Privacy Policy

Last updated: To be set on publish

Entity: Evro AI Pty Ltd (ACN 686 025 454), trading as Kora

Contents

1. 1. Who we are
2. 2. Who this policy covers
3. 3. Our role and your organisation's role
4. 4. Information we collect
5. 5. Health and other sensitive information
6. 6. What your organisation can and cannot see
7. 7. How we use information
8. 8. AI and your data
9. 9. Who we share information with
10. 10. Where your information is stored
11. 11. Security
12. 12. How long we keep information
13. 13. Children and family members
14. 14. Your rights
15. 15. Cookies
16. 16. If you are outside Australia
17. 17. Data breaches
18. 18. Changes to this policy
19. 19. Complaints and contact

1. Who we are

Kora is an employee assistance program built for organisational change. It is offered by Evro AI Pty Ltd (ACN 686 025 454), an Australian company based in Sydney, New South Wales ("Kora", "we", "us", "our").

Kora is a separate product line from the Evro meeting intelligence product. This policy covers Kora only. The Evro product has its own privacy policy at evro.ai/privacy.

Kora has three parts (together, the "Service"):

• Control: people leaders rehearse hard conversations out loud with an AI counterpart and are scored against a clinical standard.
• Know: the organisation sees which leaders and teams are ready.
• Care: employees and their eligible family members get confidential counselling, coaching, a 24/7 support line and critical incident support.

This policy explains what personal information we collect, how we use and protect it, and your rights. It is written to comply with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), and Australian state and territory health records laws, including the Health Records and Information Privacy Act 2002 (NSW) and the Health Records Act 2001 (Vic).

Kora is not an emergency service. If you or someone else is in immediate danger, call 000. For crisis support, call Lifeline on 13 11 14.

2. Who this policy covers

• Website visitors: people who browse koraeap.com or ask for a demo.
• Organisation contacts: HR, People and Culture and other staff who buy, set up or administer Kora for their organisation ("Administrators").
• People leaders: managers and leaders who use Control to rehearse conversations ("Leaders").
• Employees and family members: people who use Care ("Care Users"), including eligible immediate family members of employees.

3. Our role and your organisation's role

Your employer or the organisation that buys Kora (the "Organisation") gives its people access to the Service under a written agreement with us.

• For account details, Control and Know, we handle personal information to provide the Service to the Organisation, under that agreement and this policy.
• For Care, we handle your information to provide you with a confidential health service. Your Care information belongs to your care relationship, not to your employer. We do not give it to your Organisation in identifiable form, except in the limited cases in section 6.
• Some Care services are delivered by our clinical partners (see section 9). They hold their own clinical records and have their own privacy obligations as health service providers. We will tell you which provider is supporting you when you use those services.

4. Information we collect

4.1 Website visitors

• Name, work email, organisation and role when you book a demo, register for a group demo or contact us.
• Device and usage information such as IP address, browser type, pages viewed and approximate location from your IP address.
• Cookie and similar technology data, depending on your choices. See our Cookie preferences.

4.2 Administrators

• Name, work email, role, organisation and contact details.
• Information you give us to set up the Service, such as team structures, Leader lists and eligible employee groups.
• Billing contact details.
• Messages you send us and records of our support and account conversations.

4.3 Leaders (Control and Know)

• Account details: name, work email, role, team and the Organisation you belong to.
• Rehearsal audio: when you rehearse, we process your voice to turn it into text and let the AI counterpart respond. The audio is deleted once it is turned into text. We do not store it.
• Rehearsal transcripts: the text of your rehearsal and the AI counterpart's replies. Transcripts are private to you and are deleted after a set period.
• Scores and readiness records: your scores against the standard, gap lists, retries, completion dates and readiness status. These are kept as a record that you prepared.
• Uploaded transcripts: if you choose to upload a transcript of a real conversation for scoring, we process its contents. See section 5.3.
• Usage information: log-ins, feature use, timestamps and device information.

You should not put more personal detail about other people into a rehearsal than you need. Use first names or roles rather than full names, and leave out health and other sensitive details where you can.

4.4 Care Users (employees and family members)

• Registration details: name, email, phone number, date of birth, the Organisation you are linked to and, for family members, your relationship to the employee.
• Booking details: the type of support you choose, your preferred clinician, session times and whether sessions are by video, phone or in person.
• Health information: information you share with a clinician or the 24/7 line, the reason you reached out, wellbeing and mental health questionnaire results, risk assessments, and clinical notes kept by your clinician.
• Feedback: the rating you give after each session.
• Critical incident information: if your Organisation arranges critical incident support, details of the incident and the support given.
• Usage information: app activity, device information and timestamps.

4.5 Information from your Organisation

Your Organisation may give us your name, work email, role and team so we can set up your account and tell you that Kora is available.

5. Health and other sensitive information

5.1 Care

Information you share through Care is health information and sensitive information under the Privacy Act. We collect it only with your consent and only where it is reasonably necessary to give you care. You give that consent when you register for Care and when you choose to share information with a clinician. You can choose what you tell us.

5.2 Rehearsals

Rehearsals are practice. Leaders may mention details that are sensitive, such as an employee's health or a performance issue. We treat all rehearsal content as confidential, keep it private to the Leader, and delete transcripts after the period in section 12.

5.3 Uploaded transcripts of real conversations

If a Leader uploads a transcript of a real conversation, that transcript contains other people's personal information. The Leader and the Organisation are responsible for having a lawful basis to collect and share it, including any consent the other people in the conversation are entitled to. Kora does not record live meetings.

6. What your organisation can and cannot see

Leaders. Your Organisation can see whether you rehearsed, your scores, your gap areas and your readiness status, team by team. It cannot see your rehearsal transcripts or hear your rehearsal audio.

Care Users. Your Organisation cannot see whether you used Care, what you talked about or who you saw. It sees only de-identified trends, such as the number of sessions, satisfaction ratings and the most common reasons people reached out. We never report on a group of fewer than 10 people, so you cannot be identified from a report.

We will only disclose identifiable Care information to your Organisation or anyone else:

• with your consent;
• where a clinician reasonably believes it is necessary to lessen or prevent a serious threat to your life, health or safety, or someone else's; or
• where we or your clinician are required or authorised by law, such as a court order or mandatory reporting obligation.

7. How we use information

• To provide the Service: set up accounts, run rehearsals and scoring, show readiness reports, book and deliver care, and run the 24/7 line and critical incident support.
• To keep people safe: clinical triage, risk assessment and following up where there is a risk to someone's safety.
• To report to your Organisation: readiness reports for Leaders and de-identified Care reports, as set out in section 6.
• To support and communicate: answer questions, send service messages, launch communications for your Organisation and account notices.
• To improve the Service: understand how the Service is used, fix problems and improve features, using usage data and de-identified information.
• For security: detect and respond to misuse, fraud and security threats.
• For marketing to business contacts: we may send Administrators and website visitors who give us their work email product news and event invitations. You can unsubscribe at any time. We do not use Care information for marketing, and we do not market to Care Users on behalf of anyone else.
• To meet legal obligations: including health records, tax and record-keeping laws.

We do not sell personal information.

8. AI and your data

• We never train AI models on your data. This includes rehearsal audio, transcripts, uploaded transcripts and Care information.
• The AI services we use (ElevenLabs and Google) process your data only to provide the Service to you. They are not permitted to use it to train their own models.
• In Control, AI plays the counterpart, turns speech into text and scores rehearsals.
• In Care, AI helps triage requests for support and scores wellbeing and mental health questionnaires. Registered clinicians review triage results and make all clinical decisions.
• Scores are generated by AI against a standard designed by clinical psychologists. They can be wrong. Leaders can retry, and Organisations should not rely on a score alone to make decisions about a person's employment.

9. Who we share information with

We share personal information only as set out in this policy.

9.1 Clinical partners

The 24/7 support line and critical incident support are delivered with our clinical partner, Trauma Centre Australia. Counselling and coaching are delivered by registered psychologists and counsellors contracted by Kora. Clinicians and clinical partners are bound by professional confidentiality, health privacy laws and their agreement with us.

9.2 Service providers

We use trusted providers to run the Service. They may handle personal information only on our instructions and under a written agreement.

A current list is available on request at hello@evro.ai. We will give Organisations reasonable notice of material changes.

9.3 Legal and safety

We may disclose personal information if required or authorised by law, including to respond to a court order, to lessen or prevent a serious threat to someone's life, health or safety, or to protect our rights, our users or the public.

9.4 Business changes

If Kora or Evro AI Pty Ltd is sold, merged or restructured, personal information may pass to the new owner, who must keep handling it in line with this policy.

10. Where your information is stored

Your information is encrypted and stored in Australia.

Some of our service providers may process limited information outside Australia to provide the Service, for example to turn speech into text or to run website analytics. Where we disclose personal information overseas, we take reasonable steps under APP 8 to make sure the recipient handles it in line with the Australian Privacy Principles, including through contracts.

11. Security

We protect personal information with physical, administrative and technical safeguards, including:

• AES-256 encryption at rest and TLS 1.2 or higher in transit;
• role-based access, so staff and clinicians see only what they need;
• multi-factor authentication for administrative access;
• separation of Care information from Control and Know information;
• logging and monitoring of access to sensitive information; and
• regular security testing and vulnerability management.

No system is completely secure. If you think your account has been compromised, contact us straight away.

12. How long we keep information

Encrypted backups may be kept for up to a period to be set before publish days before they are permanently deleted.

If your Organisation ends its agreement with Kora, Kora stops funding Care. If you are seeing a counsellor, you can choose to keep seeing them privately, at your own cost. Your clinical records are kept as required by law.

13. Children and family members

Kora is for adults in the workplace. On some plans, Care is also available to eligible immediate family members of employees, including young people.

• We provide care to young people aged 8 and over. We do not see children under 8.
• Young people aged 16 and over are generally able to consent to their own health and psychological care, in line with Australian law and healthcare standards.
• Young people under 16 need the consent of a parent or guardian to register and take part.
• Clinicians follow professional and legal standards on young people's confidentiality. This may limit what is shared with a parent or guardian, especially for young people aged 16 and over.
• Family members' information is never shared with the employee's Organisation in identifiable form.

14. Your rights

You can:

• access the personal information we hold about you;
• correct information that is wrong, out of date or incomplete;
• ask us to delete your information, subject to the records we must keep by law, such as clinical records;
• opt out of marketing emails at any time; and
• withdraw consent to Care at any time, without affecting care already given.

To ask for your clinical records, contact us or your clinician. Some clinical records are held by our clinical partners, and we will help you reach the right one.

You can also deal with us anonymously or with a pseudonym where that is practical, for example when you call the 24/7 line. We may not be able to book sessions without your name and contact details.

Email hello@evro.ai with the subject line "Privacy Request". We may need to confirm your identity. We will respond within 30 days.

If your request is about information your Organisation gave us, we may also need to involve your Organisation.

15. Cookies

We use cookies on our website, koraeap.com. Essential cookies are always on. Analytics cookies (PostHog) are off until you turn them on. We do not use advertising cookies, and we do not use cookies for analytics or advertising in the Kora app. See our Cookie preferences to learn more and change your choices.

16. If you are outside Australia

Kora is built for Australian organisations, and your information is handled under Australian law. If you use Kora from another country, for example as an employee of an Australian Organisation who lives overseas, you may have extra rights under local law, such as the EU or UK General Data Protection Regulation. Contact us and we will respond in line with the law that applies to you.

17. Data breaches

If a data breach is likely to cause serious harm, we will notify the people affected and the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches scheme. We will also notify affected Organisations promptly, in line with our agreement with them.

18. Changes to this policy

We may update this policy from time to time. If we make a material change, we will tell Organisations and active users by email or in the app before it takes effect. The date at the top shows when it last changed. The current version is always at koraeap.com/privacy.

19. Complaints and contact

If you have a question or complaint about privacy, contact our Privacy Officer:

• Email: hello@evro.ai (subject: "Privacy Enquiry")
• Post: Privacy Officer, Evro AI Pty Ltd, Sydney NSW 2000, Australia

We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days.

If you are not satisfied with our response, you can complain to:

• Office of the Australian Information Commissioner (OAIC): oaic.gov.au or 1300 363 992.
• For health information in your state or territory: for example, the NSW Information and Privacy Commission (ipc.nsw.gov.au) or the Victorian Health Complaints Commissioner (hcc.vic.gov.au).
• For a complaint about a clinician's care: the Health Care Complaints Commission in NSW, or AHPRA (ahpra.gov.au) for registered psychologists.

To report a security vulnerability, email hello@evro.ai with the subject line "Vulnerability Disclosure".