1. About This Policy

RECOVR Group Pty Ltd provides mobile intravenous (IV) therapy services to clients at their home, workplace or other nominated location in New South Wales. Because we provide a health service, we collect and hold health information, and we take our privacy obligations seriously.

This Privacy Policy explains how we collect, hold, use and disclose your personal information (including health information), how you can access or correct it, and how to make a complaint. We are bound by the Privacy Act 1988 (Cth), including the Australian Privacy Principles (APPs), and the Health Records and Information Privacy Act 2002 (NSW), including the Health Privacy Principles (HPPs).

We are responsible for the personal information we collect, including information handled on our behalf by the nurses, staff and service providers we engage.

2. Definitions

APPs: The Australian Privacy Principles in Schedule 1 to the Privacy Act 1988 (Cth).

HPPs: The Health Privacy Principles in Schedule 1 to the Health Records and Information Privacy Act 2002 (NSW).

Personal Information: Information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information is true or not, and whether recorded in material form or not.

Health Information: Information or an opinion about your physical or mental health or disability, your wishes about health services, or a health service provided or to be provided to you, and other personal information collected in connection with providing a health service.

Sensitive Information: A category of personal information that includes health information, genetic and certain biometric information, and information or an opinion about an individual’s racial or ethnic origin, political opinions, membership of a political association, religious beliefs or affiliations, philosophical beliefs, membership of a professional or trade association or trade union, sexual orientation or practices, or criminal record.

Partner Providers: The independent health service providers we work with to deliver our services, described in section 3.

We / us / our: RECOVR Group Pty Ltd (ABN 77 686 539 140).

You / your: Our clients, prospective clients and any other individual whose personal information we collect.

3. How Our Service Works and Who Is Involved

Providing IV therapy safely involves several independent health professionals. So that you understand where your information goes, this is how a typical booking works:

• Booking and health questionnaire: you make a booking with us and complete a health questionnaire and consent form.

• Medical consultation and prescription: your details and health questionnaire are provided to an independent medical practitioner through our telehealth prescribing partner. The practitioner consults with you to assess whether treatment is clinically appropriate and decides whether to issue a prescription.

• Pharmacy dispensing: if a prescription is issued, it is sent to our partner compounding pharmacy, which prepares and dispenses the prescribed treatment.

• Treatment: an independent registered nurse engaged by us attends your location, administers the treatment and records the details of the treatment provided.

Our current Partner Providers are:

• Online Doctor Consults

Telehealth consultations and prescribing by independent, AHPRA-registered medical practitioners

Identity and contact details, health questionnaire, relevant medical history, current medications and allergies

• National Custom Compounding

Compounding pharmacy (Queensland) that prepares and dispenses prescribed treatments

Identity and contact details, prescription details and delivery details

• Independent registered nurses

AHPRA-registered nurses engaged by us to administer treatment at your location

Booking and location details, health questionnaire, consultation outcome, prescription and emergency contact

Each Partner Provider is a separate health service provider with its own obligations under Australian privacy and health laws. Online Doctor Consults and National Custom Compounding may also collect information directly from you and will handle it under their own privacy policies, which we encourage you to read. Our Partner Providers may change from time to time, and we will update this Policy when they do.

4. What Information We Collect

We may collect the following personal and sensitive information:

• Identity and contact details: full name, date of birth, address, phone number and email address

• Health information: medical history, current medications, allergies, relevant symptoms and other information needed to assess whether treatment is suitable and safe for you

• Consultation and prescription information: the outcome of your medical consultation and the details of any prescription issued

• Treatment records: the treatment administered, product and batch details, clinical observations, and any reactions or incidents

• Emergency contact details

• Booking and location details: the address and access information for your mobile appointment

• Billing and payment details: payments are processed by a third-party payment provider, and we do not store your full card number

• Communications: records of your enquiries and correspondence with us

• Website and device information: such as IP address, browser type and pages visited (see section 14)

If you give us personal information about another person, such as an emergency contact, please let them know and refer them to this Policy.

5. How We Collect Information

Wherever practicable, we collect personal information directly from you, including when you:

• Make an enquiry or booking (via our website, over the phone or in person)

• Complete a consent form, health questionnaire or intake document

• Communicate with us by email, SMS, phone or social media

• Visit our website or engage with our digital platforms (see section 14)

• Receive treatment from a nurse engaged by us

We may also collect information about you from others, including the medical practitioner who conducts your consultation (for example, its outcome and any prescription), our partner pharmacy (for example, dispensing details), and a person who makes a booking or referral on your behalf, such as a family member, concierge service or partner clinic.

We will obtain your consent before collecting your health information, except where the law otherwise permits. At or before the time we collect your information, we will tell you why we are collecting it and who we may share it with.

6. Why We Collect, Use and Disclose Your Information

We collect, use and disclose your personal information to:

• Assess your eligibility and suitability for treatment, including through a consultation with an independent medical practitioner

• Arrange for any prescribed treatment to be dispensed by our partner pharmacy

• Deliver safe and appropriate IV therapy services at your nominated location

• Manage bookings, payments and communications with you

• Respond to incidents, adverse reactions and emergencies

• Maintain accurate clinical records and meet our legal, professional, regulatory and insurance obligations

• Monitor and improve the quality and safety of our services and conduct our business operations

• Send appointment confirmations and service messages and, with your consent, marketing communications (see section 13)

We will only use or disclose your information for another purpose if you consent, if it is a related purpose you would reasonably expect (or, for health information, a directly related purpose), or if we are required or permitted by law to do so.

7. Disclosure of Personal Information

We may disclose your personal information to:

• Our Partner Providers described in section 3 (Online Doctor Consults, National Custom Compounding and the independent registered nurses who deliver our services) for your consultation, prescription, dispensing and treatment

• Our support staff, who assist during some sessions and only access the information they need to perform their role

• Service providers who help us operate our business, such as booking, payment, IT, cloud storage, communications and professional advisory providers

• Our insurers and legal advisers, where needed to manage claims, incidents or legal matters

• Emergency services, ambulance and hospital staff, and your emergency contact, if there is an incident or emergency

• Your regular GP or another health practitioner, where you ask us to or consent

• Regulators, courts and government authorities (such as AHPRA, the Therapeutic Goods Administration and NSW Health) where required or authorised by law

We require the nurses, staff and service providers we engage to keep your information confidential, to use it only for the purpose for which it was provided, and to handle it in accordance with applicable privacy laws.

We do not sell your personal information.

8. Disclosure Outside Australia

Our Partner Providers are based in Australia. Some of our technology service providers (for example, cloud storage, email, booking, analytics and advertising platforms) may store or process information on servers located outside Australia, including in the United States. Where this occurs, we take reasonable steps to ensure those providers handle your information consistently with the APPs and HPPs.

9. Anonymity and Pseudonymity

You may make a general enquiry without identifying yourself or by using a pseudonym. However, because our services involve a medical consultation, prescription and treatment, we cannot provide treatment without identifying you.

10. Storage and Security of Information

We take reasonable technical and organisational steps to protect your personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure, including:

• Storing information in secure, password-protected and encrypted systems

• Restricting access to authorised personnel on a need-to-know basis

• Requiring nurses and staff to secure the devices and records they use during mobile appointments

• Regularly reviewing and updating our security practices

If a data breach occurs that is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner in accordance with the Notifiable Data Breaches scheme.

11. Retention and Destruction

We retain health information for the period required by the Health Records and Information Privacy Act 2002 (NSW): seven years from the date of your last treatment with us or, if the information was collected while you were under 18, until you turn 25. Other personal information is kept only for as long as it is needed for the purposes described in this Policy or as required by law. When information is no longer required, we securely destroy or de-identify it.

12. Access and Correction

You may request access to the personal information we hold about you, or ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading. To make a request, contact our Privacy Officer using the details in section 19. We may need to verify your identity before acting on your request.

We will respond within 30 days. There is no fee to make a request, although we may charge a reasonable fee to cover the cost of providing access. If we refuse access or correction in the limited circumstances permitted by law, we will explain why in writing and tell you how to complain.

Records of your medical consultation and prescription are also held by Online Doctor Consults and National Custom Compounding. You can request access from them directly, or we can help you to do so.

13. Marketing and Communications

With your consent, we may send you service updates, offers or newsletters by email or SMS. Every marketing message will include a simple way to unsubscribe, and you can opt out at any time by contacting us. We do not use your health information for marketing. Opting out will not stop appointment or service messages about treatment you have booked.

14. Our Website, Cookies and Third-Party Services

Our website or booking platform may contain links to third-party websites and services. We are not responsible for their privacy practices and encourage you to review their privacy policies separately.

We use cookies and similar technologies on parts of our website for functionality, analytics and, where appropriate, advertising. Some of these technologies may be provided by third parties, such as analytics or advertising platforms.

We do not intentionally disclose health information entered into our booking, intake or consent forms to advertising platforms. We take reasonable steps to restrict advertising technologies from pages and systems that collect health information and to manage non-essential tracking in accordance with applicable privacy requirements.

You can manage or disable cookies through your browser settings and, where available, our website cookie preferences.

15. Automated Decision-Making

We do not use computer programs to make decisions about you that could reasonably be expected to significantly affect your rights or interests. Decisions about your eligibility and suitability for treatment are made by qualified health practitioners. If this changes, we will update this Policy.

16. Age Requirements

Our services are only available to adults aged 18 years and over.

17. Complaints

If you have a concern or complaint about how we have handled your personal information, please contact our Privacy Officer first using the details in section 19. We will acknowledge your complaint promptly and aim to respond within 30 days.

If you are not satisfied with our response, you may contact:

• Office of the Australian Information Commissioner (OAIC): www.oaic.gov.au  |  1300 363 992

• Information and Privacy Commission NSW (IPC), for complaints about health information: www.ipc.nsw.gov.au  |  1800 472 679

18. Changes to This Policy

We may amend this Privacy Policy from time to time to reflect changes in the law, technology, our Partner Providers or our practices. The latest version will always be available on our website, and the effective date at the top shows when it was last updated.

19. Contact Us

Privacy Officer

RECOVR Group Pty Ltd

ABN: 77 686 539 140

Email: info@recovr.com.au