Privacy Policy

1. About this Policy

AnodyneCann Pty Ltd (ACN) (AnodyneCann, we, us, our) is committed to protecting the privacy and security of your personal information. This Privacy Policy explains how we collect, use, disclose, store, and protect your personal information when you use our platform at anodynecann.com.au (the Site) and associated services.

This Policy is made in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). If you are located in the European Union or United Kingdom, we also comply with the General Data Protection Regulation (GDPR) to the extent it applies to you.

By using the Site you consent to the practices described in this Policy. If you do not agree, please discontinue use of the Site.

2. Personal Information We Collect

We collect personal information that you provide directly, including:

• Identity data: first name, last name, date of birth, gender, preferred pronouns
• Contact data: email address, mobile number, postal address
• Health data: medical history, current medications, health conditions, questionnaire responses
• Account data: username, password (hashed), account preferences
• Booking data: consultation appointments, booking history, practitioner details
• Payment data: billing address, transaction records (we do not store raw card numbers or CVV)
• Medicare information: Medicare number and position (where provided)
• Profile picture: where you choose to upload one
• Communications: messages, support requests, feedback you send us

We also collect certain information automatically when you use the Site, such as your IP address, browser type, device identifiers, pages visited, and referring URLs. This is used for security, performance monitoring, and service improvement.

3. How We Use Your Information

We use your personal information for the following purposes:

• To create and manage your account
• To facilitate bookings and consultations with practitioners
• To process payments securely
• To send appointment reminders and service notifications via SMS and email
• To maintain medical records and questionnaire data required for your care
• To comply with our legal and regulatory obligations
• To improve and personalise our services
• To investigate security incidents and prevent fraud
• To respond to your enquiries and support requests

Health information is sensitive information under the Privacy Act. We only collect and use it for the purpose of facilitating your healthcare consultations and in accordance with your explicit consent.

4. Legal Basis for Processing (GDPR Users)

If you are in the EU or UK, our legal bases for processing your personal data are:

• Contract: processing necessary to provide the services you requested
• Legal obligation: compliance with applicable laws
• Legitimate interests: security monitoring, fraud prevention, service improvement
• Consent: for health/sensitive data, analytics cookies, and marketing communications

5. Disclosure of Your Information

We may disclose your personal information to:

• Practitioners: doctors, nurses, and other health professionals who provide your consultations
• Service providers who assist us in operating the platform, including:
  • Google Firebase (cloud infrastructure and authentication)
  • NAB (payment processing)
  • Twilio (SMS notifications)
  • Sentry (error monitoring)
  • Vercel (hosting)
• Regulatory authorities: where required by law, court order, or government request
• Business transfers: in the event of a merger, acquisition, or sale of assets

We do not sell your personal information to third parties. All service providers are contractually bound to protect your information and only use it for the purposes we specify.

6. Data Retention

We retain your personal information for the following periods:

• Account and profile data: until you delete your account, plus 30 days
• Medical records and questionnaires: 7 years from the date of last consultation, as required by healthcare standards
• Payment and transaction records: 7 years for taxation and financial compliance
• Audit and security logs: 180 days
• Email and SMS logs: 90 days

After the applicable retention period, we securely delete or anonymise your information.

7. Cookies and Tracking Technologies

We use cookies and similar technologies to operate the Site, remember your preferences, and (with your consent) analyse usage. For full details of cookies we use, their purpose, and how to manage your preferences, please see our Cookie Policy.

You can withdraw your cookie consent at any time by clicking the "Cookie Preferences" link in the footer or adjusting your browser settings.

8. Security

We implement technical and organisational measures to protect your personal information, including:

• AES-256 encryption at rest (via Google Firebase)
• TLS encryption in transit
• Role-based access control limiting who can access your data
• Rate limiting and audit logging of sensitive operations
• Tokenised payment processing (we never store raw card details)

Despite these measures, no transmission over the internet is completely secure. If you believe your account has been compromised, please contact us immediately.

9. Your Rights

Under the Australian Privacy Act and, where applicable, the GDPR, you have the following rights:

• Access: request a copy of the personal information we hold about you
• Correction: request correction of inaccurate or incomplete information
• Deletion: request deletion of your personal information (right to erasure)
• Portability: receive a copy of your data in a machine-readable format
• Restriction: request that we restrict processing of your data in certain circumstances
• Object: object to processing based on legitimate interests, including direct marketing
• Withdraw consent: where processing is based on consent, withdraw it at any time

You can exercise your right to delete your account and download your data directly from your Profile page. For all other requests, contact us at privacy@anodynecann.com.au. We will respond within 30 days.

10. Overseas Disclosure

Some of our service providers are based in the United States (Google Firebase, Twilio, Sentry, Vercel). By using the Site you consent to your information being transferred to and processed in the United States, which may not have equivalent privacy protections to Australia or the EU. We take reasonable steps to ensure these providers handle your information in accordance with this Policy.

11. Children

Our services are not directed at persons under 18 years of age. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected information from a minor, please contact us immediately.

12. Changes to this Policy

We may update this Privacy Policy from time to time. The updated version will be published on this page with a revised "Last updated" date. We encourage you to review this Policy periodically.

13. Privacy Complaints

If you have a complaint about how we have handled your personal information, please contact our Privacy Officer:

• Email: privacy@anodynecann.com.au
• Post: Level 3, 99 Queensbridge St, Southbank VIC 3006

We will acknowledge your complaint within 5 business days and endeavour to resolve it within 30 days. If you are not satisfied with our response, you may refer your complaint to the Office of the Australian Information Commissioner (OAIC).

14. Contact Us

For any questions about this Privacy Policy, please contact:

• AnodyneCann Pty Ltd
• Level 3, 99 Queensbridge St, Southbank VIC 3006
• info@anodynecann.com.au