Privacy Policy

1. Our commitment to your privacy

MedToDoor (“MedToDoor”, “we”, “us” or “our”) is committed to protecting the privacy, confidentiality and security of the personal and health information entrusted to us.

This Privacy Policy explains how MedToDoor collects, holds, uses, discloses and protects personal information and health information when you access or use the MedToDoor website, mobile applications, online platform or services.

MedToDoor handles personal information in accordance with applicable Australian privacy and health-information laws, including, where applicable:

Privacy Act 1988 (Cth);
Australian Privacy Principles (APPs);
Health Records and Information Privacy Act 2002 (NSW) and its Health Privacy Principles (HPPs);
other applicable Commonwealth, State and Territory laws and regulatory requirements governing health, pharmacy, prescription and personal information.

Because MedToDoor facilitates health and pharmacy-related services, some information we handle is sensitive information or health information and receives additional protection under Australian law.

2. About MedToDoor

MedToDoor operates an online platform that helps users access medication-related services, including Home Medicines Reviews and prescription fulfilment and delivery services.

Where a prescription is submitted through MedToDoor for dispensing, prescription medicines are dispensed by an appropriately registered and authorised pharmacy and pharmacist in accordance with applicable Australian laws and professional requirements.

The dispensing pharmacy remains professionally responsible for dispensing decisions, clinical assessment, counselling and other professional pharmacy obligations applicable to the dispensing of medicines.

MedToDoor may also facilitate Home Medicines Reviews conducted by appropriately qualified and credentialed pharmacists and communications with a patient’s referring healthcare practitioner.

3. What information we collect

Depending on how you use MedToDoor, we may collect the following categories of information.

Identification and contact information

full name;
date of birth;
residential and delivery address;
telephone number;
email address;
account or membership information;
information reasonably required to verify your identity.

Health and prescription information

Because MedToDoor provides health and pharmacy-related services, we may collect health information and other sensitive information, including:

prescriptions and electronic prescription tokens;
photographs or copies of prescriptions;
medication names, strengths, quantities and directions;
medication and dispensing history where relevant;
allergies, medical conditions or other clinical information voluntarily provided or required to provide a service;
information concerning prescription repeats;
information supplied for a Home Medicines Review;
HMR referrals, reports and related medication-management information;
communications between you, pharmacists, pharmacies and healthcare practitioners where necessary for your care;
Medicare and Department of Veterans’ Affairs information where required;
My Health Record-related information where authorised and applicable;
other health information reasonably necessary to provide the requested service.

We only collect sensitive and health information where permitted by law, including where you have provided consent or where collection is otherwise authorised or required by law.

Transaction and payment information

orders and transactions;
products or services purchased;
payment status and refunds;
delivery charges;
transaction identifiers.

Payment-card information may be processed by secure third-party payment service providers. MedToDoor does not intentionally retain complete payment-card details where those details are processed directly by an authorised payment processor.

Technical information

IP address;
device and browser information;
operating system;
website usage information;
login and security information;
cookies and similar technologies;
technical logs used for security, fraud prevention, troubleshooting and service improvement.

4. How we collect information

directly from you when you register, create an account, submit a prescription, book a service, place an order, contact us or otherwise use MedToDoor;
when you upload or transmit an electronic prescription, prescription image, QR code or token;
from a parent, guardian, carer or authorised representative acting on your behalf;
from a pharmacy, pharmacist, GP, specialist or other healthcare provider where authorised, necessary or permitted by law;
through HMR referrals and associated healthcare communications;
through payment, delivery, identity-verification and technology providers;
automatically when you use our website or applications;
from other lawful sources where reasonably necessary to provide our services.

Where reasonably practicable, we collect personal information directly from you.

5. Why we collect, use and disclose information

establishing and administering your MedToDoor account;
verifying your identity;
receiving and processing prescription requests;
transmitting prescription information to an authorised dispensing pharmacy;
enabling a registered pharmacist to assess and dispense a valid prescription;
arranging medication fulfilment and delivery;
conducting or facilitating Home Medicines Reviews;
communicating with your GP, specialist, pharmacist or other healthcare professional where authorised or required for the relevant service;
processing payments, refunds and transactions;
communicating with you regarding prescriptions, orders, deliveries, payments, appointments, repeats and services;
maintaining appropriate health, transaction and service records;
responding to questions, complaints and support requests;
detecting or preventing fraud, misuse, security threats and unlawful activity;
maintaining and improving our website, platform and services;
meeting pharmacy, health, taxation, financial, record-keeping, regulatory and legal requirements;
responding to lawful requests from regulators, courts or government authorities;
other purposes for which you have provided consent or which are authorised or required by law.

We will not sell your identifiable health information to advertisers or data brokers.

We will not disclose identifiable prescription or health information for unrelated advertising or marketing purposes unless expressly permitted by law and, where required, you have provided appropriate consent.

6. Pharmacies, pharmacists and healthcare professionals

To provide pharmacy and healthcare-related services, MedToDoor may need to disclose relevant personal and health information to:

the pharmacy responsible for fulfilling your prescription;
registered pharmacists involved in dispensing or providing professional pharmacy services;
credentialed pharmacists conducting Home Medicines Reviews;
your referring GP, specialist or other healthcare professional;
your nominated or usual pharmacy where appropriate and authorised;
other healthcare providers involved in your care where permitted by law.

Only information reasonably necessary for the relevant service should be disclosed. A pharmacy, pharmacist, medical practitioner or other independent healthcare provider may have separate legal and professional privacy obligations and may maintain its own patient records.

7. Service providers and other third parties

MedToDoor may use trusted third parties to support its operations, including providers of secure website and cloud hosting, information technology and software, payment processing, identity and security services, SMS and email communications, booking systems, prescription-related technology, courier and delivery services, accounting and professional services, and regulatory, compliance and fraud-prevention services.

We seek to limit disclosure to information reasonably necessary for the provider to perform the relevant service. Where appropriate, we require service providers handling personal or health information on our behalf to maintain appropriate confidentiality, privacy and security protections.

We may also disclose information where required or authorised by Australian law, a court or tribunal order, or to an appropriate authority where disclosure is otherwise legally permitted.

8. Delivery of medicines

Where a dispensing pharmacy arranges delivery, information such as your name, delivery address, contact number and delivery instructions may be supplied to an authorised courier, postal or delivery provider.

Health or prescription information will not ordinarily be provided to a delivery provider unless reasonably necessary for the delivery or otherwise permitted or required by law.

9. Security of personal and health information

MedToDoor recognises the sensitivity of prescription and health information. We take reasonable technical, administrative and organisational measures designed to protect personal and health information against misuse, interference, loss, unauthorised access, unauthorised modification and unauthorised disclosure.

Our measures may include, as appropriate:

encrypted transmission of information using SSL/TLS technology;
secure hosting and storage arrangements;
access controls and authentication;
restricting access according to operational need;
system monitoring and security controls;
confidentiality requirements;
secure payment processing arrangements;
appropriate backup and recovery processes;
review of security and privacy practices.

No internet transmission or electronic storage system can be guaranteed to be completely secure. Users should also take reasonable precautions to protect passwords, devices and account credentials.

If we become aware of an eligible data breach, we will assess and respond to the incident in accordance with applicable Australian data-breach notification requirements.

10. Storage and retention

Personal and health information may be stored electronically or, where necessary, in physical form by MedToDoor or authorised service providers.

We retain information for as long as reasonably necessary to provide our services, meet applicable pharmacy and health record-keeping requirements, resolve disputes, maintain business and transaction records and comply with legal and regulatory obligations.

Where personal information is no longer required and we are not legally required to retain it, we will take reasonable steps to destroy or de-identify it in accordance with applicable law.

11. Overseas disclosure and cloud services

Some technology, cloud, communications or support service providers used by MedToDoor may store or process information outside Australia. Where personal information is disclosed to an overseas recipient, MedToDoor will take steps required by applicable Australian privacy law in relation to that disclosure.

Where practicable, we will identify countries in which overseas recipients are likely to be located.

WEBSITE ADMINISTRATOR – COMPLETE BEFORE PUBLICATION: Confirm whether any MedToDoor hosting, CRM, email, SMS, analytics, payment, app or cloud provider stores personal or health information outside Australia, and insert the applicable countries here if practicable.

12. Cookies, analytics and website technologies

MedToDoor may use cookies and similar technologies to operate the website, maintain sessions and account functionality, remember user preferences, protect against fraud and security threats, understand website performance and improve our services.

Where analytics or advertising technologies are used, MedToDoor will configure and use them consistently with applicable privacy requirements. MedToDoor should not intentionally transmit identifiable prescription information, medical information or other sensitive health information to advertising platforms for behavioural advertising.

You may be able to restrict cookies through your browser settings, although doing so may affect website functionality.

13. Direct marketing

Where permitted by law, MedToDoor may send information about its services, membership, pharmacy services or other relevant offerings. Where consent is required, we will obtain it.

You may opt out of receiving direct marketing communications at any time by using the unsubscribe facility provided in the communication or contacting us.

Operational communications relating to prescriptions, medication safety, transactions, appointments, account security, orders and deliveries are not necessarily marketing communications and may continue where required to provide the service.

We do not use sensitive health information for direct marketing except where permitted by applicable law.

14. Accessing and correcting your information

You may request access to personal information MedToDoor holds about you and request correction where you believe the information is inaccurate, incomplete, out of date, irrelevant or misleading.

Requests should be made using the contact details below. We may need to verify your identity before providing access or making a correction.

In limited circumstances, access may be refused where permitted or required by law. Where applicable, we will provide reasons for the refusal and information about available complaint mechanisms.

15. Children and authorised representatives

Where information concerns a child or another person who is unable to provide consent themselves, MedToDoor may obtain information or consent from a parent, legal guardian, authorised carer or other person legally authorised to act on that individual’s behalf. We may take reasonable steps to verify that person’s authority.

16. Anonymity and pseudonyms

Where lawful and practicable, you may interact with MedToDoor anonymously or using a pseudonym for general enquiries.

However, identification will generally be necessary where MedToDoor, a pharmacy, pharmacist or healthcare professional must verify your identity to safely and lawfully provide prescription, dispensing, delivery, HMR, Medicare, DVA or other healthcare services.

17. My Health Record, Medicare and government identifiers

Where MedToDoor or a participating healthcare professional accesses, uses or uploads information to My Health Record, this will only occur in accordance with applicable My Health Record legislation, permissions and healthcare requirements.

Medicare, DVA and other government identifiers will only be collected, used or disclosed where reasonably necessary and permitted or required by law.

18. Data breaches

MedToDoor maintains processes for assessing suspected privacy and security incidents. Where a data breach is subject to the Notifiable Data Breaches scheme or another mandatory notification requirement, MedToDoor will take appropriate steps, which may include notifying affected individuals and the Office of the Australian Information Commissioner as required by law.

19. Privacy complaints

If you believe MedToDoor has breached your privacy or improperly handled your personal or health information, please contact our Privacy Officer and provide sufficient information for us to investigate your concern.

We will acknowledge, investigate and respond to privacy complaints within a reasonable period.

If you are not satisfied with our response, you may have the right to lodge a complaint with the Office of the Australian Information Commissioner (OAIC) or, where applicable to health information in New South Wales, the Information and Privacy Commission NSW, or another relevant regulator.

20. Third-party websites and services

The MedToDoor website or platform may contain links or integrations with third-party websites or services. Those organisations may have their own privacy policies and practices.

MedToDoor is not responsible for the privacy practices of an independent third party except to the extent required by applicable law. Users should review the privacy policies of relevant third-party services before providing personal information directly to them.

21. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our services, technology, business practices or legal and regulatory requirements.

The current version will be published on the MedToDoor website together with its effective date. Material changes may also be communicated through the website, application, email or other appropriate means.

For privacy regulatory information, you may also contact the Office of the Australian Information Commissioner (OAIC).