Your enquiry. Your choices.

Who is responsible.

Visualisation Hub Pty Ltd trading as Echo Health AI operates this website. Contact security@echo-health.ai for privacy enquiries, access or correction requests, withdrawal of contact consent and complaints. This statement covers website enquiries and measurement. Clinical-platform privacy is covered separately.

Information you provide.

Ask Echo is an AI assistant for product and sales questions. Your questions and recent conversation context are processed to answer you using Echo’s published knowledge. Please do not include patient information or clinical questions. Asking questions or opening a walkthrough does not require your name or email. A separate contact form asks for your details and confirmation before creating or updating an enquiry in Echo’s lead system.

The interest form collects your name, email address and role. You may also provide your organisation, care setting, country, area of interest, partner role and a message. We record the registration time and the wording version of your contact consent. Please use professional details and avoid patient records, clinical recordings, health identifiers and other sensitive information.

Information from using the site.

The website infrastructure processes network and request information to deliver and protect the site. The enquiry endpoint uses a hashed IP address for short-lived rate-limit counters, with expiry set after one hour; expiry cleanup is asynchronous. Application logs record operational outcomes without enquiry contents and have a 30-day retention setting. Echo also receives cookie-free operational counts for fixed page, download, call-to-action, scroll and video events. The receiving service converts the request's source address into a tenant-keyed token that changes each Sydney calendar day, then stores no raw source address or user-agent in the analytics tables. If you allow optional analytics, Google Analytics also processes visit and activity information.

CloudFront edge access logs cover requests that do not run website JavaScript, including crawlers. Echo limits these logs to request time, source address, method, host and path without a query string, response status and size, declared user-agent, edge outcome, country and CloudFront request identifier. Cookies, query strings and referrers are excluded. Raw edge logs remain in a private encrypted AWS bucket for 14 days; the importer retains aggregate counts and daily tenant-keyed network-group tokens, not raw addresses or user-agent strings, in Echo’s analytics database.

If you use the 中文 translation control, we open Google Translate in a new tab with the public page address and your chosen language. The control does not send enquiry fields, URL query parameters or saved preferences. You then browse Google's translated copy under Google's privacy practices. The original Echo tab remains available for enquiries. Translation is separate from optional analytics consent.

Why we collect it.

The form is voluntary. Without the required contact fields and consent, it cannot register your interest; you can still browse resources without registering. Submitting does not purchase a service or grant clinical-platform access.

• Respond to the enquiry or commercial discussion you request.
• Contact you about the selected waitlist, early-adopter, pricing, partner or security interest under the consent beside the form.
• Maintain a record of that request and consent, manage duplicates and protect the form against misuse.
• Measure aggregate website and video operation without cookies, and obtain broader Google Analytics measurement only when optional analytics are allowed.

Who may receive the enquiry.

Ask Echo uses Echo’s configured AI provider to process product questions. Conversation state is encrypted in Echo’s database. Confirmed chat contact requests go to Echo Console for authorised staff to follow up; the chat does not subscribe you to marketing or send an email on your behalf.

Authorised Echo personnel use enquiries to follow up. The website uses Amazon S3 and CloudFront for delivery. Enquiries are saved in an encrypted Amazon DynamoDB database in the Sydney AWS region. Amazon Simple Email Service sends an internal notification to Echo’s authorised enquiry recipient. Free-text messages stay in the database and are excluded from those notifications. Website records, notification emails and any later lead-management copies must all be considered when handling access, correction, opt-out and deletion requests.

Overseas processing.

The website enquiry database and email service are configured in AWS’s Sydney region. CloudFront delivers public website content through its global network. Optional Google Analytics and email delivery may involve processing outside Australia. This notice does not promise Australia-only processing; the full provider-country and safeguard assessment remains to be completed.

Cookies and optional measurement.

Ask Echo stores a temporary conversation reference in your browser tab’s session storage so you can continue after reloading. Chat text, contact details and the conversation reference are excluded from website analytics. Closing the tab or choosing Start again clears the browser reference; neither action withdraws an enquiry already submitted.

Echo's cookie-free operational measurement runs without Google Analytics. It sends a fixed event name, the page path without a query string and, for a film, its code-owned identifier, title and playback milestone. A random browser-tab session reference supports ordered journeys, registration stages and unique-session video progress; it resets after 30 minutes without activity. The receiving service immediately converts that reference to a tenant-keyed token scoped to one Sydney calendar day and does not store the browser reference. The browser reduces the referring site to a closed category such as direct, search, social, AI assistant or other referral before sending it; no referring URL or hostname is sent. Form contents, chat text, link text, search terms and cross-day visitor identifiers are excluded. Daily network-group tokens support grouped counts; a group can contain several people and is never reported as a person.

Google Analytics loads only after you choose Allow analytics. The site's custom events cover known page paths, broad scroll depth, calls to action, PDF downloads, video activity and a completed registration event. They exclude form contents, link text, search terms and URL query parameters. Google's service may also process cookie, network and device information. Advertising signals and advertising personalisation are disabled in the website configuration.

Retention remains pending.

Ask Echo conversations expire after 30 minutes. Expired conversation state is removed in bounded cleanup batches when new conversations start, after a further day; cleanup is not an immediate deletion guarantee. Confirmed enquiries and the AI service’s usage and audit records have separate retention arrangements.

Cookie-free event totals are retained as aggregate daily counts. Daily network-group tokens, daily observed-session tokens and their fixed-event bridges are removed after 35 days; cleanup runs in bounded operational requests and may not occur at the exact expiry instant. An observed session describes one browser tab's activity window, not a person, device identity or returning visitor.

Raw CloudFront edge access logs are configured to expire after 14 days. Imported daily network-group tokens are removed after 35 days. Aggregate request counts and the identifiers of already-imported AWS log objects are retained to support trend reporting and prevent double counting.

No website-enquiry retention period has been approved, and the current registration workflow does not implement an automatic deletion schedule. The final schedule needs to cover the website database, email notifications, lead records, logs and backups. A clinical-record retention period or an older product's temporary-processing policy does not set the period for website enquiries.

Access, correction and deletion requests.

Email security@echo-health.ai with enough information to identify your enquiry. We may need proportionate identity verification before releasing or changing information. Do not email identity documents or patient records unless an appropriate process has been arranged. Requests must be assessed under applicable law, including any lawful retention obligation; deletion from backups depends on the applicable retention and recovery arrangements.

Withdraw contact consent.

Use an unsubscribe option where provided or email security@echo-health.ai to stop future marketing contact. Changing your analytics choice does not withdraw enquiry contact consent. A minimal record of an opt-out may be needed to prevent further contact; its retention must be included in the approved schedule.

Privacy complaints.

Send the nature of your concern, relevant dates and preferred reply method to security@echo-health.ai. An authorised person will need to investigate and respond. The internal response procedure and timing remain to be confirmed. If the issue remains unresolved, you may contact the Office of the Australian Information Commissioner.

Clinical information and children.

This professional enquiry form is not a patient portal or a channel for children's health information. Clinical services need an appropriate collection notice and consent process, including capacity and authorised representative arrangements. If sensitive information is submitted here by mistake, contact us so handling can be assessed.

Changes to this statement.

We will date the published statement and explain material changes. Publishing a revised statement does not itself authorise a new use of information or turn an earlier enquiry into consent for model training. The operational details identified above remain subject to confirmation.