Privacy Policy

If you are a patient

We collect:

• your name, date of birth and sex or gender;

• your contact details, including email address, mobile number, residential address, delivery address and any delivery instructions you give us;

• identity verification information, including your Medicare card number, individual reference number and card expiry, and, where you provide one, another government-issued identity document. Section 2 explains how we handle government identifiers;

• your account details, including your patient portal login, the consents and agreements you have accepted (with the date and the version of the document you accepted), and your communication preferences;

• payment information, which is collected and processed by our third-party payment processor. We never see or store your full card number. Where you join a membership or authorise recurring payments, our payment processor gives us a secure payment reference so that we can charge future payments. We hold that reference, not your card details;

• your orders, treatment plans, bookings, invoices, refunds and credit notes, and the delivery status of your orders;

• your membership, rewards, founding member, tenure, promotion and referral information, including any referral or promotional code you use or share;

• your sensitive information, principally health information, described in section 2;

• the details of your usual general practitioner or other treating practitioners, where you give them to us;

• communications between you and us, including messages, requests, appointment changes, feedback and complaints; and

• any other personal information you provide to us, or that a third party provides to us with your authority.

If you visit our website, use our online health assessment or send us an enquiry

Sensitive information is personal information that receives a higher level of protection under the APPs. The sensitive information we collect about patients is principally health information. This includes your:

• medical history;

• intake and assessment answers;

• consultation records;

• prescriptions and prescription tokens;

• risk assessments;

• pathology and test results;

• clinical letters;

• treatment plans; and

• clinical monitoring information.

We collect sensitive information only with your consent, or where the law requires or authorises us to. Where you consent, we use and disclose it only for the primary purpose for which it was collected, and for directly related purposes you would reasonably expect, such as:

• enabling our practitioners to assess your suitability for treatment, provide telehealth consultations, order pathology and prescribe where clinically appropriate;

• with your consent, holding and managing your prescriptions and electronic prescription tokens on your behalf, and sending them, together with the information a pharmacist needs, to the pharmacy that dispenses your medicine;

• sending pathology requests to, and receiving results from, our partner pathology provider;

• engaging third parties who directly assist us to provide the Services, such as our practice management software, secure hosting and workflow automation providers;

• informing your nominated general practitioner or another treating practitioner of care we have provided, where you ask us to or where it is clinically necessary;

We collect personal information directly from you when you:

• complete our online health assessment;

• create an account;

• book or attend a consultation;

• complete an intake or risk assessment with your practitioner;

• place an order;

• send us an enquiry or otherwise communicate with us; or

• use our website and patient portal.

We may also collect it from third parties with your authority or where the law permits, including:

• your treating practitioners and your nominated general practitioner;

• pathology providers;

• dispensing pharmacies;

• our payment processor (for example, whether a payment succeeded); and

• a person who refers you to us.

We also collect some information through automated technologies when you use our online Services.

If we receive personal information about you that we did not ask for, we will decide whether we could lawfully have collected it. If not, we will destroy or de-identify it where it is lawful and reasonable to do so.

We collect, hold, use and disclose personal information:

• to verify your identity and maintain your account;

• to enable our practitioners to provide safe, clinically appropriate telehealth consultations and ongoing care, including follow-up consultations and monitoring built into your treatment plan;

• to hold and manage your prescriptions, and to arrange dispensing and delivery of prescribed medicines through our partner pharmacies;

• to arrange pathology testing and receive results;

• to keep clinical and business records as required by law and professional standards;

• to communicate with you about your care, including:

• appointment confirmations and reminders;

• treatment plan and payment reminders;

• pathology and review reminders;

• delivery updates; and

• service notices;

• to respond to your enquiries;

• to administer bookings, billing, invoicing, payments, refunds, memberships, rewards, promotions and referral benefits;

• to protect against fraud, misuse, diversion of medicines and breaches of our terms;

• to improve and develop the Services, including analytics and quality assurance conducted on de-identified or aggregated information wherever practicable;

• to send you direct marketing where you have opted in (see section 8);

• to comply with our legal, regulatory, insurance and professional obligations; and

We use software automation to run our Services. For example, we use it to:

• send appointment reminders, treatment plan reminders and delivery updates at set times;

• move orders between our systems and our partners; and

• prepare documents.

We may also use artificial intelligence (AI) tools to help with administrative work, such as:

• drafting and organising documents;

• supporting our team in responding to enquiries; and

• with your consent, transcribing and summarising a consultation to help your practitioner prepare clinical notes.

Any AI-assisted note is reviewed and approved by your practitioner before it forms part of your record. You may ask for transcription to be turned off in any consultation.

No decision that significantly affects you is made by a computer alone. Every decision about your eligibility, diagnosis, treatment, prescribing, dosing or supply is made by an Australian-registered practitioner exercising independent professional judgement.

Automated screening only organises the information you provide. Where it suggests you may not be eligible for a service, you may ask for the outcome to be reviewed by our clinical team.

Where an AI or automation tool is provided by a third party, we choose and configure it so that identifying health information:

• is not used to train the provider's models;

• is not retained by the provider beyond what is needed to deliver the service; and

• is processed in Australia wherever practicable.

Section 6 describes where information may be processed overseas. This section is provided consistent with the transparency requirements of the Privacy Act, including the amendments that commence on 10 December 2026.

We may disclose personal information to the following recipients.

• Our practitioners, for the purpose of providing care to you. Our practitioners cannot see your payment, membership, reward or referral information.

• Dispensing pharmacies, being the compounding and dispensing pharmacies we partner with, for the purpose of dispensing and delivering the medicines prescribed for you.

• A pharmacy receives your name, date of birth, contact details, delivery address, prescription, and the risk assessment and clinical information the pharmacist needs to dispense safely.

• With your consent, we hold and manage your electronic prescription tokens on your behalf and release them to the dispensing pharmacy. So that repeat tokens return to us for your next order, the pharmacy records a Rxion Health managed email address against your prescription.

• Your prescription belongs to you. You can ask us at any time to send your prescription token to you directly or transfer it to a pharmacy of your choosing, as set out in our Terms and Conditions.

• Some pharmacies use an order management platform hosted overseas to track clinic orders. That platform receives order-reference information only.

• Pathology and diagnostic providers, where testing forms part of your care. This includes your referral details and the information the laboratory needs, and we also receive your results from them.

• National prescription and health services, including the electronic prescription delivery service that our practitioners' prescribing software uses to create and transmit electronic prescriptions.

• Third-party service providers who enable us to operate. These include practice management software, secure hosting and data storage, workflow automation, email and text message delivery, customer relationship management, payment processing, identity verification, accounting, insurance and professional advisers.

Consent and withdrawal. Where our handling relies on your consent, you may withdraw it at any time by contacting us. Withdrawal does not affect handling that has already occurred. It may mean we can no longer safely provide some or all of the Services to you.

Anonymity. You may deal with us anonymously or by pseudonym for general enquiries. Once you register as a patient, we must verify your identity to provide healthcare safely and lawfully, and to satisfy pharmacies and laboratories, so anonymity is not practicable.

Access. You may request access to the personal information we hold about you, including your health records. We will verify your identity, then respond within 30 days. There is no fee for making a request. A reasonable administrative fee may apply to compiling and providing copies, and we will tell you the fee before we proceed. If we refuse access, we will tell you why in writing and how you can complain.

Correction. You may ask us to correct information that is inaccurate, out of date, incomplete or misleading, at no charge. You can update your contact, delivery and marketing preferences yourself in your patient portal. If we do not agree to make a correction, we will tell you why in writing. You may ask us to attach a statement to your record noting that you believe the information is incorrect.

Transfer of records. You may ask us to provide a copy or summary of your records to your nominated healthcare provider. You may also ask us to release or transfer a prescription we hold for you (see our Terms and Conditions).

Closing your account. You may ask us to close your patient portal account at any time, and we will stop all non-essential use of your information. Clinical, financial, consent and audit records must be kept for the periods in section 9 and cannot be deleted on request. We will restrict those records so that they are used only for those legal purposes.

Marketing. Marketing is optional and separate from your care. You can opt out at any time through:

Care messages are part of your treatment and continue while you are a patient. They include:

• appointment confirmations and reminders;

• reminders that a treatment plan is awaiting payment;

• reminders that a follow-up consultation or pathology test is due; and

• delivery and service notices.

Care messages do not name medicines. We do not send system-generated messages between 9pm and 6am (Brisbane time), other than appointment reminders. You can change how you receive care messages by contacting us, though some are required for us to provide the Services safely.

Marketing messages are sent only where you have opted in. They:

• are general in nature;

• never refer to prescription medicines; and

• always include a working unsubscribe link.

Opting out of marketing does not affect your care messages, your treatment or your access to the Services. Marketing consent is never a condition of any purchase. We comply with the Spam Act 2003 (Cth) and with the advertising rules that apply to therapeutic goods and health services.

Cancellation list. If you join our cancellation list, we will contact you when an earlier appointment becomes available. That is a care message, not marketing.

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure. Those steps include:

• encryption in transit and at rest;

• mandatory multi-factor authentication and named individual accounts for our staff;

• role-based access controls that limit what each role can see;

• database-level access rules;

• tamper-evident audit logs of staff actions;

• secure Australian hosting with encrypted backups;

• contractual confidentiality obligations; and

• a data breach response plan.

Payment card details are handled only by our payment processor, which is certified to the Payment Card Industry Data Security Standard.

No transmission over the internet is completely secure. You are responsible for keeping your login details and devices secure, and for telling us promptly if you suspect unauthorised use of your account.

Retention.

• Health records: we keep these for at least 7 years from the date of the last entry in your record, or longer where required by law or where a matter is under review.

• Consents, transactions, invoices, refunds and audit logs: we keep these for at least 7 years for tax, consumer and professional obligations.

• Prescription tokens and other operational records: we keep these for as long as needed to complete your care and meet these obligations.

When personal information is no longer required and no longer subject to a retention obligation, we take reasonable steps to destroy or de-identify it.

Our public website uses cookies and similar technologies for three purposes: essential operation, analytics and advertising. Our patient portal and online health assessment do not use analytics or advertising trackers.

Essential. Some cookies are needed for the website to work and stay secure, for example to remember your privacy choices and to protect our forms from misuse. These are always on. We also run essential error monitoring (Sentry, configured for European Union hosting) so we can find and fix faults. It records technical details about the error only, never your name, email address, phone number, health answers or anything you typed into a form.

Analytics. We use Google Analytics 4 (provided by Google) and PostHog (configured for European Union hosting) to understand how the public website is used, for example which pages are visited and where visitors leave. These tools are configured not to store your IP address, PostHog does not record your screen or keystrokes, and neither tool receives eligibility answers, form contents or your patient portal activity. Pages about a particular health goal are reported only as a general page type, not as the goal you read about.

Advertising. We use Google Ads (provided by Google) and the Meta pixel (provided by Meta, for Facebook and Instagram) to measure whether our advertising works and to show our advertising to people who have visited our website. These tools may use a cookie or an advertising identifier, and Google and Meta may combine it with information they already hold about you under their own privacy policies. We do not share health information with them and we do not target advertising based on the health goal you read about. Advertising tools stop for the browser tab session when the eligibility check opens, and they never run in the patient portal or the online health assessment.

Google Tag Manager, provided by Google, loads the tools above according to your choices. It does not collect information itself.

Your choices. Analytics and advertising tools run on our public website pages unless you turn them off. You can turn either category off at any time using Manage preferences in the footer of every page, or through your browser's cookie settings, and the change applies immediately on that browser. Turning them off does not affect your ability to use the website or book a consultation. It stops future collection; it does not delete information a provider has already received. Your choice is remembered in a first-party preference cookie, and a separate anonymous identifier links preference receipts that record the choice, its version and time, a protected hash of the network address and limited browser information.

Our Services may contain links to websites operated by third parties, including pharmacies, laboratories and payment providers. Those websites are governed by their own privacy policies, and we are not responsible for how they handle your personal information.

We may update this Privacy Policy from time to time by publishing the updated version on our website. For material changes, we will take reasonable steps to notify you, for example by email or a notice in your patient portal. The version you accepted is recorded against your account. Please review this page regularly.

This Privacy Policy is available free of charge. If you would like a copy in another form, contact us and we will provide one.

Privacy Officer

Rxion Health Pty Ltd | ABN 41 697 853 517

• Email: support@rxion.com.au

• Phone: 1300 086 255

• Website: rxion.com.au