This Privacy Policy sets out how Veva Medical Pty Ltd (ABN: 50 695 800 116) (“Veva Medical”, “we”, “our” or “us”) will collect, use and otherwise handle any information which is identifiable as being about you and has the meaning given to it in section 6 of the Privacy Act 1988 (Cth) (“Personal Information”) that we collect from you when you visit, view, access or use our websites and services at vevamedical.com.au (or other relevant domains) (together referred to as the “Website”).

1. Collecting Information

1.1 You acknowledge that if you use the Website and sign up for our services, we’ll collect information about you including:

(a) when you provide Personal Information on the Website, including creating an account;

(b) when you make a booking via the Website;

(c) when you subscribe to receive notifications, emails and information from us; and

(d) generally when you visit and navigate our Website.

2. Health Information

2.1 In addition to Personal Information, we and our healthcare providers collect “health information” about you, which is a category of “sensitive information” under the Australian Privacy Principles (APPs). This may include your medical history, symptoms, treatment notes, prescriptions, screening responses and other information relevant to your care. For the purposes of this Privacy Policy, references to health information include Protected Health Information (“PHI”), where that terminology is applicable.

2.2 How we use and disclose your health information: We collect, use and hold your health information for the purpose of providing you with healthcare services, including assessment, diagnosis, treatment, prescriptions and ongoing care. We disclose your health information only to the treating practitioner(s) and your patient care team involved in your treatment, to Halaxy (our practice management system, see Section 10), or as otherwise required or authorised by law or set out elsewhere in this Policy. We do not use or disclose your health information for marketing or advertising purposes (see Section 9.7).

2.3 Your rights regarding your health information: You have the right to:

(a) request access to and inspect your health records held by us or by Halaxy;
(b) request a copy of your health records; and
(c) request correction or amendment of your health records if you believe they are inaccurate, out of date or incomplete.

To exercise any of these rights, please contact us at [email protected]. We may need to verify your identity before actioning your request. We will respond to your request within a reasonable period (ordinarily within 30 days) and, where we decline a request for access or correction, we will provide you with reasons in writing.

2.4 How to make a complaint: If you have a concern or complaint about how we have handled your Personal Information or health information, please contact us at [email protected]. We will investigate and respond to your complaint within a reasonable timeframe. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) via www.oaic.gov.au or by calling 1300 363 992.

2.5 Our legal duty to protect your privacy: Veva Medical is bound by, and committed to complying with, the Privacy Act 1988 (Cth) and the Australian Privacy Principles in respect of all Personal Information and health information we collect, hold, use and disclose. We take reasonable steps to protect your health information from misuse, interference, loss, unauthorised access, modification or disclosure.

2.6 My Health Record

Our practitioners access the My Health Record system to support the healthcare services we provide to you, including to view relevant medical history, medications, allergies, and pathology or diagnostic results that may be relevant to your consultation.

By engaging with our services and proceeding with a consultation, you consent to your treating practitioner accessing your My Health Record for the purpose of assessing your suitability for treatment, providing ongoing care, and coordinating your treatment with your other healthcare providers. Your practitioner will only access information in your My Health Record that is relevant to the healthcare services being provided to you.

You can withdraw this consent at any time by contacting us at [email protected] or by adjusting your My Health Record access controls directly via myhealthrecord.gov.au. Access to and use of My Health Record information is governed by the My Health Records Act 2012 (Cth) and its associated rules.

3. Making a Booking

3.1 When creating an account on our Website, we’ll ask you to submit certain Personal Information, including (but not limited to) your name, last name, mobile phone number, email address, ‘Login’ (i.e. username), password and gender. We may also request other information from time-to-time.

3.2 When you make a booking for an appointment with a healthcare professional via the Website, you will be asked to submit certain Personal Information, including (but not limited to) your name, last name, mobile phone number, email address, photo identification, address, age, gender and medical history. We may also request other information from time-to-time.

3.3 When we receive booking requests, we will retain the information relating to you and the booking for our records and for other internal purposes and for the purposes of contacting you about the booking.

3.4 We use Halaxy to facilitate the appointment booking process and to capture your Personal Information. When you make a booking through our Website, your Personal Information will also be provided to Halaxy and handled in accordance with their privacy policy, which may be updated from time to time. Halaxy is bound by the Australian Privacy Principles under the Privacy Act 1988 (Cth) and implements security measures to ensure the protection of your data and Personal Information. Halaxy and we may disclose your Personal Information to the health professionals and medical practices you have booked appointments with for the purposes of providing healthcare, prescriptions and other related services/products. Halaxy and we may use your Personal Information to contact you about Halaxy’s products or services, as well as share de-identified data with third parties, including for the purposes of helping Halaxy improve its services and products, for recruitment purposes, payment processing, security, reporting and/or advertising.

3.5 You acknowledge that online payments made to us on our Website are made using Stripe, a third-party payment processing platform. When you make a payment, Personal Information such as your name, billing address, and payment card details will be collected and processed directly by Stripe in accordance with their privacy policy, available at stripe.com/au/privacy. Stripe is certified to PCI-DSS standards for the secure handling of payment information. They do not store your full card details on their systems. Personal Information you provide to Stripe will be governed by their privacy policy, and we shall not be responsible or liable for your disclosure of Personal Information to them. Following your consultation, your Practitioner’s recorded treatment outcome determines whether the amount held is captured or released, and, where you are approved for an ongoing package, triggers set-up of recurring Subscription Payments for subsequent instalments in accordance with your Bundled Package Terms.

4. Submitting Material or Sending Messages

4.1 When you submit material, send us a message through the Website, or subscribe to receive information from us, we’ll ask you to provide certain Personal Information, including (but not limited to) your full name and email address. We may also request other information from time-to-time.

5. Navigating through the Website

5.1 We use session ‘cookies’ to automatically collect information about your IP address and web browser (and similar software) each time you navigate through our Website. A ‘cookie’ is a small data file that’s stored on your web browser when you access the Website.

5.2 Session cookies enable you to suspend your browsing activities on the Website and come back after a limited time without losing your page or having to re-enter your log in details. The cookie will remain on your browser, but will be inactive, if your session is timed out or you end the session by closing the browser or navigating to a different website.

5.3 You can set up your browser so it does not our accept cookies. You can also delete our cookies from your browser.

6. Universal (Google) Analytics

6.1 The Website uses Universal (Google) Analytics to analyse the use of the Website. Google Analytics generates statistical and other information about website use by means of cookies, which are stored on users’ computers. The information generated relating to our website is used to create reports about the use of the Website. Google will store and use this information. Google’s privacy policy is available at: http://www.google.com/privacypolicy.html.

7. Using and Protecting Your Information

7.1 We will use information you provide to: create and maintain client files for our records; maintain a database of user and subscriber details; updates, marketing activities (where applicable) and other internal purposes. From time to time, we may use your contact details to send you information about or notices relating to: your appointment bookings; or any changes or upgrades that we make to the Website or services we provide via the Website.

7.2 We may contract with third parties (including third parties based outside Australia) to assist, maintain and provide the services available via the Website together with related services including general business and administrative services, hosting, data security and communications (which may occur outside Australia). Those third parties (including international third parties) will be provided with access to certain personal information that we hold for the sole purpose of providing their services to us.

7.3 If we disclose your Personal Information to such third parties, we will use reasonable endeavours to ensure those third parties only use your Personal Information for the specific purposes for which we provide it to them (e.g. to assist with securing data) and consistently with this Privacy Policy.

7.4 We may also disclose your Personal Information:

(a) to professional advisors;

(b) to law enforcement authorities, if we suspect that an unlawful act is being committed or that such disclosure will prevent that unlawful act; or

(c) as otherwise required or authorised by law.

7.5 Other than the types of disclosures set out in this Privacy Policy, we will not disclose your Personal Information to any other third party unless we have your consent.

7.6 We will use reasonable security measures (which may include engaging third parties to provide such security measures) to protect your Personal Information from loss or unauthorised access, use or disclosure. We are not liable for any misuse or loss of, or unauthorised access of, Personal Information where the security of information is not within our control. The transmission and exchange of information is carried out at your own risk. We cannot guarantee the security of any information that you transmit to us or receive from us. Although we take measures to safeguard against unauthorised disclosures of information, we cannot assure you that the Personal Information will not be disclosed in a manner that is inconsistent with this Privacy Policy. We do not accept any liability for the improper action of unauthorised third parties.

8. Accessing Your Personal Information

8.1 You are entitled to know what Personal Information we hold about you. Please direct any questions regarding Personal Information we hold about you to [email protected]

8.2 This includes the right to request access to, and correction of, your Personal Information (including health information — see Section 2 above for further detail on your rights regarding health information specifically, our complaints process, and our legal obligations under the Privacy Act 1988 (Cth)).

9. Third-party platforms

9.1 Communication tools

At Veva Medical, we use secure third-party platforms to manage aspects of our patient communication including SMS and e-newsletter delivery. These tools help us stay connected with you while supporting our administrative processes. We only use these platforms in a manner that complies with Australian privacy laws and regulations.

9.2 GoHighLevel

Veva Medical utilises third-party service providers, including GoHighLevel, to facilitate communication with patients via SMS and telephone.

These communications may include appointment-related messages, service updates, and, where you have provided your consent, marketing communications. Personal Information such as your name, contact details, and appointment information may be collected and processed by GoHighLevel for the purpose of delivering these communications on our behalf. No additional health information is disclosed for marketing purposes.

You will only receive marketing messages where you have opted in to receive such communications. You may opt out at any time by following the unsubscribe instructions provided in the SMS.

Where relevant to dispensing your prescription, GoHighLevel is used to send an automated confirmation to your prescribing pharmacy once your payment has been received.

While Veva Medical takes reasonable steps to ensure that these third-party providers handle your Personal Information in accordance with the Australian Privacy Principles (APPs), these providers may store and process data on servers located outside of Australia. By engaging with Veva Medical’s services and providing your Personal Information, you consent to the disclosure of your information to these third-party providers.

Veva Medical remains committed to safeguarding your privacy and will continue to monitor the compliance of its third-party service providers with applicable privacy laws and standards.

9.3 Use of Artificial Intelligence (AI)

Veva Medical may use third-party AI platforms to assist with specific administrative functions such as appointment reminders and general patient engagement. These platforms may use voice or text-based artificial intelligence to interact with patients in a natural and conversational manner.

While limited Personal Information such as your name, contact details, and appointment-related preferences may be collected, these platforms are not used to collect or transmit sensitive health or medical information. All systems operate under strict privacy and data security protocols and may store data on secure servers, including those located outside Australia. By engaging with these services, you consent to the use of your Personal Information for the above administrative purposes. You may opt out of AI-based interactions at any time by contacting our team.

9.4 International data transfer

By engaging with our services, you acknowledge that your Personal Information may be transferred to, stored, and processed in a country other than Australia. We take reasonable steps to ensure that any overseas service providers handle your Personal Information in a manner consistent with the Australian Privacy Principles.

9.5 Your rights and consent

You may request access to, correction of, or deletion of your Personal Information held by us or through our third-party providers at any time. By using our services or subscribing to our communications, you provide informed consent to the use of these platforms under the terms described. For more information, or if you have any questions about how your Personal Information is handled, please contact our Privacy Officer at 1800 035 843.

9.6 Stripe

Veva Medical uses Stripe to process online payments. Payment information is collected and handled directly by Stripe and is not stored on our systems. Stripe may process data on servers outside Australia. By making a payment through our Website, you consent to the handling of your payment information in accordance with Stripe’s privacy policy. Where you are approved for an ongoing treatment package, your payment details are retained by Stripe to process recurring Subscription Payments for subsequent instalments.

9.7 Advertising, Analytics and Retargeting

We use advertising, analytics and marketing technologies, including the Meta Pixel, Google Ads, Google Analytics and related advertising tools, to understand how visitors interact with our website, improve our services and measure the effectiveness of our marketing activities. These technologies may collect information such as:

- Pages visited on our website;

- Actions taken on our website;

- Device, browser and operating system information;

- IP address and general location information;

- Referring websites and traffic sources;

- Advertising interactions and website engagement data.

We may use this information to:

- Measure and improve the performance of our advertising campaigns;

- Better understand how visitors use our website;

- Improve website functionality and user experience;

- Deliver relevant advertising to people who have previously visited our website;

- Create audience groups for advertising and marketing purposes; and

- Analyse website traffic and engagement trends.

As a result, you may see advertisements for our services on third-party platforms, including Google, Facebook and Instagram, after visiting our website. We may use Google Ads remarketing and similar advertising features to display advertisements to previous website visitors across Google’s advertising network. We may also use Meta advertising tools to show relevant advertisements to people who have previously visited our website or interacted with our content on Facebook or Instagram.

We do not intentionally disclose sensitive health information to Google, Meta or other advertising platforms for advertising purposes. Any information collected through advertising and analytics technologies is managed in accordance with applicable privacy laws, our internal privacy practices and the settings implemented on our website.

Third-party providers, including Google and Meta, may collect, process and store information in accordance with their own privacy policies. These providers may process information outside Australia.

You can manage your advertising preferences through your Google, Facebook and Instagram account settings and learn more about how these providers handle information through their respective privacy policies. You may also control or disable certain cookies and tracking technologies through your browser settings or any cookie consent tools made available on our website. Please note that disabling certain cookies may affect the functionality of some parts of our website.

We do not use information relating to an individual’s health condition, treatment, diagnosis, consultation outcomes or prescribed medications for targeted advertising purposes.

9.8 Online screening and intake forms (Gravity Forms)

We use Gravity Forms on our Website to collect basic contact details and health information as part of our patient screening process. Specifically:

- What we collect: basic contact information and health information provided by you as part of the screening process.

- Why we collect it: to assess your eligibility to receive our services.

- How it is used: where you are assessed as eligible, your screening information is added to your patient file in Halaxy for review by your treating practitioner.

- Who it may be disclosed to: your treating practitioner and your patient care team.

- Where it is stored: your screening information is transferred to and stored in Halaxy, and is removed from our Website systems once transferred.

- How long it is retained on our Website: less than 24 hours — screening submissions are removed from our Website systems within this period, after which the information is held only within Halaxy in accordance with Section 10 of this Policy.

Before submitting health information via our screening forms, you will be asked to provide your consent to its collection, use and disclosure for the purposes described above.

Where clinically appropriate, more detailed medical history, medications, symptoms or other clinical information may instead be collected directly within Halaxy, rather than via the Website.

10. Use of Halaxy

10.1 Veva Medical uses Halaxy, a secure, Australian-based practice management system, to manage patient information, appointments, medical records, and communications for some of our services. Halaxy is compliant with the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and is widely used by healthcare providers across Australia.

10.2 By accessing our services, you consent to your personal and health information being collected, stored, and managed through Halaxy for the purpose of delivering safe and effective care.

10.3 The types of information managed through Halaxy may include:

- Your name, date of birth, contact details, and appointment history

- Your submitted Health Summary and any treatment notes recorded during consultations

- Billing information, including invoices and receipts

- Communication related to your care, including appointment reminders, referrals, or follow-up instructions via email or SMS

10.4 Halaxy applies industry-standard security measures, including encryption, to protect your information during transmission and storage. Access to your information is strictly limited to authorised Veva Medical healthcare providers and administrative staff.

10.5 Halaxy stores all personal and health information on secure servers located in Australia and does not disclose your data to overseas entities.

10.6 For more information on Halaxy’s privacy and security practices, you can view their privacy policy at: https://www.halaxy.com/article/privacy