The detail behind those five statements.

Lange Consulting Group Pty Ltd.

This policy applies to Lange Consulting Group Pty Ltd (ABN 85 607 114 134), trading from Sydney, Australia, and to everything published at simonlange.com.au — including every assessment published here, the writing, and the consulting and advisory work described on this site. Throughout, “I”, “me” and “we” mean Lange Consulting Group Pty Ltd, and include anyone working under the company’s direction — employees, contractors or partners — who is bound by the same confidentiality and privacy obligations set out here.

Personal information means what it means in the Privacy Act 1988 (Cth): information about an identified individual, or an individual who is reasonably identifiable.

I apply the Australian Privacy Principles, whether or not I have to.

A business with annual turnover of $3 million or less is generally exempt from the Privacy Act 1988. On turnover alone, that exemption is available to me. I do not rely on it.

I work alongside health services, state health organisations and national digital health programs, and I hold myself to the standard those organisations are held to. I handle personal information in line with the Australian Privacy Principles, and I will meet the obligations of the Act as though it applied to me — including notifying you, and the Office of the Australian Information Commissioner, of any data breach likely to result in serious harm.

I hold no patient or clinical information.

I am not a healthcare provider. I do not provide a health service, I am not part of anyone’s care team, and I have no clinical role. Nothing on this site asks for information about any person’s health, and no consulting engagement I accept requires access to identifiable patient records.

The assessments ask about a practice — its systems, its governance, its backups, its interoperability, how it handles multi-factor authentication. Those answers describe a business, not a patient. They are commercially sensitive, and I treat them that way, but they are not health information about an individual.

Where a consulting engagement takes me into a client’s live environment, I work to that client’s own information governance framework, under their access controls, and I do not extract or retain identifiable clinical data.

You can deal with me without identifying yourself.

You may read this site without identifying yourself, and you may complete any assessment on this site and download your report without providing any personal information. Personal information is collected only where you choose to provide it.

Five places information can reach me, and what each one takes.

1. Simply reading the site

Nothing that identifies you is collected, and no cookies are set. Two things happen automatically, as they do on any website:

• Server logs. My infrastructure provider records standard request data — IP address, timestamp, page requested, browser type — in order to serve pages and protect the site against attack. I do not have a per-visitor view of this data and do not use it to identify anyone.
• Cookieless analytics. Aggregate page measurement is done by a privacy-first analytics service that sets no cookies, uses no client-side state, and does not fingerprint or track you across sites or sessions. What I see are aggregate page counts, referrers and country-level location. I cannot see individual visitors.

One third-party file is loaded as you read: the web fonts, served by a font provider. Requesting a file reveals your IP address to the provider serving it, and nothing else is sent. Every other script and library on this site, including the one that builds your assessment report, is served from this domain rather than from someone else’s network.

2. The assessments

Where this policy says an assessment, it means any of the following:

• the Digital Health Maturity Snapshot — free, public, and open to anyone
• the Digital Health Maturity Assessment — the fuller instrument, used with clients

If I publish another, it is added to this list before it goes live. Everything below applies to all of them equally.

Each is deliberately built so that you can complete it without giving me anything at all.

• Every score you set, every domain result and the composite figure are calculated in your browser. Nothing is sent anywhere while you work through it.
• Nothing is saved. Your answers are not written to your device or to any server, which is also why closing the tab loses them.
• You can download your report as a PDF without entering a single detail. The file is generated on your own machine.

If — and only if — you choose “Email me this report”, the following is transmitted so that the report can be built and sent to you: your name, your email address, your practice name and discipline, the number of sites your practice operates if you choose to tell me, your composite score and tier, your domain-level scores, your answers to the individual criteria, your gate and governance results, and basic submission details such as the date.

That information is processed by a report service running under my business account, which builds the report, sends it to you, and retains a copy so that I can answer any question you raise about it. A corresponding record of the submission, containing the same fields, is kept in my business systems so that submissions can be located and, where you ask me to, deleted. I use it to produce your report, to respond to you, and to understand which practices are engaging with the framework. It is never sold, and it is never passed to a third party outside the providers described below.

Digital resources may be offered based on your responses. Where they are, they are not an exchange: no details are required to download them, and there is no charge.

Before that submission is accepted, it passes an automated check that confirms a person rather than a bot is sending the form, so that the report service cannot be used to send mail in your name. That check receives the signals it needs to make the judgement — broadly, your IP address and browser characteristics. It is a privacy-preserving alternative to a CAPTCHA, it is not used to build an advertising profile of you, and it runs on the Snapshot and Assessment pages only.

3. Emailing me or booking a call

If you email me, I receive whatever you send and I keep the correspondence in my business mailbox so I can pick the conversation up where it left off.

The discovery call link on the contact page opens a third-party appointment scheduling service. When you book, the name, email address, time zone and any note you add are given directly to that provider, under its own privacy policy, and the booking lands in my calendar. I do not see anything you don’t enter on that screen.

4. The subscribe form and the free sample chapters

Two forms ask for an email address: the subscribe block on the home, book and notes pages, and the sample-chapters form on the book page. Both are connected. Nothing is sent until you submit one.

The provider is MailerLite (MailerLite, Inc., a Delaware corporation), named on the service providers page. MailerLite holds the email address you enter, your name if you give one, a tag recording which form you used, the date and time you signed up, and the ordinary record of whether an email was opened or a link followed. The list is stored in the United States and other locations where MailerLite operates.

What you receive depends on which form you use. The subscribe form signs you up to occasional notes — a few times a year, with no sequences and no funnels. The sample-chapters form sends you the sample chapters and nothing else; it carries a separate, unticked box if you also want the notes. Downloading the sample chapters does not subscribe you.

5. Consulting and advisory engagements

Working with a client means holding ordinary business information: names, roles, contact details, correspondence, meeting notes, workshop outputs, assessment results and the documents we produce together. Where a facilitated assessment is run, the results are the client’s own material and are shared back to them.

This information is held for the engagement, for follow-on work, and for the period set out under How long I keep it below. It is not used for anything else.

There is no cookie banner because there are no cookies.

This site sets no cookies of its own, uses no advertising or social media tracking pixels, and stores nothing in your browser between visits. There is nothing here for you to consent to, opt out of, or manage.

One qualification, in the interest of being exact: the automated bot check on the assessment page, and my infrastructure provider’s protection of the site against attack, may set a short-lived technical cookie if a request looks suspicious. That cookie exists to confirm you are a person and for no other purpose. It carries no advertising identifier and does not follow you to other sites.

That is a design decision, and I intend to keep it. If it ever changes, this page changes first.

Purposes, in full.

• To send you the assessment report you asked for, and to answer any question you raise about it.
• To respond to your enquiry and arrange and hold a conversation.
• To deliver, administer and invoice consulting and advisory work.
• To understand, in aggregate, which parts of this site are useful.
• To send you the free sample chapters if you ask for them, and the occasional notes if you subscribe to them.
• To meet my legal, tax, insurance and professional record-keeping obligations.

If I ever want to use your information for something outside this list, I will ask you first.

A short list of providers, and no one else.

I do not sell, rent, trade or otherwise disclose personal information for anyone else’s marketing.

Running this site and this practice requires a small number of third-party applications and services: hosting and content delivery, security and bot protection, cookieless analytics, web typefaces, business email and document storage, the assessment report service, appointment scheduling, and the newsletter and sample-chapters delivery service. Each provider, what it does and what information it handles are listed on the service providers page.

That list is kept as a separate page so that it stays accurate. The commitments in this policy apply to every provider on it: adding, removing or replacing a provider does not widen the purposes set out above, does not change the retention periods below, and does not affect your rights of access, correction and deletion. Where a change of provider affects what happens to your information, the list is updated before the change takes effect.

Beyond those providers, information is disclosed only where you have asked me to, or where I am required to by Australian law.

Overseas storage

My providers operate globally, and this site is served from the network location nearest each visitor. Information handled by them may therefore be stored or processed in the United States and in other countries where they run infrastructure. Each is subject to enforceable privacy commitments and has been chosen partly on that basis — but you should know the information does not necessarily stay in Australia. Where each provider operates is noted on the service providers page.

Retention periods, stated rather than implied.

Information is destroyed or de-identified once it is no longer needed for the purpose it was collected for, or once the period the law requires me to keep it has passed. In practice:

• Assessment submissions, and the reports built from them — 24 months from submission.
• Enquiries and email correspondence — 24 months from last contact, unless it becomes part of a client engagement.
• Discovery call bookings — 24 months from the booking.
• Newsletter subscribers and sample-chapter requests — held until you unsubscribe or ask me to remove you, and deleted within 30 days of that. An address that has not opened or clicked anything for 24 months is removed at that point.
• Client engagement records — correspondence, notes, workshop outputs, assessment results and deliverables — 7 years from the end of the engagement, to meet tax, insurance and professional obligations.
• Server and security logs held by my infrastructure provider — that provider’s standard period, measured in days.
• Aggregate analytics — held in aggregate only; no individual record is retained.

You can ask me to delete your information sooner, at any time.

Nothing here makes a decision about you.

From 10 December 2026, Australian privacy policies must disclose any use of automated decision-making that could significantly affect a person’s rights or interests. I am stating the position now rather than waiting.

I use no such system. The assessment calculates a score arithmetically from the answers you enter yourself, about your own practice, and produces a report for you to read. It makes no decision about you, grants or refuses nothing, and no algorithm is applied to your information to reach a conclusion about you. Every judgement in the advisory work is made by a person, not by a model or a rule set.

How your information is protected.

• Every page and every submission on this site travels over HTTPS.
• Accounts holding client or contact information are protected with multi-factor authentication.
• Devices are encrypted, kept patched, and locked when unattended.
• Access is limited to those who need it to do the work, under written confidentiality obligations. No shared logins, and no offshore support arrangement.
• Information is destroyed or de-identified at the end of the retention periods set out above.

No system is entirely secure. If a breach ever occurred that was likely to result in serious harm to you, I would tell you and notify the Office of the Australian Information Commissioner — promptly, and in plain language.

Access, correction and deletion.

You can ask me at any time to tell you what personal information I hold about you, to correct anything that is wrong or out of date, or to delete it. Email simon@simonlange.com.au and say what you want.

I will acknowledge you within five business days and respond in full within 30 days. There is no charge. I may need to confirm who you are before releasing information, which protects you rather than me. If I cannot give you what you have asked for — because the law requires me to keep it, or because it would reveal someone else’s information — I will tell you why in writing.

Stopping email from me

Every non-transactional email I send carries a working unsubscribe link and I act on it immediately. You can also simply reply and ask. I will not add you to a list because you downloaded something, and I do not run sequences or funnels.

How to complain.

Tell me first. Email simon@simonlange.com.au with “Privacy complaint” in the subject line and set out what happened. I will acknowledge it within five business days, investigate it, and write back within 30 days with what I found and what I am doing about it.

If my answer does not satisfy you, you can take the matter to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

Changes, and how to reach me.

I will update this page when what I do changes — and, where the change affects what happens to your information, before it takes effect rather than after. The effective date and version number at the top of this page tell you which edition you are reading.

The terms governing your use of this site are on the terms of use page. The providers referred to above are listed on the service providers page.

Lange Consulting Group Pty Ltd
ABN 85 607 114 134
Sydney, NSW, Australia
simon@simonlange.com.au

This page describes my own practices. It is not legal advice, and it is not a substitute for advice about your own obligations.

Back to the short version