Privacy policy

Clinical Thinking Pty Ltd (ABN 30 701 916 378) makes CapacityWise, bed and slot scheduling software for Phase 1 clinical trial units. This policy explains how we handle personal information about:

• visitors to our website, capacitywise.app, and people who ask us for a demo
• people who use the CapacityWise application at app.capacitywise.app or one of its regional addresses (eu., uk., us. and ca.capacitywise.app)
• site staff whose details our customers enter into CapacityWise.

We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth).

What we collect

On our website. When you ask for a demo, we collect your name, organisation and email address and, if you give them, your phone number and a message. Our website host records standard request logs, such as your IP address, browser type and the pages you request. Our website doesn’t use analytics, advertising or tracking cookies.

When we contact you about CapacityWise. If you work at a clinical trial unit, hospital or research organisation, we may collect your name, job title, organisation and work email address or phone number so we can tell you about CapacityWise.

In the CapacityWise application.

• Account details for staff who use the application: name, email address, role and organisation.
• Sign-in and security records: sign-in times, IP addresses and whether two-step verification is set up.
• Roster details our customers enter about their staff: names, roles, shifts, leave and certification expiry dates.
• Study schedules: study codes, cohorts, dates and bed counts.
• Participant screening or study ID codes. Our customers assign these codes and keep the key that links each code to a person. We don’t have that key.
• An audit log of changes made in the application, showing who made each change and when.

CapacityWise is a planning and scheduling tool, not a clinical record. It does not hold participant names, dates of birth, contact details, medical record numbers or clinical results, and our customers agree not to enter them.

How we collect it

We collect demo request details from you when you fill in the form. We find the work contact details of people we contact about CapacityWise in public sources, such as their organisation’s website, clinical trial registries and professional networks like LinkedIn, or from them directly at events. In the application, we usually collect your name, email address and role from your employer when they invite you to an account. Our customers enter roster details, study schedules and participant codes. Sign-in records and the audit log are recorded automatically as people use the application.

You can browse our website without telling us who you are. To arrange a demo or use the application, we need your name and email address.

How we use it

We use personal information to:

• respond to demo requests and follow them up
• contact people at clinical trial units, hospitals and research organisations about CapacityWise. Every message says who we are and how to tell us to stop, and we stop when you ask
• provide, secure and support the application, including sending account invitations and password-reset emails
• keep the audit trail our customers rely on for their own compliance
• meet our legal obligations.

We don’t sell personal information or use it for advertising. We use information our customers enter only to provide and support CapacityWise. We won’t add you to a mailing list without asking.

Automated decisions

CapacityWise doesn’t make decisions about people automatically. It shows information such as roster conflicts and certification expiry dates, and site staff decide what to do with it.

Information our customers enter

Information a customer enters into CapacityWise belongs to that customer. We handle it on their behalf and on their instructions, under our agreement with them. If you work at a customer site and want to access or correct information about you, contact your site first. We’ll help them respond.

Who we share it with

We use these providers to run our website and CapacityWise. They receive personal information only so they can provide their service to us.

Provider	What they do	Where the information is held
Supabase	Application database, sign-in and backups	The customer’s hosting region: Sydney, Australia; Frankfurt, Germany; London, United Kingdom; northern Virginia, United States; or Montreal, Canada
Fly.io	Application servers	The customer’s hosting region: Sydney, Australia; Frankfurt, Germany; London, United Kingdom; northern Virginia, United States; or Toronto, Canada
Amazon Web Services	Sends account invitation, password-reset and reminder emails	The customer’s hosting region: Sydney, Australia; Frankfurt, Germany; London, United Kingdom; northern Virginia, United States; or Montreal, Canada
Netlify	Hosts our website and receives demo requests	United States
Microsoft	Our email, including demo request notifications	Australia and other countries where Microsoft operates
Anthropic	An AI assistant we use to read and draft our email and to help build and run our software	United States

We don’t disclose personal information to anyone else unless the law requires it or you agree.

Information held outside Australia

Each customer chooses where CapacityWise hosts its data: Australia (Sydney), the European Union (Frankfurt), the United Kingdom (London), the United States (northern Virginia) or Canada (Montreal, with application servers in Toronto). The customer’s data, including account details, backups and the account emails we send, is stored and processed by our providers in that region. We run and support CapacityWise from Australia, so we may access it from Australia. For customers hosted in Australia, the application’s data is stored in Australia. Some personal information is held overseas:

• Resend, which sent our account emails until 14 October 2026, keeps its records of those emails, including the recipient’s email address, in the United States.
• Netlify holds demo requests and website request logs in the United States.
• Microsoft can process email sent to us in countries outside Australia.
• Anthropic processes email we ask its AI assistant to read or draft, in the United States. We don’t use it to read the information our customers enter into CapacityWise.
• Supabase, Fly.io and Amazon Web Services may access information from outside Australia to operate and support their services.

Cookies

Our website doesn’t set cookies. The application stores a sign-in token in your browser to keep you signed in. We don’t use it to track you.

Security

Information is encrypted in transit and at rest. Each customer’s data is kept separate from every other customer’s at the database level. Access is controlled by role, two-step verification is available, every change in the application is recorded in the audit log, and the database is backed up every night.

If a data breach is likely to cause serious harm, we will tell the customer whose data is involved, and notify the people affected and the Office of the Australian Information Commissioner as the law requires.

How long we keep it

• Demo enquiries: up to 2 years after our last contact with you, unless you become a customer.
• Contact details of people we contact about CapacityWise: up to 2 years after our last contact with you. If you ask us to stop, we keep only your email address on a do-not-contact list, so that we don’t contact you again.
• Account details: while the account is active, and up to 90 days after it closes.
• Customer data: while the customer’s agreement is in force and for 90 days afterwards, unless the agreement says otherwise. We then return or delete it.
• The audit log: up to 7 years, because customers rely on it as a record of who changed what.
• Backups: deleted information can stay in backups until they are replaced, which takes up to 30 days.

When we no longer need personal information, we delete it or remove anything that identifies a person. Where the law requires us to keep records for longer, we do.

Access and correction

You can ask for access to the personal information we hold about you, and ask us to correct it. Email hello@capacitywise.app. We don’t charge for this, and we’ll respond within 30 days. If your employer entered the information, we’ll work with them to respond. If we refuse a request, we’ll tell you why in writing and how to complain.

Complaints

If you have a concern about how we’ve handled your personal information, email hello@capacitywise.app and tell us what happened. We’ll confirm we’ve received it within 5 business days, look into it, and give you a written response within 30 days.

If you’re not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

If you are in the European Union or the United Kingdom

The EU General Data Protection Regulation (GDPR) and the UK GDPR give you the rights below. Clinical Thinking Pty Ltd, at the contact details at the end of this policy, is responsible for your information when we collect it for our own purposes, such as a demo request or contacting you about CapacityWise. When a customer enters information into CapacityWise, the customer is responsible for it and we process it on their behalf, so the customer’s own privacy notice applies. Contact them first, and we’ll help them respond.

Why we use your information (our legal bases).

• Demo requests: to take the steps you ask for before a possible contract, and our legitimate interest in answering your enquiry.
• Contacting you about CapacityWise: our legitimate interest in telling people who run clinical trial units about a product that is relevant to their work. You can object at any time, and we will stop.
• Accounts and sign-in records in the application: to perform our contract with your employer, and our legitimate interest in keeping the service secure.
• Meeting our legal obligations.

Your rights. You can ask us to:

• give you a copy of the personal information we hold about you
• correct it
• delete it
• restrict how we use it
• give it to you, or to another organisation, in a common electronic format.

You can object to our use of your information based on legitimate interests. If you object to us contacting you about CapacityWise, we will stop. Email hello@capacitywise.app. We’ll respond within one month, and we don’t charge.

Information sent outside your country. We are based in Australia, so information you give us is held in Australia and with the providers listed above, some of them in the United States. If your organisation chose EU or UK hosting, its CapacityWise data is held in Frankfurt or London, and we access it from Australia to support it. Australia does not have an EU or UK adequacy decision. We rely on the data protection terms in our contracts with our providers, which for Supabase, Fly.io and Amazon Web Services include the European Commission’s standard contractual clauses. To ask for a copy of these safeguards, email hello@capacitywise.app.

Complaints. You can complain to the data protection authority where you live or work: in the UK, the Information Commissioner’s Office at ico.org.uk; in the EU, your country’s authority, listed at edpb.europa.eu. We’d welcome the chance to sort out a concern first.

We have not appointed a representative in the EU or the UK.

Changes to this policy

When we change this policy, we’ll update this page and the date at the top. This policy is free. To get a copy in another format, email hello@capacitywise.app.

Contact

Clinical Thinking Pty Ltd
ABN 30 701 916 378
hello@capacitywise.app