Johnni AI – PRIVACY POLICY
We are delighted to be supporting you as a Client of Johnni.ai. We recognise the importance of keeping information disclosed to us through our engagement private and confidential. To this end, we have outlined below our Privacy Policy.
Johnni.ai is bound by the Privacy Act 1988 (Cth) (the Act) and the Australian Privacy Principles (APPs) described therein. Johnni.ai provides this Privacy Policy in accordance with Principle 1 of the APPs and intends for this Policy to act as a guide for Clients.
This Privacy Policy is effective as at 21 September 2026 and was last updated on that date to describe our Google Calendar integration. On occasion, this Privacy Policy may be reviewed and updated. Johnni.ai will notify Clients of any and all updates to this Privacy Policy by replacing all earlier displayed and/or published copies of the Policy with the updated version. As such, please ensure that you check Johnni.ai’s Privacy Policy for updates on a periodic basis. All personal information collected and held by Johnni.ai will be done so in accordance with the most recent displayed and/or published copy of the Privacy Policy.
The Kinds of Personal Information We Collect and Hold
The kinds of personal information that Johnni.ai collects from and in relation to you and your Practice or business will be determined by the nature of your dealings with us. In the provision and deployment of virtual AI receptionist services (Services), such kinds of personal information may include, without limitation:
Where you are using our virtual receptionist AI (Johnni AI):
– Identity Data including your name, age, date of birth, and gender.
– Contact Data including your telephone number, address and email.
– Transaction Data including details about payments to you from us and from you to us and other details of products and services you have purchased from us or we have purchased from you.
– Technical and Usage Data when you access any of our websites or platforms, details about your internet protocol (IP) address, login data, browser session and geo-location data, statistics on page views and sessions, device and network information, acquisition sources, search queries and/or browsing behaviour, access and use of our website (including through the use of Internet cookies), and communications with our website.
– Profile Data including your username and password for Johnni AI, purchases or orders you have made with us, and support requests you have made.
– Interaction Data including information you provide to us when you participate in any interactive features, including call transcripts, information about incoming and outgoing calls, call duration, surveys, contests, promotions, activities or events.
– Calendar Data where you choose to connect your Google Calendar to Johnni AI, as described in the section “Google Calendar integration and Google user data” below.
– Marketing and Communications Data including your preferences in receiving marketing from us and our third parties and your communication preferences.
– Professional Data including where you are a worker of ours or applying for a role with us, your professional history such as your previous positions and professional experience.
Where you are a patient or customer of our Client, personal and sensitive information including those described above:
– Identity Data
– Contact Data
– Health Information including current concerns and medical history
– Financial Information including payments you have made or not made to our Client, and the method you have used to make them
– Other information you decide to disclose to us. In the course of doing business with you, we may collect, or come across, sensitive information in different situations including when such information is offered and not solicited, such as when we set up or manage your bookings and appointments for you.
Johnni.ai will not collect personal and sensitive information unless the information is reasonably necessary for Johnni.ai to provide and deploy the Services, as described in our engagement with the Client. Additionally, where the personal information comprises sensitive information, Johnni.ai will not collect such information unless the Client has consented.
Why We Collect, Hold, Use and Disclose Personal Information
The sole purpose for which Johnni.ai collects information is to facilitate the effective, accurate and efficient provision of the Services to support your Practice or business in providing professional services.
If you are not able or willing to provide Johnni.ai with all or part of your information that we require, we may be unable to provide all or part of the Services.
How We Collect and Hold Personal Information
Johnni.ai will only collect personal information by lawful and fair means. Without limitation, we may collect personal information via telephone communications, text or email written communications, interactions with your website, or meetings.
Below are examples of how we collect personal information:
– when you provide it directly to us, including face-to-face, over the phone, over email, or online;
– when you complete a form, such as registering for any events or newsletters, or responding to surveys;
– when you use any website we operate (including from any analytics and cookie providers or marketing providers. See the “Cookies” section below for more detail on the use of cookies);
– from third parties, such as, where you are using our virtual receptionist AI, your practice management system or, where you choose to connect it, your Google Calendar; or
– from publicly available sources.
Based on our engagement, we will need to collect personal information and will be exposed to sensitive information from third parties such as patients, customers, creditors, debtors, other healthcare providers and stakeholders who contact your Practice or business. Prior to collecting this information from a third party or parties, Johnni.ai will need to obtain the Client’s written consent, and requires the Client to disclose our Services so that third parties can elect not to participate or make any disclosures.
Johnni.ai stores individuals’ personal information in electronic form, on servers located in Australia and also the United States and the EU. Any data transferred through US and/or EU servers is handled by providers holding SOC 2 Type 1 and 2 and HIPAA attestations and operating in a GDPR compliant manner, meeting industry compliance standards. Data from a connected Google Calendar is stored on our database servers in Sydney, Australia.
Johnni.ai will take reasonable steps to protect all personal information it holds from misuse, interference, loss, unauthorised access, modification, and/or disclosure. If we are notified of unauthorised access to the information, we will notify the regulator and also notify you. If Johnni.ai is no longer required under the Privacy Act 1988 (Cth) to retain the personal information, it will take reasonable steps to destroy the information or to ensure that the information is de-identified.
If the collection of your personal information is required or authorised by or under an Australian law or a court/tribunal order, Johnni.ai will endeavour to take such steps (if any) as are reasonable in the circumstances to notify you, or otherwise ensure that you are aware, of the fact that the collection of the personal information is so required or authorised.
How We Use and Disclose Personal Information
Johnni.ai is committed to ensuring that it meets the minimum privacy standards for handling personal information, as required by law, in an open and transparent way.
When required or requested, Johnni.ai may disclose personal information to employees or representatives of the Client, or relay the Client’s information to patients, customers or prospective customers. Johnni.ai will only do so with your consent and/or in accordance with the disclosure provisions contained within the Privacy Act 1988 (Cth).
Johnni.ai will not use or disclose your personal information for the purpose of direct marketing without your consent.
We have set out below a description of the purposes for which we plan to collect, hold, use and disclose your personal information.
Where you are using our virtual receptionist AI (Johnni AI):
– To allow you to register and access our software platform, including the creation of a user login: Identity Data, Contact Data.
– To evaluate your suitability as a potential client, including carrying out identity verification, background screening, fraud prevention and checks related to anti-money laundering, terrorism financing and sanctions: Identity Data, Contact Data, Background Verification Data.
– To facilitate ongoing business interactions with you, including appointment scheduling and management, and, where you have connected it, keeping your Google Calendar in step with your Johnni scheduler: Identity Data, Contact Data, Calendar Data.
– To get in touch with you regarding our services, including any support queries or questions you raise with us: Identity Data, Contact Data, Profile Data.
– To follow up on any questions or messages you send us through our websites: Identity Data, Contact Data.
– To maintain internal records and manage our admin tasks, invoicing and billing processes: Identity Data, Contact Data, Financial Data, Transaction Data.
– To analyse data for insights and conduct market research that helps us grow and refine our business, apps and online platforms: Technical and Usage Data.
– To deliver promotional content and marketing communications about our events, offers or services that we believe may interest you: Identity Data, Contact Data, Technical and Usage Data, Marketing and Communications Data.
– To operate competitions, special offers or provide you with additional rewards or benefits: Identity Data, Contact Data, Interaction Data, Marketing and Communications Data.
– To review and assess your application if you’re seeking employment with us: Identity Data, Contact Data, Professional Data.
– To meet our legal responsibilities or if legally mandated or permitted: any relevant Personal Information.
Sensitive Information. We only collect, use, store or share sensitive information for the following reasons:
– Where you have given your express consent.
– For the main reason it was collected, which is to coordinate appointments and bookings with your healthcare provider, practice or business.
– For closely related secondary purposes, such as sharing your information with approved third parties necessary to facilitate our services.
– To notify emergency responders or contact your nominated family member, partner or carer if we believe there’s a serious and imminent threat to your life, health or safety, and we’re unable to get your permission.
– Where collection or disclosure is required or allowed by law.
Where you are a patient or customer of our Clients:
– To handle your appointment scheduling and redirect your call where necessary: Identity Data, Contact Data, Sensitive Information.
– To support internal operations, including administration, billing, and maintaining business records: Identity Data, Contact Data, Financial Data, Transaction Data.
– To conduct data analysis, business growth planning and market research, as well as improve our digital platforms and social media presence: Technical and Usage Data.
– To meet our legal duties or where required or permitted by applicable laws: any relevant Personal Information.
Sensitive Information. We only collect, store, use and share sensitive information when necessary, and strictly for the following reasons:
– For any use you have expressly agreed to.
– For the main reason it was obtained, typically to coordinate bookings and manage your interactions with your healthcare provider, clinic or business.
– For secondary but directly related purposes, such as sharing with relevant third parties to help facilitate your care or support our services.
– To engage emergency services or reach out to a nominated support person if we believe there is an immediate threat to your or someone else’s safety, and we cannot reasonably obtain your permission in time.
– Where disclosure is legally required or otherwise permitted under applicable legislation.
Our disclosures of personal information to third parties
Personal information: We will only disclose personal information (excluding sensitive information) to third parties where it is necessary as part of our business, where we have your consent, or where permitted by law. This means that we may disclose personal information (excluding sensitive information) to:
– our employees, contractors and/or related entities;
– IT service providers, data storage, web-hosting and server providers;
– Google, where our Client has connected its Google Calendar: the details of a booking (customer name, phone number, email, address and notes) are written into that Client’s own Google Calendar. See “Google Calendar integration and Google user data” below;
– marketing or advertising providers;
– professional advisors, bankers, auditors, our insurers and insurance brokers;
– payment systems operators or processors;
– our existing or potential agents or business partners;
– if we merge with, or are acquired by, another company, or sell all or a portion of our assets, your personal information may be disclosed to our advisers and any prospective purchaser’s advisers and may be among the assets transferred;
– courts, tribunals and regulatory authorities, in the event you fail to pay for goods or services we have provided to you;
– courts, tribunals, regulatory authorities and law enforcement officers, as required or authorised by law, in connection with any actual or prospective legal proceedings, or in order to establish, exercise or defend our legal rights;
– third parties to collect and process data, such as your Practice or business, analytics providers and cookies; and
– any other third parties as required or permitted by law, such as where we receive a subpoena.
Sensitive information: We will only disclose sensitive information with your consent or where permitted by law. This means that we may disclose sensitive information to:
– our employees, contractors and/or related entities;
– IT service providers, data storage, web-hosting and server providers;
– professional advisors;
– if we merge with, or are acquired by, another company, or sell all or a portion of our assets, your personal information may be disclosed to our advisers and any prospective purchaser’s advisers and may be among the assets transferred;
– courts, tribunals, regulatory authorities and law enforcement officers, as required or authorised by law, in connection with any actual or prospective legal proceedings, or in order to establish, exercise or defend our legal rights;
– third parties to collect and process data, such as analytics providers and cookies; and
– any other third parties as required or permitted by law, such as where we receive a subpoena.
How to Access and Correct Your Personal Information
Please note that you have a right to gain access to the information that Johnni.ai has collected from or in relation to you. If you require access to this information, please notify us in writing. Johnni.ai will take reasonable steps to ensure that the personal information it collects, uses, and/or discloses is accurate, up to date and complete. You have the right to request that Johnni.ai corrects your personal information. If you require a correction, please notify us in writing.
How to Make a Complaint
If you believe that Johnni.ai has breached the APPs, or a registered APP Code (if any) that binds the Practice, please notify us in writing.
Alternatively, you may make a complaint by contacting the Australian Information Commissioner on 1300 363 992.
Your rights and controlling your personal information
Your choice: Please read this Privacy Policy carefully. If you provide personal information to us, you understand we will collect, hold, use and disclose your personal information in accordance with this Privacy Policy. You do not have to provide personal information to us, however, if you do not, it may affect our ability to do business with you.
Information from third parties: If we receive personal information about you from a third party, we will protect it as set out in this Privacy Policy. If you are a third party providing personal information about somebody else, you represent and warrant that you have such person’s consent to provide the personal information to us.
Restrict and unsubscribe: To object to processing for direct marketing, unsubscribe from our email database or opt out of communications (including marketing communications), please email support@johnni.ai or use the unsubscribe link in any marketing email we send you.
Storage and security
We are committed to ensuring that the personal information we collect is secure. In order to prevent unauthorised access or disclosure, we have put in place suitable physical, electronic and managerial procedures to safeguard and secure personal information and protect it from misuse, interference, loss and unauthorised access, modification and disclosure.
While we are committed to security, we cannot guarantee the security of any information that is transmitted to or by us over the Internet. The transmission and exchange of information is carried out at your own risk.
Google Calendar integration and Google user data
Johnni’s portal can connect to a business owner’s Google Calendar. This section explains what we access, how we use it, who it is shared with, how it is protected, and how to remove it.
What we access. When you connect Google Calendar we ask for two permissions: to see the list of calendars in your Google account, and to view and edit events on your calendars. From these we access only: the names and IDs of your calendars, so you can choose which one receives bookings and which ones count as busy; and the events on the calendars you tick, limited to each event’s title, start and end time, whether it is marked busy or free, and whether it has been cancelled. We do not access attendees, descriptions, attachments, or any other part of your Google account.
How we use it. We use this data for three things only: to place the appointments Johnni books into the calendar you choose, and to update or remove them if a booking is moved or cancelled; to show busy time from your ticked calendars on your Johnni scheduler; and to stop your receptionist and your online booking page from offering a time that is already taken. Your receptionist’s AI is shown only which appointment windows are free. It never receives event titles, descriptions, attendees or any other calendar content.
What we write to your calendar. Each booking Johnni makes is added to your chosen Google Calendar as an event containing the customer’s name, the service, the customer’s phone number, email and address where given, any notes, the diary it was booked into, and the time. Moving or cancelling the booking in Johnni updates or removes that event.
How we share it. We do not sell Google user data, share it with advertisers or data brokers, or use it for advertising, profiling or credit decisions. It is processed only by the service providers that run Johnni: Supabase (our database, hosted in Sydney, Australia) and Vercel (our web hosting). None of our providers, including the AI providers behind the receptionist, use any of this data to train machine learning models. We do not use Google user data to develop, improve or train AI or machine learning models. The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.
How we protect it. Your Google access tokens are stored encrypted at rest and are readable only by our server code; they are never sent to a browser or shown to anyone. All connections to Google and to our database use TLS encryption. Access to the tokens inside Johnni is restricted to the account that connected them.
How long we keep it, and how to delete it. Your tokens and the busy times we import are kept only while your Google Calendar is connected. Imported busy times are refreshed every few minutes and removed when the event is removed, when you untick a calendar, or when you disconnect. Pressing Disconnect on the Scheduler (Settings, Google Calendar) revokes our access with Google and immediately deletes your tokens, your calendar mappings and every imported busy time. You can also remove Johnni’s access at any time from your Google Account permissions page. Closing your Johnni account deletes all of this data. To ask for deletion, email support@johnni.ai.
Cookies
We may use cookies on our website from time to time. Cookies are text files placed in your computer’s browser to store your preferences. Cookies, by themselves, do not tell us your email address or other personally identifiable information. However, they do recognise you when you return to our online website and allow third parties to cause our advertisements to appear on your social media and online media feeds as part of our retargeting campaigns. If and when you choose to provide our online website with personal information, this information may be linked to the data stored in the cookie.
You can block cookies by activating the setting on your browser that allows you to refuse the setting of all or some cookies. However, if you use your browser settings to block all cookies (including essential cookies) you may not be able to access all or parts of our website.
For more information about the cookies we use, email support@johnni.ai.
Links to other websites
Our website may contain links to other parties’ websites. We do not have any control over those websites and we are not responsible for the protection and privacy of any personal information which you provide whilst visiting those websites. Those websites are not governed by this Privacy Policy.
Email: support@johnni.ai