Privacy Policy

1. Who we are

CHM Solutions Pty Ltd ("we", "us", "our") develops and publishes the Subjective Visual Vertical (SVV) iOS application. For privacy enquiries, visit our Contact Us page.

2. Who this policy applies to

This policy applies to healthcare professionals and clinical researchers ("clinicians") who use the SVV app to conduct vestibular assessments. The app is not intended for direct use by patients. Clinicians are responsible for ensuring their own use of the app complies with all applicable laws and professional obligations in their jurisdiction, including patient consent requirements.

3. What data the app processes

3.1 Motion sensor data

The app reads accelerometer data from the device to detect tilt angle during a test. This data is processed in real time and is never written to disk, transmitted, or retained beyond the active test window.

3.2 Test results

Angle measurements and test configuration (eye selection, repetitions, duration) are held in memory during a session. They are displayed on screen and, at the clinician's discretion, can be exported via the device's native email interface.

• Results are not stored on the device after the session ends.
• The app does not maintain any database, log file, or analytics store of test results.

3.3 Email export

If you choose to email results, the email is composed and sent by the Mail app (or your chosen mail client) on your device. CHM Solutions Pty Ltd does not receive, process, or have access to any email you send. The transmission is subject to your email provider's own privacy policy.

3.4 Analytics (PostHog)

The app uses PostHog to collect anonymised product analytics. PostHog may collect:

• Interaction events (screens viewed, buttons tapped, features used)
• Device type and model
• Operating system version
• Session metadata (duration, event sequences)

This data is transmitted to PostHog's servers and is subject to PostHog's Privacy Policy. PostHog does not receive patient names, identifiers, test results, angle measurements, or any other clinical data.

3.5 Data we do not collect

The app does not collect, transmit, or store:

• Patient names, identifiers, or demographic information
• Test results or angle measurements (beyond the active session)
• Precise location data

4. Clinical and regulatory context

4.1 HIPAA (United States)

The SVV app does not receive, create, maintain, or transmit electronic protected health information (ePHI) on behalf of any covered entity or business associate. The app does collect anonymised usage analytics via PostHog (see section 3.4); this data consists of interaction events and device information only — it does not include patient identifiers, test results, or any clinical data, and does not constitute ePHI. Clinicians using the app in a US healthcare context are responsible for managing any patient data in accordance with their own HIPAA obligations. Because the app does not store or transmit patient data, no Business Associate Agreement with CHM Solutions Pty Ltd is required for use of the app itself. If you choose to email results containing identifiable patient information, that communication is outside the app and within your organisation's data-handling responsibility.

4.2 Australian Privacy Act 1988

CHM Solutions Pty Ltd is an Australian company and operates in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth). Because the app collects no personal information from users or patients, most APPs are not engaged in ordinary use of the app. Any personal information you provide to us directly (e.g. via support requests) will be handled in accordance with the APPs and used only to respond to your enquiry.

4.3 GDPR (European Economic Area and United Kingdom)

If you are located in the EEA or UK, the following applies:

• Controller: CHM Solutions Pty Ltd acts as data controller in respect of usage analytics collected via PostHog and any personal data you send to us directly (e.g. support messages).
• Processors: PostHog, Inc. acts as a data processor for analytics data on our behalf. PostHog's processing is governed by their Data Processing Agreement and Privacy Policy.
• Legal basis: Legitimate interests for analytics (improving the app's usability and reliability); legitimate interests or contract performance for support communications.
• Your rights: You have the right to access, rectify, erase, restrict, or port any personal data we hold about you, and to object to processing. Visit our Contact Us page to make a request.
• Health data: Because the app does not collect or store health data on our systems, we are not a processor of patient health data under GDPR. Clinicians who process patient data using device-level tools remain the data controller for that information.
• International transfers: CHM Solutions Pty Ltd is based in Australia, which the European Commission has not formally recognised as providing an adequate level of protection at the time of writing. Analytics data is processed by PostHog, Inc. (US-based); PostHog maintains EU–US data transfer mechanisms including Standard Contractual Clauses. Where we receive personal data from EEA contacts directly, we rely on standard contractual clauses or consent as our transfer mechanism.

5. Data retention

The app retains no data. Any personal data sent to us via support is retained only as long as necessary to resolve the enquiry, and no longer than 3 years.

6. Security

The app transmits anonymised analytics data to PostHog over encrypted HTTPS connections. No clinical data or patient information is included in this transmission. For all other data — including test results and motion sensor readings — processing occurs entirely on the device and no network communication takes place. The primary data security responsibility for patient information lies with the clinician's device and, where applicable, their email provider. We recommend clinicians follow their organisation's device management policies.

7. Children

The SVV app is a clinical tool intended for use by trained healthcare professionals. It is not directed at children. We do not knowingly collect personal information from individuals under 18.

8. Changes to this policy

We may update this policy to reflect changes in the app or applicable law. Material changes will be noted on this page with a revised effective date. We encourage clinicians to review this policy periodically.

9. Contact

For privacy-related questions or to exercise your rights under applicable law, please visit our Contact Us page.