Privacy Policy

Last updated: 1 May 2026

Lifecycle Oncology Pty Ltd respects your privacy. This Policy explains what personal information we collect through immunosync.com.au and the Kairo AI assistant, why we collect it, how we use it, who we share it with, and what your rights are.

What you should know in 30 seconds: we collect very little — basically the contact details you choose to give Kairo when you ask for follow-up, the words you speak or type to Kairo while you're using it, and standard server logs. We use Google Cloud's Vertex AI to process the conversation. We don't sell your data. We don't run advertising trackers. You can email us to access, correct, or delete your information at any time.

1. About this Policy

This Privacy Policy applies to personal information we collect through:

Browsing of the website at immunosync.com.au;
Voice and text interactions with the Kairo AI assistant; and
Direct communications with us, such as emails to daniel@immunosync.com.au.

We comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where we deal with personal information of individuals located in the European Economic Area or the United Kingdom, we do so in a manner consistent with the General Data Protection Regulation (GDPR) and the UK GDPR. If you are an EEA/UK resident, the legal basis for our processing is generally your consent (which you withdraw by ceasing to use the website) or our legitimate interests in operating a clinically-literate informational service to professionals interested in our technology, balanced against your rights and freedoms.

2. Who we are

The data controller (or, in Australian terms, the APP entity) responsible for personal information collected through the website is:

Lifecycle Oncology Pty Ltd
Level 3, 179 Queen Street
Melbourne, Victoria 3000, Australia
Privacy contact: daniel@immunosync.com.au

3. Information we collect

3.1 Information you provide directly

If you ask Kairo to follow up — for example, by requesting a clinical demonstration, an Investor Pack, a partnership conversation, or a discovery call — Kairo will ask for the contact details needed to make that follow-up possible. The fields we capture, and only when you explicitly provide them, are:

Field	Required?	Example use
Email address	Yes	To contact you about the follow-up you've requested.
Interest type	Yes	To route you to the right person (e.g., demo, partnership, investor).
Name	Optional	To address you by name in our reply.
Company / organisation	Optional	To prepare relevant materials for your follow-up.
Role / job title	Optional	To pitch information at the right level of detail.
Conversation summary	Optional	A short summary of what you discussed, captured automatically by Kairo to help our team prepare.

Kairo will read your details back to you for confirmation before submitting them. We do not collect, request, or store credit card details, government identifiers, biometric identifiers, or detailed health information through the website.

3.2 Voice and text input to Kairo

While you are interacting with Kairo, your spoken voice (audio) and any typed text are streamed in real time, via secure WebSocket, to Google Cloud's Vertex AI Multimodal Live service for processing. Google's service transcribes your speech, generates Kairo's response, and synthesises spoken replies. Per Google's published terms applicable to Vertex AI customers, prompts and responses processed through Vertex AI are not used by Google to train Google's foundation models without explicit opt-in.

Kairo's session-level conversation context is held in memory only for the duration of your session and is discarded when you close the orb. We do not record or persist audio of your voice. We do, however, retain the structured summary that Kairo captures via the lead-capture function (see clause 3.1) when you have explicitly opted in.

3.3 Information collected automatically

Like most websites, our hosting provider (Netlify) records standard server-side request logs. These typically include:

Your IP address (in some cases truncated for privacy);
The user agent string of your browser (e.g., browser name and version, operating system);
The referring page;
Pages visited and timestamps;
HTTP status codes and basic performance metrics.

We use this information for security, fraud prevention, debugging, and aggregate usage analysis. See our Cookie Policy for the cookies and similar technologies used by the website.

3.4 Information from third parties

We do not currently obtain personal information about you from any third-party data broker, advertising network, or social-media platform.

4. How we use your information

We use the personal information we collect for the following purposes:

To respond to enquiries you have explicitly initiated, including follow-up after a Kairo lead capture.
To deliver the website and the Kairo assistant (including by transmitting your voice and text to Vertex AI for processing).
To improve the website, the Kairo assistant, and the underlying ImmunoSync platform — for example, by reviewing aggregate usage patterns or specific failure cases (with personally identifying details redacted where practicable).
To comply with our legal obligations and to detect, prevent, or address fraud, security, or technical issues.
To exercise or defend legal claims.

We do not engage in automated decision-making with legal or similarly significant effects on you. Kairo's responses are informational only and do not constitute regulated advice — see our AI Use & Limitations notice.

5. Who we share information with

We share personal information only with the parties listed below, and only to the extent reasonably necessary for them to perform their function on our behalf.

Recipient	Purpose	Location
Google LLC (Google Cloud / Vertex AI)	Real-time voice and text processing for Kairo, including speech recognition, generative responses, speech synthesis, and retrieval-augmented grounding against our document corpus.	Primarily us-central1 (Iowa, United States) for the Live model; "global" for the search corpus.
Netlify, Inc.	Static website hosting and serverless function execution (the back-end that mints Vertex AI tokens, captures leads, and handles the reverse proxy).	Globally distributed CDN; serverless functions executed in regions allocated by Netlify.
Google Workspace (Google Apps Script + Google Sheets)	Storage of the captured lead summary in our private Google Sheet.	Google data centres allocated by Workspace.
Our employees, contractors, and professional advisers	To respond to your enquiry, deliver the website, and operate the business — bound by confidentiality.	Predominantly Australia.

We may also disclose personal information where required by law, by a regulator with proper authority, or by a court or tribunal — and to enforce our Terms of Use or protect the rights, property, or safety of the Operator, its personnel, or others.

We do not sell your personal information.

6. Storage, security, and international transfers

Personal information that we directly hold is stored on infrastructure provided by the third parties listed in clause 5, all of which maintain enterprise-grade security controls (encryption in transit and at rest, network isolation, access logging, and similar). We restrict access internally to those personnel who need it to do their jobs.

Where personal information is processed in the United States or other jurisdictions outside Australia, that processing occurs under the operating terms of Google LLC and/or Netlify, Inc. Both providers operate compliance frameworks (including, where applicable, Standard Contractual Clauses for transfers from the EEA / UK) and we rely on those frameworks for the lawful transfer of personal information internationally. By using the website you acknowledge that your personal information may be processed outside Australia.

7. How long we keep information

We retain personal information only for as long as is necessary for the purposes for which it was collected:

Lead-capture records (your contact details and conversation summary): retained until the relevant business relationship has been concluded or you ask us to delete the record.
Email correspondence: retained in line with our internal records-management practice, typically up to 7 years.
Voice and text streamed to Kairo: not retained by us beyond the active session. Google's retention practices for prompts and responses passing through Vertex AI are governed by Google's own published terms.
Server logs: typically retained for up to 90 days by Netlify before automatic deletion or aggregation.

8. Your rights

Subject to applicable law, you have the right to:

Access the personal information we hold about you.
Correct personal information that is inaccurate, out of date, incomplete, or misleading.
Request deletion of personal information, subject to our legal and operational record-keeping obligations.
Object to or restrict certain processing (for individuals in the EEA / UK).
Withdraw consent at any time, where consent is the legal basis for processing.
Lodge a complaint with a privacy regulator (see clause 12).

To exercise any of these rights, please email daniel@immunosync.com.au with your request. We will respond within a reasonable time and, in any event, within 30 days. We may need to verify your identity before complying with the request.

9. Children

The website and Kairo are not directed to, and we do not knowingly collect personal information from, children under the age of 18. If you believe a child has provided us with personal information, please contact us and we will delete it.

10. Cookies

For information about cookies and similar technologies, see our Cookie Policy.

11. Changes to this Policy

We may update this Policy from time to time. The "Last updated" date at the top reflects the date of the latest revision. We encourage you to revisit this page periodically. Material changes will be highlighted on the website where practicable.

12. Contact and complaints

For any privacy-related question, request, or complaint, please contact:

Lifecycle Oncology Pty Ltd
Privacy Contact: Daniel Trenton, Managing Director
Level 3, 179 Queen Street
Melbourne, Victoria 3000, Australia
daniel@immunosync.com.au

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner:

OAIC enquiries line: 1300 363 992
Online: www.oaic.gov.au

If you are an EEA or UK resident, you also have the right to complain to your local supervisory authority.