Privacy Policy

Effective Date: 22nd September 2025
Last Updated: 22nd September 2025

1. Introduction

Cova AI Pty Ltd ("we", "us", "our") provides AI-powered software tools for insurance brokers ("Service"). This Privacy Policy explains how we collect, use, disclose, and protect information when you use our Service.

We comply with the Australian Privacy Principles (APPs) contained in the Privacy Act 1988 (Cth) and are committed to handling any personal information in accordance with Australian privacy laws.

Important Notice: Our Service is designed for professional use by insurance brokers. We strongly discourage users from entering personally identifiable information (PII) about their clients into our system. This Service is intended for general insurance workflow assistance, analysis, and business operations support.

2. Information We Collect

2.1 User Account Information

From insurance brokers who register for our Service:

• Business name and ABN/ACN
• Professional contact information (business email, phone)
• User authentication credentials
• Billing and payment information

2.2 Usage Information

• Service usage patterns and feature interactions
• Query logs and AI interaction history (which should not contain client PII)
• Technical data including IP addresses, browser types, and device information
• Session data and performance metrics

2.3 Business Information

• General insurance product queries and scenarios
• De-identified insurance case studies
• Business workflow preferences
• Professional development and training interactions

Note: Users are responsible for ensuring they do not input client PII into the Service. Any client information should be anonymized or replaced with placeholder data.

3. Acceptable Use and Data Input Guidelines

3.1 Prohibited Information

Users must NOT enter:

• Client names, addresses, or contact details
• Client identification numbers (Medicare, driver's license, passport, etc.)
• Specific client financial information
• Health or medical information
• Any other personally identifiable client information

3.2 Recommended Practices

• Use generic placeholders (e.g., "Client A", "Company X")
• Anonymize all case scenarios
• Focus on insurance product types, coverage questions, and general scenarios
• Utilize hypothetical examples for testing and queries

4. How We Use Information

We use collected information to:

• Provide and maintain the Service for insurance brokers
• Process subscriptions and payments
• Enhance AI-powered insurance tools and recommendations
• Provide customer support
• Monitor Service performance and usage
• Comply with legal and regulatory obligations
• Improve our Service and develop new features
• Send service-related communications and updates

5. AI Technology and Data Processing

5.1 Anthropic Claude Integration

Our Service utilizes Anthropic's Claude AI model to provide intelligent assistance to insurance brokers:

• All queries are processed through secure, encrypted connections
• We do not use user data to train or improve the underlying AI model
• Claude processes queries in accordance with Anthropic's enterprise data processing agreements
• No client PII should be processed through the AI system

5.2 Data Processing

• All AI interactions are logged for quality and compliance purposes
• Queries are retained for the period specified in our retention policy
• Users can request deletion of their query history

6. Data Retention

We retain:

• User account information: For the duration of your subscription plus 12 months
• Query and usage data: 12 months from the date of creation
• Business records: As required by Australian business and tax law (typically 7 years)
• Technical logs: 90 days for security and performance monitoring

Data is securely destroyed or de-identified after the retention period expires.

7. Disclosure to Third Parties

We may share information with:

7.1 Service Providers

• Anthropic - AI model provider (Claude) for processing insurance-related queries
• Cloud infrastructure providers (AWS/Azure/GCP)
• Payment processors
• Business analytics providers
• Customer support tools

7.2 Legal and Regulatory

We may disclose information when required by:

• Court orders or subpoenas
• Law enforcement agencies
• Regulatory bodies including ASIC and APRA
• Legal proceedings or investigations

7.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, user information may be transferred to the successor entity.

8. Data Security

We implement industry-standard security measures including:

• TLS encryption for data in transit
• Encryption at rest for stored data
• Multi-factor authentication options
• Regular security audits and assessments
• Access controls and role-based permissions
• Incident response procedures
• Regular security training for our team

9. Your Rights

As a user of our Service, you have the right to:

• Access information we hold about your account
• Request correction of inaccurate information
• Request deletion of your account and associated data
• Export your data in a portable format
• Opt-out of marketing communications
• Lodge a privacy complaint

To exercise these rights, contact our Privacy Officer.

10. Confidentiality

All information processed through our Service is treated as confidential. Our employees and contractors are bound by confidentiality agreements and only access information as necessary for their roles.

11. International Data Transfers

Some of our service providers may process data outside Australia. We ensure appropriate safeguards are in place including:

• Contractual clauses ensuring privacy protection
• Processing only in countries with adequate privacy laws
• Compliance with Australian Privacy Principle 8

12. Cookies and Analytics

We use cookies and similar technologies for:

• Authentication and security
• Remembering user preferences
• Analyzing Service usage and performance
• Improving user experience

You can manage cookie preferences through your browser settings.

13. Marketing Communications

We may send you:

• Service updates and feature announcements
• Educational content about insurance technology
• Industry news and insights
• Product offers and promotions (with consent)

You can opt-out of marketing communications at any time.

14. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be notified via:

• Email notification to registered users
• In-Service notifications
• Website announcements

Continued use after changes constitutes acceptance of the updated policy.

15. Liability and Indemnification

Users are responsible for ensuring they do not input client PII into the Service. By using our Service, you agree to indemnify us against any claims arising from unauthorized input of client personal information.

16. Complaints and Contact

For privacy concerns or complaints:

First Contact: Privacy Team
Cova AI Pty Ltd
Email: team@cova.ai
Address: 255 David Low Way, Peregian Beach QLD 4562

If Unresolved: Office of the Australian Information Commissioner (OAIC)
Phone: 1300 363 992
Website: www.oaic.gov.au

17. Governing Law

This Privacy Policy is governed by the laws of Australia and the state of [State/Territory].

This privacy policy complies with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Last reviewed: 22nd September 2025

‍