Harrison.ai Privacy Notice

Contents

Issued: 25 September 2025

1. About Harrison.ai

Harrison.ai works with leading health care organisations to develop AI solutions that support clinicians, practitioners and their patients. By responsibly harnessing data and technology, we aim to improve patient outcomes, enhance efficiency and strengthen healthcare delivery.

Harrison-AI Pty Ltd together with its affiliates (see Group Entities listed in Section 14 below) (collectively, ‘Harrison.ai’, ‘we’, ‘our’, or ‘us’) is committed to protecting the privacy and security of your personal information.

2. What this Privacy Notice covers

This Privacy Notice explains how we collect, use, disclose and safeguard personal information when you interact with us, unless a different Privacy Notice is displayed.

It applies when you:

visit our websites;
access or interact with our demo products or tools available on our websites;
use our products or services that include a link to this Privacy Notice;
subscribe to receive marketing communications from us; or
otherwise engage with us, including through social media or events.

We offer a range of products, including online demo offerings. We refer to all of these products, together with our other services and websites as “Services” in this Privacy Notice.

This Privacy Notice covers both personal information collected directly from you and data collected automatically or indirectly when you use our Services.

Where we provide the Services under contract with an organisation (e.g., your employer), that organisation controls the information processed by the Services. In such cases, we process personal information solely on behalf of the organisation and in accordance with its instructions. This Privacy Notice does not apply to the extent that we act as a processor for those organisations.

By using our Services, your personal information will be handled as described in this Privacy Notice.

For the purpose of this Privacy Notice, personal information includes any information relating to an identified or identifiable natural person.

Additional disclosures: Depending on how you interact with us, we may provide you with other Privacy Notices that include additional details about our privacy practices. For example:

For information about how we process applicant, please read the Harrison.ai Careers Privacy Notice.
A separate Privacy Notice will apply when you interact with Franklin.ai-branded offerings.

For more information on our privacy practices, visit our Data Privacy FAQs page.

3. Personal information we collect

The personal information we collect depends on your interactions with us, your consents and preferences, and the services you use.

We may collect the following directly from you:

Contact information and similar identifiers such as name, telephone number, email address, mailing address.
Professional details such as job title, role, company name, occupation.
User account details such as username, password, login, administrative permissions or other preferences
Corporate account information such as company affiliation, invoice information, payment information and other personal information connected to account management
Commercial information such as any personal information associated with sales orders
Communications and interactions such as when you email, call, contact us or interact with us, we collect and maintain a record of your contact details
Survey and research responses if you participate in our voluntary surveys or studies
Event related information such as data linked to your participation in our events
Service and support related information such as information you provide through our support channels
Content you provide through our Services including content shared, sent or uploaded when using our products or demo offerings. This may include any information you choose to include. When using our Services, we require that you use non-identifiable data wherever possible, and in the case of demo offerings, product trials, evaluations or similar, only test data such as computer-generated (synthetic), dummy or otherwise non-identifiable data should be provided.

Important: Certain personal information (such as contact details or user account credentials) is necessary for us to provide and manage your account. However, for any other content, materials or data you choose to upload, input or otherwise provide through our Services (for example, demo product content, files or other materials), you are solely responsible for ensuring that you have all necessary rights, permissions and consents to use and share such content. You must also ensure that the data is deidentified wherever possible before providing it to us.

We also collect the following automatically through your use of our Services:

Activity and usage information such as information about the features you use, the links you click on, the type, size and filenames of attachments you upload to the Services
Device and connection information such as your operating system, browser type, IP address, device identifiers, general location information, browser language, access times, date and time stamps

4. How we use your personal information

We collect personal information from the following sources:

Directly or indirectly form you
Harrison.ai companies i.e. our corporate affiliates
Our business and channel partners and from third-party services
Publicly available information and sources

You can choose to deal with us anonymously or under a pseudonym (for example, by using another name or nickname). However, if you choose not to provide your personal information to us, we may be able to offer you the assistance or services you require.

5. How we use your personal information

We use your personal information to:

provide our Services, including creating and maintaining your account, processing transactions, fulfilling orders and performing our contractual obligations;
communicate with you, including responding to enquiries, sending administrative information, and (with your consent) providing newsletters, marketing and promotional material;
understand how users access and use our Services – both in aggregate and individually – in order to maintain, support, secure and improve our Services, and to develop new products, features and functionality;
conduct research, development and quality assurance, including market research, satisfaction surveys, statistical analysis, complaint handling, audits, fraud monitoring, and data analytics;
comply with applicable legal and regulatory obligations; and
manage our business, including internal quality control, training and assessing or implementing mergers, acquisitions, reorganisations and other transactions.

Additional purposes of use relating to our demo offerings, product trials or evaluations include: include:

enabling you to test or evaluate our solutions in a controlled demonstration environment;
supporting product development and improvement, including enhancing functionality, performance and user experience (using deidentified or anonymised data wherever feasible); and
supporting training and education activities, using uploaded data in line with deidentification practices.

We do not use any content uploaded into our Services, including our demo offerings, , product trials or evaluations for model training.

6. Legal bases for processing (for EEA and UK users)

If you are an individual in the European Economic Area (EEA) or United Kingdom (UK), we collect and process information about you only where we have a lawful basis to do so under applicable data protection laws. The relevant legal bases depend on the Services you use and how you use them. In practice, this means we collect and use your information only where:

We need it to provide you the Services, including to operate the Services, provide customer support and features and to protect the safety and security of the Services;
It satisfies a legitimate interest (which is not overridden by your data protection interests) such as for research and development, to market or promote the Services and to protect our legal rights and interests;
You give us consent to do so for a specific purpose; or
We need to process your data to comply with a legal obligation.

If you have consented to our use of information about you for a specific purpose, you have the right to change your mind at any time, but this will not affect any processing that has already taken place. Where we are using your information because we have a legitimate interest to do so, you have the right to object to that use though, in some cases, this may mean no longer using the Services.

7. Disclosing personal information

When you use the Services, we disclose your personal information in line with the purposes described above. Disclosures may include:

Harrison.ai companies to operate and improve products and services and to offer other Harrison.ai affiliated services to you.
Business and channel partners for operational, organisational and infrastructure support.
Vendors and service providers who are contractually bound to process your personal information only on our instructions and under strict confidentiality.
Business transfers such as mergers, acquisitions or other corporate transactions.
Compliance and legal obligations where disclosure is required by law, court order or lawful request by regulators or authorities.
Aggregate and deidentified information – we may share information that has been aggregated or deidentified in a manner that no longer reasonably identifies you (for example, for analytics, industry research, or to improve and develop our services).
Other disclosures with your consent or as otherwise required or permitted by law.

We do not sell or rent your personal information.

8. Cookies and other trackers

Harrison.ai and our third-party partners, such as our advertising and analytics partners, use cookies and other tracking technologies (e.g., web beacons, device identifiers and pixels) to provide functionality and to recognise you across different Services and devices.

We use these technologies for the following purposes:

Strictly necessary cookies to enable our website to function securely and properly
Analytics cookies to understand how visitors use our website, improve performance and enhance user experience
Marketing cookies to deliver relevant advertising and measure the effectiveness of campaigns (only where you have provided explicit consent)

Where cookies are not strictly necessary, we rely on your consent. You can manage your cookie preferences at any time through your browser settings or, where available, through our consent management tool. Disabling cookies may affect the functionality of certain features.

9. Information storage and security

We take all reasonable steps to protect your personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. Records are held securely for future retrieval in accordance with applicable laws and good business practice.

The protective steps we take include:

confidentiality requirements of our employees and subcontractors;
limiting access to information to employees who have a need to use the information to perform their duties; and
technical and organisational security measures to protect information during collection, transfer, storage and access.

Although we use industry-standard safeguards to protect your information, no system is impenetrable and due to the inherent nature of the Internet, we cannot guarantee that information, during transmission through the Internet or while stored on our systems or otherwise in our care, is absolutely safe from intrusion. If you believe your interaction with us is no longer secure, please notify us immediately using the contact details below.

How long we keep information we collect about you depends on the type of information, as described further below. After such time, we will either delete or deidentify your information or, if this is not possible (for example, because the information has been stored in backup archives), then we will securely store your information and isolate it from any further use until deletion is possible.

Account information: We retain your account information for as long as your account is active and a reasonable period thereafter in case you decide to re-active the Services. We also retain some of your information as necessary to comply with our legal obligations, to resolve disputes, to enforce our agreements, to support business operations, and to continue to develop and improve our Servies. Where we retain information for Service improvement and development, we take steps to eliminate information that directly identifies you, and we only use the information to uncover collective insights about the use of our Services.
Information you share in our Services: Content you submit, upload or share may be retained for as long as necessary to provide the Services or for the purposes described in this Privacy Notice, unless you delete it or request its removal sooner (where applicable).
Managed accounts: If the Services are made available to you through an organisation (e.g., your employer), we retain your information as long as required by the administrator of your account.
Marketing information: If you have elected to receive marketing emails from us, we retain information about your marketing preferences for a reasonable period of time from the date you last expressed interest in our Services, such as when you last opened an email from us.

10. International Transfers

We operate globally and may transfer, process and store your personal information outside your country of residence to wherever we or our third-party service providers operate for the purpose of providing you the Services. At times, our service providers may hold your personal information in countries including the United Kingdom, Germany and Australia.

When we disclose information about you within and among Harrison.ai or to third party service providers for purposes described in this Privacy Notice, we use appropriate technical and operational safeguards as well as European Commission Standard Contractual Clauses, binding corporate rules or other appropriate legal mechanisms.

11. Your choices

Where applicable under local law, you may have certain rights with respect to your personal information:

Access – the right to request access to the personal data we hold about you. In some instances, reasonable charges may apply to provide copies.
Correction / rectification – the right to request that we correct / amend any personal data we hold about you which you believe is inaccurate.
Erasure / (right to be forgotten) – the right to request that we erase/ delete your personal data.
Restriction of processing – the right to request that we restrict the processing of your personal data.
Object to processing – the right to object to the processing of your personal data. For example: you have the right to object to the use of your personal data for direct marketing purposes.
Data Portability – the right to request that we send the data that we have collected to another organisation, or directly to you, under certain conditions and in a format that can be read by computer.
Withdrawal of consent – where processing is based on consent, you may withdraw it at any time.

Your rights are not absolute and we will assess them on your request. If you make a data subject request, you will be required to verify your identity. To exercise your rights, please use the contact details in section 14.

12. Marketing

Where applicable under local law, you may have certain rights with respect to your personal information:

Access – the right to request access to the personal data we hold about you. In some instances, reasonable charges may apply to provide copies.
Correction / rectification – the right to request that we correct / amend any personal data we hold about you which you believe is inaccurate.
Erasure / (right to be forgotten) – the right to request that we erase/ delete your personal data.
Restriction of processing – the right to request that we restrict the processing of your personal data.
Object to processing – the right to object to the processing of your personal data. For example: you have the right to object to the use of your personal data for direct marketing purposes.
Data Portability – the right to request that we send the data that we have collected to another organisation, or directly to you, under certain conditions and in a format that can be read by computer.
Withdrawal of consent – where processing is based on consent, you may withdraw it at any time.

13. Updates to this Privacy Notice

From time to time, we make changes to this Privacy Notice, as well as our processes and systems in relation to how we handle your personal information. Updates will be posted on our website with a revised ‘last updated’ date. We encourage you to review our Privacy Notice whenever you use the Services to stay informed about our information practices and the ways you can help protect your privacy.

If you disagree with any changes to this Privacy Notice, you will need to stop using the Services and deactivate your account(s) as relevant.

14. How to contact us

If you have any questions about this Privacy Notice, the personal information we hold about you, or you would like to exercise any of your rights, please contact us using the details below.

If you are not satisfied with the response, you can contact the Office of the Australian Information Commissioner. For further information about privacy, please visit the Office of the Australian Information Commissioner’s website at www.oaic.gov.au.

If you are based in the European Economic Area, United Kingdom or Switzerland, you also have the right to lodge a complaint with your local supervisory authority.

Australia:

Harrison-AI Pty Ltd
ABN 61 626 225 625
and
Harrison-AI Medical Pty Ltd
ABN 92 635 645 260

Attention: Privacy Officer
Level P, 24 Campbell Street,
Sydney NSW 2000, Australia

Email: privacy@harrison.ai

United Kingdom:

Harrison-AI Medical UK Ltd
Company no: 12804340

Attention: Privacy Officer
280 Bishopsgate,
London, EC2M 4RB, England

Email: privacy@harrison.ai

North America:

Harrison-AI Medical Inc
Company no: 6276448

Attention: Privacy Officer
8 The Green Suite R,
Dover 19901, Delaware, USA

Email: privacy@harrison.ai

Netherlands:

Harrison-AI Medical B.V
Company no: 24317083

Attention: Privacy Officer
Schiphol Boulevard 359, WTC Schiphol
1118 BJ Amsterdam Schiphol, The Netherlands

Email: privacy@harrison.ai

Vietnam:

Harrison-AI Medical Company Limited
Tax code: 0316238672

Attention: Privacy Officer
Room 16-01.02, Floor 16, 182 Le Dai Hanh
Ward 15, District 11, Ho Chi Minh City, Vietnam

Email: privacy@harrison.ai

India:

Harrison-AI Medical India Private Limited
Registration no: 156621

Attention: Privacy Officer
4th Floor Block A, Plot 4 and 5 Developed Plot Estate, OMR Perungudi Chennai
Chennai TN 600096, India

Email: privacy@harrison.ai

15. Country Addendums

These addendums may apply to our processing, use or management of your personal information depending on where you reside or where you otherwise have rights under applicable data protection laws within a certain region, country or state.

EUROPE AND UK

In certain circumstances we may transfer personal information to countries or regions outside of the United Kingdom or European Economic Area. These countries or regions may not offer the same level of data protection as your local privacy laws or GDPR and are not recognised by the European Commission as providing an adequate level of protection. Accordingly, we apply appropriate contractual safeguards to ensure the reasonable security, purpose limitation, access, recourse, enforcement of your privacy rights and integrity of your personal information (including entering the EU or UK standard contractual clauses (as applicable)) where we do transfer your personal information outside of the United Kingdom or the European Economic Area.

CALIFORNIA – ADDITIONAL RIGHTS FOR CALIFORNIA RESIDENTS

In some circumstances, the California Consumer Privacy Act of 2018 (CCPA) permits you to request information regarding the disclosure of certain personal information to third parties for direct marketing purposes if you are a California resident. We do not sell or share personal information for the purposes of the CCPA and we have not sold the personal information of any Californian resident to third parties in the preceding 12 months.

DATA PROTECTION FOR CALIFORNIA CONSUMERS UNDER THE CCPA

If the CCPA applies to us and you are an individual residing in the State of California, you have the right to: (a) request that we disclose what personal information we collect, use, disclose and sell about you; (b) request deletion of the personal information you have provided to us; and (c) be free from discrimination by us as a result of you exercising your rights under the CCPA.

Under the CCPA, the above rights do not apply to, and “personal information” does not include, certain categories of information, such as: (i) publicly available information from government records; (ii) deidentified or aggregated consumer information; (iii) health or medical information covered by the Health Insurance Portability and Accountability Act (HIPPA) and the California Confidentiality of Medical Information Act or clinical trial data.

If these rights apply to you and you wish to exercise any of these rights, you must submit a verifiable Consumer Request by Email: privacy@harrison.ai In accordance with the CCPA, you can also designate a third-party agent to exercise your CCPA rights on your behalf.