranteed to be completely secure. We therefore use a risk-based approach and seek to minimise the amount of personal information exposed to each system or provider.

Khin maintains processes for responding to suspected privacy and security incidents.

Where we become aware of a suspected data breach involving information handled for a client, we will investigate the incident and work with the affected client as appropriate.

Where the Notifiable Data Breaches scheme or another notification obligation applies to Khin, we will assess the incident and make notifications required by law.

Where a client is responsible for making a notification, Khin will provide relevant information reasonably available to us to assist that client's assessment.

We retain personal information only for as long as reasonably necessary to provide our services or as required by law, then take reasonable steps to delete or de-identify it. Retention periods vary depending on the type of information and service involved. Some information may remain temporarily in secure backups or system logs until overwritten through normal retention processes. Where we handle information on behalf of a client, retention and deletion may also depend on that client's instructions and the connected systems involved.

We may use business contact information to communicate with you about Khin services.

You may ask us to stop sending marketing communications at any time by using an unsubscribe mechanism where provided or by contacting us. We handle opt-out requests in accordance with the Spam Act 2003 (Cth).

Operational, security, billing or service-related communications may still be sent where necessary.

You may request access to personal information Khin holds about you or ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading.

In some circumstances, the law permits or requires us to refuse access. If this occurs, we will generally explain the reason where we are permitted to do so.

We may need to verify your identity before providing access or making a correction.

Where the relevant information is held by Khin solely on behalf of one of our clients, we may refer your request to that client or assist the client in responding.

Requests can be made using the contact details below.

You may ask us to delete personal information about you.

Australian privacy law does not provide an unrestricted right to deletion in every circumstance, so we may need to retain information where required by law, contract, security requirements or legitimate record-keeping obligations.

Where deletion is appropriate and reasonably practicable, we will take reasonable steps to delete or de-identify the relevant information.

If information is held on behalf of a Khin client, we may refer the request to that client.

Requests can be made using the contact details below.

If you believe Khin has mishandled your personal information, please contact us.

We will take privacy complaints seriously and will seek to:

1. acknowledge the complaint;
2. investigate what occurred;
3. provide a response within a reasonable period; and
4. take appropriate corrective action where necessary.

We aim to respond to privacy complaints within 30 days, although complex matters may require additional time.

If you are not satisfied with our response and the Privacy Act applies to the matter, you may be able to make a complaint to the Office of the Australian Information Commissioner (OAIC).

Information about making a privacy complaint is available at oaic.gov.au.

For requests, questions or complaints concerning privacy, contact:

You may also contact us through the enquiry details published at khin.com.au.

Our services, technology providers and legal obligations may change over time.

We may update this Privacy Policy to reflect changes to our practices, services or applicable law.

The current version will be published on our website together with the date it was last updated.

Where a change materially affects how we handle personal information, we will take reasonable steps to provide additional notice where appropriate.