Privacy Policy

Last updated: 12 February 2026

Connect I/O ("we," "us" or "our") operates the website connectio.com.au and a suite of mobile applications, including ScriptSafe, I’m Grateful, Knak, Read It, NutriScan, The Night Shift, and Layers (collectively, the "Services"). We respect your privacy and are committed to protecting it through compliance with this Privacy Policy. This Policy describes the Personal Information that we collect, how we use it, the legal basis for processing it, and the rights available to users ("you" or "your"). It forms a legally binding agreement between you and Connect I/O. By accessing or using our Services, you acknowledge that you have read, understood and agree to be bound by this Policy.

Our Services are directed to users in Australia and around the world. Australia’s privacy laws are changing; as of 10 June 2025, individuals have a statutory tort for serious invasions of privacy, and organisations must comply with enhanced enforcement powers and the obligation to notify the Office of the Australian Information Commissioner ("OAIC") within 72 hours of a data breach. A Children’s Online Privacy Code will also be introduced by 10 December 2026 and will impose additional requirements when services are likely to be accessed by children. We have updated this Privacy Policy to address these reforms and our current features.

1. Personal Information We Collect

We collect various types of information when you use our Services. You may decline to provide certain Personal Information, but this may limit your ability to access some features of our Services.

1.1 Information Collected Across All Services

• Authentication & account information: Credentials used for Sign In With Apple, email/password, or other login methods.
• Technical identifiers & device information: Technical identifiers such as device type, operating system version, and IP address.
• Usage data & preferences: Information about your interactions with our Services, communications and preferences.
• Contact details & communications: Name, email address and communications when you contact us or sign up for newsletters.

1.2 Service-Specific Information

ScriptSafe

• Prescription and eScript data: To help you manage electronic prescriptions (eScripts), we collect information such as script tokens, medication names, dosage instructions, issue and expiration dates, and prescriber or pharmacy details.

Layers (AI-Powered Layer Extraction)

Important Notice: Layers uses third-party AI services to provide layer extraction functionality. Before using these features, you must provide explicit consent for the transmission of your data to these services. See Section 3.2 for complete details.

• Images: Photos and images you upload for layer extraction processing.
• Extracted Layers: AI-processed images with separated backgrounds and subjects.
• Project Metadata: Project names, creation dates, and export formats you choose.
• Purchase History: Subscription status and in-app purchase records.

2. How We Use Personal Information

We use Personal Information to:

• Provide, maintain and improve our Services, including securely storing your data, organising it for easy access, and delivering core functionality.
• Personalise your experience and display relevant information based on your usage and preferences.
• Authenticate users and secure accounts.
• Send push notifications to inform you of updates, reminders, or new features. You can manage your notification preferences within the app.
• Conduct analytics and research to understand how users interact with our Services and to develop new products.
• Comply with our legal obligations, including obligations under the Australian Privacy Act and to notify the OAIC of data breaches.

2.1 Layers-Specific Uses

• AI Processing: Images are sent to Wavespeed (via BuildShip) for AI-powered layer extraction using BiRefNet technology.
• Storage: Your projects and extracted layers are stored securely in Supabase cloud storage.
• Export: Processing and delivering your extracted layers in PNG or PSD format.

We do not use automated decision-making that significantly affects individuals. If we introduce automated systems that make decisions likely to affect your rights or interests, we will update this Policy accordingly.

3. Service-Specific Features

3.1 ScriptSafe – Notifications and Script Management

• Secure storage and organisation – Your eScripts are stored in one secure location, separate from SMS and emails.
• Instant notifications – You receive alerts when new prescriptions are issued.
• Refill tracking – The app monitors expiration dates and refill schedules, sending reminders so you never miss a renewal.
• User-friendly interface – ScriptSafe is designed to be easy to use for all ages.

3.2 Layers – AI-Powered Layer Extraction

Privacy Consent Requirement

Before using Layers’ AI features, you must provide explicit consent for the transmission of your data to third-party AI services. By using Layers, you acknowledge and agree that:

• You have read and understood this Privacy Policy, including this "AI-Powered Layer Extraction" section
• You consent to the transmission of your images to Wavespeed via BuildShip for AI-powered layer extraction
• You understand that your email address and user ID may also be shared for account linking purposes
• You can withdraw consent at any time in the App Settings, though this will prevent use of AI features

What Data is Sent for AI Processing

When you upload an image for layer extraction, the following data is transmitted to our AI processing partners:

Who Receives Your Data

Wavespeed

Service: AI-powered image segmentation using BiRefNet model Location: United States Data Processed: Images you upload for layer extraction Purpose: Analyzes images to separate foreground subjects from backgrounds Data Retention: Images are processed in real-time and not retained by Wavespeed after processing is complete Privacy Policy: https://wavespeed.ai/static/privacy

BuildShip (CreateNew.inc)

Service: Secure workflow automation platform Location: United States Data Processed: Images and metadata during transmission to Wavespeed Purpose: Orchestrates secure data transfer between our systems and Wavespeed Security: All data is encrypted in transit via HTTPS/TLS Privacy Policy: https://buildship.io/privacy

Data Protection by Third Parties

We confirm that both Wavespeed and BuildShip provide the same or equal protection for your data as described in this Privacy Policy. Both services:

• Process data in accordance with applicable privacy laws (GDPR, CCPA)
• Use industry-standard encryption for data in transit and at rest
• Do not use your images for training AI models without explicit consent
• Do not share your data with additional third parties
• Maintain appropriate security measures and certifications
• Provide mechanisms for data deletion upon request

Your Consent in the App

Before any image is sent for AI processing, the App will:

1. Display a clear notice explaining what data will be sent
2. Identify the third-party services (Wavespeed via BuildShip)
3. Explain how the data will be used
4. Request your explicit permission (tap "I Understand and Agree")

You can withdraw your consent at any time in the App Settings. Withdrawing consent will prevent future AI processing but will not delete data already processed.

AI Results Disclaimer

We are not responsible for AI processing errors or unexpected results. You acknowledge that AI technology has limitations and may not produce perfect results for all images.

Your use of these features is voluntary. You can manage notification preferences or delete your account at any time; if you do, we will remove your data in accordance with the Data Retention section.

4. Legal Basis for Processing

• Consent – e.g., when you choose to create an account, store prescriptions, receive notifications, or use AI processing features.
• Performance of a contract – e.g., to provide the Services you request.
• Legitimate interests – e.g., to improve our Services, ensure security and develop new features.
• Compliance with a legal obligation – e.g., to comply with the Privacy Act or report privacy breaches.

5. Sharing and Disclosure of Information

We may share Personal Information with:

• Service providers who help us operate and improve the Services, including:
  • Supabase – Database, authentication, and file storage
  • RevenueCat – In-app purchase and subscription management
  • Wavespeed – AI-powered image processing (Layers app only, with your explicit consent)
  • BuildShip – Workflow automation for secure data transmission (Layers app only, with your explicit consent)
• Healthcare partners to facilitate redemption of eScripts, with your consent or as required by law.
• Business partners and affiliates in connection with the operation of our Services.
• Law enforcement authorities and regulators when required by law or necessary to protect rights and safety.
• Potential acquirers in the event of a merger or sale.

We do not sell your Personal Information. We may share aggregated or de-identified information that cannot reasonably be used to identify you.

6. Data Retention

• Retain your data while your account is active.
• Remove your data when you delete your account or as required by law.
• Maintain certain records only as long as necessary to meet legal requirements and resolve disputes.

Layers-specific: Images sent to Wavespeed are processed in real-time and are not retained by Wavespeed after processing is complete, unless you explicitly opt-in to model improvement (which requires separate consent).

7. International Data Transfers

Our Services may involve processing personal information in countries outside Australia, including the United States (for AI processing via Wavespeed and BuildShip). We implement safeguards such as contractual commitments to ensure equivalent protection. By using our Services, you consent to these transfers.

8. Children’s Privacy

Our Services are not directed at children under 16 years of age. We do not knowingly collect personal information from children without parental consent. If you believe your child has provided us with personal information, please contact us so we can delete it.

9. Automated Decision-Making Transparency

We currently do not use automated decision-making that significantly affects users’ rights or interests. If we implement such systems, we will clearly explain the nature, significance, and your rights in relation to it.

10. Data Security and Breach Notification

We have implemented technical and organisational measures to protect Personal Information, including encryption, access controls, and regular security assessments. If a data breach occurs that is likely to cause serious harm, we will notify the OAIC within 72 hours and affected individuals as soon as practicable.

Layers-specific security measures:

• All data is stored in secure cloud infrastructure (Supabase)
• Images are encrypted in transit (HTTPS/TLS) and at rest (AES-256)
• Authentication is handled via secure JWT tokens
• We implement Row Level Security (RLS) to ensure you can only access your own data
• Regular security audits and penetration testing

11. Your Rights

• Access – Request a copy of your Personal Information.
• Correction – Request corrections to inaccurate or incomplete information.
• Deletion – Ask us to delete your Personal Information and close your account.
• Objection and restriction – Object to or request restriction of processing in certain circumstances.
• Withdraw consent – Withdraw consent at any time (including AI processing consent in the Layers app).
• Complaint – Lodge a complaint with the OAIC or another supervisory authority.

12. Changes to This Privacy Policy

We may update this Policy to reflect changes in law, technology, practices or features. We will post the revised Policy and indicate the date of the last update. Material changes will be communicated through the App or via email.

13. Contact Us

Connect I/O Pty Ltd

Privacy Office

Sydney, NSW, Australia

Email: info@connectio.com.au

For questions specifically about AI data processing in the Layers app, please include "Layers AI Privacy" in your email subject line.