Privacy Policy

Romero is operated by Tryromero Pty Ltd (ABN 37 394 341 077). Romero is a tool for medical and allied health clinics to find practitioners near them and contact those practitioners directly. This policy explains what we collect, why, and what we do with it.

We handle personal information in line with the Australian Privacy Principles under the Privacy Act 1988 (Cth).

Your account. Your name, email address and an encrypted password, so you can sign in.

Your clinic. Its name, address and the professions you hire for. The address is converted to map coordinates so distances can be measured.

Practitioner records you add. Names, contact details, locations, experience and any notes you enter or import. This information is provided by you; Romero does not collect or supply practitioner data of its own.

Messages sent through Romero. The subject and body of emails you send, and of replies received in the conversations you started.

Mailbox access. If you connect Gmail or Outlook, we store access tokens issued by that provider. We never ask for, receive or store your email password.

If you connect a Google account, Romero requests permission to send email on your behalf, to read messages so replies to your outreach can be shown back to you, and to see your email address so we can label the connected mailbox.

We use this access only to send the messages you have written and approved, and to retrieve replies to conversations Romero started. We do not read unrelated mail, we do not use Gmail data for advertising, we do not sell it, and we do not use it to train machine learning models.

Romero’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect your mailbox in Settings at any time, which deletes the stored tokens. You can also revoke Romero’s access directly from your Google account security settings.

Data is held in a Postgres database operated by Supabase. Each clinic’s records are separated at the database level, so one clinic cannot read another’s data.

Mailbox access tokens are encrypted with AES-256-GCM before they are written, and are not readable from the browser.

No system is perfectly secure, and we cannot guarantee absolute security, but we take reasonable steps to protect information from misuse, loss and unauthorised access.

We do not sell personal information. We share it only with the services needed to run Romero: Supabase (database and authentication), Mapbox (converting addresses to map coordinates), Google and Microsoft (sending and receiving your email), and our hosting provider.

Every message sent through Romero identifies the clinic sending it and offers a way to opt out. When someone asks not to be contacted, their address is added to that clinic’s suppression list and Romero refuses to send to it again.

If you are a practitioner and want your details removed, contact the clinic that holds them, or write to us at harley@romero-org.com and we will help.

We keep your data while your account is active. Ask us to close your account and we will delete your clinic’s data, other than records we are required to keep by law and opt-out records, which are retained so we do not contact someone who has asked us not to.

You may ask for a copy of the personal information we hold about you, ask us to correct it, or make a complaint about how we have handled it. Write to harley@romero-org.com and we will respond within a reasonable time. If you are not satisfied, you can contact the Office of the Australian Information Commissioner.

If this policy changes we will update this page and the date at the top. Material changes will be notified to account holders by email.

Tryromero Pty Ltd (ABN 37 394 341 077)
12 Wilson Street, South Yarra VIC
harley@romero-org.com