Privacy Policy

Last updated: 12 May 2026

1. Introduction

Regeniq Pty Ltd (ACN 694 432 865) (Regeniq, we, us, our) is an Australian company based in Brisbane, Queensland. We operate the website at regeniq.au and a telehealth platform that facilitates consultations between patients and Australian-registered health practitioners.

Regeniq is committed to protecting your personal information. We are bound by the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs). This Privacy Policy explains how we collect, use, hold, and disclose personal information, and how you can exercise your rights in relation to that information.

By providing personal information to us, you consent to our collection, use, and disclosure of that information in accordance with this Privacy Policy. Consent in relation to Sensitive Health Information is addressed separately in the relevant clauses below.

This Privacy Policy should be read together with our Terms and Conditions, Refund Policy, and Fulfilment and Delivery Policy.

2. Definitions

In this Privacy Policy:

Personal Information has the meaning given in section 6 of the Privacy Act. It means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether or not the information is true and whether or not it is recorded in a material form. Examples include your name, age, gender, and contact details.
Sensitive Health Information means sensitive information and health information as defined in the Privacy Act. Examples include your medical history, height, weight, current medications, allergies, Medicare number, Individual Healthcare Identifier (IHI), and information about your sexual orientation or activity where clinically relevant.
Spam Act means the Spam Act 2003 (Cth).
APP means an Australian Privacy Principle under the Privacy Act.
Partner Practitioners means Australian-registered health practitioners who provide consultations through the platform. See the Terms and Conditions for further detail.
Partner Pharmacies means the pharmacies that dispense medications prescribed through the platform, including Formulae and Infinity Wellness Group, and other pharmacies engaged from time to time. See the Terms and Conditions for further detail.
Services means the telehealth platform, the website, the patient portal, and any related products or services we provide.

3. How we collect your personal information

We collect personal information in the following ways:

Directly from you when you create an account, complete intake forms, attend a consultation, communicate with us through the patient portal, or otherwise use the Services.
Through the Halaxy iframe embedded on regeniq.au when you book a consultation or complete Halaxy-hosted intake. See section 13 for how this dual collection works.
Through cookies and tracking technologies when you visit the website. See section 10.
From Partner Practitioners and Partner Pharmacies during the course of providing your care, including clinical notes, prescriptions, dispensing records, and dispatch information.
From third parties where you have authorised disclosure, such as your general practitioner, a pathology provider, or another health service.
From government health systems where you have consented, including My Health Record and any Active Script List (ASL).
When you contact us by email, phone, or in-platform messaging, including for support, complaints, or general enquiries.

4. What personal information we collect

The personal information we collect depends on how you interact with us. It may include:

Identification information: your name, date of birth, gender, postal address, email address, and phone number.
Account information: your username, password (stored in hashed form), and information about your use of the patient portal.
Sensitive Health Information (collected with your consent): your medical history, current medications, allergies, symptoms, height, weight, blood test and pathology results, photographs of medical conditions where you provide them, and information about your sexual orientation or activity where relevant to clinical assessment.
Medicare and health identifiers: your Medicare number, Individual Healthcare Identifier (IHI), and private health insurance details where you provide them.
Payment information: your billing address and payment card details. Card details are collected and processed by Stripe. Regeniq does not store full card numbers.
Technical information: device-related information (such as your device ID or serial number), IP address, browser type, operating system, statistics on page views, traffic, and standard web log information.

If you do not provide the personal information we reasonably request, we may not be able to provide the Services to you.

5. Why we collect, use, and disclose personal information

We collect, use, and disclose personal information for the following purposes:

To facilitate consultations between you and Partner Practitioners.
To facilitate the dispensing of prescriptions by Partner Pharmacies and the delivery of medication to you. Where you authorise us, we act as your agent in relation to payments to Partner Pharmacies for medication.
To operate, secure, maintain, and improve the platform and the Services, including troubleshooting, fraud prevention, and analytics.
To send you transactional and treatment-related communications, including booking confirmations, dispatch notifications, billing receipts, refill reminders, consultation prompts, and pathology follow-ups. See section 14.
To create and maintain clinical and administrative records.
To comply with our legal and regulatory obligations, including under the Privacy Act, the Health Practitioner Regulation National Law, AHPRA requirements, TGA requirements, Medicare regulations, the Healthcare Identifiers Act 2010 (Cth), and taxation laws.
To resolve complaints and disputes.
To detect, prevent, and respond to fraud, misuse, or unauthorised access.

6. To whom we disclose your personal information

We may disclose your personal information to:

Partner Practitioners who provide consultations through the platform.
Partner Pharmacies who dispense medications, including Formulae, Infinity Wellness Group, and other pharmacies engaged from time to time.
Couriers appointed by a Partner Pharmacy to deliver medication to you.
Pathology providers to whom you have been referred for blood tests, bulk-billed where eligible.
Halaxy Pty Ltd, our practice management software provider, which collects personal information independently as a separate data controller through its embedded iframe. See section 13.
Service providers, including:
1. Stripe, our payment processor, based in the United States.
2. Supabase, our database provider. Primary patient data is hosted in Australia (Sydney region).
3. Vercel, our hosting and edge network provider.
4. Our email service provider, for transactional and reminder communications.
Analytics and marketing tracking providers, as described in section 10.
Government agencies where required, authorised, or permitted by law, including Medicare, AHPRA, the TGA, the Office of the Health Ombudsman, the Office of the Australian Information Commissioner (OAIC), law enforcement agencies, and courts and tribunals.
Professional advisers and insurers in confidence, including our lawyers, accountants, and auditors.
A prospective purchaser of Regeniq or any part of its business, subject to appropriate confidentiality undertakings.

Should a Partner Practitioner form a professional view that a patient is at imminent risk of harm to themselves or others, the Partner Practitioner may, in line with their professional and ethical obligations, contact emergency services or request a welfare check, and may disclose relevant personal information to those services.

7. Prescriptions, tokens, and the Active Script List

Where a Partner Practitioner issues an electronic prescription (e-script), it is generated as a token, typically a barcode or QR code. The following applies:

Regeniq's default operational model is that the e-script token is transmitted directly to a Partner Pharmacy on the patient's behalf for dispensing, rather than sent to the patient.
Where you prefer, the token can be sent to you so that you can forward it to a pharmacy of your choice.
Where Regeniq holds tokens on your behalf, we continue to do so until the prescription (including any repeats) has been dispensed in full, or until you withdraw your consent for us to hold the tokens.
An Active Script List (ASL) is a central repository of a patient's e-script tokens, accessible to pharmacies you authorise. Where you have an ASL, your tokens may be added to the ASL unless you ask the Partner Practitioner not to do so. Any pharmacy dispensing your prescription will need to access your ASL.
Tokens and dispensing information may also interact with My Health Record. See section 12.

8. Sensitive Health Information

We collect Sensitive Health Information only with your consent and in accordance with the Privacy Act and any applicable state or territory health records legislation.

Consent is obtained at registration and through intake forms, consultation flows, and consent-to-treatment checkpoints within the Services.
You may withdraw your consent for future collection of Sensitive Health Information at any time by emailing privacy@regeniq.au. If you do, we may not be able to continue providing the Services to you.
Sensitive Health Information is treated with the highest level of protection in our systems and is only accessible to those who require access for clinical, operational, or legal purposes.

9. Security

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure. Our measures include:

Primary patient data hosted in Australia by Supabase in the Sydney region.
Transport encryption (TLS) on all connections between your browser or device and our systems.
Encryption at rest for sensitive data stored in our database.
Role-based access controls and row-level security in our database.
Multi-factor authentication for staff and practitioner accounts where applicable.
Regular security review of our vendors and sub-processors.
Staff training on privacy and information security.

No system is completely secure, and we cannot guarantee absolute security. You should keep your account credentials confidential and contact us immediately if you suspect unauthorised access to your account.

Regeniq complies with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act and is committed to notifying the OAIC and affected individuals where the scheme is triggered. See section 21.

10. Cookies, tracking technologies, and analytics

We use the following analytics and tracking tools on the website:

Meta Pixel and Conversions API (CAPI): a browser-side pixel and a server-side API operated by Meta Platforms, Inc. Data is shared with Meta for advertising attribution and audience building. Hashed personal information may be transmitted to Meta for matching purposes.
Google Analytics 4 (GA4): pseudonymous usage data is shared with Google LLC for analytics. This may include your IP address (truncated where supported), device information, and pageview events.
Google Tag Manager (GTM): a tag orchestration layer operated by Google LLC. GTM itself does not collect personal information, but the tags it deploys (including those listed above) may.
PostHog: a product analytics tool. PostHog may capture session-level interaction data. Session recording is configured to mask sensitive fields, including intake forms, identifiers, and payment fields. Recordings of sensitive flows are disabled.

Cookies are small text files placed on your device when you visit the website. We use cookies as follows:

Essential cookies (authentication, security, and session cookies) are necessary for the Services to function and do not require separate consent.
Analytics and marketing cookies are used as described above. You may disable cookies through your browser settings, although some parts of the website may not function correctly if you do.
The Services are designed for Australian users. By using the Services, you are on notice that the cookies and tracking technologies described in this section are deployed.

11. Cross-border disclosure (APP 8)

Our primary clinical and account data is held in Australia (Supabase, Sydney region). Our policy is to keep primary patient data onshore. However, some service providers and analytics tools listed in this Privacy Policy are based overseas, including:

Stripe (United States), for payment processing.
Meta Platforms, Inc. (United States), for advertising analytics and attribution.
Google LLC (United States), for analytics and tag orchestration.
PostHog, for product analytics. The data centre region depends on configuration, and we select an Australian or European Union data centre where available.
Our email service provider, hosting edge nodes, and similar providers may also process data overseas.

By using the Services, you consent to the disclosure of relevant personal information to these overseas recipients in accordance with this Privacy Policy. We take reasonable steps to ensure that overseas recipients are bound by contractual protections substantially similar to the APPs. You acknowledge that you may not be able to seek redress under the Privacy Act from those overseas recipients directly.

12. My Health Record and government health systems

In line with Australian Government policy, Partner Practitioners and Partner Pharmacies may upload information about your care to My Health Record, unless you have opted out.
You can manage or cancel your My Health Record at digitalhealth.gov.au.
Regeniq does not control My Health Record. Information uploaded to My Health Record is governed by the My Health Records Act 2012 (Cth) and the Healthcare Identifiers Act 2010 (Cth).
Where Medicare benefits are claimed on your behalf (for example, for bulk-billed pathology), relevant information is shared with Medicare in accordance with the Human Services (Medicare) Act 1973 (Cth) and the National Health Act 1953 (Cth).

13. Halaxy iframe and dual collection

Bookings on regeniq.au are facilitated through an embedded iframe provided by Halaxy Pty Ltd, our practice management software provider.
When you interact with the Halaxy iframe, including when booking a consultation or completing intake forms hosted by Halaxy, Halaxy collects your personal information independently as a separate data controller.
Halaxy's collection, use, and disclosure of your personal information is governed by Halaxy's own privacy policy, available at halaxy.com/privacy. You should review Halaxy's policy in addition to this one.
Regeniq receives a subset of the information collected by Halaxy that is necessary for clinical and operational purposes, including appointment details, clinical notes, and patient contact information.
Where there is an overlap between Halaxy's clinical record system and Regeniq's platform records, both Regeniq and Halaxy hold copies of clinical records as required by AHPRA and applicable law, and as necessary for continuity of care.
Regeniq does not control Halaxy's privacy practices. If you have concerns about Halaxy's handling of your information, you should contact Halaxy directly through the channels in Halaxy's privacy policy.

14. Direct marketing

Regeniq sends treatment-related reminders, including refill reminders, consultation prompts, and pathology follow-ups. These reminders are direct marketing under the Privacy Act and the Spam Act.
You may opt out at any time by:
1. using the unsubscribe link in any reminder email;
2. replying STOP to an SMS reminder; or
3. emailing privacy@regeniq.au.
Opting out of treatment reminders does not affect your receipt of transactional communications, including booking confirmations, dispatch notifications, and billing receipts, which are necessary for the Services.
Regeniq does not currently send general newsletters, advertising emails, or third-party marketing.
Regeniq does not sell, rent, or trade personal information with third parties for their independent marketing purposes.

15. AI features

The platform may, from time to time, offer features powered by artificial intelligence or machine learning, including educational summaries, intake prompts, and platform assistance.
AI providers contracted by Regeniq may have limited access to a subset of data necessary to deliver the relevant feature, subject to contractual protections.
Regeniq prohibits AI providers from using patient data to train, fine-tune, or otherwise improve models that are not used to deliver services back to Regeniq, except where you give explicit, separate consent.
AI features do not constitute medical advice. See the Terms and Conditions for the operational disclosure.
Patient data shared with AI providers may include de-identified information. Where personal information is involved, you will be informed at the point of use.

16. Retention

Clinical records are retained for at least 7 years from the date of last clinical contact for adult patients.
For patients who were under 18 at the time of last clinical contact, records are retained until the patient reaches 25 years of age, or for 7 years from the date of last clinical contact, whichever is longer.
Records may be retained for longer where required by law (for example, taxation or insurance regulations) or where there is an ongoing legal, regulatory, or insurance matter.
Once retention is no longer required, personal information is destroyed or de-identified.
Account data not subject to specific retention requirements is deleted within a reasonable period after account closure, except where it has been incorporated into clinical records.

17. Recordings

Consultations and telephone calls are not recorded by default. If a recording is ever required, for example for quality assurance or training purposes, you will be told in advance and may decline.

18. Access and correction

You may request access to the personal information we hold about you by emailing privacy@regeniq.au.
We will respond within a reasonable period. We may need to verify your identity before providing access.
In limited circumstances, we may refuse access, for example where access would unreasonably impact the privacy of others, where the request is frivolous or vexatious, or where required or authorised by law. If we refuse, we will provide written reasons.
You may request correction of personal information you believe is inaccurate, incomplete, or out of date. We will take reasonable steps to correct it.
There is no fee for routine access or correction requests.

19. Children

The Services are intended for individuals aged 18 years and over, as set out in the Terms and Conditions. Regeniq does not knowingly collect personal information from individuals under 18. If we become aware that we have collected personal information from a minor outside the Services' eligibility framework, we will take reasonable steps to delete that information.

20. De-identified data

Regeniq may use de-identified data (data from which a patient cannot reasonably be re-identified) for research, analytics, quality assurance, and service improvement. De-identified data is not personal information under the Privacy Act.

21. Notifiable data breaches

Regeniq complies with the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act. Where there is a data breach likely to result in serious harm to one or more individuals, we will notify affected individuals and the OAIC as required by the scheme.

22. Complaints

If you believe Regeniq has breached the Privacy Act or the APPs, or if you wish to make a privacy complaint, please contact the Regeniq Privacy Officer at privacy@regeniq.au.
Please include your name, contact details, and a clear description of your complaint.
We will acknowledge your complaint and respond within a reasonable period.
If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.
For health service complaints (as distinct from privacy complaints), please see the Terms and Conditions.

23. Changes to this policy

We may amend this Privacy Policy from time to time. Changes take effect from the date they are published on the website. Where a change is material, we will give reasonable notice, for example by email or in-platform notice. Continued use of the Services after the effective date constitutes acceptance of the changes.

24. Contact

For all privacy queries, please contact:

Privacy Officer Regeniq Pty Ltd (ACN 694 432 865) Brisbane, Queensland, Australia Email: privacy@regeniq.au Website: regeniq.au