LEGAL

Privacy policy

LAST UPDATED: [DATE]

Who we are and what this covers

nørma is made by The Artistry of Humanity Pty Ltd (ABN 61 676 269 579), Unit 17, 3 Alexander Street, Coogee NSW 2034, Australia. In this policy, "we", "us" and "AOH" mean The Artistry of Humanity Pty Ltd.

This policy explains what personal information we collect when you use the nørma app, why we collect it, who can see it, and what your choices are. It applies to everything that makes up nørma: the companion app on iOS, Android and the web; the leadership dashboard and admin console used by your organisation's nominated leaders and administrators, including the information we collect about them in that role; and our website at joinnorma.com. The website sets no tracking cookies; it loads its fonts from Google Fonts, which sends a request to Google.

We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles. If you are in the European Union, the United Kingdom or a US state with its own privacy law, section 10 explains your additional rights.

The short version

You use nørma because your organisation has made it available. Your organisation pays for it. But what you put into nørma is yours:

(a)

Your employer never sees your check-in answers, your reflections, your voice recordings, your personal scores, your habits, your commitments or anything else you enter. Not on request, not in a dispute, not ever. We have agreed this with your employer in writing, and we built the app so that it cannot happen.

(b)

Your employer sees anonymised results for groups of at least five people: how a team or the organisation as a whole is doing across the Five Pillars and the culture questions, and the themes that come up across people's reflections. If a group is smaller than five, your employer sees nothing for that group: no number, no count.

(c)

If you write something in a free-text box, your employer sees it only if you chose to share it, and only mixed in with others' responses and with names removed.

(d)

We do not monitor you, and we do not tell your employer anything about you as an individual.

(e)

You can see, download and delete everything you have entered, at any time, from inside the app.

(f)

nørma is not a medical or crisis service. If you are in danger, contact emergency services or a crisis line (section 9).

What we collect

InformationWhere it comes from

Account details: your name, work email address, your organisation and the team you are in, and your login details.Your organisation gives us your name, work email and team so it can invite you. You set your own password or sign in with a method your organisation provides.

Check-in answers: your ratings and responses on the Five Pillars check-in and the culture questions (whether you feel safe to speak up, heard and valued).You, when you complete a check-in.

Reflections: what you write or say in the reflection feature, any life context you choose to add, and the mirror responses, themes and indicators the app generates from it.You. If you use voice, your speech is turned into text on your device; nothing is sent anywhere to be transcribed. We store the text and, separately, the recording so you can play it back. Only your account can access the recording.

Habits, commitments and journeys: the habits you track, the commitments you make, your progress through growth journeys, your personal fulfilment score and your growth momentum.You, as you use the app.

Free-text responses: anything you type into an optional comment box, and whether you chose to share it with your organisation.You.

Settings and device information: your reminder preferences, notification token, device type, operating system, app version, language and time zone.Your device and the app.

Usage information: records of your sign-ins and the technical details of your sessions, kept for security, plus error and performance data. nørma contains no advertising or analytics trackers and does not follow you outside the app.The app, automatically.

Support correspondence: what you send us if you contact support.You.

Some of what you enter may be information about your health or wellbeing. Under Australian law this is sensitive information, and we only collect it because you choose to give it to us when you use the app. You can use nørma without entering anything you do not want to.

Why we use it, and who sees what

PurposeWho sees the information

To run your private companion app: show your check-ins, reflections, habits and progress back to you, send reminders you have set, and keep your account working.You. AOH's own administration accounts cannot read your content. A small number of named engineers can reach the systems that hold it, for operations and support only, under access controls, logging and confidentiality obligations. Nobody reads it as a matter of course.

To generate your mirror and themes using AI: when you write or speak a reflection, the text (and any life context you added) is sent to our AI provider to produce a response that reflects back what you said and to identify themes and indicators.You. The AI provider receives the text without your name, email or organisation, and is contractually prohibited from training its models on it (section 5).

To give your organisation an anonymised picture of how its people are doing: we combine check-in answers, and themes and indicators drawn from reflections, into results for groups of at least five people, in the same way your answers roll into a team's fulfilment score.Your organisation's nominated leaders and administrators, but only the aggregated result for groups of at least five. Never your individual answers, never your reflections, never anything that identifies you. This includes indicators of serious concerns, such as bullying or safety, that come up across reflections: your organisation sees a count or level for a group of at least five, never the reflection and never who it came from. A leader's own answers are left out of their team's figures.

To count how many people are enrolled in nørma, so your organisation can be billed.Your organisation's administrators manage the list of who is invited and see how many people are enrolled, and the participation level for groups of at least five. They do not see whether or how you use the app.

To keep nørma secure, fix problems and understand how the app is used.AOH and our engineering partner, using usage information and, where needed, logs.

To improve nørma and the Five Pillars framework.AOH, using information that has been de-identified so it cannot be linked back to you or your organisation.

To respond when you contact us.AOH support.

We do not sell your information. We do not use it for advertising. We do not use it to train third-party AI models. We do not share it with your employer, with other employers, or with anyone else except as described in section 5, or where the law requires us to, or where we reasonably believe it is necessary to protect someone's life or safety and the law allows it.

Who we share it with

We use a small number of service providers to run nørma. Each is bound by a contract that limits what it can do with your information:

ProviderWhat forWhere

Amazon Web ServicesHosting, database, storage (including your voice recordings), backups, sign-in and email deliveryAustralia (Sydney), unless your organisation has chosen another region, which your organisation will tell you

AnthropicThe AI model that generates your mirror and classifies themes. Receives the reflection text and any life context, without your name, email or organisation. Not permitted to train on it.United States

Expo, Apple and GoogleDelivering push notifications to your device (your device token and the notification text only)Global

TensariaEngineering and operations support for the platform, under confidentiality and access controlsAustralia

Your speech is turned into text on your own device. No audio is sent to anyone to be transcribed.

Some of these providers are outside Australia. Before we disclose your information overseas, we take the steps Australian privacy law requires to make sure it stays protected.

How long we keep it

We keep your information while your account is active. If you delete your account in the app, it is suspended for 30 days, during which you can change your mind and restore it. After that, everything you entered is erased: reflections, recordings, check-ins, habits, all of it. Group results your answers already contributed to are not recalculated, because they contain nothing that identifies you. Records of your sign-ins are kept for security, backups are deleted on their normal cycle, and we keep anything the law requires us to keep.

If your organisation removes you, for example because you leave, or if your organisation stops using nørma, your access ends. You have 30 days to export your data before it is erased.

We may keep de-identified information that cannot be linked to you.

Your choices and rights

(a)

See and download. You can view everything you have entered inside the app and export it as a single file at any time.

(b)

Correct. You can edit your habits, commitments and reflections in the app. If something else about you is wrong, tell us and we will fix it.

(c)

Delete. You can delete individual reflections, or your whole account, from the app's settings at any time. You do not need your employer's permission.

(d)

Share or not. Free-text responses are only shared with your organisation if you choose to share them. The default is not to share.

(e)

Notifications. You can turn reminders off in the app or in your device settings.

(f)

Complain. If you think we have mishandled your information, contact us (section 11). We will respond within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Using nørma is voluntary. Your organisation has agreed with us that it will not require you to use it and will not treat you differently if you do not.

How we protect it

Your information is encrypted in transit and at rest. Access to the systems that hold it is limited to named people who need it, protected by multi-factor authentication, and logged. The minimum group size of five, the exclusion of a leader's own answers from their team's figures, and the rule that stops a small group's result being worked out by subtraction are enforced on our servers, before anything reaches your organisation's dashboard. The dashboard only ever receives the finished group figures. Two honest limits: a group of five shows a result from its first check-in, so a figure can rest on a few answers, and comparing figures over time can narrow down who might have changed. Your organisation can raise the minimum, and it has agreed never to try to work out who said what. We test our security independently and we maintain an information security program aligned to ISO 27001. No system is perfectly secure, and if a breach affects your information we will tell you and the regulator as the law requires.

nørma is not a crisis service

nørma supports your wellbeing and fulfilment. It does not diagnose or treat anything, it is not a substitute for a doctor, psychologist or counsellor, and it is not monitored by a person. Responses generated by AI can be wrong and are not advice.

If you enter something that suggests you may be at risk, the app will show you contact details for support services. It will not alert your employer or anyone else. If you are in immediate danger, call emergency services (000 in Australia, 911 in the United States) or a crisis line such as Lifeline on 13 11 14 (Australia) or 988 (United States).

If you are outside Australia

European Union and United Kingdom. For the information you enter into the app, AOH is the controller. We rely on your consent, which you give by using the app and can withdraw by deleting your account. You have the rights to access, rectify, erase, restrict and port your data, to object, and to lodge a complaint with your local supervisory authority. Where we transfer your data outside the EU or UK, we use Standard Contractual Clauses or an equivalent safeguard. [Add the EU or UK representative's details once appointed, if required.]

United States. Depending on your state, you may have the right to know what personal information we hold about you, to delete it, to correct it, and not to be discriminated against for exercising those rights. We do not sell or share personal information for targeted advertising. You can exercise these rights in the app or by contacting us.

Wherever you are, you have the choices in section 7.

Contact us

Privacy questions, requests and complaints: [privacy@joinnorma.com]

Post: The Artistry of Humanity Pty Ltd, Unit 17, 3 Alexander Street, Coogee NSW 2034, Australia

Changes to this policy

If we change this policy in a way that matters, we will tell you in the app before the change takes effect. The date at the top shows when it was last updated.

The terms each person accepts when they create an account.Read the Terms of use ›