Privacy Policy

Viamentis Pty Ltd ("Viamentis", "we", "us", or "our") is an Australian software company headquartered in Adelaide, South Australia. We develop and operate the Tenon platform — a workflow, incident management, and risk management system used primarily by health and human services organisations.

This Privacy Policy applies to personal information collected, held, used, or disclosed by Viamentis in connection with:

• the Tenon platform and Rabbet AI features;
• our website at tenon.viamentis.au; and
• interactions with Viamentis for support, sales, and implementation services.

Viamentis is bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where Tenon is used to process health information, the additional obligations under the Privacy Act relating to sensitive information also apply.

In most cases, Viamentis acts as a data processor — we process personal information on behalf of our customers (the organisations that deploy Tenon), who are the data controllers responsible for that information. This policy describes how Viamentis handles personal information in that capacity and in connection with our own operations.

The personal information held within Tenon is determined by the organisation deploying and configuring the platform. Depending on configuration, this may include:

Viamentis does not collect personal information from individuals directly — information is entered into Tenon by the organisations and staff who use the platform.

Information held within Tenon is used exclusively to deliver the platform services contracted by the deploying organisation. Viamentis does not use customer data for marketing, profiling, or any purpose outside of the service relationship.

Specifically, Viamentis uses personal information to:

• operate, maintain, and improve the Tenon platform;
• deliver automated notifications, system alerts, and workflow communications;
• provide technical support and respond to service requests;
• process AI-assisted features within Rabbet (where enabled), such as generating reports, categorising data, and transcribing voice input; and
• meet legal, regulatory, and contractual obligations.

Contact details provided through the Tenon website (such as demo or enquiry requests) are used only to respond to the enquiry and will not be added to marketing lists without explicit consent.

Viamentis implements appropriate technical and organisational measures to protect personal information against unauthorised access, disclosure, alteration, and loss. These measures include:

• encryption of data in transit using TLS 1.2 or higher;
• encryption of data at rest within managed database infrastructure;
• role-based access controls ensuring staff only access information necessary for their role;
• multi-factor authentication for administrative access;
• regular security reviews and dependency patching; and
• audit logging of all data access and changes within the platform.

For cloud-hosted deployments, Tenon runs on Amazon Web Services infrastructure within Australia. For on-premises deployments, security of the underlying infrastructure is the responsibility of the deploying organisation.

No method of transmission or storage is completely secure. While we work to protect your information, we cannot guarantee absolute security.

To deliver Tenon, Viamentis engages a small number of trusted third-party sub-processors. These organisations process personal information only to the extent necessary to provide the contracted service and are bound by appropriate data processing agreements.

A full and current list of sub-processors — including the services they provide, the data they process, and which deployment types they apply to — is maintained at:

Viamentis does not sell, trade, rent, or otherwise transfer personal information to third parties for their own purposes.

Viamentis reserves the right to reference customer organisation names in marketing materials, case studies, or on our website. Customer organisation names will be removed upon written request.

Tenon uses session cookies and browser storage to maintain authenticated sessions and remember user preferences such as organisation context and display settings. These are essential to the functioning of the platform and cannot be disabled without affecting the ability to use Tenon.

Tenon does not use tracking cookies, advertising cookies, or cookies that monitor activity across third-party websites.

IP addresses are recorded in access logs for security monitoring and administrator review of user-initiated actions. These logs are retained for a limited period in accordance with our data retention practices.

This website (tenon.viamentis.au) may use minimal analytics to understand how visitors interact with the site. No personal information is collected through these analytics without consent.

All data held within Tenon remains the property of the deploying organisation. Viamentis retains data only for as long as necessary to deliver the contracted services, or as required by applicable law.

Upon termination of a service agreement, Viamentis will:

• provide a reasonable period for the organisation to export their data;
• securely delete or destroy all associated data from Viamentis-managed infrastructure; and
• confirm destruction in writing upon request.

Authorised administrators of a Tenon deployment may request deletion of specific records at any time, subject to any legal or regulatory retention obligations that apply to the deploying organisation (such as health record retention requirements under applicable state and territory legislation).

Viamentis maintains security measures designed to prevent unauthorised access to personal information. In the event of a data breach, Viamentis will act in accordance with the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988 (Cth).

If Viamentis becomes aware of a breach that is likely to result in serious harm to any individuals whose information is involved, we will:

• notify the affected organisation as soon as practicable;
• notify the Office of the Australian Information Commissioner (OAIC); and
• take reasonable steps to contain the breach and prevent further harm.

Deploying organisations, as data controllers, are responsible for notifying affected individuals in accordance with their own obligations under the NDB scheme and any relevant state health privacy legislation.

Under the Australian Privacy Principles, individuals have the right to:

• request access to personal information held about them;
• request correction of personal information that is inaccurate, out of date, incomplete, or misleading; and
• make a complaint about how their personal information has been handled.

Because Viamentis processes personal information on behalf of deploying organisations, requests for access or correction should in the first instance be directed to the organisation that deployed Tenon in the relevant context (for example, the hospital or health service you received care from).

Where a request relates specifically to how Viamentis has handled personal information in its own right, please contact us directly using the details below.

Where Tenon is deployed on the customer's own infrastructure (on-premises), the deploying organisation is responsible for the security and management of all data stored within their environment.

On-premises deployments make outbound API calls to Tenon Central — a Viamentis-hosted service — to access shared platform capabilities including AI features (via Anthropic and OpenAI), voice transcription (via Amazon Transcribe), message queuing (via Amazon SQS), and communication services (via Twilio and SendGrid). When these features are used, relevant data is transmitted to Tenon Central and the associated sub-processors. The same sub-processor protections described in this policy and on the sub-processors page apply.

If an on-premises customer disables specific features (such as AI or SMS), the corresponding sub-processors will not receive any data.

Viamentis may update this Privacy Policy from time to time to reflect changes in our practices, platform capabilities, or legal obligations. The date of the most recent update is shown at the top of this page.

Where changes are material, we will notify current customers via the platform or by email prior to the changes taking effect. Continued use of Tenon following notification constitutes acceptance of the updated policy.

For privacy-related enquiries, complaints, or requests, please contact Viamentis at:

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.