Privacy Policy

Halo Clinic Pty Ltd (ACN 696 922 120) (“Halo Clinic”, “we”, “us”, “our”) is an online health platform that connects patients with independent, AHPRA-registered healthcare practitioners (engaged through our prescribing partner Signatura Co Pty Ltd (ACN 696 947 476) (“Signatura Co”)) for the provision of telehealth consultations and access to compounded medications, including peptide therapies and GLP-1 receptor agonists. When you use our services, you are trusting us with your information. We recognise the importance of protecting your privacy and the rights of individuals in relation to their personal information and are committed to handling it with the utmost care.

This Privacy Policy describes how we collect, use, disclose, and protect your personal information when you use our website, platform (“Platform”), and services. We are legally bound by the Privacy Act 1988 (Cth) (as amended by the Privacy and Other Legislation Amendment Act 2024 (Cth)) (“Privacy Act”), which includes the Australian Privacy Principles (APPs), and relevant State and Territory health records legislation, including the Health Records and Information Privacy Act 2002 (NSW), the Health Records Act 2001 (Vic), and the Health Records (Privacy and Access) Act 1997 (ACT).

By using our services or providing us with your personal information, you consent to your information being handled as set out in this Privacy Policy.

We collect personal information that is necessary to provide you with our services safely and effectively. This includes:

• Personal Information: Your name, date of birth, contact details (address, email, phone number), Medicare information, your GP’s contact details, and (where required for eligibility, dispensing, or to verify your identity) a photo of your face and/or a copy of a government-issued identity document.
• Sensitive Health Information: This is the primary type of information we collect and may include your current and past medical history, illnesses, symptoms, test results, medications (including details of compounded medications, peptide therapies, and GLP-1 receptor agonists), allergies, weight and metabolic information, lifestyle factors, and other health information you provide or that we consider necessary to facilitate your care.
• Technical and Usage Data: Your IP address, device ID, and information about how you interact with our Platform. For more details, please see section 11 (Cookies, Analytics and Advertising) below.

We collect your personal information in a fair and lawful manner. This occurs when you:

• Register an account on our Platform.
• Complete our online forms, questionnaires, or surveys.
• Attend a telehealth consultation with a healthcare practitioner.
• Correspond with us via email, telephone, or our Platform.
• From third parties, such as other healthcare providers (with your consent), pathology services, or government sources like the My Health Record system.

If you choose not to provide us with your personal information, we may not be able to provide you with our services.

We collect, hold, use, and disclose your personal information for the primary purpose of providing and managing our healthcare services. This includes:

• Providing Clinical Care: To facilitate telehealth consultations, connect you with healthcare practitioners, maintain your health records, and manage your treatment plan.
• Communication: To send you appointment reminders, follow-up on your care, provide you with information, and respond to your enquiries.
• Administrative Purposes: To process payments, verify your identity, and manage your account.
• Regulatory Compliance: To comply with our legal obligations, including obligations under the Therapeutic Goods Act 1989 (Cth) (and where applicable, requirements under section 19A and the Special Access Scheme for unapproved or compounded therapeutic goods), TGA adverse event reporting obligations, mandatory health record retention obligations, and any other applicable State, Territory or Commonwealth law.
• Service Improvement: To conduct de-identified research and analysis to improve our services, platform, and patient outcomes.
• Direct Marketing: To send you information about our services or health topics that may interest you. You can opt out of these communications at any time.

We only disclose your personal information for the purposes outlined in this policy, or where required by law. This may include sharing information with:

• Healthcare Practitioners: The doctors, nurse practitioners, and other AHPRA-registered healthcare practitioners who provide care to you via our Platform. These practitioners are engaged through Signatura Co, which sits outside the Halo Health corporate group in order to preserve the clinical and regulatory independence of practitioners.
• Fulfilment Partner Pharmacy and Suppliers: Our nominated fulfilment partner compounding pharmacy (and the pharmacy’s raw ingredient wholesaler, where relevant) for the dispensing, compounding, and fulfilment of your prescriptions.
• Your Other Healthcare Providers: Your nominated GP or other specialists, with your consent, to ensure continuity of care.
• Third-Party Service Providers: Our IT service providers, cloud storage providers, infrastructure providers, and payment processors who assist us in operating our business. We require these providers to adhere to privacy and data security standards consistent with this Privacy Policy and Australian Privacy Principle 11 (security of personal information).
• Government and Regulatory Bodies: As required or authorised by law, including the Therapeutic Goods Administration (TGA), the Office of the Australian Information Commissioner (OAIC), the Australian Health Practitioner Regulation Agency (AHPRA), the Australian Signals Directorate (in connection with mandatory ransomware payment reporting under the Cyber Security Act 2024 (Cth) where applicable), or in response to a court order, subpoena, or other valid legal process.

Overseas Data Transfers

Some of our service providers (including cloud and infrastructure providers) may be located overseas, including in countries such as the United States, the European Union, and Singapore. Where we disclose your personal information to an overseas recipient, we comply with our obligations under Australian Privacy Principle 8, which generally requires us to take reasonable steps to ensure that the overseas recipient handles your information in a manner consistent with the Australian Privacy Principles. From time to time, the Commonwealth Government may prescribe certain countries as “whitelisted” jurisdictions under the Privacy Act 1988 (Cth) (as amended by the Privacy and Other Legislation Amendment Act 2024 (Cth)), in which case different conditions may apply to disclosures to recipients in those jurisdictions. We will update this Privacy Policy if our overseas disclosure practices change materially.

We take a range of technical and organisational measures to protect your information from misuse, interference, loss, and unauthorised access, modification, or disclosure, consistent with the standard expressed in Australian Privacy Principle 11.1 (as clarified by the Privacy and Other Legislation Amendment Act 2024 (Cth)). These measures include technical security (encryption in transit and at rest, firewalls, multi-factor authentication, secure software development practices, and regular vulnerability testing) and organisational controls (role-based access, staff training, vendor due diligence, and incident response planning).

We are required by law to retain health information for minimum periods, which differ across Australian jurisdictions. As a general standard, we retain adult patient records for a minimum of seven (7) years from the date of last patient contact, and records relating to patients who were minors at the time of treatment until the patient turns 25 years of age (or seven years from the date of last patient contact, whichever is later). Once information is no longer needed for a valid purpose or required to be kept by law, it will be securely destroyed or permanently de-identified in accordance with our Record Keeping & Documentation Policy.

In the unlikely event of a data breach that is likely to result in serious harm to you, we will comply with our obligations under the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act, including by notifying you and the Office of the Australian Information Commissioner (OAIC) within the timeframes prescribed by law. Further detail about our breach response procedures is set out in our Data Security & Breach Response Policy.

You have rights regarding the information we hold about you. You have the right to:

• Request Access: You can request access to the personal information we hold about you, in accordance with Australian Privacy Principle 12.
• Request Correction: If you believe the information we hold is inaccurate, incomplete, out-of-date, irrelevant, or misleading, you can request that we correct it, in accordance with Australian Privacy Principle 13.

To exercise these rights, please contact our Privacy Officer (whose details are set out in section 8 below). We will ordinarily respond to access requests within 30 days and to correction requests within a reasonable period (typically 30 days), and may require you to verify your identity before we provide access to your information.

If you have any concerns or wish to make a complaint about how we have handled your personal information, please contact our Privacy Officer. We will investigate your complaint and provide you with a response in a timely manner.

Privacy Officer Email: info@yourhalo.health

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au, or with the relevant State or Territory health complaints body in your jurisdiction, including: the Health Care Complaints Commission (HCCC) in NSW; the Health Complaints Commissioner in Victoria; the Office of the Health Ombudsman (OHO) in Queensland; the Health and Disability Services Complaints Office (HaDSCO) in Western Australia; the Health and Community Services Complaints Commissioner in South Australia; the Health Complaints Commissioner in Tasmania; the Health and Community Services Complaints Commissioner in the Northern Territory; or the ACT Human Rights Commission — Health Services Commissioner in the Australian Capital Territory.

We may use artificial intelligence (AI) tools, including large language models, and other automated systems to support the delivery of our services. Examples include software-based eligibility checks and triage, decision-support tools available to our practitioners, drafting and quality-checking patient communications, summarising consultation notes, and assisting with customer support enquiries.

Where we use AI or automated systems to process your personal or sensitive health information, we apply access controls, contractual protections, and other technical and organisational measures designed to limit use to the purposes set out in this Privacy Policy.

We may also use a limited amount of de-identified or pseudonymised information to train, test, and evaluate internal AI tools so that we can improve the accuracy, safety, and clinical relevance of outputs, detect and correct failure patterns, and support auditing and quality improvement. We take reasonable steps to ensure information used for these purposes cannot be re-identified.

AI tools are used to support, and not to replace, the professional judgement of our practitioners, and the outputs of any AI tool are not a substitute for professional medical advice. Where an AI feature is used in a way that may materially affect you, we apply appropriate human oversight by an AHPRA-registered healthcare practitioner or other qualified staff member.

Where we use automated decision-making in a manner that produces decisions that have a legal effect on you, or that significantly affect you in a similarly important way, we will provide further information about that automated decision-making in this Privacy Policy in accordance with our obligations under the Privacy Act 1988 (Cth) (as amended by the Privacy and Other Legislation Amendment Act 2024 (Cth)). Clinical decisions about your care (including diagnosis, treatment, and prescription decisions) are made by an AHPRA-registered healthcare practitioner exercising their independent clinical judgement, and are not made by automated means alone.

Some telehealth consultations, support calls, and chats with our team (including in-app messaging) may be recorded or transcribed. We may use these recordings and transcripts for purposes including:

• maintaining clinical records of your consultations as required under applicable healthcare and pharmacy record-keeping rules;
• quality assurance, practitioner supervision, and training;
• safety and incident management, including investigating any adverse event or complaint;
• investigating complaints, disputes, or regulatory enquiries; and
• improving the safety and quality of our services.

Where a consultation is recorded as part of your clinical record, the recording or transcript will be retained and protected in the same manner as the rest of your sensitive health information, in accordance with section 6 of this Privacy Policy. Where you do not wish a non-clinical call to be recorded, please tell us (or the practitioner) at the start of the call and we will discuss how to proceed.

We use cookies and similar technologies to operate our website, remember your preferences, keep you signed in, and understand how our website is used. You can control or disable cookies through your browser settings, although some features may not work correctly without them.

On our public marketing and checkout pages, we also use third-party analytics and advertising technologies, including the TikTok Pixel and similar tools from social media platforms such as Instagram, to measure how our marketing performs and to reach relevant audiences. These tools may set cookies and collect technical and usage data, such as the pages you view and the actions you take (for example, starting or completing an order), along with your device information and approximate location. This information may be processed overseas, as described in section 5.

We use these advertising and analytics tools only on our public marketing and checkout pages. We do not run them on your patient account, your results, or other pages where your health information is displayed, and we never share the content of your health questionnaires, consultations, or results with these providers. You can opt out of interest-based advertising through the settings offered by the relevant platform, and through your device or browser controls.

We may update this Privacy Policy from time to time. The latest version will always be available on our website. Your continued use of our services after an update constitutes your acceptance of the revised policy.