Privacy Policy

Introduction

This Privacy Policy explains how COVA AI PTY LTD ABN 55 686 877 270 and its related bodies corporate (referred to in this Privacy Policy as "COVA", "we", "us" or "our") collect, use, hold, disclose and otherwise process Personal Information and Personal Data in connection with our websites, platform, products and services.

This Privacy Policy applies whenever you access or use the COVA platform, website or related services, communicate with us, create or administer an account, or otherwise interact with us as a customer, authorised user, broker, underwriter, insurer, claims handler, administrator, representative, contractor, website visitor or other business contact.

COVA provides an AI-powered software platform designed for use by insurance-sector professionals and organisations. The platform includes AI-assisted workflows, document processing, drafting, research, CRM and workflow management tools, policy and claims support tools, and other user-directed functionality.

For the purposes of applicable privacy and data protection laws, including the Privacy Act 1988 (Cth), the Australian Privacy Principles, the UK General Data Protection Regulation ("UK GDPR"), the EU General Data Protection Regulation ("EU GDPR"), the UK Data Protection Act 2018 and other applicable privacy laws, COVA may act as either:

a controller in relation to Personal Information we collect and use for our own business operations, including account administration, billing, support, security, analytics, marketing and platform management; or
a processor or service provider where we process Customer Material and Personal Information on behalf of our customers through the platform.

This Privacy Policy applies to:

Personal Information and Personal Data collected directly from you;
Personal Information provided by customer organisations, account administrators or authorised users;
Customer Material uploaded, stored or processed through the platform;
information collected through our website, platform, cookies, analytics tools and related technologies; and
other information collected in connection with the provision, operation, security and improvement of our services.

We take privacy and data protection seriously. This Privacy Policy explains:

what information we collect and process;
how and why we use that information;
when we disclose information to service providers and subprocessors;
how we protect information;
how international transfers may occur;
your privacy and data protection rights; and
how you can contact us or make a complaint.

Our platform is intended for use by insurance-sector professionals and organisations. The platform operates as a copilot and support tool only. Customers and users remain responsible for reviewing, verifying and approving all AI-generated outputs, communications, decisions and advice before relying on or providing them to any third party.

This Privacy Policy should be read together with our Terms, Data Processing Addendum, Acceptable Use Policy, Cookie Policy and any applicable Data Handling Schedule. Where we process Customer Material on behalf of a customer, the Data Processing Addendum may contain additional terms that apply to that processing.

In this Privacy Policy:

Customer Material means any information, documents, prompts, data, content, files, records, materials, inputs, outputs or other materials that customers or authorised users provide, upload, submit, connect or otherwise make available through the platform; and
Personal Information has the meaning given under the Privacy Act 1988 (Cth), and Personal Data has the meaning given under applicable UK GDPR, EU GDPR or other applicable data protection laws.

Types of Personal Information We Collect

The Personal Information and Personal Data we collect depends on how you interact with us, the services you use, the information uploaded to the platform, and the nature of your relationship with us.

The information we collect may include:

name, username and account credentials;
job title, employer, business details and professional role information;
email address, telephone number, mailing address and other contact details;
billing details, subscription information and payment-related information;
identity and verification information reasonably required for onboarding, account administration, fraud prevention, licensing checks or compliance purposes;
communications with us, including support requests, enquiries, feedback, survey responses and training interactions;
records relating to platform usage, subscriptions, seat allocation, account administration and customer relationship management activities;
device, browser, operating system, IP address, session, diagnostic, log and usage information;
location and timezone information derived from device or browser settings;
information collected through cookies, analytics technologies and similar tracking tools, as further described in our Cookie Policy;
Customer Material, prompts, instructions, documents, inputs and outputs processed through the platform;
insurance-related information uploaded or processed by customers and users, including policy schedules, policy wording, claims information, underwriting information, renewal information, business risk information, correspondence, spreadsheets, forms and related records;
commercial, financial and operational information relating to customer organisations and their clients;
sensitive information and special category data where uploaded or processed through the platform for legitimate insurance, underwriting, broking, claims management or related business purposes;
information about third parties where you provide that information to us or upload it through the platform;
marketing and communication preferences; and
any other information you voluntarily provide to us or authorise us to collect in connection with the platform or our services.

Sensitive information and special category data processed through the platform may include health information, medical information, injury information, workers compensation information, claims-related information and other information that may attract additional protections under applicable privacy or data protection laws.

We do not intentionally collect payment card information directly through the platform unless expressly stated. Payment processing services may be provided by third-party payment providers.

You are responsible for ensuring that any Personal Information, sensitive information or Customer Material uploaded to the platform has been collected and disclosed lawfully and that you have all necessary rights, consents, notices and lawful bases required to provide that information to us for processing through the platform.

How We Collect Personal Information

We collect Personal Information and Personal Data in a variety of ways depending on how you interact with us, the platform and our services.

We may collect information directly from you where you:

create an account or subscribe to the platform;
register as an authorised user under a customer account;
contact us through our website or platform;
communicate with us by email, telephone, video conference, social media, messaging applications or other channels;
request support, onboarding, demonstrations, training or technical assistance;
use the platform or interact with AI tools, workflows, prompts, outputs or platform functionality;
upload or submit Customer Material, documents, forms, correspondence or other content through the platform;
participate in surveys, feedback sessions, marketing activities, events or promotions;
subscribe to newsletters, alerts or marketing communications;
apply to work with us or provide services to us; or
otherwise interact with us in connection with our business, website, platform or services.

We may also collect Personal Information and Personal Data from third parties, including:

customer organisations, account administrators and authorised users;
service providers, subprocessors and integration partners;
identity verification, fraud prevention or compliance providers;
analytics, advertising and website technology providers;
publicly available sources and professional networking platforms;
referral partners, advisers and representatives; and
other persons where authorised by law or where reasonably necessary to provide the platform or services.

When you use our website or platform, we and our service providers may automatically collect technical and usage information through cookies, analytics technologies, server logs and similar tracking tools. This may include:

device identifiers and browser information;
IP address and approximate location information;
session activity and usage behaviour;
page interaction and navigation information;
referral URLs and access timestamps;
crash reports, diagnostics and performance information; and
platform interaction and feature usage data.

We may also collect information generated through your use of AI-assisted functionality within the platform, including prompts, instructions, uploaded documents, generated outputs and workflow interactions.

Further information about our use of cookies, analytics technologies and similar tools is available in our Cookie Policy.

We take reasonable steps to ensure that the Personal Information we collect is relevant, accurate, up to date and protected from misuse, interference, loss and unauthorised access, modification or disclosure.

How We Use Personal Information

We collect, use and process Personal Information and Personal Data for purposes connected with the operation, security, administration and improvement of our business, platform and services.

We may use Personal Information and Personal Data to:

provide, operate, manage, maintain and improve the platform and related services;
create, administer and manage customer accounts, subscriptions, seats and authorised users;
process prompts, uploaded documents, instructions, workflows and AI-generated outputs within the platform;
provide onboarding, implementation, support, training and customer assistance;
communicate with customers and users regarding accounts, subscriptions, updates, notices, billing, technical matters, security matters and support requests;
verify identity, authority, licensing status or account permissions where reasonably required;
monitor platform usage, prevent misuse, detect unauthorised activity, enforce our terms and protect the security and integrity of the platform;
develop, test, improve and optimise platform functionality, workflows, user experience and operational performance;
conduct analytics, reporting, diagnostics, research and service improvement activities using aggregated or de-identified information where practicable;
comply with legal obligations, regulatory requirements, lawful requests, court orders or industry obligations;
protect our legal rights, investigate disputes and enforce our agreements and policies;
process payments, subscriptions and related administrative activities;
respond to enquiries, feedback, complaints and support requests;
send administrative, operational and service-related communications;
send marketing, promotional or event-related communications where permitted by law or where consent has been obtained;
consider employment applications and engage service providers, contractors or business partners; and
otherwise operate and manage our business and services.

Where required under applicable law, we will obtain consent before sending direct marketing communications. You may opt out of marketing communications at any time by using the unsubscribe facility or contacting us using the details set out in this Privacy Policy.

We will send electronic marketing communications only where permitted by applicable law, including the Spam Act 2003 (Cth), and will include an unsubscribe facility where required.

We may also use Personal Information and Personal Data where reasonably necessary for our legitimate business interests, including:

improving platform functionality, security and reliability;
developing new features, tools and integrations;
understanding platform usage trends and customer needs;
preventing fraud, misuse, security incidents and unlawful activity; and
maintaining and improving customer and user experience.

We do not use Customer Material, Personal Information uploaded by customers, or customer-uploaded documents, prompts or outputs to train, fine-tune or improve general AI or machine learning models unless expressly agreed with the relevant customer.

Customers and users remain responsible for reviewing, verifying and approving all AI-generated outputs before relying on them or providing them to any third party.

Disclosure of Personal Information

We may disclose Personal Information and Personal Data to third parties where reasonably necessary for the operation of our business, the provision of the platform and services, compliance with legal obligations, or other purposes described in this Privacy Policy.

We may disclose information to:

our related bodies corporate and affiliated entities;
hosting providers, cloud infrastructure providers and data centre providers;
AI providers, subprocessors and technology service providers involved in delivering platform functionality;
payment processors, billing providers and financial service providers;
identity verification, fraud prevention and security providers;
customer support, onboarding, training and communication providers;
analytics, monitoring and diagnostic service providers;
professional advisers including lawyers, accountants, auditors, insurers and consultants;
contractors, service providers and integration partners;
regulatory bodies, government agencies, courts, law enforcement authorities or other parties where required or authorised by law;
auditors, investigators or professional advisers in connection with legal, regulatory or compliance matters;
actual or prospective purchasers, investors, financiers or advisers in connection with a merger, acquisition, financing, restructuring, sale of assets or other corporate transaction; and
other persons or entities where disclosure is reasonably necessary to provide the platform or where you otherwise authorise the disclosure.

Some of our service providers, subprocessors and technology providers may be located outside Australia, including in New Zealand, the United Kingdom, the United States, the European Union and other jurisdictions in which our service providers operate.

Where required by applicable law, we take reasonable steps to ensure that overseas recipients handle Personal Information in a manner consistent with applicable privacy and data protection requirements.

We may disclose Customer Material and Personal Information to subprocessors and third-party service providers that assist us in operating the platform, including providers of:

hosting and infrastructure services;
AI and machine learning services;
authentication and identity services;
customer support and communications services;
analytics and monitoring tools;
security and fraud prevention services; and
billing and payment processing services.

A current list of subprocessors may be made available separately or incorporated into our Data Handling Schedule from time to time.

We do not sell Personal Information to third parties.

Where reasonably practicable, contractual confidentiality, privacy and data protection obligations are imposed on third-party service providers that process Personal Information on our behalf.

Security

We take reasonable technical, organisational and administrative measures designed to protect Personal Information and Personal Data from misuse, interference, loss, unauthorised access, modification and disclosure.

Our security measures may include:

access controls and authentication measures;
password protection and user credential controls;
multi-factor authentication and role-based permissions where implemented;
encryption and secure transmission technologies where appropriate;
logging, monitoring and audit functionality;
network, infrastructure and endpoint security controls;
backup, resilience and recovery processes;
internal confidentiality and access management procedures;
security testing, maintenance and monitoring activities; and
incident response and security management procedures.

Customer Material is intended to be logically segregated between customer environments to help prevent unauthorised access between different customers and users.

We may use third-party hosting providers, cloud providers, AI providers and subprocessors to support the operation of the platform and related services. While we take reasonable steps to assess and manage security risks associated with those providers, we do not control all third-party systems or infrastructure.

You are responsible for maintaining the confidentiality and security of account credentials, access devices and authentication methods used to access the platform.

While we take reasonable steps to protect Personal Information and Personal Data, no method of electronic transmission, storage or processing is completely secure. To the maximum extent permitted by law, we do not guarantee that the platform or any systems, communications or data storage arrangements will be completely secure, uninterrupted or free from unauthorised access, cyber incidents or other security events.

Further details regarding our security practices may be set out in our Data Handling Schedule or other technical documentation made available from time to time.

Third-Party Websites and Services

Our website, platform or services may contain links to third-party websites, platforms, integrations, tools or services operated by external providers.

Those third-party services are provided for convenience only. We do not control, endorse or accept responsibility for the content, availability, security, functionality or privacy practices of third-party websites or services.

Your use of third-party websites, integrations or services is subject to the terms, conditions and privacy policies of those third parties. We encourage you to review those documents before providing Personal Information or using third-party services.

The platform may also integrate with or depend on third-party providers, including cloud providers, AI providers, analytics providers, communication tools, authentication providers and other technology services. Changes, outages, interruptions, security incidents or policy changes affecting those third-party providers may impact the availability or functionality of the platform.

To the maximum extent permitted by law, we are not responsible for Personal Information, Customer Material or other information handled by third-party providers outside our reasonable control.

Your Privacy Rights

Depending on your location and the applicable privacy or data protection laws, you may have certain rights in relation to your Personal Information and Personal Data.

These rights may include the right to:

request access to Personal Information we hold about you;
request correction of inaccurate, incomplete or outdated Personal Information;
request deletion or erasure of Personal Information in certain circumstances;
object to or restrict certain types of processing;
withdraw consent where processing is based on consent;
request portability of certain Personal Information in a structured, commonly used and machine-readable format;
opt out of direct marketing communications;
request information about how your Personal Information is processed; and
lodge a complaint with a relevant privacy or data protection regulator.

Where applicable under the UK GDPR or EU GDPR, you may also have rights relating to:

restriction of processing;
objection to processing based on legitimate interests;
data portability; and
certain automated decision-making and profiling activities.

We will consider and respond to privacy rights requests in accordance with applicable law. In some circumstances, we may refuse a request where permitted or required by law, including where the request would:

adversely affect the rights of another person;
conflict with legal or regulatory obligations;
compromise security, fraud prevention or legal proceedings; or
relate to information processed on behalf of a customer where that customer is the relevant controller.

Where we process Personal Information on behalf of a customer as a processor or service provider, requests relating to Customer Material may need to be directed to the relevant customer organisation.

You may opt out of marketing communications at any time by using the unsubscribe facility in our communications or by contacting us using the details set out in this Privacy Policy.

If you believe your privacy or data protection rights have been breached, you may contact us using the details below. You may also lodge a complaint with the Office of the Australian Information Commissioner, the UK Information Commissioner's Office, or another applicable supervisory authority in your jurisdiction.

The platform is designed as a copilot tool and is not intended to make fully automated decisions about individuals that produce legal or similarly significant effects without appropriate human review by a qualified professional.

Data Retention

We retain Personal Information and Personal Data only for as long as reasonably necessary for the purposes described in this Privacy Policy, including for:

providing and operating the platform and services;
account administration and customer support;
security, fraud prevention and platform integrity purposes;
complying with legal, regulatory, tax, accounting and reporting obligations;
resolving disputes and enforcing agreements; and
maintaining appropriate business and operational records.

Retention periods may vary depending on:

the type of information;
the nature of the services provided;
applicable legal, regulatory or contractual obligations;
whether the information relates to an active customer account;
the sensitivity of the information; and
operational, security and backup requirements.

Where we process Customer Material on behalf of a customer, retention and deletion of that data may also be governed by:

the applicable customer agreement;
customer instructions;
applicable legal obligations; and
our data retention or deletion schedules and backup processes.

When Personal Information or Personal Data is no longer reasonably required, we will take reasonable steps to securely delete, destroy, de-identify or anonymise the information in accordance with applicable law and our internal retention practices.

Certain information may be retained for longer periods where required for legal, regulatory, security, fraud prevention, dispute resolution, backup, archival or enforcement purposes.

Backup copies and residual system data may continue to exist for a limited period following deletion from active systems.

Further information regarding retention periods, deletion practices and backup processes may be set out in our Data Handling Schedule or provided upon request.

International Data Transfers

COVA operates internationally and may transfer, access, host, store or process Personal Information and Personal Data in countries outside the jurisdiction in which the information was originally collected, including outside Australia, the United Kingdom and the European Economic Area ("EEA").

Our services may involve the use of hosting providers, cloud infrastructure providers, AI providers, subprocessors, support providers and other service providers located in:

Australia;
New Zealand;
the United Kingdom;
the United States;
the European Union; and
other jurisdictions in which our service providers or subprocessors operate from time to time.

Customer Material for Australian and New Zealand customers is generally intended to be hosted in Australia using AWS infrastructure located in Sydney, with backup and redundancy arrangements in Australia. Customer Material relating to United Kingdom operations may be hosted using infrastructure located in the United Kingdom.

Customer Material relating to United States operations may be hosted or processed in the locations set out in our Data Handling Schedule or other written notice, including where reasonably required for support, security, AI processing, analytics, administration, legal compliance or operation of the platform.

Where Personal Information or Personal Data is transferred outside the UK or EEA to a country that is not recognised as providing an adequate level of data protection, we will take reasonable steps to implement appropriate safeguards as required under applicable law.

Those safeguards may include:

standard contractual clauses;
international data transfer agreements;
data processing agreements;
contractual confidentiality and security obligations;
approved transfer mechanisms under applicable privacy or data protection laws; or
other lawful transfer mechanisms permitted under applicable law.

By using the platform or otherwise providing Personal Information to us, you acknowledge that international transfers may occur in accordance with this Privacy Policy.

Further information regarding international transfers, subprocessors and hosting arrangements may be made available in our Data Handling Schedule or upon request.

Contact Us

If you have any questions about this Privacy Policy, our privacy practices, the handling of your Personal Information, or if you wish to make a privacy request or complaint, please contact us using the details below.

Privacy Contact: COVA AI PTY LTD
Email: privacy@cova.ai
Address: 255 David Low Way, Peregian Beach, QLD 4573
Support Contact: hello@cova.ai

We will consider and respond to privacy-related enquiries and complaints in accordance with applicable privacy and data protection laws.

If you are not satisfied with our response, you may have the right to lodge a complaint with the Office of the Australian Information Commissioner, the UK Information Commissioner's Office, or another applicable supervisory authority in your jurisdiction.

Changes to This Privacy Policy

We may update or amend this Privacy Policy from time to time to reflect changes to:

our platform, services or business operations;
applicable laws or regulatory requirements;
technology, security or operational practices; or
our use of service providers or subprocessors.

We will publish the updated Privacy Policy on our website or platform and, where required by law, provide notice of material changes using appropriate communication methods.

Your continued use of the platform or services following publication of an updated Privacy Policy constitutes acknowledgement of the updated Privacy Policy to the extent permitted by law.