1. Introduction
The National Justice Project Ltd (ABN23 609 620 028) ("NJP", "we", "us", "our")operates the Hear Me Out platform (Platform). The Platform is anAI-assisted tool designed to help users identify complaint bodies, complaintpathways, support services and next steps that may be relevant to theirsituation. It provides legal information and complaint-navigationguidance only. It does not provide legal advice.
This Privacy Policy explains howwe collect, hold, use and disclose personal information in connection with thePlatform, and how you can request access to or correction of your personalinformation. The Privacy Policy applies to anyone who uses the Platform orotherwise interacts with us about the platform, including individuals,advocates, support workers, professionals and other users.We handle personalinformation in accordance with the Privacy Act 1988 (Cth) (Privacy Act) as amended from time to time, including the Australian PrivacyPrinciples (APPs). The APPs are designed to protect the privacy ofindividuals by regulating the way personal information is collected, used,disclosed, and managed.
The Platform currently only providesinformation about New South Wales, Victoria and federal complaint pathways.
2. What Personal Information do we collect?
The personal information we collect through the Platform depends on how you use the Platform and interact with us, and what information you choose to include in free-text inputs.
For the triage chatbot tool, we collect:
- the information you enter into the chat;
- the date of the log; and
- the session ID.
We may also collect:
- information you provide when contacting us, requesting support, or giving feedback;
- records of communications with us about the Platform; and
- website and service usage information collected through our platform and service providers, including analytics, security and technical tools.
The Platform does not ask users to provide more personal or sensitive information than is reasonably necessary to use the service. Where practicable, users may interact with the Platform without identifying themselves, or by using a pseudonym. Users should avoid including names, contact details, health information or other sensitive information unless it is reasonably necessary to explain their issue.
However, as the Platform accepts free-text user input, information entered into the triage chatbot may include personal or sensitive information about you or another person. Personal information has the meaning given in the Privacy Act and includes information or an opinion relating to an identified, or reasonably identifiable, individual, whether the information is true or not. Sensitive information, as a subset of personal information, includes information about an individual's health, racial or ethnic origin, political opinions, membership of a political association, religious beliefs or affiliations, philosophical beliefs, membership of a professional or trade association or membership of a trade union, among other things
3. How do we collect and hold personal information?
We collect personal information in the following ways:
- directly from you when you use the Platform, submit a chat message, contact us or provide feedback;
- automatically when you use the website, chatbot or related systems, for example technical and usage information such as timestamps, pages visited, browser or device information, IP address, error logs, security logs and analytics information;
- through service providers that support the operation, security, analytics, maintenance and improvement of the platform.
Triage Tool:
When you use the triage tool, full triage chatbot conversations are logged automatically. These triage logs are stored in the Platform’s administrative systems.
The following measures are in place to ensure the protection of collected personal information:
- administrative access is restricted to the Project Lead, and any other person granted permission by the Project Lead;
- access requires authentication controls, including double factor authentication through a justice.org.au email account;
- personal information is stored in a protected cloud environment; and
- access to the personal information is logged and monitored.
3.3 Retention of Information
NJP takes reasonable steps to detect, assess and respond to privacy and security incidents affecting the Platform.
Third-Party Service Providers may also have administrative or support access where reasonably required to maintain or support the platform.
Complaint Writing Tool:
Based on our current understanding and configuration of the complaint writer tool, these user interactions are not stored in the same administrative logging environment as triage chatbot interactions and are not visible there, or retained in the AI environment.
We keep personal information only for as long as it is reasonably necessary for the purposes described in this Privacy Policy, including operating, securing, reviewing and improving the Platform, responding to issues, and meeting legal and governance requirements.
Triage admin logs are retained only for as long as they are reasonably required for those purposes. When personal information is no longer reasonably required for a purpose permitted under applicable privacy law, we will take reasonable steps to destroy it or de-identify it, unless we are required or authorised by law to retain it. NJP reviews its information-handling practices from time to time and is continuing to develop and formalise retention and deletion processes for triage logs.
4. How we handle information entered into the Platform
Triage logs may be accessed by authorised users where reasonably necessary for platform operation, troubleshooting, safety, quality assurance, evaluation and improvement.
Where practicable, we de-identify information before using it for broader internal analysis, reporting, research, advocacy or service improvement. Authorised users manually review triage logs and remove direct identifying details. Direct identifiers include, but are not limited to, names, addresses, occupation, employer and organisation names. Where sensitive information is provided through the Platform, the information is retained so far as it is not capable of directly identifying any individual. This de-identified information is recorded in internal spreadsheets, which are stored in NJP’s SharePoint environment.
When de-identified spreadsheet information is created, any identifiable SharePoint version is deleted immediately. NJP does not keep an identifiable spreadsheet version outside the triage admin logs.
4.1 Third Party Service Providers:
This Platform uses third-party providers and infrastructure to help deliver and maintain the platform. These currently include Webflow, Microsoft Azure, Azure OpenAI, Cosmos DB, Pinecone, Google Analytics, Sentry, reCAPTCHA and Bitbucket (collectively "Third-Party Service Providers"). These Third-Party Service Providers support different aspects of the website, AI infrastructure, storage, analytics, monitoring, security, deployment and platform administration.
If personal information is included in a triage message, it may be disclosed to Third-Party Service Providers that support the operation of the Platform, including providers involved in hosting, AI functionality, storage, analytics, monitoring, security, bot protection, deployment and system administration.
We take reasonable steps to ensure that third-party service providers handling personal information on our behalf do so under appropriate contractual, technical or organisational arrangements.
This Platform is configured so that personal information handled through the platform is intended to be stored and processed in Australia. We rely on information provided by our relevant service providers about their Australian hosting and processing arrangements. However, some Third-Party Service Providers, or their products, infrastructure, subprocessors or support services, may involve access to or processing of personal information outside Australia in some circumstances, including for maintenance, support or incident response. For that reason, we cannot guarantee that overseas disclosure or overseas access will never occur.
Where personal information is disclosed to, or accessed by, an overseas recipient in connection with the operation, support, maintenance or improvement of the Platform, we take reasonable steps to ensure that the recipient handles that information in a manner consistent with applicable privacy obligations.
We may also disclose personal information where required or authorised by law, where you direct us to do so, or where disclosure is reasonably necessary to lessen or prevent a serious threat to life, health or safety, where permitted by law.
4.2 Automated Processes:
The Platform uses artificial intelligence, including large language models provided by Third-Party Service Providers, to process information entered by users and generate responses. This processing is substantially automated.
The personal information subject to this automated processing includes the information described in section 2 above. Authorised NJP personnel may review triage logs and AI-generated outputs for the purposes described in section 5 above.
The outputs generated through this automated processing include the identification of complaint bodies, complaint pathways, support services and suggested next steps that may be relevant to your situation, as well as draft complaint correspondence generated through the complaint writing tool. The Platform does not make binding decisions or determinations that affect your legal rights or obligations. You retain full autonomy over what action, if any, you take based on the information provided by the Platform.
5. Purposes of Collection, Use and Disclosure
We collect, hold, use and disclose personal information for the following purposes:
- providing the Platform’s functionality, including the triage chatbot and complaint writing tools;
- responding to user queries, feedback, complaints and support requests;
- monitoring and reviewing online chats for quality assurance, training and compliance purposes;
- to improve automated responses generated with GenAI;
- platform operation, troubleshooting, safety, quality assurance, evaluation and improvement;
- de-identified reporting, research, advocacy and analysis of structural or systemic trends;
- maintaining the security and integrity of the Platform and its systems;
- complying with applicable laws, regulations and legal obligations; and
- any other purpose notified to you at or before the time of collection, or to which you have consented.
We will not use or disclose personal information for a purpose other than the purposes listed above, unless we have your consent, or an exception under the Privacy Act applies (for example, where use or disclosure is required or authorised by or under an Australian law or court order).
6. Access and amendment
You may request access topersonal information we hold about you, and you may ask us to correct personalinformation that is inaccurate, out of date, incomplete, irrelevant ormisleading. We may need to verify your identity before responding to a request.In some circumstances, the law permits us to refuse access or decline to make arequested correction.
To request access to orcorrection of your personal information, please contact us using the detailsbelow.
7. Complaints
If you have a concern about howwe have handled your personal information, you may contact us using the detailsbelow and describe your concern. We will consider your complaint and respondwithin a reasonable period. We may ask you for further information to help usassess and respond to your complaint.
If you are not satisfied with ourresponse, you may complain to the Office of the Australian InformationCommissioner (OAIC).
9. Updates to this Privacy Policy
We may update this Privacy Policyfrom time to time to reflect changes to the Platform, our practices, Third-PartyService Providers or legal requirements.
The current version will bepublished on our website with its effective date.
This privacy policy was last updated June 2026.