Privacy Policy
Sanctorum Operated by Sanctorum Labs Pty Ltd (ACN 700 724 625, ABN 78 700 724 625)
Effective date: 13 September 2026 Last updated: 13 September 2026
1. Who we are
Sanctorum is an education application for health students, beginning with anatomy and physiology. It is operated by Sanctorum Labs Pty Ltd, an Australian proprietary company registered in South Australia (ACN 700 724 625, ABN 78 700 724 625).
In this policy, "Sanctorum", "we", "us" and "our" mean Sanctorum Labs Pty Ltd. "You" means anyone who uses the Sanctorum website or app, or who contacts us.
We take your privacy seriously. This policy explains what personal information we collect, why we collect it, who we share it with, and what control you have over it. It is written to comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
Contact for privacy matters Email: privacy@sanctorumlabs.com Post: Sanctorum Labs Pty Ltd — PO Box 273, Greenacres SA 5086, Australia.
2. The short version
- We collect the minimum we need to give you an account, teach you, and take payment.
- We do not sell your personal information, and we never will.
- We do not use your study data to advertise to you.
- You can ask us for a copy of your data, ask us to correct it, or ask us to delete your account at any time.
- Some of our service providers store data overseas. Section 7 names them.
The rest of this policy is the detail behind those points.
3. What personal information we collect
3.1 Information you give us
| What | Examples | Why we need it |
|---|---|---|
| Account details | Your name, email address, and a password (stored only as a secure one-way hash — we never see or store your actual password) | To create and secure your account, and to contact you about it |
| Profile details (optional) | Your university or institution, your year or stage of study, your discipline | To show you the right content and to understand who our users are |
| Payment details | Your billing name and email, and the last four digits and expiry of your card | To take and manage your subscription payment |
| Communications | Anything you send us by email or through a support or feedback form, including content error reports | To answer you and to fix problems |
We do not collect or store your full card number. Card details are entered directly with our payment processor, Stripe, and never pass through our systems. See section 7.
3.2 Information we collect automatically
| What | Examples | Why we need it |
|---|---|---|
| Study and progress data | Which learning units you open, quiz answers, scores, streaks, time spent, what you have marked as difficult | This is the core of the product — it is how Sanctorum adapts what it shows you and tracks your progress |
| Device and technical data | IP address, browser and device type, operating system, approximate location derived from IP (country/city level only), crash reports | To keep the service working, to secure it, and to diagnose faults |
| Usage analytics | Pages and screens viewed, features used, buttons pressed, session length | To understand which parts of the product work and which need improving |
We do not collect your precise GPS location, your contacts, your photos, your microphone or your camera.
3.3 Sensitive information
We do not ask for or intentionally collect "sensitive information" as the Privacy Act defines it — including health information, racial or ethnic origin, political or religious beliefs, sexual orientation, or criminal record.
Please note: Sanctorum teaches anatomy and physiology. It is a study tool, not a health service. The fact that you study a particular topic is not a record about your own health, and we do not treat it as one. Please do not send us information about your own health, or a patient's health, through support messages or feedback forms.
3.4 If you do not give us this information
You can browse our public website without an account. If you do not give us a name, email address and password, we cannot create an account for you or save your progress. If you do not give payment details, you cannot subscribe to a paid plan.
4. How we use your information
We use your personal information to:
- Create and run your account — sign you in, keep you signed in across devices, and recover access if you lose your password.
- Deliver the product — show you learning content, quizzes and images, and record your progress.
- Personalise your learning — decide what to show you next, when to revise a topic, and how to pace your study, based on how you have performed.
- Take payment — process your subscription, issue receipts, handle failed payments, and manage renewals, cancellations and refunds.
- Support you — answer your questions and investigate problems you report.
- Improve Sanctorum — understand in aggregate which content and features work, find and fix bugs, and correct errors in our educational content.
- Keep the service secure — detect and prevent fraud, account sharing in breach of our terms, abuse, and unauthorised access.
- Meet our legal obligations — including tax, accounting and record-keeping requirements.
We will not use your personal information for a purpose that is unrelated to the ones above unless you would reasonably expect it, you have consented, or the law requires or permits it.
5. Direct marketing
If you have an account, we may email you about Sanctorum — new content, features, or offers.
- Every marketing email has an unsubscribe link. One click, and we stop.
- You can also email us at the address in section 1 and ask to be removed.
- Unsubscribing does not stop essential service emails — password resets, payment receipts, notice of a change to these terms, or a security alert. You cannot opt out of those while you hold an account, because we need to be able to reach you about your own account.
- We do not provide your details to any third party for their own marketing.
6. Cookies and similar technologies
We use cookies and similar local storage to:
- Keep you signed in (essential — the service does not work without these).
- Remember your preferences.
- Measure how the product is used, through our analytics provider (see section 7).
You can block or delete cookies in your browser settings, but the essential ones are required for sign-in to work.
7. Who we share your information with
We do not sell your personal information, and we do not disclose it for anyone else's marketing.
We use the following service providers to run Sanctorum. Each of them only receives what they need, and each is bound to protect it.
| Provider | What they do | What they receive | Where data may be stored |
|---|---|---|---|
| Supabase | Database, authentication and file storage | Account details, study and progress data | Australia (Sydney) — no overseas disclosure |
| Stripe | Payment processing | Billing name, email, card details (entered directly with Stripe), transaction records | United States and other countries where Stripe operates |
| PostHog | Product analytics | Usage events, device and technical data, a pseudonymous user identifier | European Union (PostHog EU cloud, hosted in Germany) |
| Vercel | Website and application hosting | Technical data such as IP address in server logs | United States and its global edge network |
| Hostinger | Email hosting for our support and correspondence addresses | Your name, email address and the content of messages you send us | Outside Australia — Hostinger operates data centres in Europe, the United States and Asia |
We may also disclose your personal information:
- to our professional advisers (accountants, lawyers, auditors), under obligations of confidentiality;
- where we are required or authorised by Australian law, or by a court, tribunal or regulator;
- where it is necessary to prevent a serious threat to someone's life, health or safety;
- to investigate suspected unlawful activity or a serious breach of our terms; and
- to a buyer or successor if Sanctorum Labs Pty Ltd is sold, merged or restructured — in which case your information stays subject to a policy at least as protective as this one, and we will tell you.
7.1 Overseas disclosure
Some of the providers above store or process data outside Australia, as set out in the table. Where we disclose your personal information overseas, we take reasonable steps to ensure the recipient handles it in a way consistent with the Australian Privacy Principles — including through the contractual terms in their data processing agreements. By using Sanctorum you acknowledge that your information may be stored and processed in the countries listed above.
8. How we protect your information
We take reasonable steps to protect your personal information from misuse, interference, loss, and unauthorised access, modification or disclosure. These include:
- Encryption in transit (HTTPS/TLS) across the whole service, and encryption at rest in our database.
- Passwords stored only as salted one-way hashes — we cannot read them, and neither can an attacker who obtains the database.
- Access controls limiting who can reach production data, with access granted on a need-to-have basis.
- Reputable infrastructure providers with their own independently audited security programs.
- Regular updates and dependency patching.
No system is perfectly secure. If we become aware of a data breach that is likely to result in serious harm, we will notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.
9. How long we keep your information
- While your account is open, we keep your account and study data so the product works and your progress is preserved.
- If you delete your account, we delete or irreversibly de-identify your personal information within 30 days, except where we must keep something longer.
- Financial records (invoices, payment records) are kept for seven years, as Australian tax law requires. These contain your name, email and transaction details, but not your study data.
- De-identified, aggregated data — for example "62% of users found this quiz question difficult" — may be kept indefinitely. It cannot be linked back to you.
10. Your rights: access, correction and deletion
You can, at any time:
- Access — ask for a copy of the personal information we hold about you.
- Correct — ask us to fix anything inaccurate, out of date or incomplete. Most of this you can do yourself in your account settings.
- Delete — ask us to close your account and delete your personal information, subject to the record keeping obligations in section 9.
- Complain — see section 11.
Email the address in section 1. We will respond within 30 days. We do not charge for access requests, though we may charge a reasonable cost for an unusually large or repeated request — and we will tell you before we do.
We may need to verify your identity before acting on a request, to make sure we are not giving your data to someone else. In limited cases the Privacy Act permits us to refuse access or correction; if that happens we will tell you why, in writing, and how to complain.
11. Complaints
If you think we have mishandled your personal information or breached the Australian Privacy Principles, please tell us first. Email the address in section 1 with the details.
We will acknowledge your complaint within 5 business days and give you a written response within 30 days.
If you are not satisfied with our response, you can take the complaint to:
Office of the Australian Information Commissioner (OAIC) Website: oaic.gov.au Phone: 1300 363 992 Post: GPO Box 5218, Sydney NSW 2001
12. Users under 18
Sanctorum is intended for people aged 16 and over. It is built for university-level health students, and we do not knowingly create accounts for anyone under 16.
If you are under 18:
- You may use Sanctorum's free features, but paid plans are available only to people aged 18 and over.
- We handle your personal information the same careful way we handle everyone's, and we do not use it for profiling or targeted advertising.
If you believe someone under 16 has created an account, email us at the address in section 1 and we will close it and delete the information.
13. International users
Sanctorum is operated from Australia and is available to students around the world. Wherever you use it from, your information is handled under Australian law as described in this policy, and stored with the providers named in section 7.
14. Changes to this policy
We may update this policy as Sanctorum changes or the law changes. The "last updated" date at the top always reflects the current version.
If we make a change that materially affects how we handle your personal information, we will tell you by email or by a notice in the app before it takes effect. Continuing to use Sanctorum after that means you accept the updated policy.
15. Contact us
Sanctorum Labs Pty Ltd ACN 700 724 625 · ABN 78 700 724 625
Email: privacy@sanctorumlabs.com Post: Sanctorum Labs Pty Ltd — PO Box 273, Greenacres SA 5086, Australia.