Skip to content
Legal

Privacy Policy

How we collect, use, and protect your personal and health information, in line with Australian privacy law.

Last updated

Xavier Mawson trading as VitalityRX (ABN 48 695 670 145) ("VitalityRx", "we", "us", "our") is committed to protecting your personal and health information. This policy explains what we collect, how we use it, and the choices you have. It is written in plain English. It works alongside our Terms of Service.

We have adopted the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth). The APPs govern how we collect, use, disclose, store, secure and dispose of your personal information. A copy of the principles is available at www.oaic.gov.au.

Plain-English summary. We collect only what we need to provide care to you. Your data is stored on Australian-hosted, encrypted servers, accessed only by your care team, and never sold to anyone. You can ask to see, correct or delete it at any time.

What we collect

Personal information is anything that identifies you. The information we collect from you typically includes:

  • Name, date of birth, contact details and address
  • Health information, including clinical concerns and history, consultation notes and care records, medication and prescription history, referral letters and correspondence, blood work and pathology results, video consultation metadata (date, duration, clinician), and Medicare or health fund claim information
  • Payment details when you book a paid service
  • Communications you send us (secure messages, emails, call notes)
  • Technical information when you use our website (IP address, browser type, pages viewed). See Cookies and tracking below

We collect this information directly from you in most cases, through your assessment, consultations, secure messaging or pathology partners. Where we collect from a third party, such as your regular GP, we will let you know.

Anonymity and pseudonymity

Under Australian Privacy Principle 2, you have the right to deal with organisations anonymously or by pseudonym where lawful and practicable. Due to the nature of the health services we provide, it is generally impracticable for us to deal with individuals who have not identified themselves. Accurate identification is required to ensure the safety and continuity of clinical care, to comply with our legal and professional obligations under applicable health legislation, and to meet the requirements of Medicare and private health insurance billing. General enquiries that do not involve clinical care may be made without providing personal identification.

Sensitive information

Health information is classed as sensitive information under the Privacy Act, and is treated with the highest level of care. We only collect, use or disclose sensitive information when:

  • It is required to provide care you have asked for
  • You have given explicit consent
  • It is directly related to a primary purpose you would reasonably expect
  • The law authorises or requires it

Unsolicited personal information

From time to time, we may receive personal or health information that we did not solicit, such as misdirected correspondence, unsolicited referrals, or voluntary over-disclosure during enquiries. Where we receive unsolicited personal information, we will promptly assess whether that information is of a kind we could have collected under our standard collection practices. If so, it will be handled in line with this policy. If not, it will be destroyed or de-identified as soon as practicable. We will not use or disclose unsolicited information before completing this assessment.

How we use it

We use your personal and health information to:

  • Provide consultations, prescriptions and ongoing care
  • Coordinate pathology, imaging and specialist referrals
  • Communicate with your regular GP, with your consent, so your care stays joined up
  • Operate, maintain and improve our service
  • Comply with legal and professional obligations
  • Send you service-related emails (appointment reminders, care updates). These are not marketing and you cannot opt out while you remain a patient
  • Send you marketing or educational content if you have opted in. You can unsubscribe at any time using the link in any such email

We will never use your health or sensitive information to target advertising to you. Any marketing is sent only with your express opt-in consent, and you can opt out at any time. We do not provide your information to third parties for their own marketing.

Telehealth privacy

When you access our telehealth services, extra privacy considerations apply:

  • Identity verification. We verify your identity at the start of each consultation to support the safety and accuracy of your care.
  • Consultation environment. Your clinician will confirm who is present during the consultation. We encourage you to be in a private space where you can speak freely.
  • Recording. Consultations are not recorded unless you are informed and give explicit consent.
  • Clinical suitability. Telehealth is not right for everything. Your clinician may recommend in-person care, a referral, further tests, or no treatment where telehealth is not suitable for you.

AI and automated tools

We may use AI-assisted tools for administrative tasks such as form processing, appointment scheduling, and preliminary data organisation. No clinical decisions, diagnoses, or prescribing are made by automated systems. All clinical assessments and treatment decisions are made by a qualified Australian clinician who reviews your information personally.

Where AI tools are used, they operate under clinician oversight and do not replace professional medical judgement.

Third parties

We use carefully selected third parties to deliver our service. These include:

  • Pathology providers. Accredited Australian labs where you complete blood work and other investigations.
  • Pharmacies. If your clinician prescribes and you choose to have it dispensed, we may share the prescription with the Australian pharmacy you nominate, which is authorised under the relevant state and territory pharmacy and medicines laws.
  • Specialist clinicians. When we refer you for imaging or in-person care.
  • Cloud and software vendors. For video consultations, electronic health records, payment processing and email delivery, each selected for their compliance with Australian privacy law.

Each provider only receives the minimum information required to do their part. We do not sell your information to anyone.

Disclosure of your information

Your information may be disclosed:

  • To the third parties listed above, only as needed to provide care
  • To your nominated GP or specialist, with your consent, so your care stays coordinated
  • To emergency services or healthcare providers if there is a serious and imminent threat to your life, health or safety
  • Where required or authorised by Australian law, including subpoenas or coronial enquiries

We will never disclose your information to insurers, employers, marketers or data brokers without your explicit consent.

Cross-border data disclosure

Our primary data storage is on Australian-hosted servers. Some third-party services we use may process data on servers located outside Australia. These include video platforms, email delivery systems, and website analytics and advertising-measurement tools (such as Google Analytics and the Meta Pixel and Conversions API). For these tools, the main recipient country is the United States. We require these recipients to handle your information under contractual data-protection terms consistent with the Australian Privacy Principles. We obtain your consent to any overseas disclosure of your health information at the point you provide it, through the consent statement on our intake and booking forms. We do not disclose your health information overseas for any purpose other than delivering your care and operating our service.

Security and retention

Your personal and health information is encrypted in transit and at rest, and stored on Australian-hosted servers with strict access controls. Only members of your care team can access your records, and all access is logged.

We retain health records for the period required by applicable state and territory health-records legislation, including the Health Records and Information Privacy Act 2002 (NSW) and equivalent legislation in other jurisdictions. Under that legislation, the retention period runs from the date of the last entry in your record. This is generally 7 years from the date of the last entry. Where you were under 18 at the time of treatment, records are retained until you turn 25. After this period, records are either deleted or de-identified.

Healthcare and government identifiers

We may collect government and healthcare identifiers such as Medicare numbers, Individual Healthcare Identifiers (IHI), and Department of Veterans' Affairs (DVA) numbers where required to provide our services or process claims.

In line with the Healthcare Identifiers Act 2010 (Cth) and the Australian Privacy Principles, we will only use or disclose these identifiers for the purposes for which they were collected, or as otherwise required or authorised by law. We do not use healthcare identifiers as our own internal patient identifiers.

These identifiers are stored securely and access is restricted to authorised clinical and administrative staff.

My Health Record

VitalityRx does not currently upload information to the My Health Record system. If this changes, we will update this policy and notify you before any information is shared. You can manage your My Health Record preferences at myhealthrecord.gov.au.

Notifiable data breaches

Under Part IIIC of the Privacy Act 1988, we are required to notify affected individuals and the Office of the Australian Information Commissioner (OAIC) if we become aware of an eligible data breach that is likely to result in serious harm. An eligible data breach occurs when personal information we hold is subject to unauthorised access, disclosure, or loss.

If we identify a suspected eligible data breach, we will assess it within 30 days. If the breach is confirmed as notifiable, we will notify affected individuals and the OAIC as required by law. Notifications will include the nature of the breach, the types of information involved, and recommended steps you can take. If you believe your information held by us may have been compromised, please contact us immediately at [email protected].

Access and corrections

You have the right to access the personal information we hold about you, and to ask us to correct anything that is inaccurate, out of date or incomplete. To make a request, email us at [email protected].

Access is free. We may charge a reasonable administrative fee for producing copies of large records. We may need to verify your identity before releasing information.

Cookies and tracking

Our website uses cookies and similar technologies to remember your preferences, measure how the site is used and, where you have consented, deliver relevant marketing content. Because health browsing can reveal sensitive interests, we treat this data with care. You can disable cookies in your browser at any time, though some site features may not work as expected.

We use analytics tools (for example Google Analytics 4 and the Meta Pixel) on a privacy-respecting basis. These tools may collect IP addresses and browsing behaviour but do not access your medical records.

Policy updates

This policy may change from time to time. The most recent version is always available on this page, and the "last updated" date at the top reflects the most recent revision. Material changes will be notified to you by email where appropriate.

Complaints and contact

If you have any questions or concerns about this policy or how we have handled your information, please contact us first. We take privacy complaints seriously and will respond within 30 days.

If you are not satisfied with our response, you can lodge a complaint with the Office of the Australian Information Commissioner at www.oaic.gov.au.