Privacy Policy

1. Introduction

XTENDER HEALTH SOLUTIONS PTY LTD (ABN 74 694 974 984, ACN 694 974 984) ("Xtender", "we", "us", or "our") is committed to protecting the privacy of personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

By using our services, you acknowledge that you have read and agree to this Privacy Policy.

2. Definitions

• "Customers" means business entities that subscribe to our Services, such as pharmacies and pharmacy groups.
• "Users" means individuals who access or use our Services, including individual pharmacists using the free Pharmacist Hub.
• "Services" means the Xtender platform, website, applications, and related services.
• "Personal Information" has the meaning given in the Privacy Act 1988 (Cth).

3. Information We Collect

Information You Provide

• Contact details (name, email, phone number, business address)
• Account credentials (username, password)
• Business information (ABN, company name)
• Payment and billing information

Information Collected Automatically

• Device information (IP address, browser type, operating system)
• Usage data (pages visited, features used)
• Cookies and similar tracking technologies

Health Information

Our platform may process health information on behalf of our Customers (such as pharmacies). In such cases, health information is collected and processed only as directed by our Customers, who remain responsible for compliance with applicable health records legislation.

4. Lawful Basis for Collection

We collect, use, and disclose personal information where reasonably necessary for our functions and activities, with your consent, or as otherwise permitted or required by law, including under the Australian Privacy Principles.

5. How We Use Your Information

• Service Delivery: To provide and improve our Services
• Account Management: To create and manage your account
• Communication: To send service notices and updates
• Marketing: To send promotional materials (with your consent and in accordance with the Spam Act 2003 (Cth)). You may opt out at any time using the unsubscribe mechanism provided in each communication.
• Security: To detect and prevent fraud
• Legal Compliance: To comply with applicable laws

6. Disclosure of Information

We may share personal information with:

• Cloud hosting and infrastructure providers
• Payment processors
• Email and SMS service providers
• Analytics services

We may also disclose information where required by law or court order.

Overseas Disclosure

Some of our service providers (such as cloud hosting, email delivery, and payment processing providers) may be located outside Australia. Where personal information is disclosed to overseas recipients, we take reasonable steps to ensure those recipients handle the information in accordance with the Australian Privacy Principles, as required by APP 8.

7. Data Security

We implement appropriate security measures including:

• Encryption of data in transit and at rest (AES-256, TLS 1.2+)
• Secure access controls and authentication
• Regular security assessments
• Employee training on data protection

8. Data Breach Notification

In the event of an eligible data breach, we will comply with our obligations under the Privacy Act 1988 (Cth), including the Notifiable Data Breaches (NDB) scheme. This includes notifying affected individuals and the Office of the Australian Information Commissioner (OAIC) as required.

9. Your Rights

• Access: You may request access to your personal information
• Correction: You may request correction of inaccurate information
• Opt-Out: You may opt out of marketing communications at any time
• Complaints: You may lodge a complaint with us or the Office of the Australian Information Commissioner (OAIC)

10. Cookies

We use cookies to remember preferences, authenticate users, and analyse usage. You can control cookies through your browser settings.

11. Data Retention

We retain personal information for as long as necessary to fulfil the purposes for which it was collected, comply with legal requirements, and enforce our agreements.

12. Clinical and Medical Disclaimer

Any information displayed within the Services (including CPD tracking, training course directories, and professional development tools) is for administrative and organisational purposes only and should not be relied upon as a substitute for professional medical judgement.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified by posting the updated policy and updating the "Effective Date".