Data & Security.

TECH4GOOD Pty Ltd (ABN 87 634 472 352) trading as HodieLabs · Version 1.0 · Effective March 2026

1. Our Security Philosophy

HodieLabs is built around a simple principle: the interface should recede, and your biology should be the only thing that matters, including who can see it. We apply a defence-in-depth approach, layering controls so that no single safeguard is a single point of failure. Security and privacy are considered at the design stage of every feature, not bolted on afterwards.

This page explains, in plain language, the measures we use to protect your information. It complements our Privacy Policy, which sets out our legal obligations and your rights in full.

2. Encryption

• In transit: all connections between your device, our platform, and our partners are encrypted using TLS 1.3 (or higher). We enforce HTTPS across the entire platform.
• At rest: all stored health, genetic, and personal data is encrypted using AES-256.
• Key management: encryption keys are managed in a dedicated key management service, rotated regularly, and isolated from the data they protect.
• Sensitive fields: particularly sensitive identifiers receive additional field-level protection.

3. Access Controls

• Least privilege: staff are granted only the minimum access required for their role, and access to identifiable health data is tightly restricted.
• Multi-factor authentication: MFA is mandatory for all staff and administrative access to our systems.
• Role-based access control (RBAC): permissions are governed by defined roles and reviewed periodically.
• Audit logging: all access to health records and My Health Record data is logged and subject to regular review. Anomalous access is investigated.
• Your account: we support strong passwords and account-level multi-factor authentication so you can protect your own access.

4. Infrastructure and Hosting

We host data with reputable cloud infrastructure providers that maintain internationally recognised security certifications (such as ISO/IEC 27001 and SOC 2). Wherever practicable, Australian user data is stored within Australia. Where any processing occurs outside Australia, we ensure comparable protections are in place, in accordance with Australian Privacy Principle 8. We never transfer My Health Record data overseas.

Our environments are segmented, with production data separated from development and testing environments. Test and development environments never use real, identifiable health data.

5. Genetic and My Health Record Data

Genetic information and My Health Record data warrant the highest level of care. These categories are collected only with your explicit, specific consent; are accessed only for the permitted purposes described in our Privacy Policy; and are subject to the same encryption, access control, and audit safeguards described above. We will never use this data for advertising, insurance underwriting, employment decisions, or any purpose you have not authorised.

6. Monitoring and Testing

• Penetration testing: independent security firms test our platform at least annually.
• Vulnerability management: we continuously scan for vulnerabilities and apply security patches on a risk-prioritised basis.
• Monitoring: we monitor systems for unusual activity, intrusion attempts, and integrity issues around the clock.
• Secure development: code is peer-reviewed, dependencies are scanned, and changes follow controlled release processes.

7. Our People

Technology alone does not keep data safe. All HodieLabs employees and contractors are bound by confidentiality obligations, undergo background checks appropriate to their role, and complete mandatory privacy and security training at onboarding and annually thereafter. Access to sensitive data is granted on a need-to-know basis and revoked promptly when no longer required.

8. Third-Party Partners

Laboratories, imaging providers, payment processors, and infrastructure vendors are carefully vetted and bound by contractual data processing agreements. These agreements restrict use of your data to providing services to HodieLabs, prohibit unauthorised onward disclosure, require prompt breach notification, and mandate secure deletion or return of data on termination. Payment card data is handled exclusively by PCI-DSS compliant providers. We never store full card numbers.

9. Incident and Breach Response

We maintain a documented incident response plan and a dedicated response team. In the event of a data breach that is likely to result in serious harm, we will act in accordance with the Notifiable Data Breaches (NDB) scheme under the Privacy Act, containing the incident, assessing its impact, and notifying affected individuals and the Office of the Australian Information Commissioner as required by law. Where the My Health Record system is involved, we will also notify the Australian Digital Health Agency.

10. Data Retention and Deletion

We keep your data only as long as necessary for the purpose it was collected or as required by law, and then securely delete it in a manner designed to prevent recovery. Detailed retention periods for each data category, including health records, genomic data, and My Health Record data, are set out in our Privacy Policy. You may request deletion of your data at any time, subject to our legal retention obligations, and we can provide written confirmation once complete.

11. Your Role in Security

• Use a strong, unique password and enable multi-factor authentication on your account.
• Never share your login credentials, and sign out on shared devices.
• Be alert to phishing. We will never ask for your password by email or phone.
• Notify us immediately if you suspect any unauthorised access to your account.

12. Reporting a Vulnerability

We welcome responsible disclosure from the security community. If you believe you have found a security vulnerability in our platform, please email us at security@hodielabs.com with details so we can investigate. Please act in good faith, avoid accessing or modifying other users' data, and give us a reasonable opportunity to remediate before any public disclosure.

13. Contact