Skip to content

Privacy Policy

Last updated: 13 July 2026

Purpose

This Privacy Policy outlines how we collect, use, store, disclose, and protect your personal information, including sensitive and health information, in accordance with:

  • Privacy Act 1988 (Cth)
  • Australian Privacy Principles (APPs)
  • My Health Records Act 2012 (Cth)
  • Applicable State and Territory health privacy laws

We are committed to safeguarding your privacy and complying with all relevant legislation.

Scope

This Policy applies to all individuals who interact with us, including patients, website visitors, service users, contractors, and employees, and covers all methods of personal information collection, whether electronic, verbal, or written.

Definitions

  • Personal Information: Information or an opinion about an identifiable individual, recorded in any form, including names, contact details, or other details from which a person's identity can reasonably be ascertained.
  • Sensitive Information: A subset of personal information that includes racial or ethnic origin, political opinions, religious beliefs, sexual preferences, criminal records, or membership in professional/trade associations.
  • Health Information: Information about your health, disabilities, or use of health services.
  • Protected Health Information (PHI): Individually identifiable health information created, received, maintained or transmitted by RegenXhealth in connection with providing healthcare services. This includes medical histories, consultation records, diagnoses, treatment plans, prescriptions, pathology results, billing information and other health information linked to an identifiable individual. In Australia, PHI is handled as health information and sensitive information under applicable privacy and health-record laws.
  • Third-Party Website Visitors: Individuals who visit the clinic's website but are not current patients or users of our services.

What Information We Collect

We may collect the following types of personal information:

For Patients:

  • Full name, date of birth, gender
  • Contact details: phone number, email, residential address
  • Medicare number, private health insurance details
  • Medical history, current health status, referrals, pathology results, prescriptions
  • Payment and billing details
  • Telehealth session records and usage data

Website Visitors:

  • Technical Data: IP address, browser type, operating system, device information, and website usage data.
  • Personal Data: Any personal information you choose to provide through contact forms, newsletter sign-ups, or online queries.

How We Collect Information

We collect personal information through various methods, including:

  • Direct interactions with patients during consultations, via telehealth platforms, phone calls, or emails.
  • Online forms, such as appointment booking or contact forms on our website.
  • Automatic collection through cookies and similar technologies when you visit our website.
  • Third-party referrals from other healthcare providers, insurers, or authorised representatives.

Anonymity and Pseudonymity

Due to the nature of the health services we provide, it is generally impracticable for us to deal with individuals who have not identified themselves. Accurate identification is required to ensure the safety and continuity of clinical care, to comply with our legal and professional obligations under applicable health legislation, and to meet the requirements of Medicare and private health insurance billing.

Accordingly, we are unable to provide health services to individuals who choose to interact anonymously or using a pseudonym. Where you contact us for general enquiries only and do not seek clinical services, you may choose not to identify yourself to the extent that it is lawful and practicable to do so.

Unsolicited Information

From time to time, we may receive personal or health information that we did not solicit, for example, through misdirected correspondence, unsolicited referrals, or information provided voluntarily beyond what was requested.

Where we receive unsolicited personal information, we will promptly assess whether that information is of a kind we could have collected under our standard collection practices as described in this Policy. If the information could have been collected in the ordinary course of providing our services, we will handle it in accordance with this Policy as if it had been actively collected.

If we determine that the unsolicited information is not of a kind we would have been entitled to collect, we will, as soon as practicable and where lawful to do so, destroy or permanently de-identify that information. We will not use or disclose unsolicited information for any purpose prior to making this assessment.

Where unsolicited information relates to a third party rather than the individual who provided it, we will take particular care to limit its use strictly to what is necessary and will not retain it beyond the purpose for which it was received, unless we are required to do so by law.

Legal Basis for Collection

We collect personal information:

  • With your consent
  • When necessary for the performance of healthcare services
  • To comply with legal obligations
  • To pursue legitimate interests (e.g. improving services)

How We Use Your Information

For Patients:

We use your personal information for the following purposes:

  • To provide healthcare services, including telehealth consultations, diagnosis, treatment, and follow-up care.
  • To communicate with you regarding appointments, treatment plans, and health-related information.
  • To process payments, including Medicare and private health insurance claims.
  • To comply with legal and regulatory obligations, such as reporting notifiable diseases or responding to court orders.
  • To improve our services, telehealth platforms, and website functionality.
  • To provide you with updates about our services, appointment reminders, or health-related information. You can opt out of receiving these communications at any time by following the "unsubscribe" instructions included in the communication or by contacting us directly. We will not use your health information for direct marketing without your explicit consent.

For Website Visitors:

We use your information to:

  • Respond to your inquiries or requests made through our website.
  • Analyse website usage and improve user experience.
  • Manage our website's functionality and security.

Disclosure of Information

We do not sell or rent your personal information to third parties. We may share your personal information in the following circumstances:

  • Healthcare Providers: With your consent, we may share your health information with other healthcare providers involved in your care.
  • Third-Party Service Providers: We may share your information with third-party service providers who assist us in delivering our services (e.g., IT service providers, payment processors) under strict confidentiality agreements.
  • Legal Requirements: We may disclose your information where required or authorised by law (e.g., to comply with a subpoena or court order).
  • Regulatory Authorities: We may disclose your information to regulatory authorities as required for compliance with health regulations.
  • Overseas Disclosure of Information: We do not routinely disclose personal or health information to overseas recipients. If it becomes necessary to transfer your information outside Australia (for example, where our third-party service providers store data on secure overseas servers), we will:
    • Only transfer the information where permitted by law;
    • Take reasonable steps to ensure the overseas recipient complies with Australian privacy principles or equivalent safeguards; and
    • Inform you in advance, including which country the information will be transferred to, where possible.

Protected Health Information (PHI) and Notice of Privacy Practices

RegenXhealth may use and disclose PHI only as permitted or required by law and as reasonably necessary to provide, administer and support healthcare services.

How We May Use and Disclose PHI

  • Treatment and care: To assess clinical suitability, provide telehealth consultations, document diagnoses and treatment, issue prescriptions, coordinate dispensing with Your Compound Pharmacy Solutions, arrange referrals or pathology, and communicate with other healthcare providers involved in the patient's care.
  • Payment and administration: To collect consultation fees, process medication payments only after a valid prescription has been issued, manage billing and refunds, and maintain required administrative and financial records.
  • Healthcare operations: To conduct quality assurance, clinical governance, audits, staff training, complaint handling, safety monitoring, information security, regulatory compliance and service improvement.
  • Legal and regulatory purposes: To comply with applicable laws, court orders, subpoenas, regulatory requirements, public-health obligations or lawful requests from authorised government bodies, and where necessary to prevent or reduce a serious threat to health or safety.
  • With consent or authorisation: For any other use or disclosure not otherwise permitted by law. RegenXhealth will not use PHI for direct marketing without the individual's express consent.

Where practicable, RegenXhealth limits the PHI used or disclosed to the minimum information reasonably necessary for the relevant purpose, except where broader disclosure is required for treatment or otherwise permitted or required by law.

Legal Duties Regarding PHI

As the healthcare entity responsible for the PHI it holds, RegenXhealth has a legal duty to maintain the privacy and security of PHI; comply with the Privacy Act 1988 (Cth), the Australian Privacy Principles, the My Health Records Act 2012 (Cth) where applicable, and relevant State and Territory health privacy laws; provide clear notice of its privacy practices; follow the terms of this Policy; restrict access to authorised personnel; securely retain and dispose of records; and notify affected individuals and the Office of the Australian Information Commissioner where an eligible data breach occurs.

Data Security Measures

We implement the following measures to protect your personal information from misuse, interference, loss, unauthorised access, modification, or disclosure:

  • Encryption: All personal information is encrypted during transmission over the internet using secure socket layer (SSL) technology.
  • Access Controls: Access to your personal information is restricted to authorised personnel who need it to perform their duties.
  • Secure Storage: All digital data is stored on secure servers protected by firewalls and regularly updated security software.
  • Regular Audits: We conduct regular security audits and assessments to identify and mitigate potential vulnerabilities.
  • Multi-Factor Authentication (MFA): Employees must use MFA to access systems containing sensitive information.

Cookies and Tracking Technologies

We use cookies and similar tracking technologies on our website to improve your browsing experience, analyse traffic, and support the functionality and security of our online services. These tools help us understand how visitors use our website and enable us to deliver a more personalised and efficient user experience.

What Are Cookies?

Cookies are small text files that are placed on your device (computer, tablet, or mobile) by websites you visit. They are widely used to make websites work, improve efficiency, and provide reporting information.

Types of Cookies We Use

  • Strictly Necessary Cookies: These are essential for the operation of our website and enable basic features such as page navigation, secure access, and session management. Our website cannot function properly without these cookies.
  • Performance and Analytics Cookies: These collect anonymised information about how visitors use our website, such as which pages are visited most often or if error messages occur. This data helps us improve website performance and user experience.
  • Functionality Cookies: These remember your preferences and settings (such as language, location, or login details) to provide enhanced, more personalised features.
  • Third-Party Cookies: In some cases, we may use third-party services (such as embedded videos or social media plug-ins) which may place cookies on your device. These providers are responsible for how they use cookies, and we recommend reviewing their privacy policies.

Managing Your Cookie Preferences

You can choose to accept, decline, or customise your cookie preferences through your browser settings or by using a cookie management tool (where available on our website). Most web browsers automatically accept cookies, but you can usually modify your browser settings to decline them or notify you when a cookie is set.

Please note that disabling certain cookies may affect the functionality or performance of our website and limit your ability to access some services or features.

Where required by law, we will seek your consent before placing non-essential cookies on your device. By continuing to use our website after seeing a cookie notice, you are deemed to consent to the use of cookies as described in this Policy.

Data Retention

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, to comply with our legal and regulatory obligations, and for legitimate operational or business requirements.

Our retention practices take into account the type of information held, its sensitivity, applicable laws and regulatory requirements, and the risks of unauthorised use or disclosure.

Retention of Health Records

In accordance with legal obligations and professional standards, we retain patient health records for the following minimum periods:

  • Adult Patients: At least 7 years from the date of the last consultation or entry in the record.
  • Child Patients: Until the patient turns 25 years of age, or for 7 years from the date of the last entry, whichever is longer.
  • Deceased Patients: Health records are retained in accordance with the above timelines unless a longer period is necessary for legal or clinical reasons.

Retention of Website and Technical Data

Data collected from website visitors, such as cookies, IP addresses, and analytics, is retained for up to 2 years, or longer if required for legal, technical, or business continuity purposes.

Other Records

Administrative, financial, or communication records (such as email correspondence, appointment logs, or billing records) are retained in line with legal retention obligations, typically between 5 to 7 years, depending on the nature of the document.

Secure Disposal

Once personal information is no longer required, we securely dispose of or de-identify it in accordance with industry standards and applicable law. This includes:

  • Secure deletion of electronic records
  • Shredding of physical documents
  • Use of data destruction services certified for handling sensitive information

We conduct regular reviews of our data holdings to ensure information is not retained longer than necessary.

Your Rights

You have the following rights regarding your personal information and PHI, subject to applicable law and any lawful exceptions:

  • Access and inspection: Request access to and inspect the health records and other personal information RegenXhealth holds about you.
  • Copies of records: Request a copy of your records in an available electronic or physical format. A reasonable fee may apply for copying, postage or administration.
  • Correction or amendment: Request that inaccurate, incomplete, out-of-date, irrelevant or misleading information be corrected or that an amendment request be added to the record where the original entry must be retained.
  • Restrictions: Request limits on particular uses or disclosures of your PHI. RegenXhealth will consider the request but may be unable to agree where the use or disclosure is required for treatment, safety, legal compliance or another lawful purpose.
  • Confidential communications: Request that RegenXhealth communicates with you through a particular method or at a particular address where this is reasonable and practicable.
  • Information about disclosures: Request information about how your PHI has been used or disclosed, where such information is available and required to be provided by law.
  • Withdrawal of consent: Withdraw a consent previously given for a use or disclosure, except where action has already been taken in reliance on that consent or continued handling is authorised or required by law.
  • Privacy complaints: Make a complaint about the handling of your PHI without being penalised or adversely treated for exercising your privacy rights.

How to Exercise Your Rights

Submit your request in writing through the contact form at www.regenxhealth.com.au. Include your full name, date of birth, contact details, a clear description of the records or action requested, and your preferred format or method of communication. RegenXhealth may request reasonable proof of identity or authority before providing access or making a change.

RegenXhealth aims to acknowledge and respond to valid requests within a reasonable timeframe, generally within 30 days. There is no fee for submitting a request or requesting a correction. A reasonable fee may be charged for providing copies or for excessive or repetitive requests, where permitted by law.

Where access, correction or another request is refused or limited, RegenXhealth will provide written reasons where required and explain the available complaint or review options.

Data Breach Notification

We take data security seriously and have implemented appropriate technical and organisational measures to protect personal information. However, in the event of a data breach, we will comply with the Notifiable Data Breaches (NDB) scheme under the Privacy Act 1988 (Cth) and take swift action to mitigate any potential harm.

A data breach may include the unauthorised access to, disclosure of, or loss of personal information that we hold. If we have reasonable grounds to believe that a data breach is likely to result in serious harm to any individuals whose information is involved, we will:

  • Promptly assess the breach to determine its nature, scope, and potential impact in accordance with our internal data breach response plan;
  • Contain the breach where possible, and take immediate steps to prevent further unauthorised access or disclosure;
  • Notify affected individuals as soon as practicable, including details of the breach, the types of information involved, recommended steps they should take, and how we are responding;
  • Notify the Office of the Australian Information Commissioner (OAIC) by submitting a Notifiable Data Breach Statement through the prescribed process;
  • Document the breach and all steps taken in response, in compliance with our obligations under the Privacy Act;
  • Review our policies, procedures, and security safeguards to prevent recurrence and improve future responses.

Where we determine that a data breach does not meet the threshold for notification but may still carry risks, we will take proactive steps to inform affected individuals where appropriate.

We are committed to acting transparently, responsibly, and promptly to minimise the impact of any data breach and to uphold the privacy and trust of our patients, clients, and stakeholders.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our privacy practices, legal obligations, or service offerings. The updated version will be published on our website and will take effect from the Effective Date listed at the beginning of this Policy.

We encourage you to review this Policy periodically to stay informed about how we handle your personal information. Where material changes are made that may impact your rights, we will take reasonable steps to bring these changes to your attention, such as through notices on our website or direct communication where appropriate.

Your continued use of our services following the Effective Date of an updated Policy indicates your acceptance of the changes.

Privacy Policy Complaints and Enquiries

To file a complaint with RegenXhealth about the handling of your personal information or PHI, submit a written complaint through the contact form at www.regenxhealth.com.au and mark it "Privacy Complaint".

Please include your full name and contact details, a description of the issue, relevant dates or interactions, the outcome you are seeking, and copies of any supporting documents. RegenXhealth may contact you for additional information or to verify your identity.

RegenXhealth will acknowledge the complaint within a reasonable timeframe, investigate the circumstances, and provide a written response outlining the outcome and any corrective action taken. You will not be penalised or adversely treated for making a complaint or exercising a privacy right.

If you are not satisfied with RegenXhealth's response, you may escalate the complaint to the Office of the Australian Information Commissioner (OAIC):

  • Website: www.oaic.gov.au
  • Phone: 1300 363 992
  • Mail: GPO Box 5218, Sydney NSW 2001